3.12.3 Table Attributes

When declaring a table, you can specify a number of attributes that affect its operation:

&default

Specifies a value to yield when an index does not appear in the table. Syntax:

&default = expr

expr can have one of two forms. If it's type is the same as the table's yield type, then expr is evaluated and returned. If it's type is a function with arguments whose types correspond left-to-right with the index types of the table, and which returns a type the same as the yield type, then that function is called with the indices that yielded the missing value to compute the default value.

For example:

              global a: table[count] of string &default = "nothing special";
     

will return the string "nothing special" anytime a is indexed with a count value that does not appear in a.

A more dynamic example:

              function nothing_special(): string
                  {
                  if ( panic_mode )
                      return "look out!";
                  else
                      return "nothing special";
                  }
          
              global a: table[count] of string &default = nothing_special;
     

An example of using a function that computes using the index:

              function make_pretty(c: count): string
                  {
                  return fmt("**%d**", c);
                  }
          
              global a: table[count] of string &default = make_pretty;
     

&create_expire

Specifies that elements in the table should be automatically deleted after a given amount of time has elapsed since they were first entered into the table. Syntax:

&create_expire = expr

where expr is of type interval.

&read_expire

The same as create_expire except the element is deleted when the given amount of time has lapsed since the last time the element was accessed from the table.

&write_expire

The same as &create_expire except the element is deleted when the given amount of time has lapsed since the last time the element was entered or modified in the table.

&expire_func

Specifies a function to call when an element is due for expression because of &create_expire, &read_expire, or &write_expire. Syntax:

&expire_func = expr

expr must be a function that takes two arguments: the first one is a table with the same index and yield types as the associated table. The second one is of type any and corresponds to the index(es) of the element being expired. The function must return an interval value. The interval indicates for how much longer the element should remain in the table; returning 0 secs or a negative value instructs Bro to go ahead and delete the element.

Deficiency: The use of an any type here is temporary and will be changing in the future to a general tuple notion.

You specify multiple attributes by listing one after the other, without commas between them:

         global a: table[count] of string &default="foo" &write_expire=5sec;

Note that you can specify each type of attribute only once. You can, however, specify more than one of &create_expire, &read_expire, or &write_expire. In that case, whenever any of the corresponding timers expires, the element will be deleted.