Conflicting errors when creating a table

Zeek
1

Hello.

I’m trying to read in a table where the key is a set. The Input::add_table operation seems fine with this, but the table declaration fails. The line “global whitelist: table[set[addr]] of Service_whitelist_data = table(); “ generates the error ”bad index type (set[addr])”

I can avoid this error by declaring “global whitelist: table[addr] of Service_whitelist_data = table(); “, but then receive the error “Input stream whitelist: Table type does not match index type. Need type ‘table’:set[addr], got ‘addr’:addr”.

I’m assuming that my type declaration “table[set[addr]]” is incorrect, and that the error message is suggesting a solution. I’ve tried a number of type declaration variations: all have failed. I’ve also looked through the documentation and input framework examples, but came away empty handed. How do I satisfy the ‘table’:set[addr] requirement?

Best Regards,

Earl Eiland,

Sr. Cyber Security Engineer,

Emerging Technologies, root9B,

San Antonio, Texas

2

The error message "bad index type" means that a table's index type
cannot be a set.

To solve this problem, you will probably need to add a new column
to your input file. The new column will be the index to your table.