Re: [Bro-Dev] Broker::publish API

2018-08-14 Thread Jon Siwek
On Tue, Aug 14, 2018 at 12:09 PM Jan Grashöfer wrote: > > On 13/08/18 18:24, Jon Siwek wrote: > > Old Worker: > > > >Cluster::relay_rr(Cluster::proxy_pool, my_event); > > > > New Worker: > > > >Broker::publish(Cluster::rr_topic(Cluster::proxy_pool), my_event); > > That doesn't look like an

Re: [Bro-Dev] Broker::publish API

2018-08-14 Thread Jan Grashöfer
On 13/08/18 18:24, Jon Siwek wrote: > Old Worker: > >Cluster::relay_rr(Cluster::proxy_pool, my_event); > > New Worker: > >Broker::publish(Cluster::rr_topic(Cluster::proxy_pool), my_event); That doesn't look like an API simplification to me ;D > Even Newer Worker: > >Broker::publis

Re: [Bro-Dev] Broker::publish API

2018-08-14 Thread Robin Sommer
On Tue, Aug 14, 2018 at 10:51 -0500, Jonathan Siwek wrote: > Not sure, is Broker::auto_publish() currently able to do the same thing? Hmm .. Good point. Scope is different between the two (event vs topic) but the effect is similar in the end. > I can also see the opposite being intuitive: If

Re: [Bro-Dev] Broker::publish API

2018-08-14 Thread Jon Siwek
On Tue, Aug 14, 2018 at 10:13 AM Robin Sommer wrote: > One more question: what about raising published events locally as well > if the sending node is subscribed to the topic? I'm kind of torn on > that. I don't think we want that as a default, but perhaps as an > option, either with the publish(

Re: [Bro-Dev] Broker::publish API

2018-08-14 Thread Robin Sommer
On Mon, Aug 13, 2018 at 13:55 -0500, Jonathan Siwek wrote: > associating node IDs with subscription state and also message state > (push node IDs into messages upon receipt before forwarding), Yeah, that sounds like the right direction. Some reading might be worthwile doing here, there are qui

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Jon Siwek
On Mon, Aug 13, 2018 at 12:56 PM Azoff, Justin S wrote: > > Broker::publish(Cluster::worker_topic, my_event); > The one tricky case is doing that on the manager. While the manager is fully > connected to all workers, > you really want to offload the fanning out of messages to one of the proxi

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Azoff, Justin S
> On Aug 13, 2018, at 12:24 PM, Jon Siwek wrote: > > Even Newer Worker: > > Broker::publish(Cluster::worker_topic, my_event); > > See any problems there? That's nice and simple :-) Assuming that can send the events around in the most efficient way possible, that's perfect. The one tricky

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Jon Siwek
On Mon, Aug 13, 2018 at 8:09 AM Jan Grashöfer wrote: > > On 10/08/18 17:12, Robin Sommer wrote: > > I hear you, but I think I haven't quite understood the concern yet. > > Can you give me an example where the difference matters? What's > > different between publishing intel events to bro/cluster/w

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Jon Siwek
On Fri, Aug 10, 2018 at 11:47 AM Azoff, Justin S wrote: > If relay is removed how does a script writer efficiently get an event from > one worker (or manager) > to all of the other workers? Old Worker: Cluster::relay_rr(Cluster::proxy_pool, my_event); New Worker: Broker::publish(Cluster:

Re: [Bro-Dev] Broker::publish API

2018-08-13 Thread Jan Grashöfer
On 10/08/18 17:12, Robin Sommer wrote: > I hear you, but I think I haven't quite understood the concern yet. > Can you give me an example where the difference matters? What's > different between publishing intel events to bro/cluster/worker/intel > vs bro/cluster/worker if both go to all workers? O

Re: [Bro-Dev] Broker::publish API

2018-08-10 Thread Azoff, Justin S
> On Aug 10, 2018, at 11:55 AM, Robin Sommer wrote: > > > Ok, let's make that change then, I think removing relay() will help > for sure making the API easier. If relay is removed how does a script writer efficiently get an event from one worker (or manager) to all of the other workers? — J

