Greetings! I am migrating some scripts from 2.6.4 to 3.0.0. The scripts reside here in github:
https://github.com/idaholab/Malcolm/tree/master/moloch/zeek
These worked fine in 2.6.4, but in 3.0.0 running zeek fails with something like this:
/opt/zeek/share/zeek/site/./extractor_params.zeek, line 936: &optional is not valid for global variables (&optional, &redef, &default=dat, &optional)
when running the command:
zeek -r whatever.pcap local extractor.zeek extractor_override.interesting.zeek
It appears the problem is this: in extractor_params.zeek I have a global table that looks like this:
const extractor_mime_to_ext_map : table[string] of string = {
[“application/acad”]= “dwg”,
[“application/andrew-inset”]= “ez”,
…
[“x-world/x-vrml”]= “wrl”
} &default=“bin” &redef;
This is the default. In extractor_override.interesting.zeek I have a redef table in the export section that looks like this:
redef extractor_mime_to_ext_map : table[string] of string = {
[“application/binary”]= “bin”,
…
} &default=“dat”;
I found this issue (https://github.com/zeek/zeek/issues/157) and this commit (https://github.com/zeek/zeek/commit/db79041b1924e95d0bbde81acfbfb8d8ba1814b5) with the comment “This disallows &default for global values that are not tables, and &optional for all globals.” However, in my case aren’t these both tables?
In the end, I don’t think it’s a big deal. If I remove the &default=“dat” from the extractor_override.interesting.zeek table it does run okay. But I would like to understand what is happening here. Especially, what will happen if the table is redef’ed and the lookup value is not found? I don’t think it will use the original global table, right? It seems to me like I should be able to have defaults on both since they are, in fact, tables.
Thanks,
-SG