On Aug 30, 2017, at 11:32 AM, Azoff, Justin S
On Aug 29, 2017, at 3:58 PM, Jonathan Siwek
A minor/unrelated detail of this change is that it also allows
'pattern' values to be exchanged over broker messages. It currently
does this via Bro's serialization, but can likely be done via the
pattern's textual representation instead (need to look into it more).
That's interesting.. Does that somehow get around the bro limitation that patterns
can not be constructed at runtime?
In the sense that a Bro instance can receive a new pattern value from another Bro
instance, yes, but each individual Bro instance is still limited to creating pattern
values at init time (AFAIK). So each time you wanted to change a given pattern, you’d
need to restart the Bro instance that is doing the sending and have it init the pattern
with the desired value. I’m not sure if there’s other ways to e.g. dynamically create new
patterns from arbitrary strings, I think Seth had showed me some hacky way to do it
before, but I forgot what it was.
Also note that this doesn’t differ from what the ‘send_id’ BIF can currently do. Maybe
the commit description made it seem like it was completely new capability, but I think it
was just something that got overlooked when initially creating the Broker framework.