Hey,
do we have any example how to replace the old &synchronized attribute in the new Broker-powered world? I looked at the documentation (it’s extremely verbose) and found nothing that I could relate to.
Here is the pattern I’m trying to port to 2.6. It’s basically a code that uses the Input Framework, reads some lists, stores them in a simple set and keeps this set synchronized.
The problem might be coming from a not obvious behavior of the &synchronized attribute - I had no idea what it did, I knew that it was supposed to be there.
The old 2.5.5 documentation mentions this attribute briefly
https://docs.zeek.org/en/stable/script-reference/attributes.html
&synchronized - synchronize a variable across nodes ← what nodes are we talking about? what’s the communication flow here? Who is the producer, who is the consumer?
It is impossible to move my scripts over to Broker without answering those questions.
type Idx: record {
whitelist_ip: subnet;
};
global whitelist_scan_ip: set[subnet] = {} &synchronized; ← the boo-boo is here
event bro_init()
{
Input::add_table([$source=“scan_ip.txt”,
$name=“whitelist_scan_ip”,
$idx=Idx,
$destination=whitelist_scan_ip,
$mode=Input::REREAD]);
}