[Bro-Dev] Feedback on configuration framework implementation
jan.grashoefer at gmail.com
Thu Nov 30 10:22:27 PST 2017
On 30/11/17 19:01, Johanna Amann wrote:
>> 1. Thinking of handlers that may change values and are associated with a
>> priority, hooks come to my mind (e.g. Intel::extend_match). Are
>> functions preferable compared to hooks here?
> In this case - yes. The problem with hooks is that they cannot return a
> value, which is used here to let user change (or reject) changes to
> options. :)
The Intel::extend_match hook allows changing values or rejecting as
well. If the "chain of hooks" is "broken", i.e. one hook executed a
break statement, the call to the hook returns false and (in that case)
the log write is rejected. Otherwise, all changes made to the hook
arguments inside the handlers are propagated allowing changes.
More information about the bro-dev