Fatal error

[kevross33]

Hi,

Not sure if my build (repeated in test and multiple production systems) but I get fatal errros on all the plugins (s7com, bacnet, enip etc.) with basically the following kinds of error

warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 28: Duplicate identifier documentation: S7comm::rosctrs warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 30 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 31: redefinition requires "redef" (S7comm::functions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 43: Duplicate identifier documentation: S7comm::functions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 45 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 46: redefinition requires "redef" (S7comm::areas) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 62: Duplicate identifier documentation: S7comm::areas warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 64 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 65: redefinition requires "redef" (S7comm::item_transport_sizes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 83: Duplicate identifier documentation: S7comm::item_transport_sizes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 85 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 86: redefinition requires "redef" (S7comm::data_transport_sizes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 95: Duplicate identifier documentation: S7comm::data_transport_sizes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 97 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 98: redefinition requires "redef" (S7comm::item_syntax_ids) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 109: Duplicate identifier documentation: S7comm::item_syntax_ids warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 111 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 112: redefinition requires "redef" (S7comm::user_data_function_modes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 115: Duplicate identifier documentation: S7comm::user_data_function_modes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 117 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 118: redefinition requires "redef" (S7comm::user_data_function_groups) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 127: Duplicate identifier documentation: S7comm::user_data_function_groups warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 129 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 130: redefinition requires "redef" (S7comm::user_data_programmer_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 139: Duplicate identifier documentation: S7comm::user_data_programmer_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 141 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 142: redefinition requires "redef" (S7comm::user_data_cyclic_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 144: Duplicate identifier documentation: S7comm::user_data_cyclic_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 146 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 147: redefinition requires "redef" (S7comm::user_data_block_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 150: Duplicate identifier documentation: S7comm::user_data_block_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 152 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 153: redefinition requires "redef" (S7comm::user_data_sec_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 154: Duplicate identifier documentation: S7comm::user_data_sec_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 156 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 157: redefinition requires "redef" (S7comm::user_data_time_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 161: Duplicate identifier documentation: S7comm::user_data_time_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 163 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 164: redefinition requires "redef" (S7comm::user_data_cpu_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 171: Duplicate identifier documentation: S7comm::user_data_cpu_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 173 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 174: redefinition requires "redef" (S7comm::error_classes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 181: Duplicate identifier documentation: S7comm::error_classes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 183 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 184: redefinition requires "redef" (S7comm::syntax_ids) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 197: Duplicate identifier documentation: S7comm::syntax_ids warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 199 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 200: redefinition requires "redef" (S7comm::return_codes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 208: Duplicate identifier documentation: S7comm::return_codes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 210 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 211: redefinition requires "redef" (S7comm::error_codes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 417: Duplicate identifier documentation: S7comm::error_codes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 419 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 420: redefinition requires "redef" (S7comm::vartab_areas) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 437: Duplicate identifier documentation: S7comm::vartab_areas warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 1: Discarded extraneous Zeekygen comment: Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 1: Discarded extraneous Zeekygen comment: SPDX-License-Identifier: BSD-3-Clause error in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 12: identifier or enumerator value in enumerated type definition already exists error in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 13: identifier or enumerator value in enumerated type definition already exists error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 23: already defined (S7comm::log_iso_cotp) error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 35: already defined (S7comm::log_s7comm) error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 43 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 44: already defined (S7comm::ports) fatal error in /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, lines 13-16: BroType::AsEnumType (error/enum) (error)

[NothinRandom]

Hi @kevross33,

Could you check cmake version of the your hosts? We've recently migrated over to zeek 3.1.0, so the minimum cmake version is 3.0 as suggested in CMakeLists.txt.

[NothinRandom]

Hi @kevross33,

Were you able to resolve this issue via updating CMAKE?

[kevross33]

Hi,

Sorry I have just tried this (cmake was already of version):

cmake --version

cmake version 3.10.2

Using zkg to install it that was fine but when I run zeekctl check the following comes back. This is running on Ubuntu 18.04 (tried on both server and desktop versions)

warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 173 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 174: redefinition requires "redef" (S7comm::error_classes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 181: Duplicate identifier documentation: S7comm::error_classes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 183 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 184: redefinition requires "redef" (S7comm::syntax_ids) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 197: Duplicate identifier documentation: S7comm::syntax_ids warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 199 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 200: redefinition requires "redef" (S7comm::return_codes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 208: Duplicate identifier documentation: S7comm::return_codes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 210 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 211: redefinition requires "redef" (S7comm::error_codes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 417: Duplicate identifier documentation: S7comm::error_codes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 419 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 420: redefinition requires "redef" (S7comm::vartab_areas) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 437: Duplicate identifier documentation: S7comm::vartab_areas warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 1: Discarded extraneous Zeekygen comment: Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 1: Discarded extraneous Zeekygen comment: SPDX-License-Identifier: BSD-3-Clause error in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 12: identifier or enumerator value in enumerated type definition already exists error in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 13: identifier or enumerator value in enumerated type definition already exists error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 23: already defined (S7comm::log_iso_cotp) error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 35: already defined (S7comm::log_s7comm) error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 43 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 44: already defined (S7comm::ports) fatal error in /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, lines 13-16: BroType::AsEnumType (error/enum) (error)

[NothinRandom]

@kevross33, hmm... this is strange because I've built this plugin and a few others throughout this week without seeing these warnings/errors.

