[Zeek] error message "&optional is not valid for global variables"
Seth Grover
sethdgrover at gmail.com
Wed Oct 9 14:18:52 PDT 2019
Greetings! I am migrating some scripts from 2.6.4 to 3.0.0. The scripts
reside here in github:
https://github.com/idaholab/Malcolm/tree/master/moloch/zeek
These worked fine in 2.6.4, but in 3.0.0 running zeek fails with something
like this:
/opt/zeek/share/zeek/site/./extractor_params.zeek, line 936: &optional is
not valid for global variables (&optional, &redef, &default=dat, &optional)
when running the command:
zeek -r whatever.pcap local extractor.zeek
extractor_override.interesting.zeek
It appears the problem is this: in extractor_params.zeek I have a global
table that looks like this:
const extractor_mime_to_ext_map : table[string] of string = {
["application/acad"]= "dwg",
["application/andrew-inset"]= "ez",
...
["x-world/x-vrml"]= "wrl"
} &default="bin" &redef;
This is the default. In extractor_override.interesting.zeek I have a redef
table in the export section that looks like this:
redef extractor_mime_to_ext_map : table[string] of string = {
["application/binary"]= "bin",
...
} &default="dat";
I found this issue (https://github.com/zeek/zeek/issues/157) and this
commit (
https://github.com/zeek/zeek/commit/db79041b1924e95d0bbde81acfbfb8d8ba1814b5)
with the comment "This disallows &default for global values that are not
tables, and &optional for all globals." However, in my case aren't these
*both* tables?
In the end, I don't *think* it's a big deal. If I remove the &default="dat"
from the extractor_override.interesting.zeek table it does run okay. But I
would like to understand what is happening here. Especially, what will
happen if the table is redef'ed and the lookup value is not found? I don't
think it will use the original global table, right? It seems to me like I
should be able to have defaults on both since they are, in fact, tables.
Thanks,
-SG
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20191009/c3a1365f/attachment.html
More information about the Zeek
mailing list