[Bro-Dev] open a pipe?

[Seth Hall]

On Mar 27, 2012, at 10:21 AM, Robin Sommer wrote:

> Regarding what the interface looks like, there are a number of
> options. Using "when" is one, we could indeed feed in there. But I'm
> not sure it's right model here: when would work best for simple
> one-request-one-reply style I/O but with pipes we may want more: keep
> writing into it, and keep reading out. That would work better with a
> file-like object ones prints to, and any output turning into events.
> But there may be still better models that that.


I keep thinking that we just need to provide the connection between the input framework and sub processes.  From the script-land perspective, something like this maybe?

# The sub process is defined
SubProcess::new("sha_hash", [$cmd="shasum"]);

# STDIN is connected to a Bro file.
local sha_command = SubProcess::get_stdin("sha_hash");

# STDERR and STDOUT are connected to inputs
Input::add_event([$name="sha_hash",
                  $source=SubProcess::get_stdout("sha_hash"),
                  $fields=ShaVal, $ev=sha_line,
                  $mode=Input::STREAM, $reader=Input::READER_RAW]);
Input::add_event([$name="sha_hash",
                  $source=SubProcess::get_stderr("sha_hash"),
                  $fields=ShaVal, $ev=sha_line,
                  $mode=Input::STREAM, $reader=Input::READER_RAW]);

# The subprocess is actually executed.
SubProcess::run("sha_hash");

# Send data to STDIN of the command.
print sha_command, "some data";

# The command dies and the input streams are destroyed.
close(sha_command);

I think that SubProcess::get_stdout and SubProcess::get_stderr would return strings (file names) and SubProcess::get_stdin would return a file typed variable.  It's all pretty verbose, but I don't think we have many options to keep things async and functional with the event loop.  Thoughts?

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/