[Bro-Dev] #884: Scripting inconsistency in the input framework

[Bro Tracker]

#884: Scripting inconsistency in the input framework
--------------------------+---------------------
 Reporter:  sheharbano.k  |       Type:  Problem
   Status:  new           |   Priority:  Normal
Milestone:  Bro2.2        |  Component:  Bro
  Version:  git/master    |   Keywords:
--------------------------+---------------------
 If a table contains data read in using the input framework, the script for
 parsing through the table is not completely consistent with how 'normal'
 bro tables are parsed. For a normal table the following works fine:
 ----------------------------
 type IdxIp: record {
         bad_ip: addr;
 };

 global tb_ip: table[IdxIp] of count;

 tb_ip[ [$bad_ip=1.1.1.1] ] = 1;
 tb_ip[ [$bad_ip=2.2.2.2] ] = 2;

 local rec: IdxIp;
 for ( rec in tb_ip)
         print rec$bad_ip;

 ------------------------------------

 However, if tb_ip has data that was read using the input framework, then
 the following generates the error <type clash in iteration>:

 ------------------------------------
 type IdxIp: record {
         bad_ip: addr;
 };

 local rec: IdxIp;
 for ( rec in BlacklistMgr::blacklist_ip )
         print rec$bad_ip;
 -------------------------------------

 So instead, one must use the following syntax for tables related to the
 input framework:

 --------------------------------------
 type IdxIp: record {
         bad_ip: addr;
 };

 for ( [bad_ip] in BlacklistMgr::blacklist_ip )
             print bad_ip;

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/884>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker