[Bro-Dev] Hooks (Re: [Bro-Commits] [git/bro] topic/jsiwek/hook: Add new function flavor called a "hook". (e0fb9eb))

[Seth Hall]

On Nov 16, 2012, at 9:56 PM, Robin Sommer <robin at icir.org> wrote:

> Thinking now about it, I believe either way is fine. The boolean hook
> would convey a bit more information back to the caller and allow
> simple yes/no decisions that way. But I'm not sure we need that. On
> the other hand, Seth didn't like the "break" so that would go away.

Jon actually convinced me in favor of "break" earlier today.  Something about needing to return from these hooks feels wrong.

I was pushing for the change to making this an expression earlier today too and having a return value (I was actually pushing for a return record that had more than just if the execution was broken) and Jon made a good point about the partial inconsistency with the hook prototype.

If we had the simple boolean return from hook as an expression…

   global my_hook: hook(foobar: string): bool;

It's weird because that's not the prototype for each hook handler (not sure what to call those?) since each hook handler doesn't have a return value.

 .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/