[Bro] Receiving bro events via broccoli API

[Stefan Kornexl]

Hi Mike,

On Wed, Jun 15, 2005 at 04:48:46PM -0500, Mike Muratet wrote:

> However, the compiler is complaining about 
> the call-back function argument in my interface: "passing arg 3 of 
> 'bro_event_registry_add' from incompatible pointer type". I have tried to 
> type this as void and as BroEventFunc with the same results.

The return type of the function should be void:

void your_callback_func(BroConn* bc, ...) { ... }

Not to confuse with that, the 3rd argument to bro_event_registry_add()
is expected to be of BroEventFunc.  In order to cast your function
accordingly when passing it, you can do:

bro_event_registry_add(bc, "your_event_name",
                       (BroEventFunc)your_callback_func);


> The events in conn.bro have 'connection' objects as their parameters. As I 
> understand the manuals, I can get the fields out of the object with the 
> bro_record_get_xxxx methods?

Your callback function needs to have a BroRecord* as one of its
arguments at the appropriate position, and yes, then you can use the
bro_record_get_xxxx functions to access the fields in that record
passed to your callback when the event arrives.


-- Stefan