[Bro-Dev] [Bro-Commits] [git/bro] topic/jsiwek/actor-system: Add Broker::publish_id function to replace send_id (096ec69)

Siwek, Jon jsiwek at illinois.edu
Thu Aug 31 07:59:05 PDT 2017


> On Aug 30, 2017, at 11:32 AM, Azoff, Justin S <jazoff at illinois.edu> wrote:
> 
>> On Aug 29, 2017, at 3:58 PM, Jonathan Siwek <jsiwek at ncsa.illinois.edu> wrote:
>> 
>>   A minor/unrelated detail of this change is that it also allows
>>   'pattern' values to be exchanged over broker messages.  It currently
>>   does this via Bro's serialization, but can likely be done via the
>>   pattern's textual representation instead (need to look into it more).
> 
> That's interesting.. Does that somehow get around the bro limitation that patterns can not be constructed at runtime?

In the sense that a Bro instance can receive a new pattern value from another Bro instance, yes, but each individual Bro instance is still limited to creating pattern values at init time (AFAIK).  So each time you wanted to change a given pattern, you’d need to restart the Bro instance that is doing the sending and have it init the pattern with the desired value.  I’m not sure if there’s other ways to e.g. dynamically create new patterns from arbitrary strings, I think Seth had showed me some hacky way to do it before, but I forgot what it was.

Also note that this doesn’t differ from what the ‘send_id’ BIF can currently do.  Maybe the commit description made it seem like it was completely new capability, but I think it was just something that got overlooked when initially creating the Broker framework.

- Jon



More information about the bro-dev mailing list