search

zeek / zeek-af_packet-plugin

Plugin providing native AF_Packet support for Zeek.
Other
33 stars 30 forks source link

Avoid Zeek script double-loading problems #31

Closed ckreibich closed 2 years ago

ckreibich commented 2 years ago

When you install versions of the package >= 3.0, running Zeek with the installed package throws a bunch of warnings:

$ zkg install zeek-af_packet-plugin
The following packages will be INSTALLED:
  zeek/j-gras/zeek-af_packet-plugin (3.0.1)

Proceed? [Y/n]
Running unit tests for "zeek/j-gras/zeek-af_packet-plugin"
Installing "zeek/j-gras/zeek-af_packet-plugin"...
Installed "zeek/j-gras/zeek-af_packet-plugin" (3.0.1)
Loaded "zeek/j-gras/zeek-af_packet-plugin"

$ zeek packages
warning in /home/christian/inst/opt/zeek/lib64/zeek/plugins/packages/zeek-af_packet-plugin/scripts/./init.zeek, line 9 and /home/christian/inst/opt/zeek/share/zeek/site/packages/./zeek-af_packet-plugin/./init.zeek, line 9: redefinition requires "redef" (AF_Packet::buffer_size)
warning in /home/christian/inst/opt/zeek/share/zeek/site/packages/./zeek-af_packet-plugin/./init.zeek, line 9: Duplicate identifier documentation: AF_Packet::buffer_size
warning in /home/christian/inst/opt/zeek/lib64/zeek/plugins/packages/zeek-af_packet-plugin/scripts/./init.zeek, line 11 and /home/christian/inst/opt/zeek/share/zeek/site/packages/./zeek-af_packet-plugin/./init.zeek, line 11: redefinition requires "redef" (AF_Packet::enable_hw_timestamping)
warning in /home/christian/inst/opt/zeek/share/zeek/site/packages/./zeek-af_packet-plugin/./init.zeek, line 11: Duplicate identifier documentation: AF_Packet::enable_hw_timestamping
warning in /home/christian/inst/opt/zeek/lib64/zeek/plugins/packages/zeek-af_packet-plugin/scripts/./init.zeek, line 13 and /home/christian/inst/opt/zeek/share/zeek/site/packages/./zeek-af_packet-plugin/./init.zeek, line 13: redefinition requires "redef" (AF_Packet::enable_fanout)
...

It does actually run, but that's just luck — with more severe script-level clashes it'd bail out. The problem is that the package has an unintentional double-use of the scripts folder: the plugin machinery automatically picks it as its location of Zeek scripts required for the plugin to function, and zkg's packaging also picks it up via the explicit instruction in zkg.meta.

This PR simply moves the package-level stuff to a subdirectory, as a placeholder. That placeholder still avoids the warning that e3aea14a84c505367cd6277c67b6def2f5ea9d5f wanted to fix.

J-Gras commented 2 years ago

Thanks a lot Christian! I missed testing the plugin while loading packages. I reproduced the problem, merged your changes (fixing a small typo in zkg.meta: scripts --> script_dir) and created a new release.

ckreibich commented 2 years ago

That was super fast, thank you Jan! :raised_hands: