[Bro-Dev] [Proposal] Language extensions for better Broker support

Matthias Vallentin vallentin at icir.org
Fri Dec 2 09:17:22 PST 2016

> Feedback welcome, this is just a first draft.

I like this. Some initial feedback:

  - In the switch statement, I would require that a user either provide
    a default case or fully enumerates all cases. Otherwise it's too
    easy to cause harder-to-debug run-time errors.

  - For the abbreviated switch statement, what do you think about this

        switch ( type(v)  ) {
            case b: bool
                print "bool", b;

            case s: set[int] 
                print "set", s;

            case r: some_record
                print "record", r;

    Since we don't use the arrow operator anywhere and already declare
    variable type with colons as in Pascal, this could feel more natural
    to Bro.

  - Why do we need a string comparison here? 
        if ( type(v) == string )

    Wouldn't it suffice to have 

        if ( type(v) == X )

    where X is a type instance (e.g., addr, count, set[int])  or a
    user-defined type (e.g., connection)? In other words, I don't
    understand why equality comparison need to be between a type and a

 - Uplevelling, why do we need type() in the first place? Can't we just
   overload the switch statement to work on types as well? Or do you
   have other use cases in mind?

 - Regarding asynchronous execution:

     local h = async lookup_hostname(“www.icir.org”);

   I like the explicit keyword here to signal asynchrony. Ignoring the
   when statement for now, users rely on non-preempted execution both
   within a function and an event handler, and I would argue that many
   scripts are built around this assumption. When these semantics
   change, it could become harder to reason about the execution model.
   However, if we make timeouts mandatory, I woudn't mind dropping the
   async keyword.


More information about the bro-dev mailing list