Upgrade from 2.4 to 2.5

Hello.

I’m upgrading an install from 2.4 to the latest.

Did this ability go away in 2.5:

write_file(fileh, fmt(“filename: %s \r\n”, c$http?$filename ? c$http$filename : “uninitialized”));

Specifically the c$http?$filename.

Is there a list I can reference of thing that may have been deprecated?

Thanks in advance for putting up with my newbie questions.

Carl

I ran across this issue just the other day. Evidently, ?$ no longer works in a ternary expression, which I presume is a bug, rather than a feature.

Jim

Hello.

I'm upgrading an install from 2.4 to the latest.

Did this ability go away in 2.5:

write_file(fileh, fmt("filename: %s \r\n", c$http?$filename ? c$http$filename : "uninitialized"));

Specifically the c$http?$filename.

Yes, c$http$filename went away (specifically the 'filename' field of the HTTP::Info record no longer exists).

Take a look at [1] for the fields that are currently available. You might want to use some of these as replacement:

* c$http$current_entity$filename

* c$http$orig_filenames

* c$http$resp_filenames

Is there a list I can reference of thing that may have been deprecated?

There's guidance at [2], which is generally derived from the contents of the NEWS file inside the Bro source tree.

- Jon

[1] https://www.bro.org/sphinx/scripts/base/protocols/http/main.bro.html#type-HTTP::Info

[2] https://www.bro.org/sphinx/install/upgrade.html

This test case at least still works as expected in git/master:

type myrec: record { a: string &optional; };
local mr1 = myrec($a = "aaa");
local mr2 = myrec();
print mr1?$a ? "yes" : "no";
print mr2?$a ? "yes" : "no";

Can you give more details on exactly what you see or file a bug report if you've found a situation where the ?$ or ternary expressions aren't working?

- Jon

Jon, for my own edification, what was the driving motivation for removing the c$http$filename field?

I think it was just that you can have multiple files per connection so ‘filename’ became ‘filenames’.

Copy that

Yes, the reasoning I imagine went something like that -- it was not exactly correct to have a singular 'filename' when actually there may be many.

- Jon

Thanks Jon, and everyone else that responded.

Can you offer suggestions on a fix for:

local ftp = FTP::get_ftp_info(c);

I looked in the release notes / doc and didn’t find any mention of it going away.

Thanks again.

I'm not too sure what that is either, I don't see it in the source code for 2.4. Maybe c$ftp has what you need (the FTP::Info record type) ?

- Jon

I’ll just tag team with Jon today. :slight_smile:

I didn’t see a get_ftp_info function as far back as v1.5, so I suspect this is from a custom policy. I’ve got some time tonight to look at it if you can send me the policy and hopefully whatever you find nearby that declares that function.

-Dop

I did a ‘grep -Hnr * get_ftp_info’ and only found the one reference. I will keep poking around and hopefully find some more info on it. Thanks for looking.