Install fails with ZKG 2.12.0 (Zeek 4.2.0)

[saintorphan]

🐛 Summary

I've been unable to get this to compile in our dev environment, both with ZKG and manually.
Upon investigation, it appears that ZeekPlugin.cmake is calling ZeekPluginBootstrap.cmake, which does not exist in CMake's repo, or anywhere on the internet for that matter. This is probably me doing something wrong here. Any insight is appreciated.
Notes:
I no longer get the ZeekPluginBootstrap error after moving the Zeek Devel .cmake files into place, but cmake can't seem to find them even in the cmake/Modules directory.

To reproduce

1. zkg install icsnpp-enip
   (That didn't work, so tried manual installation)
2. ./configure

Expected behavior

I expected ZKG to compile the plugin, and/or be able to compile the plugin at all.
zeek version 4.2.0
zkg 2.12.0
cmake version 3.26.5
cc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-21.0.1)
c++ (GCC) 8.5.0 20210514 (Red Hat 8.5.0-21.0.1)
gcc (GCC) 8.5.0 20210514 (Red Hat 8.5.0-21.0.1)
g++ (GCC) 8.5.0 20210514 (Red Hat 8.5.0-21.0.1)

Paste the results here:

ZKG INSTALL

[root@sensor-001 ~]# zkg install icsnpp-enip
The following packages will be INSTALLED:
zeek/cisagov/icsnpp-enip (main)

Proceed? [Y/n] Y
Running unit tests for "zeek/cisagov/icsnpp-enip"
error: failed to run tests for zeek/cisagov/icsnpp-enip: package build_command failed, see log in /usr/var/lib/zkg/logs/icsnpp-enip-build.log
Proceed to install anyway? [N/y] Y
Installing "zeek/cisagov/icsnpp-enip"..
Failed installing "zeek/cisagov/icsnpp-enip": package build_command failed, see log in /usr/var/lib/zkg/logs/icsnpp-enip-build.log
error: incomplete installation, the follow packages failed to be installed:
zeek/cisagov/icsnpp-enip (main)

BUILD LOG

=== STDOUT ===
Build Directory : build
Zeek Source Directory :
-- The C compiler identification is GNU 8.5.0
-- The CXX compiler identification is GNU 8.5.0
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/cc - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Check for working CXX compiler: /usr/bin/c++ - skipped
-- Detecting CXX compile features
-- Detecting CXX compile features - done
-- Configuring incomplete, errors occurred!

MANUAL ATTEMPT

[root@sensor-001 icsnpp-enip]# ./configure
Build Directory : build
Zeek Source Directory :
CMake Error at /usr/share/cmake/Modules/ZeekPlugin.cmake:27 (find_package):
Could not find a package configuration file provided by "Zeek" with any of
the following names:

ZeekConfig.cmake
zeek-config.cmake

Add the installation prefix of "Zeek" to CMAKE_PREFIX_PATH or set
"Zeek_DIR" to a directory containing one of the above files. If "Zeek"
provides a separate development package or SDK, be sure it has been
installed.
Call Stack (most recent call first):
/usr/share/cmake/Modules/ZeekPlugin.cmake:68 (zeek_plugin_bootstrapping)
CMakeLists.txt:5 (include)

[saintorphan]

Upgrading to latest LTS of Zeek and trying again - hoping that's all that is wrong

[mmguero]

My guess is we just aren't (despite what zkg.meta says) supporting the old version of Zeek, I think that running a modern Zeek will resolve the issue.

[saintorphan]

After upgrading, it shows up in zeek -N, and I can generate logs manually by feeding it the .pcap file with zeek -Cr and specifying icsnpp/enip.
Why though when running in daemon mode can't it see CIP traffic and generate logs on it's own? Is there a way to verify/ensure that the plugin is running? Other Zeek plugins seem to work fine in daemon mode.

