Bro script for reading a list of Ips and domains

Question

I am trying to read a file with a list of IP addresses and another one with domains, as a proof of concept of the Input Framework defined in https://docs.zeek.org/en/stable/frameworks/input.html

I´ve prepared the following bro scripts:

reading.bro:

type Idx: record {
        ip: addr;
};

type Idx: record {
        domain: string;
};


global ips: table[addr] of Idx = table();
global domains: table[string] of Idx = table();

event bro_init() {
    Input::add_table([$source="read_ip_bro", $name="ips",
                      $idx=Idx, $destination=ips, $mode=Input::REREAD]);

    Input::add_table([$source="read_domain_bro", $name="domains",
                      $idx=Idx, $destination=domains, $mode=Input::REREAD]);

    Input::remove("ips");
    Input::remove("domains");
}

And the bad_ip.bro script, which check if an IP is in the blacklist, which loads the previous one:

bad_ip.bro

@load reading.bro

module HTTP;

event http_reply(c: connection, version: string, code: count, reason: string)
        {
        if ( c$id$orig_h in ips )
                print fmt("A malicious IP is connecting: %s", c$id$orig_h);
        }

However, when I run bro, I get the error:

error: Input stream ips: Table type does not match index type. Need type 'string':string, got 'addr':addr
Segmentation fault (core dumped)

Answer 1

You cannot assign a string type to an addr type. In order to do so, you must use the utility function to_addr(). Of course, it would be wise to verify that that string contains a valid addr first. For example:

 if(is_valid_ip(inputString){
   inputAddr = to_addr(inputString)
 } else { print "addr expected, got a string"; }