[Zeek-Dev] Re: netmap 2.0.0 vs. zeek 4.0.0

2021-03-16 Thread Christian Kreibich
Btw, there's work underway to simplify building external plugins directly into Zeek: https://github.com/zeek/zeek/pull/1416 That might be another option in the not-too-distant future. Best, Christian ___ zeek-dev mailing list -- zeek-dev@lists.zeek.or

[Zeek-Dev] Re: netmap 2.0.0 vs. zeek 4.0.0

2021-03-16 Thread Christian Kreibich
On 3/16/21 2:10 PM, Craig Leres wrote: It's easy enough to put zeek-config on PATH but it doesn't work because it is configured/built to install in /usr/local but during the packaging process it's actually installed in /wrkdirs/usr/ports/security/zeek/work/stage/usr/local. This causes zeek-config

[Zeek-Dev] Re: netmap 2.0.0 vs. zeek 4.0.0

2021-03-16 Thread Christian Kreibich
Hey Craig, It's been a while! :) On 3/16/21 10:54 AM, Craig Leres wrote: Due to the way FreeBSD packages are built at this point zeek is installed but in /wrkdirs/usr/ports/security/zeek/work/stage/usr/local, not /usr/local. As long as the configure/build process is able to find zeek-config,

[Zeek-Dev] Re: Proposed change to lambda semantics - shallow copying rather than references

2020-12-11 Thread Christian Kreibich
On 12/11/20 1:47 AM, Robin Sommer wrote: Sounds like a way forward then to both address the current concern, and improve this overall. Does this work for everybody? Yes for me, just one comment: I'm a bit nervous about getting too inspired by C++ syntax. With every new standard round it's look

[Zeek-Dev] Re: Proposed change to lambda semantics - shallow copying rather than references

2020-12-09 Thread Christian Kreibich
some guy in 2005: - The manual has been updated to clarify that aggregate values in events are passed as shallow copies, so that modifications to elements of the values after posting the event but before it's handled will be visible to the handlers for the events (Christian K

[Zeek-Dev] Re: Proposed change to lambda semantics - shallow copying rather than references

2020-12-09 Thread Christian Kreibich
On 12/9/20 11:10 AM, Vern Paxson wrote: For the script optimization/compilation work I’ve been doing, I’ve been looking into what it will take to compile lambdas (anonymous functions). I think the current functionality would be better, since it's how I'd expect it to behave (which probably jus

[Zeek-Dev] Re: [Zeek-Def] Re: Platform support policy

2020-11-09 Thread Christian Kreibich
On 11/9/20 1:41 AM, Robin Sommer wrote: Yeah, agree, that sounds better than maintaining the information separately. Cool. I've updated the wiki page to refer to our CI configs for the details. I'm definitely not the expert here but it all looks like Catalina with varying additions: Yeah, I

[Zeek-Dev] Re: [Zeek-Def] Re: Platform support policy

2020-11-06 Thread Christian Kreibich
On 11/6/20 2:03 AM, Robin Sommer wrote: - Which of these come with additional requirements beyond just OS base packages? We should note those. What I can think of: - CentOS: We require devtoolset (which version?) and probably EPEL? I don't recall how people get some of the depende

[Zeek-Dev] Re: Platform support policy

2020-11-05 Thread Christian Kreibich
On 11/5/20 8:51 PM, Christian Kreibich wrote: I'm putting together a PR (still a draft) for bringing our CI in line with what's in that page: Ahem -- that was supposed to be: https://github.com/zeek/zeek/pull/1268/ Best, Christian __

[Zeek-Dev] Re: Platform support policy

2020-11-05 Thread Christian Kreibich
Hi folks, Sorry for the delay here -- I've now put together a page: https://github.com/zeek/zeek/wiki/Platform-Support-Policy I've also added an entry to the calendar for macOS (Catalina, using the availability of images in Cirrus CI as a driver), and I'm putting together a PR (still a draft)

[Zeek-Dev] Re: Platform support policy

2020-10-22 Thread Christian Kreibich
On 10/22/20 1:40 AM, Robin Sommer wrote: Want to start a Wiki page where we collect the pieces for our new policy? Can link to those calendars from there. Sure thing. I agree with your remaining comments, too. Best, Christian ___ zeek-dev mailing lis

[Zeek-Dev] Re: Platform support policy

2020-10-21 Thread Christian Kreibich
On 10/7/20 12:37 AM, Robin Sommer wrote: Yes, that would be great. Okay, I've put one together: https://bit.ly/zeek-os-calendar-ical https://bit.ly/zeek-os-calendar-google This includes CentOS, Debian, Fedora, FreeBSD, and Ubuntu. I tried a few things and landed on one entry per release that

[Zeek-Dev] Re: Platform support policy

2020-10-06 Thread Christian Kreibich
On 10/5/20 4:08 AM, Robin Sommer wrote: The advantage of this is that we won’t rely on having to specify specific compiler versions, which isn’t well-defined (because things also depend on libstdc++ version, system libs, etc.), but instead on whether people can actually compile Zeek on the platfo

[Zeek-Dev] Re: Unit tests in plugins?

2020-09-09 Thread Christian Kreibich
On 9/9/20 9:56 AM, Seth Hall wrote: Has anyone put any thought to how we could create and run unit tests in Zeek plugins? I don't think any work has been done on that yet, but I'd love to be able to create unit tests in plugins. Yeah I've tinkered a bit with this. I was able to get a unit test

[Zeek-Dev] Re: Moving policy scripts into packages

2020-08-31 Thread Christian Kreibich
Great summary, thanks Robin. On 8/31/20 2:14 AM, Robin Sommer wrote: - zkg: - Could we add a way to "prime" zkg's package cache so that a Zeek distribution could distribute a snapshot of "zeek-packages" for direct use; but zkg would still pull in updates if online acces

[Zeek-Dev] Re: Moving policy scripts into packages

2020-08-25 Thread Christian Kreibich
On 8/25/20 1:27 AM, Jan Grashöfer wrote: I think the underlying issue extends to the pcaps as well. If I am not mistaken, a significant number of test cases make use of the same pcaps. Having multiple copies of them scattered across different repositories doesn't feel right. Good point, yeah. I

[Zeek-Dev] Re: Moving policy scripts into packages

2020-08-24 Thread Christian Kreibich
On 8/24/20 11:49 AM, Johanna Amann via zeek-dev wrote: * Testing: Currently, some of the policy scripts have tests that use Zeek functionality in rather unique ways / or are the only tests for some Zeek functionality. The SSL validation scripts are one example. This, from my point o

[Zeek-Dev] Re: Moving policy scripts into packages

2020-08-24 Thread Christian Kreibich
On 8/24/20 9:51 AM, Robin Sommer wrote: Also, one additional thought: Jon reminded me that zkg can manage dependencies already. So the "collection" I mentioned could be a meta-package that depends on all the ones we want. Yeah, agreed -- I prefer #2 for the same reason. Best, Christian ___