Re: [Bro-Dev] Broker::publish API

2018-08-10 Thread Robin Sommer
On Fri, Aug 10, 2018 at 10:24 -0500, Jonathan Siwek wrote: > Or is it a matter of "if a user needed it for something, then it's > available" ? Yeah, including matching expectations: if there's a "bro/cluster/worker" topic, I'd expect I can publish there to reach all the workers (from anywhere)

Re: [Bro-Dev] Broker::publish API

2018-08-10 Thread Jon Siwek
On Fri, Aug 10, 2018 at 8:29 AM Jan Grashöfer wrote: > > Let me try to phrase it differently: If there's already a topic for a > > use case, it's better to use it. That's easier and less error-prone. > > So if, e.g., I want to send my script's data to all workers, > > publishing to bro/cluster/wo

Re: [Bro-Dev] Broker::publish API

2018-08-10 Thread Jon Siwek
On Thu, Aug 9, 2018 at 1:29 PM Robin Sommer wrote: > > (1) enable the "explicit/manual" forwarding by default? > > Coming from that assumption above, I'd say yes here, doing it like you > suggest: differentiate between forwarding and locally raising an event > by topic. Maybe instead of adding it

Re: [Bro-Dev] Broker::publish API

2018-08-10 Thread Robin Sommer
On Fri, Aug 10, 2018 at 15:22 +0200, Jan Grashöfer wrote: > different purposes. If that is still a design goal, it feels like the > structure of a cluster could be more volatile than it used to be. It is, and we have some of that, and I think it fits in with the discussion here too. In my mind

Re: [Bro-Dev] Broker::publish API

2018-08-10 Thread Jan Grashöfer
On 08/08/18 17:48, Robin Sommer wrote:> I think it's safe to assume we have the cluster structure under our > own control; it's whatever we configure it to be. That's something > that's easier to change later than the API itself. Said differently: > we can always adjust the connections and topics

Re: [Bro-Dev] Broker::publish API

2018-08-09 Thread Robin Sommer
Yeah, and let me add one thing: What if as a starting point for modeling things, we assumed that we have global topic-based routing available. Meaning if node A publishes to topic X, the message will show up at all nodes that are subscribed to topic X anywhere, no matter what the topology --- Broke

Re: [Bro-Dev] Broker::publish API

2018-08-09 Thread Jon Siwek
On Wed, Aug 8, 2018 at 2:50 PM Robin Sommer wrote: > > * enable message forwarding by default (meaning re-implement the one > > or two subscription patterns that might create a cycle) > > Haven't quite made up my mind on this one. In principlel yes, but > right now a host needs to be subscribed t

Re: [Bro-Dev] Broker::publish API

2018-08-08 Thread Robin Sommer
On Wed, Aug 08, 2018 at 12:36 -0500, Jonathan Siwek wrote: > * publish() API simplifications/compressions (pending decision on > exactly what those should be) Yeah, with an eye on the semantics for forwarding (now and later), and whether to raise published events locally as well if the host is

Re: [Bro-Dev] Broker::publish API

2018-08-08 Thread Jon Siwek
On Wed, Aug 8, 2018 at 10:55 AM Robin Sommer wrote: > That's actually something I realized yesterday: we don't have direct > worker-to-worker communication right now, correct? A worker cannot > just publish to "bro/cluster/workers". Right, here's a crude graphic of the cluster layout from the do

Re: [Bro-Dev] Broker::publish API

2018-08-08 Thread Jon Siwek
On Wed, Aug 8, 2018 at 10:53 AM Robin Sommer wrote: > > Yeah, I realize that. A direct port of the old logic was of course the > goal so far, with the drawbacks of that approach accepted & > understood. That's what's in place now; that's great and exactly as > planned. We can get 2.6 out this way,

Re: [Bro-Dev] Broker::publish API

2018-08-08 Thread Robin Sommer
On Wed, Aug 08, 2018 at 14:20 +, Justin Azoff wrote: > There's also a bunch of places that I think were written standalone first and > then updated to work on a cluster in > place resulting in some awkwardness.. Yeah, indeed, that's another other source of complexity with these scripts.

