Zeek broker and spicy script not working in 6.1.1

Zeek
1

Hi,
I have installed latest zeek 6.1.1 ( spicyc 1.9.0 and spicyz 6.1.1 ) release. I am facing issue publishing data over broker for spicy script. The same script is working fine in both zeek 6.0.0 ( spicyz 6.0.0 , spicyc 1.8.1) and zeek 6.2.0-dev.147 ( spicyz version 6.2.0-dev.147 , spicyc version v1.9.0-dev.157 ). I have compiled iec104 and installed iec104.hlto and published over the broker and received in another end point ( did the same thing for 6.0.0, 6.1.1 and 6.2.0-dev.147). Strange thing is that zeek script without using spicy is working fine with the broker in 6.1.1 but not the spicy script which is running fine in other two zeek versions. It seems there is some issue with this spicy version ?

Thanks
Biswa

2

Spicy knows nothing about Broker so your issue is elsewhere, but it is impossible to tell where from the information you have shared. If you would share a minimal example we might be able to help you, see e.g., here for how to create a good example.

Please invest your time to reduce your example as much as possible and do not share your full code like in other questions. This increases the chances of you getting the help you are looking for by a lot.

FTR, a previous discussion was Packet processing doubt in spicy parser and zeek broker.

3

Hi @Benjamin_Bannier ,
I am doing the exact same thing with other zeek version, but getting published message in another python end point subscriber.
I am using georgemakrakis/zeek-iec104: A Zeek Parser for the IEC 104 protcol built using Spicy. (github.com) for this test. Just added 3 steps as below

step 1: ip, port for connecting peer.
event zeek_init() &priority=5
{
suspend_processing();
Broker::peer(addr_to_uri(127.0.0.1), 50003/tcp);
.....
}

Step 2: Started processing once peer is connected …

event Broker::peer_added(ep: Broker::EndpointInfo, msg: string)
{
print "PEER ADDED", ep;
continue_processing();

}
Step 3: publishing message from an event

event iec104::apci ()
{
....
Broker::publish("/topic/iec104", iec_parsed, c);
....
}

and just receiving message in another python script
self.ep = broker.Endpoint()
self.sub = self.ep.make_subscriber("/topic/iec104")
self.ss = self.ep.make_status_subscriber(True)
self.ep.listen("127.0.0.1", 50003)
.....
once connected dump the message

The same scripts are running fine with other zeek versions.

Is there any native zeek spicy parser and broker script which I can try with 6.1.1, to confirm?

Please let me know if you need any other input to give feedback to this problem.
Thanks
Biswa

4

It is still not clear to me what issue you are running into. I tried the following:

event zeek_init() &priority=5
	{
	suspend_processing();
	Broker::peer(addr_to_uri(127.0.0.1), 50003/tcp);
	}

event Broker::peer_added(ep: Broker::EndpointInfo, msg: string)
	{
	print "PEER ADDED", ep;
	continue_processing();
	}

# No need for the IEC104 package, any triggered event should work.
event connection_established(c: connection)
	{
	print "PUBLISHING";
	Broker::publish("/topic/test", connection_established, c);
	}

#!/usr/bin/env python3

import broker

ep = broker.Endpoint()
sub = ep.make_subscriber("/topic/test")
ss = ep.make_status_subscriber(True)
ep.listen("127.0.0.1", 50003)

print(sub.get())

I first started the Python script, and then run Zeek against a PCAP containing connections so connection_established is triggered. The Python script receives a value both with zeek-6.0.0 and zeek-6.1.1.

5

Hi @Benjamin_Bannier ,
As I told in my first message that normal zeek scripts using broker framework were working but not spicy scripts. That’s why I referred the iec104. It’s a spicy parser, so what I assumed is that there might be some issue in sending parsed iec104 data over the broker that is coming from spicy parser. But, I might be wrong here. I will test in another machine setting up zeek 6.1.1 and let you know.

Thanks
Biswa