[Bro-Dev] changing Notice::policy mechanism

[Seth Hall]

On Nov 1, 2012, at 10:28 PM, Seth Hall <seth at icir.org> wrote:

> As we discussed earlier and I never brought up in my overview, would it be better if we had some mechanism sitting between events and functions?  "Synchronous events"? "Multi-bodied functions"?  Here's an example of how a synchronous event might look at the script land…


Aaand, to reply to myself…  Now that I implemented that sample code, I don't like it.  Events presume the event queue.  If we bypass that, it just seems bad and inconsistent.  Maybe we just need a mechanism for multi-bodied functions?  It would basically be functions that could be defined over and over, could have a &priority attribute applied to them, and would be enforced to have no return value.

global foobar: function(a: count) &multibody;

function foobar(a: count) &priority=5
	{
	print "foobar at priority 5";
	}

function foobar(a: count) &priority=8
	{
	print "foobar at priority 8";
	}

print foobar(1); // <-- Maybe it could return a count to indicate number of bodies executed?



Sample output
=============
foobar at priority 8
foobar at priority 5
2

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/