[Bro-Dev] changing Notice::policy mechanism

Seth Hall seth at icir.org
Thu Nov 1 19:44:45 PDT 2012

On Nov 1, 2012, at 10:28 PM, Seth Hall <seth at icir.org> wrote:

> As we discussed earlier and I never brought up in my overview, would it be better if we had some mechanism sitting between events and functions?  "Synchronous events"? "Multi-bodied functions"?  Here's an example of how a synchronous event might look at the script land…

Aaand, to reply to myself…  Now that I implemented that sample code, I don't like it.  Events presume the event queue.  If we bypass that, it just seems bad and inconsistent.  Maybe we just need a mechanism for multi-bodied functions?  It would basically be functions that could be defined over and over, could have a &priority attribute applied to them, and would be enforced to have no return value.

global foobar: function(a: count) &multibody;

function foobar(a: count) &priority=5
	print "foobar at priority 5";

function foobar(a: count) &priority=8
	print "foobar at priority 8";

print foobar(1); // <-- Maybe it could return a count to indicate number of bodies executed?

Sample output
foobar at priority 8
foobar at priority 5


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the bro-dev mailing list