a tree structure with Bro records

Zeek
1

Hello,

I would like to build a tree data structure to track flows at
different aggregate granularities. However, I cannot seem to construct
a recursive record structure.

The following...

type tree_node : record {
    data : count;
    parent : tree_node;
};

... will lead to...

$ bro tree.bro
./tree.bro, line 3 and ./tree.bro, line 5
   (tree_node): error, not a BRO type

... and changing the parent type to 'any' and doing anything w/ the record...

type tree_node : record {
    data : count;
    parent : any;
};

event bro_init () {
    local tn : tree_node;
    tn$data = 0;
    tn$parent = tn;
}

... will lead to...

$ bro tree.bro
./tree.bro, line 12 (tn$parent = tn): error, type clash in assignment

... because you cannot assign to 'any' type variables, I guess.

So... just wondering if there is some other scheme / mechanism to
build such a tree in Bro, or am I just out-of-luck.

Thanks,
Mike

2

So... just wondering if there is some other scheme / mechanism to
build such a tree in Bro, or am I just out-of-luck.

I'm afraid closer to just-out-of-luck.

You could fake it up using table[string] of XYZ, where XYZ records include
a string that point back into the table. Not pretty, but seems it should
work.

    Vern