On Nov 16, 2012, at 9:56 PM, Robin Sommer <[email protected]> wrote:

> Thinking now about it, I believe either way is fine. The boolean hook
> would convey a bit more information back to the caller and allow
> simple yes/no decisions that way. But I'm not sure we need that. On
> the other hand, Seth didn't like the "break" so that would go away.

Jon actually convinced me in favor of "break" earlier today.  Something about 
needing to return from these hooks feels wrong.

I was pushing for the change to making this an expression earlier today too and 
having a return value (I was actually pushing for a return record that had more 
than just if the execution was broken) and Jon made a good point about the 
partial inconsistency with the hook prototype.

If we had the simple boolean return from hook as an expression…

   global my_hook: hook(foobar: string): bool;

It's weird because that's not the prototype for each hook handler (not sure 
what to call those?) since each hook handler doesn't have a return value.

 .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/


_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev

Reply via email to