[Bro-Dev] #884: Scripting inconsistency in the input framework

[Bro Tracker]

#884: Scripting inconsistency in the input framework
---------------------------+------------------------
  Reporter:  sheharbano.k  |      Owner:  amannb
      Type:  Problem       |     Status:  accepted
  Priority:  Normal        |  Milestone:  Bro2.2
 Component:  Bro           |    Version:  git/master
Resolution:                |   Keywords:
---------------------------+------------------------

Comment (by amannb):

 Sorry, I was not entirely able to reproduce this problem.

 If a table is read using the input framework and you use your type (IdxIp)
 as the index type, the resulting table is of type

 {{{
 global tb_ip: table[addr] of count;
 }}}

 and not of type

 {{{
 global tb_ip: table[IdxIp] of count;
 }}}

 The index record is just there to give the input framework the information
 about the names of the fields that are present in the input file -- the
 bro table that is constructed will use an IndexType that contains
 everything that was contained in the record in the same order.

 Thus if you have a record like

 {{{
 type testrecord: record {
    a: addr;
    b: count;
    c: string;
 }
 }}}

 the resulting table will be of type

 {{{
  table test [addr, count, string] of count;
 }}}

 and not of type

 {{{
  table test[testrecord] of count;
 }}}

 However you should not even have been able to load the data into a table
 with the wrong type -- the input framework should refuse loading data in a
 table with nonmatching index types. And this seemed to work in my tests.

 So could you perhaps send me the exact scripts that you are using (or
 attach them here)? Perhaps something else is going on that I am not
 thinking of at the moment.

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/884#comment:2>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker