[Bro] Questions about bro module declarations

[francois.pennaneach at free.fr]

Hi,

Thank you for your answer.
I took a glimpse at "Scope" C++ code but nothing obvious  :(

Btw, what do you think of the following test case :


module Module1;
export {
    const var : string = "Module1::var";
     
    function test_func1(var : string) { print var, Module1::var; }
    
    function test_func2(            ) { print var, Module1::var; }
}

event bro_init()
	{
	test_func1("Argument");
	test_func2();
	}

Output for this test is :

Argument Argument
Module1::var Module1::var

I think it's a bit disturbing ? I was expecting a warning on variable name clashes, at least.
(I get this one while renaming a local variable in one of my big bro script, suddently everything was broken... ).

Thank you.

----- Mail original -----
De: "Seth Hall" <seth at icir.org>
À: "francois pennaneach" <francois.pennaneach at free.fr>
Cc: bro at bro.org
Envoyé: Jeudi 17 Novembre 2016 15:33:13
Objet: Re: [Bro] Questions about bro module declarations


> On Nov 15, 2016, at 8:20 AM, francois.pennaneach at free.fr wrote:
> 
> Then I tried this second script :
> 
> export {
>    const var : string = "GLOBAL::var_1";
> }
> 
> module Module1;
> 
> export {
>    function test_func() { print var; }
> }
> 
> 
> event bro_init() {
>    Module1::test_func();
> }
> 
> 
> It prints "GLOBAL::var_1". Good. So Module1::test_func() has "default" visibility on GLOBAL module.

It's just looking to the global scope since there is no var_1 in the local scope.


> Third try :
> 
> export {
>    const var : string = "GLOBAL::var_1";
> }
> 
> 
> module Module1;
> export {
>    const var : string = "Module1::var";
>    function test_func() { print var; }
> }
> 
> It prints "Module1::var". Why not.
> However, I was expecting Bro to report a conflict between using GLOBAL::var or Module1::var, as both are visible...

This is the same as your second script.  It looks for the id in the local scope and then tries the global module if the local module doesn't have one with that name.


> Fourth test : try to force the use of GLOBAL::var in test_func().
> 
> export {
>    const var : string = "GLOBAL::var_1";
> }
> 
> module Module1;
> export {
>    const var : string = "Module1::var";
>    function test_func() { print GLOBAL::var; }
> }
> 
> Bro reports an error : 
> line 15: unknown identifier GLOBAL::var, at or near "GLOBAL::var"
> 
> 
> Did I miss something ?
> What exactly is GLOBAL and what are its visibility rules and how does Bro search for identifiers in modules ?
> How to explicitly make a reference to an identifier in GLOBAL module, as GLOBAL:: does not work ?

I'm pretty sure you just encountered a bug.  I see the same behavior and it definitely shouldn't be working that way.  I filed a bug ticket:
	https://bro-tracker.atlassian.net/browse/BIT-1758

Thanks!
  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro.org/