[Bro] Receiving bro events via broccoli API

Mike Muratet mike.muratet at torchtechnologies.com
Thu Jun 16 06:51:49 PDT 2005


>> However, the compiler is complaining about
>> the call-back function argument in my interface: "passing arg 3 of
>> 'bro_event_registry_add' from incompatible pointer type". I have tried to
>> type this as void and as BroEventFunc with the same results.
> The return type of the function should be void:
> void your_callback_func(BroConn* bc, ...) { ... }
> Not to confuse with that, the 3rd argument to bro_event_registry_add()
> is expected to be of BroEventFunc.  In order to cast your function
> accordingly when passing it, you can do:
> bro_event_registry_add(bc, "your_event_name",
>                       (BroEventFunc)your_callback_func);

Doh. I completely forgot about the trick. Thanks.

>> The events in conn.bro have 'connection' objects as their parameters. As 
>> I
>> understand the manuals, I can get the fields out of the object with the
>> bro_record_get_xxxx methods?
> Your callback function needs to have a BroRecord* as one of its
> arguments at the appropriate position, and yes, then you can use the
> bro_record_get_xxxx functions to access the fields in that record
> passed to your callback when the event arrives.

I'll give that a shot. Thanks again.



More information about the Bro mailing list