Bro - Broccoli Data Type Mismatch issue

Zeek
1

Hi,

I am developing Bro scripts for reading modbus packets.
I send the packet details to broccoli as events.
When I send an event with parameters of type “addr” and “vector of count” from the bro script to broccoli, the broccoli doesn’t receive the parameters correctly.
The code –

Bro script –

global pong: event(reg: vector of count, ipaddr: addr);

event modbus_read_holding_registers_response(c: connection, headers: ModbusHeaders, registers: ModbusRegisters)
{

event pong(ModbusRegisters,c$id$resp_h);

#ModbusRegisters - type vector of count
#c$id$resp_h type-addr

}

Broccoli Script –

static void bro_pong(BroConn *conn,void *data,BroRecord *rec,BroAddr *address)
{

int type = BRO_TYPE_COUNT;
uint64 *register;
if (! (seq = bro_record_get_nth_val(rec, 0, &type)))
{
printf(“Error getting sequence count from event, got type %i\n”, type);
return;
}
printf("pong event from seq=%“PRIu64"”,*register);

printf("\nAddress:");
for(i=3;i>=0;i–)
{
printf("%“PRIu32”.",address->addr[i]);
}
printf("\n");

}

Thanks in advance!

Vishak Muthukumar

Graduate Student

University of California, Davis
2

You are passing the type, you need to pass the value.

event pong(headers, c$id$resp_h);

  .Seth

3

global pong: event(reg: vector of count, ipaddr: addr);

<snip>

static void bro_pong(BroConn *conn,void *data,BroRecord *rec,BroAddr *address)

I'm not completely sure that Vectors are supported as values in broccoli. From my quick glance it looks like they're an unsupported but you can't just treat them like a record like you are doing. There may be other problems, but I noticed that immediately. You also aren't showing us any code where you are subscribing to events with broccoli so I can't even be sure you are doing that correctly.

  .Seth

4

The issue is solved,
I needed to do typecasting to receive the correct IP address -

The broccoli script is –

static void bro_pong(BroConn *conn,void *data,BroAddr *address)
{

char addr[INET6_ADDRSTRLEN];
inet_ntop(AF_INET, address->addr + 3, addr, INET6_ADDRSTRLEN);
printf(“Received bro_address%s\n”, addr);
}

Thanks for your help.

Vishak