[Bro-Dev] Module prefix in sending and receiving Broker events

Matthias Vallentin vallentin at icir.org
Thu Sep 27 01:47:51 PDT 2018

>It might also help if you send actual examples that can be run if that
>still doesn't work because it's hard to interpret what you mean by
>"publish via Broker".  

Okay, so first a pure Bro example. This one works:

    module Foo;

    global foo: event(); // declaration

    event foo()
      print "foo";

    event bro_init()
      event Foo::foo();

If I remove the event declaration, I get:

    error in ./foo.bro, line 10: not an event (Foo::foo())

If I remove the Foo:: qualification in bro_init *and* the declaration, I 
get the expected output again. If I don't remove the declaration, 
nothing gets printed.

Now with Broker, a working example:

    redef exit_only_after_terminate = T;

    module Foo;

    global foo: event(); // declaration

    event foo()
      print "foo";

    event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string)
      Broker::publish("foo", Broker::make_event(foo));

    event Broker::peer_lost(endpoint: Broker::EndpointInfo, msg: string)

    event bro_init()
      Broker::peer("localhost", 55555/tcp);

The Broker Python script:

    #!/usr/bin/env python

    import broker
    import broker.bro

    # Setup endpoint and subscribers.
    endpoint = broker.Endpoint()
    endpoint.listen("localhost", 55555)
    subscriber = endpoint.make_subscriber("foo")
    while True:
        topic, data = subscriber.get()
        endpoint.publish("foo", broker.bro.Event("Foo::foo"))

The Python script prints

    [<broker._broker.Count object at 0x10ac9f5e0>, <broker._broker.Count object at 0x10ace2880>, ['Foo::foo', []]]

and the Bro script "foo". So far so good. If I remove the event 
declaration, the Python script prints

    [<broker._broker.Count object at 0x10ac7c810>, <broker._broker.Count object at 0x10a04e8b8>, ['foo', []]]

and the Bro script nothing.

I hope this illustrates the issue a bit better.


Matthias Vallentin
Tenzir GmbH
c/o Regus
Valentinskamp 24
20354 Hamburg
info at tenzir.com
+49 40 209337260
Commercial Register Hamburg
HRB 148081
VAT Number DE314897407
Dr. Matthias Vallentin
Dominik Charousset

More information about the bro-dev mailing list