Re: [Bro-Dev] Broker::publish API

2018-08-08 Thread Robin Sommer
Yeah, I realize that. A direct port of the old logic was of course the goal so far, with the drawbacks of that approach accepted & understood. That's what's in place now; that's great and exactly as planned. We can get 2.6 out this way, and it'll be fine. My point is that now also seems like a goo

Re: [Bro-Dev] Broker::publish API

2018-08-08 Thread Robin Sommer
On Tue, Aug 07, 2018 at 12:05 +0200, Jan Grashöfer wrote: > What I can recall, it's about simplifying the API in the light of > multi-hop routing, which is not fully functional yet. To level up a bit, what I'm hoping for is that we can find some easy ways to simplify the API a bit more now, wit

Re: [Bro-Dev] Broker::publish API

2018-08-08 Thread Azoff, Justin S
> On Aug 6, 2018, at 3:50 PM, Robin Sommer wrote: > >- Relaying is hardly used. > > >- There's a lot of checks in publishing code of the type "if I am > (not) of node type X". I think these 2 are somewhat related. Since there weren't higher level things like relaying, in order

Re: [Bro-Dev] Broker::publish API

2018-08-07 Thread Jon Siwek
On Mon, Aug 6, 2018 at 3:00 PM Robin Sommer wrote: > Overall I have to say I found it pretty hard to follow this all > because we don't have much consistency right now in how scripts > structure their communication. That's not surprising, given that we're > just starting to use all this, but it s

Re: [Bro-Dev] Broker::publish API

2018-08-07 Thread Jon Siwek
On Mon, Aug 6, 2018 at 1:57 PM Robin Sommer wrote: > I have another question about this specific case: we use relay_rr() > only for sending Intel::insert_indicator. Intel::remove_indicator gets > published normally through auto_publish(). Why the difference? Potentially no reason other than no o

Re: [Bro-Dev] Broker::publish API

2018-08-07 Thread Jan Grashöfer
To be honest, I have somehow lost track of the discussion. What I can recall, it's about simplifying the API in the light of multi-hop routing, which is not fully functional yet. Regarding multi-hop routing I am even not sure what the actual goal is that we are currently aiming at. However, fro

Re: [Bro-Dev] Broker::publish API

2018-08-06 Thread Robin Sommer
On Mon, Jul 30, 2018 at 09:01 -0700, I wrote: > Is there a summary somewhere of what events & topics the cluster nodes > are currently exchanging? So I went through the exercise of collecting this information: what connections do we have between nodes, who's subscribing to what, and who's publi

Re: [Bro-Dev] Broker::publish API

2018-08-06 Thread Robin Sommer
On Fri, Aug 03, 2018 at 15:57 -0500, Jonathan Siwek wrote: > Another use is hidden within Cluster::relay_rr(): Yeah, though at least from an API perspective this is different: The caller gives relay_rr() only one topic to send to (indicator_topic). It's then using a different topic internally

Re: [Bro-Dev] Broker::publish API

2018-08-03 Thread Jon Siwek
On Fri, Aug 3, 2018 at 12:22 PM Robin Sommer wrote: > On Fri, Jul 27, 2018 at 10:39 -0700, I wrote: > > > Broker::relay(change_topic, change_topic, Config::cluster_set_option, ID, > > val, location); > > Can somebody remind me what the use-case is for changing the topic on > relay? Grepping over

Re: [Bro-Dev] Broker::publish API

2018-08-03 Thread Robin Sommer
On Fri, Jul 27, 2018 at 10:39 -0700, I wrote: > Broker::relay(change_topic, change_topic, Config::cluster_set_option, ID, > val, location); Can somebody remind me what the use-case is for changing the topic on relay? Grepping over our standard scripts, I see only one use of relay(), and that'

