deleting table entries

Zeek
1

Hi,
Does bro scripting allow table entries to be deleted while iterating over the entries of the table?
My test script below shows a weird behavior.

Is there a way to clear the entire contents of the table? I am collecting sum-stats (epoch is 60s)
in a table during the epoch_result callback. Then in the epoch_finished callback, I’d like to write
the summary results to a log. After that, I’d like to clear the table so that its ready for the next
iteration. Iterating and deleting individual elements seems to have a problem as shown in my
test script. Any help is appreciated. Thanks.

Dk.

global test_table: table[count] of count = table();

event bro_init()
{
local c: count = 0;

while (c < 100) {
test_table[c] = c;
c += 1;
}

print fmt(“test_table size: %d”, |test_table|);
}

event bro_done()
{
while (|test_table| > 0) {
print fmt(“test_table size: %d”, |test_table|);

this loop should walk all entries in one go. But it doesn’t

because of the delete.

for (c in test_table) {
delete test_table[c];
}
}

print fmt(“test_table size: %d”, |test_table|);
}

#test_table size: 100
#test_table size: 100
#test_table size: 43
#test_table size: 14
#test_table size: 1
#test_table size: 0

2

All,
I performed on more experiment. If I iterate over table entries without removing any entries
while iterating then it iterates over all entries. However, if I remove one or more entries
during iteration, then the loop does not iterate over all the elements. Some elements
could be skipped. See the code and the result from my experiment below.

Could one of the experts chime. Clearly, this is not a desired behavior. Thanks.

Dk.

global test_table: table[count] of count = table();

event bro_init()
{
local c: count = 0;

while (c < 100) {
test_table[c] = c;
c += 1;
}

print fmt(“test_table size: %d”, |test_table|);
}

event bro_done()
{
local lcount: count = 0;
for (c in test_table) {
++lcount;
}

print fmt(“Entries iterated: %d”, lcount);

while (|test_table| > 0) {
lcount = 0;

print fmt(“Table table size before deletion: %d”, |test_table|);
for (c in test_table) {
delete test_table[c];
++lcount;
}

print fmt(“Entries deleted: %d”, lcount);
}

print fmt(“test_table size: %d”, |test_table|);
}

test_table size: 100
Entries iterated: 100
Table table size before deletion: 100
Entries deleted: 59
Table table size before deletion: 41
Entries deleted: 30
Table table size before deletion: 11
Entries deleted: 11
test_table size: 0
3

Hi,

I think this is the expected (at least, documented) behavior :

https://www.bro.org/sphinx/script-reference/statements.html#keyword-for

Currently, modifying a container’s membership while iterating over it may result in undefined behavior, so do not add or remove elements inside the loop.