Making Broker Optional in Script
Andrew Klaus <[email protected]> Mon, 25 Nov 2019 11:45:34 -0700
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAGENE8tCKOsrGc2d_sm1ZDedoPbnfWYNA6Mwxqd1sPo-G49=kQ@mail.gmail.com> |
Hello,
I have a Zeek script that I would like to add optional Broker functionality
to. I don't want it to be a requirement, so I'm adding run-time redef
options that can be toggled to enable/disable it.
Something like:
-------
export {
const broker_enable = F &redef;
}
@if (MODULE::broker_enable)
event bro_init()
{
Broker::listen("127.0.0.1", 9999/tcp);
}
@endif
-------
When I attempt to add this line to my local.bro/zeek file after the @load
package:
---
redef MODULE::broker_enable = T;
---
It won't override broker_enable and thus doesn't listen on the socket. I
assume that it's because the @load happens before the redef in local.bro,
and thus doesn't override when it checks for the @if ?
Is there a better way that I can do this? Like checking if Broker is
actually available? I tried this, but it doesn't work either:
---
@ifdef (Broker)
print "Broker Enabled";
@endif
---
Thanks in advance,
Andrew
_______________________________________________
Zeek mailing list
[email protected]
http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek