Re: [Bro-Dev] Overload Bro Events
On Thu, Apr 12, 2018 at 14:44 -0500, you wrote: > > event overload%(c: connection%); > > event overload%(c: connection, h: header%); > > event overload%(c: connection, h: header, d: data%); > > Overloading is not supported for functions in general (function/event/hook). This has interesting implication for BIT-1431: if overloading worked work, that could take the place of the attribute suggested there. Robin -- Robin Sommer * ICSI/LBNL * ro...@icir.org * www.icir.org/robin ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
Re: [Bro-Dev] Overload Bro Events
On 4/12/18 2:23 PM, DW wrote: > Hello, > > it is possible to overload events in Bro based on the event-parameter > and trigger the "right" event based on the given parameter? > > E.g. I would define events like this > > event overload%(c: connection%); > event overload%(c: connection, h: header%); > event overload%(c: connection, h: header, d: data%); Overloading is not supported for functions in general (function/event/hook). - Jon ___ bro-dev mailing list bro-dev@bro.org http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
[Bro-Dev] Overload Bro Events
Hello,
it is possible to overload events in Bro based on the event-parameter
and trigger the "right" event based on the given parameter?
E.g. I would define events like this
event overload%(c: connection%);
event overload%(c: connection, h: header%);
event overload%(c: connection, h: header, d: data%);
...
In the protocol parser source:
...
EventHandlerPtr ev = overload;
val_list* vl = new val_list();
switch(type) {
case 1:
vl->append(BuildConnVal());
case 2:
vl->append(BuildConnVal());
vl->append(header);
case 3:
vl->append(BuildConnVal());
vl->append(header);
vl->append(data);
}
ConnectionEvent(ev, vl);
Dane
___
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
