[Bro-Dev] #884: Scripting inconsistency in the input framework
Bro Tracker
bro at tracker.bro-ids.org
Mon Oct 1 13:42:32 PDT 2012
#884: Scripting inconsistency in the input framework
---------------------------+------------------------
Reporter: sheharbano.k | Owner: amannb
Type: Problem | Status: accepted
Priority: Normal | Milestone: Bro2.2
Component: Bro | Version: git/master
Resolution: | Keywords:
---------------------------+------------------------
Comment (by amannb):
Sorry, I was not entirely able to reproduce this problem.
If a table is read using the input framework and you use your type (IdxIp)
as the index type, the resulting table is of type
{{{
global tb_ip: table[addr] of count;
}}}
and not of type
{{{
global tb_ip: table[IdxIp] of count;
}}}
The index record is just there to give the input framework the information
about the names of the fields that are present in the input file -- the
bro table that is constructed will use an IndexType that contains
everything that was contained in the record in the same order.
Thus if you have a record like
{{{
type testrecord: record {
a: addr;
b: count;
c: string;
}
}}}
the resulting table will be of type
{{{
table test [addr, count, string] of count;
}}}
and not of type
{{{
table test[testrecord] of count;
}}}
However you should not even have been able to load the data into a table
with the wrong type -- the input framework should refuse loading data in a
table with nonmatching index types. And this seemed to work in my tests.
So could you perhaps send me the exact scripts that you are using (or
attach them here)? Perhaps something else is going on that I am not
thinking of at the moment.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/884#comment:2>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
More information about the bro-dev
mailing list