"Error: alternate function prototype already exists" for custom event

Zeek
1

Hello everyone,

I am new to Zeek, and this is my first post on this forum.
I am trying to implement a custom plugin for Multicast DNS (mDNS) detection and parsing.
For now, I have only implemented one event, which is supposed to be triggered for every mDNS packet, which is detected with a signature file.
However, when I try to run a simple script in bare mode using this event, I get the following error:

$ zeek -r ../../test.pcap mdns-test.zeek -b
error in /path/to/plugin/mdns/build/lib/bif/./events.bif.zeek, line 17 and ./mdns-test.zeek, line 8: alternate function prototype already exists (event(c:connection;) and record { c:connection; })

I cannot understand where this error comes from, as it seems this error is normally related to functions.
Strangely enough, this error does not appear when Zeek is not run in bare mode.

Here are some related files:

mdns-test.zeek

########## IMPORTS ##########
@load-plugin IoT::mDNS

# START
event zeek_init() {
}

event mdns_event(c: connection)
    {
    print "mDNS event !";
    }

# FINISH
event zeek_done() {
}

dpd.sig

# Signature for Multicast DNS (mDNS) messages
# Generated by binpac_quickstart

signature dpd_mdns {
	
	dst-ip == 224.0.0.251,[ff02::fb]
	src-port == 5353
	dst-port == 5353
	ip-proto == udp

	enable "mDNS"

}

events.bif

## Generated for mDNS connections
##
## See `Google <http://lmgtfy.com/?q=mDNS>`__ for more information about mDNS
##
## c: The connection
##
event mdns_event%(c: connection%);

events.bif.zeek

## Generated for mDNS connections
##
## See `Google <http://lmgtfy.com/?q=mDNS>`__ for more information about mDNS
##
## c: The connection
##
export {
global mdns_event: event(c: connection );

} # end of export section
module GLOBAL;

Don’t hesitate to ask for any other useful files.
Thanks in advance.

2

Hey @fdeekers - welcome.

In non-bare mode, dynamic plugins and supporting scripts (types, bif,…) are loaded early before the scripts from the command line.

There might be some interaction between bare mode and @load-plugin that’s unexpected in that the supporting scripts are only loaded once the file which did @load-plugin was fully processed? (cc @robin)

$ ZEEK_DEBUG_LOG_STDERR=1 ZEEK_PLUGIN_PATH=./build zeek -b -B scripts,plugins ./test.zeek
         0.000000/1659082005.355490 [scripts] Loading ././test.zeek
         0.000000/1659082005.355521 [plugins] Activating plugin Corelight::Test
         0.000000/1659082005.355528 [plugins]   Searching for shared libraries ./build//lib/*.linux-x86_64.so
         0.000000/1659082005.355948 [plugins]   InitializingComponents
         0.000000/1659082005.355959 [plugins]   Loaded ./build//lib/Corelight-Test.linux-x86_64.so
         0.000000/1659082005.355969 [plugins]   Adding ./build/scripts to ZEEKPATH
         0.000000/1659082005.355976 [plugins]   Loading ./build/scripts/__preload__.zeek
         0.000000/1659082005.355983 [plugins]   Loading ./build/lib/bif/__load__.zeek
         0.000000/1659082005.355990 [plugins]   Loading ./build/scripts/__load__.zeek
         0.000000/1659082005.356085 [scripts] AlreadyScanned result (0) /home/awelzel/corelight-oss/test-plugin/scripts/__preload__.zeek
         0.000000/1659082005.356110 [scripts] Loading ././build/scripts/__preload__.zeek
         0.000000/1659082005.356167 [scripts] AlreadyScanned result (0) /home/awelzel/corelight-oss/test-plugin/scripts/types.zeek
         0.000000/1659082005.356191 [scripts] Loading ././build/scripts/./types.zeek
         0.000000/1659082005.356256 [scripts] AlreadyScanned result (0) /home/awelzel/corelight-oss/test-plugin/build/lib/bif/__load__.zeek
         0.000000/1659082005.356302 [scripts] Loading ././build/lib/bif/__load__.zeek
         0.000000/1659082005.356345 [scripts] AlreadyScanned result (0) /home/awelzel/corelight-oss/test-plugin/build/lib/bif/test.bif.zeek
         0.000000/1659082005.356363 [scripts] Loading ././build/lib/bif/./test.bif.zeek
         0.000000/1659082005.356458 [scripts] AlreadyScanned result (0) /home/awelzel/corelight-oss/test-plugin/build/lib/bif/events.bif.zeek
         0.000000/1659082005.356479 [scripts] Loading ././build/lib/bif/./events.bif.zeek
error in ././build/lib/bif/./events.bif.zeek, line 10 and ././test.zeek, line 3: alternate function prototype already exists (event(c:connection;) and record { c:connection; })

If one splits load-plugin and event usage into two files, the error goes away.

$ cat test-load.zeek 
@load-plugin Corelight::Test
$ cat test-use.zeek 
event mdns_event(c:connection) { }
$ ZEEK_DEBUG_LOG_STDERR=1 ZEEK_PLUGIN_PATH=./build zeek -b ./test-load.zeek ./test-use.zeek

@fdekeers - depending on input from others, this may be worth an issue on Github.

Edit: Instead of splitting into two files, you can also run in bare-mode and put the plugin name on the command-line as a work-around: zeek -b IoT::mDNS ./test.zeek.

Thanks!

3

Hi,
Indeed, the error disappeared when putting the name of the module in the command line.
Thanks a lot for your quick answer !

4

Yeah, this difference between command line and @load-plugin does seem surprising. Worth a ticket I’d say.

5

For reference: @load-plugin in bare-mode not loading all lib/bif/*.zeek files · Issue #2311 · zeek/zeek · GitHub