callback example in zeek script

cb-example.zeek

# An example of event callbacks in a Zeek cluster. Callbacks are a bit clunky as events are not first-class types


# The below cluster code copied from 
#  https://docs.zeek.org/en/current/frameworks/supervisor.html#supervised-cluster-example
event zeek_init() &priority=10 {
  if ( ! Supervisor::is_supervisor() ) {
    return;
  }

  Broker::listen("127.0.0.1", 9999/tcp);
  local cluster: table[string] of Supervisor::ClusterEndpoint;
  cluster["manager"] = [$role=Supervisor::MANAGER, $host=127.0.0.1, $p=10010/tcp];
  cluster["logger"] = [$role=Supervisor::LOGGER, $host=127.0.0.1, $p=10020/tcp];
  cluster["proxy-01"] = [$role=Supervisor::PROXY, $host=127.0.0.1, $p=10030/tcp];
  cluster["worker-01"] = [$role=Supervisor::WORKER, $host=127.0.0.1, $p=10040/tcp, $interface="eth0"];
  cluster["worker-02"] = [$role=Supervisor::WORKER, $host=127.0.0.1, $p=10050/tcp, $interface="eth1"];

  for ( n, ep in cluster ) {
    local sn = Supervisor::NodeConfig($name=n);
    sn$cluster = cluster;
    sn$directory = n;
    if ( ep?$interface ) { 
      sn$interface = ep$interface; 
    }
    local res = Supervisor::create(sn);
    if ( res != "" ) { 
      print fmt("supervisor failed to create node '%s': %s", n, res); 
    }
  }
}


# Event callback toy example
module Foo;
export {
  global worker_event: event(data: string);
  global worker_callback_event: event(data: string);
  global proxy_event: event(data: string, caller: string);
}

event zeek_init() &priority=-10 {
@if (Cluster::local_node_type() == Cluster::WORKER)
  Broker::subscribe(Broker::node_id());
  schedule 20sec { Foo::worker_event("worker-string") };
@endif
}

event Foo::worker_event(data: string) {
  # Send some data to the proxy
  Broker::publish(Cluster::node_topic("proxy-01"), Foo::proxy_event, data, Broker::node_id());
}

event Foo::proxy_event(data: string, caller_node_id: string) {
  # Mutate the worker's data and send it back to them
  Broker::publish(caller_node_id, Foo::worker_callback_event, data + ":proxy-string");
}

event Foo::worker_callback_event(data: string) {
  # Print the mutated data from the proxy
  print data;
}