Were to define global const (const.bif VS. bro.init + NetVar.{cc|h}

Development
1

Hi,

I just noticed that multiple ways are used to define global const that
is accessed / redefined from both event engine and policy layer:

* in const.bif OR in bro.init and NetVar.{h|cc}
* in const.bif OR in a specific .bro script and NetVar.{h|cc}

it seems that all three options are used. I was wondering whether it
makes sense to unify them wrt the general Bro documentation / cleanup
efforts.

At least the ones that use const.bif and bro.init could be unified. Then
there's only a single place (bro.init or const.bif) were users have to
look to find out about global configuration settings.

For analyzer specific configuration options (i.e., ones that are defined
in a particular policy script) be more logical to keep them in the
policy script. (Or they could still be defined in const.bif and then
just redef'ed in the policy script, so that users who look at the policy
script are aware that the const exists)

But, YMMV.
cu
Gregor

2

* in const.bif OR in bro.init and NetVar.{h|cc}
* in const.bif OR in a specific .bro script and NetVar.{h|cc}

it seems that all three options are used. I was wondering whether it
makes sense to unify them wrt the general Bro documentation / cleanup
efforts.

I believe const.bif is the right way to go. It's cleaner than the others,
but we never managed to consistently only use it (much less migrate the
older stuff over to it).

For analyzer specific configuration options (i.e., ones that are defined
in a particular policy script) be more logical to keep them in the
policy script. (Or they could still be defined in const.bif and then
just redef'ed in the policy script, so that users who look at the policy
script are aware that the const exists)

That latter makes sense to me.

    Vern