BinPAC and custom types

Zeek
1

Hi,

I’m making some good progress writing an analyser with BinPAC, only small issue is that I can’t find a way to get custom Bro script types to be parsed on initiation of Bro. I’ve tried adding a types.bif file and defining the type there but can only seem to do a simple definition such as:

type ::: record;

rather than the full definition:

type ::: record {

bool_var1: bool;

bool_var2: bool;

int_var: int;

};

I have to add the above type manually to the generated Bro_.events.bif.bro file or the core init-bare.bro file.

I’ve had a search around, but all references are to add it to the init-bare.bro file. Changing one of the core files doesn’t seem to fit with the plugin style of development.

Is there any way to add a type without doing it manually or tainting init-bare.bro?

Thanks,

Stu

2

You need to define the name and that it's a record in the types.bif file and then create a Bro script with the full type definition that is auto loaded when your plugin is loaded. I think that if you used the script that autogenerates a structure for you, you should have a file named scripts/types.bro that is exactly for this purpose.

   .Seth