Re: [Bro-Dev] Broker::publish API

2018-07-30 Thread Robin Sommer
On Mon, Jul 30, 2018 at 13:30 -0500, Jonathan Siwek wrote: > Seems clunky and could get dicey Agreed. :) It'd just be a heuristic to catch some obvious errors. I don't think there's more we can do, we can't really catch loops statically by looking at the code. Robin -- Robin Sommer * Coreli

Re: [Bro-Dev] Broker::publish API

2018-07-30 Thread Jon Siwek
On Mon, Jul 30, 2018 at 12:16 PM Robin Sommer wrote: > > I'd be more comfortable if one could automate answering the question: > > "if I add a subscription to a given node in the network, will I create > > a cycle?". > > Hmm ... What about a test mode where we'd spin up a dummy cluster > (similar

Re: [Bro-Dev] Broker::publish API

2018-07-30 Thread Robin Sommer
On Mon, Jul 30, 2018 at 11:15 -0500, Jonathan Siwek wrote: > I don't see why not, but it takes planning and prudence on everyone's > part (including users) to not break that rule. Yeah, question is we can pre-configure the cluster so that user's don't need to worry about it most of the time.

Re: [Bro-Dev] Broker::publish API

2018-07-30 Thread Jon Siwek
On Mon, Jul 30, 2018 at 11:02 AM Robin Sommer wrote: > True, although it's not cycles in the connection topology that matter, > it's cycles in topic subscriptions. Right, good point. > I need to think about this a bit > more (and I need to remind myself how our topics currently look like) I th

Re: [Bro-Dev] Broker::publish API

2018-07-30 Thread Jon Siwek
On Fri, Jul 27, 2018 at 7:30 PM Azoff, Justin S wrote: > > > > On Jul 27, 2018, at 6:10 PM, Jon Siwek wrote: > > > > On Fri, Jul 27, 2018 at 3:55 PM Azoff, Justin S wrote: > > > >> I do agree that there's room for a lot of simplification, for example a > >> worker broadcasting a message efficie

Re: [Bro-Dev] Broker::publish API

2018-07-30 Thread Robin Sommer
On Fri, Jul 27, 2018 at 14:47 -0500, Jonathan Siwek wrote: > Broker does not yet have automatic multihop where subscriptions are > globally flooded automatically. Yep, that's what I meant: dynamic multihop where each node tracks what its peers are subscribing to, and forwards messages independent

Re: [Bro-Dev] Broker::publish API

2018-07-27 Thread Azoff, Justin S
> On Jul 27, 2018, at 6:10 PM, Jon Siwek wrote: > > On Fri, Jul 27, 2018 at 3:55 PM Azoff, Justin S wrote: > >> I do agree that there's room for a lot of simplification, for example a >> worker broadcasting a message efficiently to all >> other workers needs to do something like this from the

Re: [Bro-Dev] Broker::publish API

2018-07-27 Thread Jon Siwek
On Fri, Jul 27, 2018 at 3:55 PM Azoff, Justin S wrote: > I do agree that there's room for a lot of simplification, for example a > worker broadcasting a message efficiently to all > other workers needs to do something like this from the docs: > > Cluster::relay_rr(Cluster::proxy_pool, "e

Re: [Bro-Dev] Broker::publish API

2018-07-27 Thread Azoff, Justin S
> On Jul 27, 2018, at 1:39 PM, Robin Sommer wrote: > > I'm wondering if we should give it another try to simply this API > while we still can (i.e., before 2.6 goes out). To me, the most > intuitive publish operation is "send to topic T and propagate to > everybody subscribed to that topic". I'd

Re: [Bro-Dev] Broker::publish API

2018-07-27 Thread Jon Siwek
On Fri, Jul 27, 2018 at 12:40 PM Robin Sommer wrote: > I'm wondering if we should give it another try to simply this API > while we still can (i.e., before 2.6 goes out). To me, the most > intuitive publish operation is "send to topic T and propagate to > everybody subscribed to that topic". I'd