Bro v1.4.0 smtp_port Erreur de segmentation

Zeek
1

Hi,
When I start `./bro140ipv6 bro.init mt` I have this error:
  policy/snort.bro, line 28 and
  policy/smtp.bro, line 115
    (smtp_ports): error, already defined
  policy/smtp.bro, line 116 ($ports=smtp_ports): run-time error, uninitialized list value
  Erreur de segmentation

policy/mt.bro:
  @load alarm
  @load dns-lookup
  @load snort
  @load smtp

policy/snort.bro:
  28: const smtp_ports = { 25/tcp };
policy/smtp.bro: (original, not modified)
  115: global smtp_ports = { 25/tcp, 587/tcp } &redef;

Im understand than why bro error, but fix segmentation error please ?

Regards
Rmkml
Crusoe-Researches.com

2

When I start `./bro140ipv6 bro.init mt` I have this error:
policy/snort.bro, line 28 and

snort.bro in the 1.4 release only has 21 lines.

Erreur de segmentation

I don't see this behavior but because your error mentions line 28 in the snort.bro script I believe you may have some other problem going on.

Im understand than why bro error, but fix segmentation error please ?

It would be helpful if you provided a backtrace with your report.

Thanks,
   .Seth

3

Hi Seth,
I have restored snort.bro and added this line:
   22: const smtp_ports = { 25/tcp };
same pb, how create backtrace please ?
Regards
Rmkml
Crusoe-Researches.com

4

Hi Seth,
I have restored snort.bro and added this line:
  22: const smtp_ports = { 25/tcp };

Ok, I replicated your crash and added it to the ticket tracker. Here's the most minimal script I could make that replicated the segfault...

global smtp_ports;
const blah = [$ports=smtp_ports];

I think there are two problems occurring here. Causing the problem between the smtp.bro and snort.bro scripts are these two lines...

const smtp_ports = { 25/tcp };
global smtp_ports = { 25/tcp, 587/tcp };

It causes the error message "(smtp_ports): error, already defined". I don't think that execution should continue after the attempted globalizing of the smtp_ports variable. It seems like that should be a terminating error because it should always be caught at initialization time and wouldn't just crop up at arbitrary points during runtime. Anyway, I filed a ticket for this too.

Here are the tickets:
   http://tracker.icir.org/bro/ticket/34
   http://tracker.icir.org/bro/ticket/35

same pb, how create backtrace please ?

Use gdb.

$ gdb ./src/bro
<gdb starts up here>

(gbd) run test-crash.bro
<bro crashes here>

(gdb) bt
<gdb prints backtrace here>

   .Seth