I'm writing an analyzer as a plugin and I would like to create some new bro data type (record type to be exact) to hand over some protocol data in a compact form as parameters to the event functions.
For now I have declared the new types in types.bif and defined them in init-bare.bro, but I don't think that this is the right way, because I have to manually modify the bro source files.
Is there a way to declare and define the new type inside the plugin source files, so that the types will be featured in bro after the plugin was installed?
Take a look into this example: https://github.com/vitalyrepin/uap-bro I have defined three record types in that plugin: DeviceRec, UserAgentRec and AgentRec.
P.S. I think bro-dev is a better mailing list to discuss bro dev. issues: http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
thanks for the hint. I declared my types in types.bif and defined them in types.bro now, but now I can’t acces them anymore in my Source.cc file. I get following error:
error: ‘BifType::Record::My_Type’ has not been declared
My .cc line: rl = new RecordVal(BifType::Record::My_Type);
How can I access the types now?
P.S. Yeah, I think the other mailing list is besser for this purpose, but I don’t want to start a new question now.
Make sure you include the generated header file in your .cc file like this…