[Bro-Dev] Feedback on configuration framework implementation

Jan Grashöfer jan.grashoefer at gmail.com
Thu Nov 30 10:22:27 PST 2017


On 30/11/17 19:01, Johanna Amann wrote:
>> 1. Thinking of handlers that may change values and are associated with a
>> priority, hooks come to my mind (e.g. Intel::extend_match). Are
>> functions preferable compared to hooks here?
> 
> In this case - yes. The problem with hooks is that they cannot return a
> value, which is used here to let user change (or reject) changes to
> options. :)

The Intel::extend_match hook allows changing values or rejecting as 
well. If the "chain of hooks" is "broken", i.e. one hook executed a 
break statement, the call to the hook returns false and (in that case) 
the log write is rejected. Otherwise, all changes made to the hook 
arguments inside the handlers are propagated allowing changes.

Jan


More information about the bro-dev mailing list