[Bro] confusing error on if statement

[Earl Eiland]

I’m testing to see if c$service is a subset of a set[string] field in a table, and getting the error message

“error in string and ./bro_scripts/Screen_protocols.bro, line 79: type clash (string and Screen_protocols::c$service)
error in ./bro_scripts/Screen_protocols.bro, line 79 and string: type mismatch (Screen_protocols::c$service and string)
error in ./bro_scripts/Screen_protocols.bro, line 79: not an index type (Screen_protocols::c$service in Screen_protocols::whitelist[Screen_protocols::c$id$orig_h, Screen_protocols::c$id$resp_h]$service)”

The command is: “if (c$service !in whitelist[c$id$orig_h, c$id$resp_h]$service)”
Where the table is defined as “global whitelist: table[addr, addr] of Service_whitelist_data = table();” and the table field service is defined as “service: set[string];”

Please advise!

Best Regards,

Earl Eiland,
Sr. Cyber Security Engineer,
Emerging Technologies, root9B,
San Antonio, Texas

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20150817/4d0a7cf8/attachment.html