Bro on macos, magic bug

Zeek
#1

Hello,

I’m trying to use bro 2.2 on Mac (10.9.2) with macports

but when I try to parse a pcap, I got magic errors:

$ bro -r

/opt/local/share/bro/magic/animation, 193: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/animation, 195: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/animation, 197: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/animation, 199: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/animation, 201: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/animation, 203: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/animation, 205: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/animation, 208: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/archive, 45: Warning: Current entry does not yet have a description for adding a MIME type
/opt/local/share/bro/magic/cafebabe, 19: Warning: Current entry does not yet have a description for adding a MIME type
internal error: can’t load magic file /opt/local/share/bro/magic: could not find any valid magic files!
<<<

Those files are from bro, while macports’ libmagic (5.18) has /opt/local/share/misc/magic.mgc

same if I do
MAGIC=/opt/local/share/misc/magic.mgc bro -r

as suggested on http://comments.gmane.org/gmane.comp.security.detection.bro/6225

Improvement with https://bro-tracker.atlassian.net/browse/BIT-1143.

I gave a try to github head and it works as expected, probably because of above change.

So is a fix is expected for 2.2 or 2.3 is sufficiently near release?

Thanks

Julien

#2

internal error: can't load magic file /opt/local/share/bro/magic: could not find any valid magic files!
<<<

Those files are from bro, while macports' libmagic (5.18) has /opt/local/share/misc/magic.mgc

same if I do
MAGIC=/opt/local/share/misc/magic.mgc bro -r <pcapfile>

Try also `BROMAGIC=/opt/local/share/misc/magic.mgc MAGIC=/opt/local/share/misc/magic.mgc bro -r <pcapfile>`.

So is a fix is expected for 2.2 or 2.3 is sufficiently near release?

No 2.2 changes are planned and the 2.3 (beta) isn’t dated, you’ll have to infer from https://bro-tracker.atlassian.net/issues/?filter=10001

- Jon

#3

Try also `BROMAGIC=/opt/local/share/misc/magic.mgc
MAGIC=/opt/local/share/misc/magic.mgc bro -r <pcapfile>`.

yes with BROMAGIC, it's working. without environment or only MAGIC, only
warnings and no output.

> So is a fix is expected for 2.2 or 2.3 is sufficiently near release?

No 2.2 changes are planned and the 2.3 (beta) isn’t dated, you’ll have to
infer from https://bro-tracker.atlassian.net/issues/?filter=10001

ok.

Thanks a lot!
Cheers,

Julien

#4