New bro types when writing a plugin

Zeek
1

Hey there,

I'm writing an analyzer as a plugin and I would like to create some new bro data type (record type to be exact) to hand over some protocol data in a compact form as parameters to the event functions.

For now I have declared the new types in types.bif and defined them in init-bare.bro, but I don't think that this is the right way, because I have to manually modify the bro source files.

Is there a way to declare and define the new type inside the plugin source files, so that the types will be featured in bro after the plugin was installed?

Greetings,

Dane

2

Hello,

Take a look into this example: https://github.com/vitalyrepin/uap-bro I have defined three record types in that plugin: DeviceRec, UserAgentRec and AgentRec.

P.S. I think bro-dev is a better mailing list to discuss bro dev. issues: http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev

3

Hey

thanks for the hint. I declared my types in types.bif and defined them in types.bro now, but now I can’t acces them anymore in my Source.cc file. I get following error:

error: ‘BifType::Record::My_Type’ has not been declared

My .cc line: rl = new RecordVal(BifType::Record::My_Type);

How can I access the types now?

P.S. Yeah, I think the other mailing list is besser for this purpose, but I don’t want to start a new question now. :slight_smile:

4

Make sure you include the generated header file in your .cc file like this…

#include “types.bif.h”

.Seth