[Bro] Questions about bro module declarations

[Seth Hall]

> On Nov 15, 2016, at 8:20 AM, francois.pennaneach at free.fr wrote:
> 
> Then I tried this second script :
> 
> export {
>    const var : string = "GLOBAL::var_1";
> }
> 
> module Module1;
> 
> export {
>    function test_func() { print var; }
> }
> 
> 
> event bro_init() {
>    Module1::test_func();
> }
> 
> 
> It prints "GLOBAL::var_1". Good. So Module1::test_func() has "default" visibility on GLOBAL module.

It's just looking to the global scope since there is no var_1 in the local scope.


> Third try :
> 
> export {
>    const var : string = "GLOBAL::var_1";
> }
> 
> 
> module Module1;
> export {
>    const var : string = "Module1::var";
>    function test_func() { print var; }
> }
> 
> It prints "Module1::var". Why not.
> However, I was expecting Bro to report a conflict between using GLOBAL::var or Module1::var, as both are visible...

This is the same as your second script.  It looks for the id in the local scope and then tries the global module if the local module doesn't have one with that name.


> Fourth test : try to force the use of GLOBAL::var in test_func().
> 
> export {
>    const var : string = "GLOBAL::var_1";
> }
> 
> module Module1;
> export {
>    const var : string = "Module1::var";
>    function test_func() { print GLOBAL::var; }
> }
> 
> Bro reports an error : 
> line 15: unknown identifier GLOBAL::var, at or near "GLOBAL::var"
> 
> 
> Did I miss something ?
> What exactly is GLOBAL and what are its visibility rules and how does Bro search for identifiers in modules ?
> How to explicitly make a reference to an identifier in GLOBAL module, as GLOBAL:: does not work ?

I'm pretty sure you just encountered a bug.  I see the same behavior and it definitely shouldn't be working that way.  I filed a bug ticket:
	https://bro-tracker.atlassian.net/browse/BIT-1758

Thanks!
  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/