[Bro] Receiving bro events via broccoli API

[Mike Muratet]

Stefan

>
>> However, the compiler is complaining about
>> the call-back function argument in my interface: "passing arg 3 of
>> 'bro_event_registry_add' from incompatible pointer type". I have tried to
>> type this as void and as BroEventFunc with the same results.
>
> The return type of the function should be void:
>
> void your_callback_func(BroConn* bc, ...) { ... }
>
> Not to confuse with that, the 3rd argument to bro_event_registry_add()
> is expected to be of BroEventFunc.  In order to cast your function
> accordingly when passing it, you can do:
>
> bro_event_registry_add(bc, "your_event_name",
>                       (BroEventFunc)your_callback_func);
>
>

Doh. I completely forgot about the trick. Thanks.

>> The events in conn.bro have 'connection' objects as their parameters. As 
>> I
>> understand the manuals, I can get the fields out of the object with the
>> bro_record_get_xxxx methods?
>
> Your callback function needs to have a BroRecord* as one of its
> arguments at the appropriate position, and yes, then you can use the
> bro_record_get_xxxx functions to access the fields in that record
> passed to your callback when the event arrives.
>
>

I'll give that a shot. Thanks again.

Cheers

Mike