[Bro-Dev] 'for loop' variable modification

Jon Siwek jsiwek at corelight.com
Fri Jan 5 17:28:27 PST 2018

On Fri, Jan 5, 2018 at 2:19 PM, Jim Mellander <jmellander at lbl.gov> wrote:

> I haven't checked whether my desired behavior works, but since its not
> documented, I wouldn't want to rely on it in any event.

Yeah, I doubt the example you gave currently works -- it would just
change the local value in the frame without modifying the internal

> I would be interested in hearing comments or suggestions on this issue.

What you want, the ability to split the processing of large data
tables/sets over time, makes sense.  I've probably also run into at
least a couple cases where I've been concerned about how long it would
take to iterate over a set/table and process all keys in one go.  The
approach that comes to mind for doing that would be adding coroutines.
Robin has some ongoing work with adding better support for async
function calls, and I wonder if the way that's done would make it
pretty simple to add general coroutine support as well.  E.g. stuff
could look like:

event process_stuff()
    local num_processed = 0;

    for ( local item in foo )

        if ( ++num_processed % 1000 == 0 )
            yield;  # resume next time events get drained (e.g. next packet)

There could also be other types of yield instructions, like "yield 1
second" or "yield wait_for_my_signal()" which would, respectively,
resume after arbitrary amount of time or a custom function says it

- Jon

More information about the bro-dev mailing list