Re: Event namespaces

Mike Dopheide <[email protected]> Wed, 23 Oct 2019 14:12:27 -0500
Newsgroups gmane.comp.security.detection.bro
Message-ID <CAPy2kFYi9SjekaM3rh_kO-3K8=-9YqadcqjBx+SoaCRCfQ3XGg@mail.gmail.com>
Hhmm...  I get the expected non-working behavior:

====== TEST 1 ======
# cat test.zeek
module MyModule;

export {
    global my_event: event();
}

event my_event()
    {
    print "got my event";
    }

event zeek_init()
    {
    event my_event();
    schedule 10sec { my_event() };
    }

# zeek -i eth0 test.zeek
listening on eth0

(nothing else)

======= TEST 2 =======
# cat test2.zeek
module MyModule;

export {
    global my_event: event();
}

event my_event()
    {
    print "got my event";
    }

event zeek_init()
    {
    event MyModule::my_event();
    schedule 10sec { MyModule::my_event() };
    }

# zeek -i eth0 test2.zeek
listening on eth0

got my event
got my event



On Wed, Oct 23, 2019 at 1:34 PM Jeff Barber <[email protected]> wrote:

> At
> https://docs.zeek.org/en/stable/frameworks/broker.html#a-reminder-about-events-and-module-namespaces,
> following a code sample, there is the statement:
>
> *This code runs without errors, however, the local my_event handler will
> never be called and also not any remote handlers either, even if
> Broker::auto_publish was used elsewhere for it. *
>
>
> My tests have not supported that assertion: the event handler is invoked -
> even via auto_publish. If it is so, how/when exactly would it manifest? Are
> there other factors that might cause it to be true in some cases? (Say, the
> same event name in a different namespace?)
>
> Just trying to figure out how careful I need to be of namespace issues. My
> tests have generally shown that if you get the namespace of some script
> element wrong, the script parsing stage gives you an 'undefined' right out
> of the gate.
>
> Thanks,
> Jeff
>
> _______________________________________________
> Zeek mailing list
> [email protected]
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek

_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek