[Bro] Bro Error: fatal error in <no location>: Val::CONVERTER (string/record)

[（peter）]

Hi all,

I add a file named “main.bro”  into the directory /usr/local/bro/share/bro/base/protocols/pop3/. The file’s content is as following:

module POP3;

export {
    redef enum Log::ID += { LOG };

    type Info: record {
        ts:      time     &log;
        src:     addr     &log;
        srcport: port     &log;
        dst:     addr     &log;
        dstport: port     &log;
    };  

    global log_pop: event(rec: Info);
}

redef record connection += {
    pop3:   Info &optional;
};

const ports = { 110/tcp };
redef likely_server_ports += { ports };

event bro_init() &priority=5
{
    Log::create_stream(LOG, [$columns=Info, $ev=log_pop]);
    Analyzer::register_for_ports(Analyzer::ANALYZER_POP3, ports);
}

event pop3_request(c: connection, is_orig: bool, command: string, arg: string) &priority=5
{
    Log::write(LOG, command);
}

And I also modify the file _load_.bro, it’s content is as following:
@load-sigs ./dpd.sig
@load ./main

OK, after the modify, I run the command stop, then start in the broctl, it work ok!

But when I receive mail from pop3 server with my mail client, the bro is crash, and I found the error message in the logs/current/stderr.log:
[root at VPS2 logs]# more current/stderr.log 
listening on em2, capture length 8192 bytes

1397564041.380190 fatal error in <no location>: Val::CONVERTER (string/record) (CAPA)

I don’t know what happened, and what should I do next. Does anyone’s bro support the pop3? Could you tell me how to do it?

Thank you.

-------------
peter
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20140415/0b0f0a15/attachment.html