Passing a Table to the policy engine

Zeek
1

I tried doing this in my myfile.cc file:

  int pathArr[100];
  val_list* vl = new val_list;
  ...
  TableVal* myPath = new TableVal(internal_type("count")->AsTableType());
  for ( int i=0; i < 100; i++ ) {
    myPath->Assign(new Val(i, TYPE_INT), new Val(pathArr[i], TYPE_INT));
  }
  updaterec->Assign(1, myPath);
  vl->append(updaterec);
  mgr.QueueEvent(update, vl, Event::LOCAL, this);

but I beleve that my TableVal* myPath assigmnet is incorrect, as it
does not recognize "count" as a type when i run it.

You have the right idea. Two problems I see are: (1) you should use
TYPE_COUNT rather than TYPE_INT (count is unsigned, int is signed), though
that shouldn't matter in practice; (2) I don't understand the line:

  updaterec->Assign(1, myPath);

What is updaterec and why are you assigning element 1 rather than element 0?

    Vern

2

Hi,

> int pathArr[100];
> val_list* vl = new val_list;
> ...
> TableVal* myPath = new TableVal(internal_type("count")->AsTableType());
> for ( int i=0; i < 100; i++ ) {
> myPath->Assign(new Val(i, TYPE_INT), new Val(pathArr[i], TYPE_INT));
> }
> updaterec->Assign(1, myPath);
> vl->append(updaterec);
> mgr.QueueEvent(update, vl, Event::LOCAL, this);
>
> but I beleve that my TableVal* myPath assigmnet is incorrect, as it
> does not recognize "count" as a type when i run it.

You have the right idea. Two problems I see are: (1) you should use
TYPE_COUNT rather than TYPE_INT (count is unsigned, int is signed), though
that shouldn't matter in practice;

Okay, let me explain. In my bro.init, i have a record:

  type some_rec: record {
    path_table: table[count] of count;
  }

in my myfile.cc code, i tried doing this:

  myFuncInC ()
  {
    printf ("I am in this function\n");
        int pathArr[100];
        val_list* vl = new val_list;
         RecordVal* myrec = new RecordVal(some_rec);
         ...
         TableVal* myPath = new TableVal(internal_type("count")->AsTableType());
         for ( int i=0; i < 100; i++ ) {
                 myPath->Assign(new Val(i, TYPE_COUNT), new Val(pathArr[i], TYPE_COUNT));
         }
         myrec->Assign(0, myPath);
         vl->append(myrec);
         mgr.QueueEvent(some_event, vl, Event::LOCAL, this);
  }

But i get a runtime error:

%I am in this function
%1078809250.202295 internal error: internal type count missing

I dont think its because of my TYPC_COUNT as opposed to TYPE_INT. it does
not like me using a count for my table, maybe because i have not defined
it? It could be my line:

  TableVal* myPath = new TableVal(internal_type("count")->AsTableType());

where I am using internal_type("count")->AsTableType(), which might not
work. However, i dont know how else to create a table[count] of count
otherwise.

Thanks

Charles

3

There are two possibilities:

- you can define a new type in bro.init and then access it:

      bro.init:
            type my_table_count_of_count: table[count] of count;
      *.cc:
           TableVal* myPath = new TableVal(internal_type("my_table_count_of_count")->AsTableType());

- you instantiate a new BroType yourself:

      TypeList *myIndices = new TypeList(base_type(TYPE_COUNT));
      myIndices->Append(base_type(TYPE_COUNT));
      TableType* myType = new TableType(myIndices, base_type(TYPE_COUNT));
      
      TableVal* myPath = new TableVal(myType);
            
(Both are completely untested which means that they probably won't
work out-of-the-box :slight_smile:

Robin

4

There are two possibilities:

- you can define a new type in bro.init and then access it:

      bro.init:
            type my_table_count_of_count: table[count] of count;
      *.cc:
           TableVal* myPath = new TableVal(internal_type("my_table_count_of_count")->AsTableType());

This works right out of the box! thanks!

charles