How to manage a dynamic vector

Zeek
1

Hi,
i have some problems with a code like this:

------- code.bro -----

type known_services_buffer: record {
    host: addr;
    port_num: port;
    port_proto: transport_proto;
    service: set[string];
};

type known_services_buffer_vec: vector of known_services_buffer;
global known_services_buf_vec = known_services_buffer_vec();
global count_a: int = 0;

event Known::log_known_services(rec: Known::ServicesInfo) &priority=5
{
        ...do something.....
        known_services_buf_vec[count_a]$host = rec$host;
        known_services_buf_vec[count_a]$port_num = rec$port_num;
        known_services_buf_vec[count_a]$port_proto = rec$port_proto;
        known_services_buf_vec[count_a]$service = rec$service;
        count_a = count_a + 1;
}

event Conn::log_conn(rec: Conn::Info)
{
    print (count_a);
    for (idx in known_services_buf_vec)
    {
           ...do something....
    }
}

------ code.bro -------

My variable count_a is incremented each time the event
Known::log_known_services is executed, but the last "for" in
Conn::log_conn is never executed because known_services_buf_vec is
always a void vector.
What's wrong? Any suggestion?
Thanks

2

Where are you defining your new type and declaring your global variables? Across multiple files? Within export blocks?

-AK

3

Vectors are a little goofy in Bro still. They are statically sized so you are creating an instance of a zero length vector. There is a built in function named “resize” that you may want to use to provide a size to your vector.
  https://www.bro.org/sphinx-git/scripts/base/bif/bro.bif.bro.html#id-resize

Alternately, you may want to use something like a table[count] of known_services_buffer

  .Seth