Could you provide the following info: 1) Which Zeek version? 3) Which ZKG version? 2) What's your build command

This is what I use inside dockerfile:

RUN zkg install --force \
   zeek/amzn/zeek-plugin-bacnet \
   zeek/amzn/zeek-plugin-enip \
   zeek/amzn/zeek-plugin-profinet \
   zeek/amzn/zeek-plugin-s7comm \
   zeek/amzn/zeek-plugin-tds

Outside of docker, you should just need to remove the RUN statement

[kevross33]

Hi,

1) zeek version 3.0.1 2) zkg-2.1.2 3) # zkg install --force zeek/amzn/zeek-plugin-s7comm Installing "zeek/amzn/zeek-plugin-s7comm"............... Installed "zeek/amzn/zeek-plugin-s7comm" (master) Loaded "zeek/amzn/zeek-plugin-s7comm"

Then when I do zeekctl check it throws the previously provided errors.

[NothinRandom]

@kevross33, I'll build the specified zeek version and try to reproduce this issue. Meanwhile, have you tried newer Zeek releases? I think we're at 3.1.4 right now. This would certainly help me eliminate some issues. Thanks

[kevross33]

OK I will upgrade and try this to see if it is something in the version. Thanks.

[kevross33]

Hi,

Still no luck i'm afraid

zeek -v

zeek version 3.1.4

r# zkg install zeek/amzn/zeek-plugin-s7comm The following packages will be INSTALLED: zeek/amzn/zeek-plugin-s7comm (master)

Proceed? [Y/n] y Installing "zeek/amzn/zeek-plugin-s7comm"............. Installed "zeek/amzn/zeek-plugin-s7comm" (master) Loaded "zeek/amzn/zeek-plugin-s7comm"

warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 146 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 147: redefinition requires "redef" (S7comm::user_data_block_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 150: Duplicate identifier documentation: S7comm::user_data_block_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 152 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 153: redefinition requires "redef" (S7comm::user_data_sec_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 154: Duplicate identifier documentation: S7comm::user_data_sec_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 156 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 157: redefinition requires "redef" (S7comm::user_data_time_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 161: Duplicate identifier documentation: S7comm::user_data_time_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 163 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 164: redefinition requires "redef" (S7comm::user_data_cpu_subfunctions) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 171: Duplicate identifier documentation: S7comm::user_data_cpu_subfunctions warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 173 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 174: redefinition requires "redef" (S7comm::error_classes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 181: Duplicate identifier documentation: S7comm::error_classes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 183 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 184: redefinition requires "redef" (S7comm::syntax_ids) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 197: Duplicate identifier documentation: S7comm::syntax_ids warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 199 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 200: redefinition requires "redef" (S7comm::return_codes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 208: Duplicate identifier documentation: S7comm::return_codes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 210 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 211: redefinition requires "redef" (S7comm::error_codes) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 417: Duplicate identifier documentation: S7comm::error_codes warning in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./consts.zeek, line 419 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 420: redefinition requires "redef" (S7comm::vartab_areas) warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./consts.zeek, line 437: Duplicate identifier documentation: S7comm::vartab_areas warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 1: Discarded extraneous Zeekygen comment: Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. warning in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 1: Discarded extraneous Zeekygen comment: SPDX-License-Identifier: BSD-3-Clause error in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 12: identifier or enumerator value in enumerated type definition already exists error in /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 13: identifier or enumerator value in enumerated type definition already exists error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 23: already defined (S7comm::log_iso_cotp) error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 35: already defined (S7comm::log_s7comm) error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 43 and /usr/local/zeek/share/zeek/site/./packages/./zeek-plugin-s7comm/./main.zeek, line 44: already defined (S7comm::ports) fatal error in /usr/local/zeek/share/zeek/base/frameworks/logging/./main.zeek, lines 13-18: BroType::AsEnumType (error/enum) (error)

[kevross33]

Here is my installed packages too

zkg list all | grep install

zeek/j-gras/zeek-af_packet-plugin (installed: 2.0.0) - This plugin provides native AF_Packet support for Zeek. zeek/lexibrent/zeek-EternalSafety (installed: master) - EternalSafety is a Zeek/Bro package for detecting potentially-dangerous SMBv1 protocol violations that encapsulate bugs exploited by the infamous Eternal* family of Windows exploits. zeek/micrictor/smbfp (installed: master) - A package to create a fingerprint of SMB clients zeek/micrictor/spl-spt (installed: master) - A package that creates a log for sequences of packet lengths and times, allowing for new analytics based on these data features. zeek/mitre-attack/bzar (installed: master) - BZAR - Bro/Zeek ATT&CK-based Analytics and Reporting. zeek/salesforce/hassh (installed: master) - HASSH is used to identify specific Client and Server SSH implementations. zeek/salesforce/ja3 (installed: master) - JA3 creates 32 character SSL client fingerprints and logs them as a field in ssl.log.

[NothinRandom]

@kevross33, looking through these errors, I have a suspicion that maybe there exists different versions of the plugins. Example error:

error in /usr/local/zeek/lib/zeek/plugins/packages/zeek-plugin-s7comm/scripts/./main.zeek, line 35: already defined (S7comm::log_s7comm)

Send me a message using my username at gmail. I'll set up a session to see if I could help you troubleshoot this issue.

[voteblake]

Thanks for reporting, this should now be fixed by #3