Defining a table inside a record

Zeek
1

Hi,

In the bro scripting language (policy file), is it possible to define a table inside a record? I am trying to do so now and it results in a run-time error when I try to add an element to the table in the record for the first time.

Thanks and Regards,
Abhinay

2

Could you post a simple script demonstrating the problem? I believe I know
what you're running up against, but it'll be easiest to show how to fix it
given an example.

    Vern

3

Hi Vern,

I have attached an example script. I get the following error when I run it:
"1145312860.146852 ../policy/example.bro, line 16 (curr_info$temp_table):
internal error: field value missing"

Am I doing something wrong?

Also, the ref-manual mentions that we should use "* expr" for doing a deep
copy. I get an error when I try to do so. What is the correct syntax for
doing a deep copy.

Thanks and Regards,
Abhinay

example.bro (440 Bytes)

4

Am I doing something wrong?

It's subtle, but the problem is that this:

  local curr_info: temp_info;

assigns a record value to curr_info but one that *doesn't have any of the
fields initialized*. It's the same as if you had a field "foo: double"
in the record - you couldn't then access temp_info$foo in an expression
because it hasn't yet been assigned.

The following will fix the problem. Change:

  ...
  local curr_info: temp_info;
  curr_info$temp_table[1] = "abhinay";
  ...

to

  ...
  local curr_info: temp_info;
  local table_val_for_record : table[count] of string;
  curr_info$temp_table = table_val_for_record;
  curr_info$temp_table[1] = "abhinay";
  ...

Also, the ref-manual mentions that we should use "* expr" for doing a deep
copy. I get an error when I try to do so. What is the correct syntax for
doing a deep copy.

Argh, that's out-of-date (where in the manual do you see it?). Instead
use "copy(expr)".

    Vern

5

Thanks Vern,

That fixed the problem.

About deep copy, I am using version 0.9. If I use copy, Bro complains saying
"unknown identifier copy". Is there any other way to do a deep copy in v0.9.

Thanks,
Abhinay

6

About deep copy, I am using version 0.9. If I use copy, Bro complains saying
"unknown identifier copy". Is there any other way to do a deep copy in v0.9.

No, it's a feature that was added in 1.0.

    Vern

7

Well one can still do the deep copy manually, no? You'll need to go over
your original data structure and assign all elementary fields to the new
structure manually. Upgrading to 1.0+ is encouraged!

I'll look into correcting the documentation regarding copy().

Cheers,
Christian.