Two-dimensional arrays and for loop in Bro

Zeek
1

Hi,

I need to use two-dimensional (2D) arrays and for loops in one of my policy
scripts. Could someone please clarify the following questions for me.

1. I am thinking of implementing 2D arrays as table of tables. Is this the
best of doing this? Is "array[][]" in C equivalent to "global array:
table[count] of table[count] of count" in Bro? Can I access an element of
this array as array[index1][index2]? Also, is there a short-hand notation of
initializing all the elements of the 2D array to 0?

2. The reference manual mentions that Bro lacks ways of controlling the
order in which it iterates over the indices in a for loop. I need to iterate
over a for loop in order. What is the best way of doing this?

Thanks and Regards,
Abhinay

2

Hi Abhinay,

Hi,

I need to use two-dimensional (2D) arrays and for loops in one of my policy
scripts. Could someone please clarify the following questions for me.

1. I am thinking of implementing 2D arrays as table of tables. Is this the
best of doing this? Is "array" in C equivalent to "global array:
table[count] of table[count] of count" in Bro?

No, it's most closely related to a vector of vectors, much like in C.

Can I access an element of
this array as array[index1][index2]?

Yes, assuming the structure located at array[index1] is defined.

Also, is there a short-hand notation of
initializing all the elements of the 2D array to 0?

Not at the moment, no, since it'll depend on what size you want the
matrix to be.

2. The reference manual mentions that Bro lacks ways of controlling the
order in which it iterates over the indices in a for loop. I need to iterate
over a for loop in order. What is the best way of doing this?

You can avoid this by using vectors. The code snippet below uses
recursion to work around the lack of a numeric for-loop and will print
out:

m[1,1] = 1
m[1,2] = 0
m[1,3] = 0
m[2,1] = 0
m[2,2] = 2
m[2,3] = 0
m[3,1] = 0
m[3,2] = 0
m[3,3] = 3

type mrow: vector of count;
type matrix: vector of mrow;

function matrix_row_init(r: mrow, col: count)
{
        r[col] = 0;

        if (col > 1)
                matrix_row_init(r, col-1);
}

function matrix_init(m: matrix, row: count, cols: count)
{
        local r: mrow;
        matrix_row_init(r, cols);
        m[row] = r;

        if (row > 1)
                matrix_init(m, row-1, cols);
}

function matrix_new(rows: count, cols: count): matrix
{
        local m: matrix;
        matrix_init(m, rows, cols);
        return m;
}

event bro_init() {
        local m: matrix = matrix_new(3, 3);

        m[1][1] = 1;
        m[2][2] = 2;
        m[3][3] = 3;

        for (r in m) {
                for (c in m[r]) {
                        print fmt("m[%d,%d] = %d", r, c, m[r][c]);
                }
        }
}

Note that while you have to do the assignment of rows to the matrix
vector, you can save yourself the assignment of counts to each position
in a row if you know you'll always be assigning values before using
them. I also have no idea how slow/fast the above code will be for
nontrivial matrix sizes. :slight_smile:

Cheers,
Christian