[Bro-Dev] [JIRA] (BIT-1090) fatal error Val::CONVERTER

[tyler.schoenke (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1090?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14502#comment-14502 ] 

tyler.schoenke commented on BIT-1090:
-------------------------------------

I set up the file without the redef, and formatted it as you specified.   

$ cat sigsup-ssh-pass3.bro
SSH::ignore_guessers[172.0.0.0/16] = set( 10.0.0.1/32 );
SSH::ignore_guessers[192.168.1.0/16] = set( 192.168.2.0/32 );


That got rid of the fatal error, but it looks like the array is empty.   Maybe the -I option is showing the value of the array before it gets populated by the bro script?

$ bro  my-detect-bruteforcing.bro sigsup-ssh-pass3.bro -I SSH::ignore_guessers;
SSH::ignore_guessers : table[subnet] of set[subnet] = {

} &redef

Tyler




> fatal error Val::CONVERTER
> --------------------------
>
>                 Key: BIT-1090
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1090
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: 2.1
>         Environment: Ubuntu 10.04.03 LTS, bro 2.1-179
>            Reporter: tyler.schoenke
>         Attachments: my-detect-bruteforcing.bro, sigsup-ssh-pass2.bro
>
>
> Hi guys,
> I get the following message when I modified a data structure in detect-bruteforcing.bro.  I didn't get a chance to test against the current version, but did a quick check against the mailing lists and tracker and didn't see this issue mentioned.
> $ bro  my-detect-bruteforcing.bro sigsup-ssh-pass2.bro
> fatal error in ./sigsup-ssh-pass2.bro, line 2: Val::CONVERTER (types/table) (10.0.0.1/32)
> Here is the modification to detect-bruteforcing.bro:
> 	const ignore_guessers: table[subnet] of set[subnet] = {} &redef;
> I found the need to whitelist from a single host to multiple subnets instead of a single subnet.  The following minimal script will produce the error.
> cat sigsup-ssh-pass2.bro
> redef SSH::ignore_guessers = {
> 	[172.0.0.0/16] = set( 10.0.0.1/32 )
> };
> Any help would be appreciated.
> Thanks,
> Tyler



--
This message was sent by Atlassian JIRA
(v6.2-OD-01#6204)