Error loading scripts in Bro

[monkykap]

Bro Version: 2.5.1

I receive the following error when checking scripts:

[BroControl] > deploy checking configurations ... bro scripts failed. error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 66: orphaned field "client_version" in record coercion ((coerce (coerce [] to JA3::TLSFPStorage) to TLSFP::TLSFPStorage)) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 83: orphaned field "client_version" in record coercion ((coerce (coerce [] to JA3::TLSFPStorage) to TLSFP::TLSFPStorage)) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 102: orphaned field "client_version" in record coercion ((coerce (coerce [] to JA3::TLSFPStorage) to TLSFP::TLSFPStorage)) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 121: orphaned field "client_version" in record coercion ((coerce (coerce [] to JA3::TLSFPStorage) to TLSFP::TLSFPStorage)) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 122: no such field in record (JA3::c$tlsfp$client_version) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 127: no such field in record (JA3::c$tlsfp$client_ciphers) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 128: no such field in record (JA3::c$tlsfp$client_ciphers) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 131: no such field in record (JA3::c$tlsfp$client_ciphers) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 135: no such field in record (JA3::c$tlsfp$client_version) error in /opt/bro/share/bro/site/./ja3/./ja3.bro, line 135: no such field in record (JA3::c$tlsfp$client_ciphers)

Not sure if i am missing a step. I tried loading the scripts from two different locations custom and site.

[jalthouse-sfdc]

Drop your version of the script into http://try.bro.org/ and test it against "exercise_traffic.pcap" and send me the URL. I'll take a look.

[monkykap]

Hmm... seems to work in try bro: http://try.bro.org/#/trybro/saved/209079

[jalthouse-sfdc]

Maybe it was the way the script was copied over. Try removing the script and references to it and then install it using 'bro-pkg install ja3'

[jatkinson-sfdc]

monkykap - Just worked through this with another user. There are 2 modules, JA3 & TLSFP, which are defining the TLSFPStorage record.

Example of a bro-package that Security Onion may load up that conflicts with this repo.
https://github.com/fatemabw/bro-inventory-scripts/blob/master/scripts/tls_fingerprinting.bro

You'll want to review the scripts that you are loading and verify where TLSFPStorage is being defined.