[jjrush]

@saintorphan

Overview

I was able to use zeekctl to spin up zeek as a process and use tcpreplay to successfully process ENIP/CIP traffic. I used the single pcap provided in this repo in tests/traces/.
Note that my zeek is installed in /opt/zeek but you can find your's by running zeek-config --prefix in case it wasn't installed in the same place.
Also you can verify what plugins are enabled by running
zeekctl diag | grep -A1 "Zeek plugins:"
Simply adjust -A# where # is the number of lines you want to display after "Zeek plugins:". If you don't get any hits that's a problem.

rush@cyber-dev:/opt/zeek$ zeekctl diag | grep -A1 "Zeek plugins:"
Zeek plugins:
ICSNPP::ENIP - Ethernet/IP and CIP Protocol analyzer for TCP/UDP (dynamic, version 1.3.0)

local.zeek (/opt/zeek/share/zeek/site/)

@load packages

I only have @load packages that way I make sure to load my zkg install'd packages (like icsnpp-enip). Everything else I commented out. You can also check to make sure you have your packages installed by grepping zeek -NN | grep ENIP

rush@cyber-dev:/opt/zeek$ zeek -NN | grep ENIP
ICSNPP::ENIP - Ethernet/IP and CIP Protocol analyzer for TCP/UDP (dynamic, version 1.3.0)
    [Analyzer] ENIP_TCP (ANALYZER_ENIP_TCP, enabled)
    [Analyzer] ENIP_UDP (ANALYZER_ENIP_UDP, enabled)

node.cfg (in /opt/zeek/etc/node.cfg)

[zeek]
type=standalone
host=localhost
interface=enp0s31f6

This is my barebones node setup for this testing.

Steps to reproduce

Note that I put an extra space between commands to make it easier to see everything

# remove any existing logs
rush@cyber-dev:~/test$ sudo rm /opt/zeek/logs/current/*
# verify they are gone
rush@cyber-dev:~/test$ ls /opt/zeek/logs/current

# stop any running zeek process
rush@cyber-dev:~/test$ sudo /opt/zeek/bin/zeekctl stop
stopping zeek ...

# launch zeek as daemon based on node.cfg and local.zeek (loads packages like icsnpp-enip)
rush@cyber-dev:~/test$ sudo /opt/zeek/bin/zeekctl deploy
checking configurations ...
installing ...
removing old policies in /opt/zeek/spool/installed-scripts-do-not-touch/site ...
removing old policies in /opt/zeek/spool/installed-scripts-do-not-touch/auto ...
creating policy directories ...
installing site policies ...
generating standalone-layout.zeek ...
generating local-networks.zeek ...
generating zeekctl-config.zeek ...
generating zeekctl-config.sh ...
stopping ...
stopping zeek ...
starting ...
starting zeek ...

# make sure daemon is running
rush@cyber-dev:~/test$ sudo /opt/zeek/bin/zeekctl status
Name         Type       Host          Status    Pid    Started
zeek         standalone localhost     running   155556 24 Jun 15:04:20

# replay traffic to the interface specified in node.cfg
rush@cyber-dev:~/test$ sudo tcpreplay --topspeed -vi enp0s31f6 ../work/parsers/icsnpp-enip/tests/traces/enip_cip_example.pcap 
reading from file -, link-type EN10MB (Ethernet), snapshot length 262144
17:29:08.1224804548 IP 192.168.10.105.3033 > 192.168.10.120.44818: Flags [.], ack 2381756312, win 65264, length 0
17:29:09.1224804549 IP 192.168.10.105.3033 > 192.168.10.120.44818: Flags [P.], seq 0:210, ack 1, win 65264, length 210
...
yada yada
...
Actual: 776 packets (81449 bytes) sent in 0.027782 seconds
Rated: 2931718.3 Bps, 23.45 Mbps, 27931.75 pps
Flows: 9 flows, 323.95 fps, 770 unique flow packets, 6 unique non-flow packets
Statistics for network device: enp0s31f6
	Successful packets:        776
	Failed packets:            0
	Truncated packets:         0
	Retried packets (ENOBUFS): 0
	Retried packets (EAGAIN):  0

# check for logs
rush@cyber-dev:~/test$ ls /opt/zeek/logs/current
 cip_identity.log   conn.log   enip.log   loaded_scripts.log   reporter.log   stdout.log
 cip_io.log         dns.log    http.log   packet_filter.log    stderr.log     weird.log

I was able to verify the plugin was installed, the daemon is running, and that traffic was processed by the daemon with tcpreplay. I believe that satisfies problem.