On Fri, Feb 10, 2017 at 11:51:08AM -0600, Vlad Grigorescu wrote:
What do people think about splitting up portions of
init-bare into separate
files, and having init-bare simply @load those files? Right now, it's a
4500+ line script that keeps growing, and it commonly results in conflicts.
For the protocols, I could see having a file such as
protocols/kerberos/bare.bro which defines the appropriate types which are
currently in init-bare.
That sounds like a good idea - I am not a big fan of the fact that a lot
of the protocol dependent datatypes are in init-bare currently.
I am just not sure if it might require a lot of fiddling to get the load
order of things correct; but assuming that every protocol has a bare.bro
(or perhaps a datatypes.bro or similar?), that should not be a huge issue.