[Bro-Dev] #884: Scripting inconsistency in the input framework

Bro Tracker bro at tracker.bro-ids.org
Mon Oct 1 13:42:32 PDT 2012

#884: Scripting inconsistency in the input framework
  Reporter:  sheharbano.k  |      Owner:  amannb
      Type:  Problem       |     Status:  accepted
  Priority:  Normal        |  Milestone:  Bro2.2
 Component:  Bro           |    Version:  git/master
Resolution:                |   Keywords:

Comment (by amannb):

 Sorry, I was not entirely able to reproduce this problem.

 If a table is read using the input framework and you use your type (IdxIp)
 as the index type, the resulting table is of type

 global tb_ip: table[addr] of count;

 and not of type

 global tb_ip: table[IdxIp] of count;

 The index record is just there to give the input framework the information
 about the names of the fields that are present in the input file -- the
 bro table that is constructed will use an IndexType that contains
 everything that was contained in the record in the same order.

 Thus if you have a record like

 type testrecord: record {
    a: addr;
    b: count;
    c: string;

 the resulting table will be of type

  table test [addr, count, string] of count;

 and not of type

  table test[testrecord] of count;

 However you should not even have been able to load the data into a table
 with the wrong type -- the input framework should refuse loading data in a
 table with nonmatching index types. And this seemed to work in my tests.

 So could you perhaps send me the exact scripts that you are using (or
 attach them here)? Perhaps something else is going on that I am not
 thinking of at the moment.

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/884#comment:2>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list