Need help understanding serializer

Christian Kreibich christian at whoop.org
Tue Apr 27 20:09:57 PDT 2004


On Tue, 2004-04-27 at 10:50, Christian Kreibich wrote:
>
> Well see I need a mechanism to communicate with local sensors (in
> intrusion detection parlance), and I was thinking of communicating
> through unix domain sockets (largely because I have code that I could
> reuse for that). So at the Bro end, another Serializer sounds like a
> good idea.
> 
> The problem is that the existing Serializer class already implies that I
> want to send connections, IDs, etc (ie things that are largely
> interesting for Bro-Bro communication only) which is not necessarily the
> case for what I need. The SerializationFormat gives me what I need to do
> the marshalling, but it doesn't handle I/O. And a format plus I/O are
> pretty much the core ingredients of a Serializer, right? Also I could
> build the callback API that I was looking for in my own Serializer...

To clarify what I mean I've put up a patch at

http://www.cl.cam.ac.uk/~cpk25/BroSerializer.diff.gz 

that moves all the callback and Serialize()/Unserialize() stuff down to
a new child class that I called BroSerializer (as it's geared towards
Bro-Bro communication). The new Serializer class only has only the basic
read/write methods, the cache subsystem, and the error stuff left.
RemoteSerializer is now derived from BroSerializer.

I could now derive my own serializer from this Serializer class without
much trouble. The patch should apply cleanly against 0.8a82.

The separation was pretty easy -- maybe that's an indication that this
would be a good move ... does this look reasonable?

Thanks,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org





More information about the Bro mailing list