[Bro-Dev] Overload Bro Events

[DW]

Hello,

it is possible to overload events in Bro based on the event-parameter 
and trigger the "right" event based on the given parameter?

E.g. I would define events like this

event overload%(c: connection%);
event overload%(c: connection, h: header%);
event overload%(c: connection, h: header, d: data%);
...

In the protocol parser source:

...
EventHandlerPtr ev = overload;
val_list* vl = new val_list();

switch(type) {
     case 1:
         vl->append(BuildConnVal());
     case 2:
         vl->append(BuildConnVal());
         vl->append(header);
     case 3:
         vl->append(BuildConnVal());
         vl->append(header);
         vl->append(data);
}
ConnectionEvent(ev, vl);


Dane