Clean way to pass events from Bro to C++

José María González chema at
Thu Jun 17 18:33:09 PDT 2004


I'm looking for a clean way to pass an event from Bro 
to C++. The idea is to have a function, one of whose 
parameters is an event. Bro associates some condition 
to the event, and eventually calls it. 

An example: I want to write a function that does DNS 
resolutions. The user should be able to do something like 

# Bro lang (start)
event my_event (a: addr)
  printf fmt ("there is a resolution for %s", a);
my_address =;
resolve_dns (my_address, my_event);
# end

And when the resolution is finished, Bro will queue the event 
my_event with the parameter 

I can think of 2 implementations consisting on adding a 
new function to bro.bif:

- The first implementation is to add resolve_dns with the 
event parameter set of type "any". The parameter is a 
Val* that encloses the local function of the event, so 
I can call the function using the following: 

function resolve_dns%(a: addr, e: any%) : bool

This works, but has the inconvenient that I only have access 
to the EventHandler::local Func. In other words, I can call the 
event's function, but not queue the event in the EventManager. 

- A second implementation consists of asking the user for 
the name of the event, instead of the event itself, and then 
lookup for it in the event registry:

resolve_dns ("my_address", my_event); # note the quotes on my_address
function resolve_dns%(a_name: string, e: any%) : bool
  EventHandler* handler = event_registry->Lookup(a_name->CheckString());

Now I have my EventHandler, but it seems weird to request 
the user to quote the event name. 

I was wondering whether somebody has an idea on what's 
the best way to do this. 


More information about the Bro mailing list