[Zeek] error message "&optional is not valid for global variables"

Seth Grover sethdgrover at gmail.com
Wed Oct 9 14:18:52 PDT 2019


Greetings! I am migrating some scripts from 2.6.4 to 3.0.0. The scripts
reside here in github:

https://github.com/idaholab/Malcolm/tree/master/moloch/zeek

These worked fine in 2.6.4, but in 3.0.0 running zeek fails with something
like this:

/opt/zeek/share/zeek/site/./extractor_params.zeek, line 936: &optional is
not valid for global variables (&optional, &redef, &default=dat, &optional)

when running the command:

zeek -r whatever.pcap local extractor.zeek
extractor_override.interesting.zeek

It appears the problem is this: in extractor_params.zeek I have a global
table that looks like this:

  const extractor_mime_to_ext_map : table[string] of string = {
    ["application/acad"]= "dwg",
    ["application/andrew-inset"]= "ez",
...
    ["x-world/x-vrml"]= "wrl"
  } &default="bin" &redef;

This is the default. In extractor_override.interesting.zeek I have a redef
table in the export section that looks like this:

  redef extractor_mime_to_ext_map : table[string] of string = {
    ["application/binary"]= "bin",
...
  } &default="dat";

I found this issue (https://github.com/zeek/zeek/issues/157) and this
commit (
https://github.com/zeek/zeek/commit/db79041b1924e95d0bbde81acfbfb8d8ba1814b5)
with the comment "This disallows &default for global values that are not
tables, and &optional for all globals." However, in my case aren't these
*both* tables?

In the end, I don't *think* it's a big deal. If I remove the &default="dat"
from the extractor_override.interesting.zeek table it does run okay. But I
would like to understand what is happening here. Especially, what will
happen if the table is redef'ed and the lookup value is not found? I don't
think it will use the original global table, right? It seems to me like I
should be able to have defaults on both since they are, in fact, tables.

Thanks,

-SG
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/zeek/attachments/20191009/c3a1365f/attachment.html 


More information about the Zeek mailing list