# spicy docker image - type parsing oddity

**URL:** <https://community.zeek.org/t/spicy-docker-image-type-parsing-oddity/3894>\
**Category:** Zeek\
**Created:** [November 6, 2015, 4:10am UTC](https://community.zeek.org/t/spicy-docker-image-type-parsing-oddity/3894 "2015-11-06T04:10:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Troy\_Jordan](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@Troy\_Jordan](https://community.zeek.org/u/Troy_Jordan)\
**Post date:** [November 6, 2015, 4:10am UTC](https://community.zeek.org/t/spicy-docker-image-type-parsing-oddity/3894/1 "2015-11-06T04:10:54Z")

</div>

Hello,

I'm uncertain if I've run into an issue peculiar to the spicy docker  
image (which should be the latest - 247ea5070b15), or if this is syntax  
problem.

In a basic modbus parser (attached : .pac2, .evt, .bro and modbus trace  
file) , the Message definition throws an error when executing as:

root# bro -r modbus\_part1.3.pcap modbus.evt modbus.bro

> > > struct.set \_\_self "data" ref\<MODBUS::DinputsPdu\>()

\<no location\>:: error, operand type ref\<MODBUS::DinputsPdu\> is not  
compatible with type ref\<MODBUS::CoilsPdu\> [pass::hilti::Validator]

However, ALT Message definition works fine. In fact, if I parse the  
data field with the same type (ie both with type CoilsPdu or both with  
type DinputsPdu) it works, which is puzzling.

The idea is to parse different modbus function codes as different types  
to enable raising type-specific events.

Any insights appreciated.

- Troy

[modbus-parse-fail.tar](https://community.zeek.org/uploads/short-url/1a07isaNDTiKA6JomrpP8BwNPM4.tar) (10 KB)

---

<div class="post-metadata">

**Author:** ![Troy\_Jordan](https://avatars.discourse-cdn.com/v4/letter/t/ecae2f/32.png) [@Troy\_Jordan](https://community.zeek.org/u/Troy_Jordan)\
**Post date:** [November 6, 2015, 8:39pm UTC](https://community.zeek.org/t/spicy-docker-image-type-parsing-oddity/3894/2 "2015-11-06T20:39:35Z")

</div>

So, this is easy to fix. I figured out that once a field name gets  
typed, it can only appear again with the same type. Makes perfect sense.

So this snippet would work:

switch ( self.fcode ) {  
&nbsp;&nbsp;&nbsp;&nbsp;b"0x01" -\> data1: CoilPDU;  
&nbsp;&nbsp;&nbsp;&nbsp;b"0x03" -\> data2: HregisterPDU;  
&nbsp;&nbsp;&nbsp;&nbsp;}

and so would this:

switch ( self.fcode ) {  
&nbsp;&nbsp;&nbsp;&nbsp;b"0x01" -\> data1: CoilPDU;  
&nbsp;&nbsp;&nbsp;&nbsp;b"0x03" -\> data1: CoilPDU;  
&nbsp;&nbsp;&nbsp;&nbsp;}

but not this one which reuses the 'data' fieldname but with different types:

switch ( self.fcode ) {  
&nbsp;&nbsp;&nbsp;&nbsp;b"0x01" -\> data: CoilPDU;  
&nbsp;&nbsp;&nbsp;&nbsp;b"0x03" -\> data: HregisterPDU;  
&nbsp;&nbsp;&nbsp;&nbsp;}

- Troy

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [November 6, 2015, 9:23pm UTC](https://community.zeek.org/t/spicy-docker-image-type-parsing-oddity/3894/3 "2015-11-06T21:23:17Z")

</div>

Yeah, exactly. That's something the compiler should catch and give you  
a decent error message for but validation is still a weak spot of  
Spicy.

Robin

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/spicy-docker-image-type-parsing-oddity/3894/4 "2022-05-06T15:43:12Z")

</div>