<div dir="ltr">Greetings! I am migrating some scripts from 2.6.4 to 3.0.0. The scripts reside here in github:<br><br><a href="https://github.com/idaholab/Malcolm/tree/master/moloch/zeek" target="_blank">https://github.com/idaholab/Malcolm/tree/master/moloch/zeek</a><br><br>These worked fine in 2.6.4, but in 3.0.0 running zeek fails with something like this:<br><br>/opt/zeek/share/zeek/site/./extractor_params.zeek,
line 936: &optional is not valid for global variables
(&optional, &redef, &default=dat, &optional)<br><br>when running the command:<br><br>zeek -r whatever.pcap local extractor.zeek extractor_override.interesting.zeek<br><br>It appears the problem is this: in extractor_params.zeek I have a global table that looks like this:<br><br> const extractor_mime_to_ext_map : table[string] of string = {<br> ["application/acad"]= "dwg",<br> ["application/andrew-inset"]= "ez",<br>...<br> ["x-world/x-vrml"]= "wrl"<br> } &default="bin" &redef;<br><br>This is the default. In extractor_override.interesting.zeek I have a redef table in the export section that looks like this:<br><br> redef extractor_mime_to_ext_map : table[string] of string = {<br> ["application/binary"]= "bin",<br>...<br> } &default="dat";<br><br>I found this issue (<a href="https://github.com/zeek/zeek/issues/157" target="_blank">https://github.com/zeek/zeek/issues/157</a>) and this commit (<a href="https://github.com/zeek/zeek/commit/db79041b1924e95d0bbde81acfbfb8d8ba1814b5" target="_blank">https://github.com/zeek/zeek/commit/db79041b1924e95d0bbde81acfbfb8d8ba1814b5</a>)
with the comment "This disallows &default for global values that
are not tables, and &optional for all globals." However, in my case
aren't these *both* tables?<br><br>In the end, I don't *think* it's a big deal. If I remove the &default="dat" from the extractor_override.interesting.zeek
table it does run okay. But I would like to understand what is
happening here. Especially, what will happen if the table is redef'ed
and the lookup value is not found? I don't think it will use the
original global table, right? It seems to me like I should be able to
have defaults on both since they are, in fact, tables.<br><br>Thanks,<br><br>-SG</div>