mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
431767d04b
This is based on the discussion in zeek/zeek#2668. Using &default with tables can be confusing as the default value is not inserted. The following example prints an empty table at the end even new Service records was instantiated. type Service: record { occurrences: count &default=0; last_seen: time &default=network_time(); }; global services: table[string] of Service &default=Service(); event zeek_init() { services["http"]$occurrences += 1; services["http"]$last_seen = network_time(); print services; } Changing above &default to &default_insert will insert the newly created default value upon a missed lookup and act less surprising. Other examples that caused confusion previously revolved around table of sets or table of vectors and `add` or `+=` not working as expected. tbl_of_vector["http"] += 1 add tbl_of_set["http"][1];
40 lines
940 B
Text
40 lines
940 B
Text
# @TEST-EXEC: zeek -b %INPUT >out
|
|
# @TEST-EXEC: btest-diff out
|
|
# @TEST-EXEC: btest-diff .stderr
|
|
|
|
global tbl: table[count] of string &default_insert="<default>";
|
|
global tbl_vec: table[count] of vector of string &default_insert=vector("a", "b");
|
|
|
|
type R: record {
|
|
a: string;
|
|
};
|
|
global tbl_def_func: table[count] of R &default_insert=function(c: count): R { return R($a=cat(c)); };
|
|
|
|
# This takes a different code path than without a table constructor.
|
|
global tbl_construct = table([1] = R($a="1")) &default_insert=function(c: count): R { return R($a=cat(c)); };
|
|
|
|
event zeek_init()
|
|
{
|
|
print type_name(tbl_construct);
|
|
|
|
print "===";
|
|
print tbl[0];
|
|
print tbl;
|
|
|
|
print "===";
|
|
print tbl_vec[0];
|
|
print tbl_vec[1];
|
|
tbl_vec[0] += "c";
|
|
tbl_vec[1] += "d";
|
|
print tbl_vec;
|
|
|
|
print "===";
|
|
print tbl_def_func[0];
|
|
print tbl_def_func[1];
|
|
print tbl_def_func;
|
|
|
|
print "===";
|
|
print tbl_construct[0];
|
|
print tbl_construct[1];
|
|
print tbl_construct;
|
|
}
|