[Bro-Dev] [JIRA] (BIT-1530) protocol_confirmation event cannot be hooked by plugin

Jeff Barber (JIRA) jira at bro-tracker.atlassian.net
Tue Jan 26 14:28:00 PST 2016

Jeff Barber created BIT-1530:

             Summary: protocol_confirmation event cannot be hooked by plugin
                 Key: BIT-1530
                 URL: https://bro-tracker.atlassian.net/browse/BIT-1530
             Project: Bro Issue Tracker
          Issue Type: Problem
          Components: Bro
    Affects Versions: 2.4
            Reporter: Jeff Barber

The way the 'protocol_confirmation' event is raised bypasses the plugin event-hook mechanism. Plugin event hooks are triggered via EventMgr.QueueEvent which is in the usual event generation interface. However, protocol_confirmation is generated via this code in src/analyzer/Analyzer.cc:

        // We immediately raise the event so that the analyzer can quickly
        // react if necessary.
        ::Event* e = new ::Event(protocol_confirmation, vl, SOURCE_LOCAL);

The EventMgr.Dispatch method doesn't invoke the hook so at present it's not possible for a plugin to hook this event. It would be nice if this were orthogonal with other events.

This message was sent by Atlassian JIRA

More information about the bro-dev mailing list