[Bro] &expire_func/&create_expire question

[Christian Kreibich]

On Thu, 2006-11-16 at 23:51 -0800, Vern Paxson wrote:
> > can the &expire_func and &create_expire attributes be assigned at
> > run-time?
> 
> They should be, and looking at the code in question where you're getting
> the crash, I don't offhand see why it's failing.  Can you or Mike put
> together a self-contained demo script that tickles this bug?

Here you go -- this crashes on the first packet:

----
type flow_state: record {
        t: table[count] of count;
};

global state: table[addr] of flow_state;

function flow_state_new(i: interval): flow_state
{
        local fs: flow_state;
        local t: table[count] of count &create_expire=i;

        fs$t = t;
        return fs;
}

event new_packet(c: connection, p: pkt_hdr)
{
        local fs: flow_state;

        if (c$id$orig_h !in state) {
                fs = flow_state_new(5 secs);
                state[c$id$orig_h] = fs;
        }
}
----

This works:

----
type count_table: table[count] of count &create_expire=5 secs;

type flow_state: record {
        t: count_table;
};

global state: table[addr] of flow_state;

function flow_state_new(): flow_state
{
        local fs: flow_state;
        local t: count_table;

        fs$t = t;
        return fs;
}

event new_packet(c: connection, p: pkt_hdr)
{
        local fs: flow_state;

        if (c$id$orig_h !in state) {
                fs = flow_state_new();
                state[c$id$orig_h] = fs;
        }
}
----

Cheers,
Christian.
-- 
________________________________________________________________________
                                          http://www.cl.cam.ac.uk/~cpk25
                                                    http://www.whoop.org