[Bro-Dev] declaration error: &default function type clash

Aashish Sharma asharma at lbl.gov
Thu May 12 01:44:58 PDT 2016


So I am trying to convert tables into using opaque of cardinality since thats more memory efficient (or counting bloomfilters for that matter):

works: if table (0) converted to (1) 
errors: if table (2) converted to (3) 


Details: I am trying the following, original table (0) converted to (1): 

(0) global likely_scanner: table[addr,port] of set[addr] &read_expire=1 day &synchronized ;

(1) global c_likely_scanner: table[addr] of opaque of cardinality
        &default = function(n: any): opaque of cardinality { return hll_cardinality_init(0.1, 0.95); }
        &read_expire=1 day  ;


ERRORS: 

(2) global likely_scanner: table[addr,port] of set[addr] &read_expire=1 day &synchronized ;

Converted table:

(3) global c_likely_scanner: table[addr,port] of opaque of cardinality
        &default = function(n: any): opaque of cardinality { return hll_cardinality_init(0.1, 0.95); }
        &read_expire=1 day  ;

I get this error:

check-knock.bro, line 58: &default function type clash (&default=anonymous-function{ return (hll_cardinality_init(0.1, 0.95))})



Question: 

how do I declare (3) so that I can avoid the "&default function type clash"  error above.

I am not sure what am I doing wrong in the declaration. Any thoughts/advice how to get past this issue ?

Thanks,
Aashish



More information about the bro-dev mailing list