[Bro] Bro 2.6.1 release

[James Lay]

On 2018-12-19 13:35, Mike Dopheide wrote:
> Installing a bro-pkg that is a plugin does rebuild it.  They aren't
> distributed as binaries.
> 
> -Dop

Ah....I did not know that.  So in the future for folks (I've already git 
cloned and compiled) a bro-pkg remove/bro-pkg install does the 
trick...good to know thank you.

James

> 
> On Wed, Dec 19, 2018 at 2:32 PM James Lay <jlay at slave-tothe-box.net>
> wrote:
> 
>> On 2018-12-19 13:06, Michael Shirk wrote:
>>> You need to rebuild the package/plugin, I think this was just
>> added to
>>> the zeek package manager...or will be soon
>>> 
>>> On Wed, Dec 19, 2018 at 2:58 PM James Lay
>> <jlay at slave-tothe-box.net>
>>> wrote:
>>>> 
>>>> On 2018-12-19 11:24, Jon Siwek wrote:
>>>>> Bro v2.6.1 is available for download:
>>>>> 
>>>>>     https://www.zeek.org/download/index.html
>>>>>     https://www.zeek.org/downloads/bro-2.6.1.tar.gz
>>>>> 
>>>>> This release updates the embedded SQLite to version 3.26.0 to
>>>>> address the "Magellan" remote code execution vulnerability.
>> The
>>>>> stock Bro configuration/scripts don't use SQLite by default,
>> but
>>>>> custom user scripts/packages may.
>>>>> 
>>>>> This release also updates Broker to v1.1.2, which includes a
>>>>> minor bug fix in its Python bindings and improved support for
>>>>> building it as a static library.
>>>> 
>>>> And the first casualty:
>>>> 
>>>> bro-af_packet-plugin
>>>> 
>>>> fatal error in /usr/local/bro/share/bro/base/init-bare.bro, line
>> 1:
>>>> cannot load plugin library
>>>> 
>> 
> /usr/local/bro/lib/bro/plugins/packages/bro-af_packet-plugin//lib/Bro-AF_Packet.linux-x86_64.so
>> [1]:
>>>> 
>> 
> /usr/local/bro/lib/bro/plugins/packages/bro-af_packet-plugin//lib/Bro-AF_Packet.linux-x86_64.so
>> [1]:
>>>> undefined symbol: bro_version_2_6_plugin_6
>>>> 
>>>> bro-pkg upgrade bro-af_packet-plugin
>>>> All packages already up-to-date.
>>>> 
>>>> Now what :)
>>>> 
>>>> James
>> 
>> Ok...so...this was installed using the spiffy bro-pkg, so
>> "rebuilding"
>> isn't an option if I intend to stick with bro-pkg.  If plugins
>> aren't
>> going to keep in sync with the core app proper then that might be an
>> 
>> issue (especially in my case it looks like).
>> 
>> James
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
> 
> 
> Links:
> ------
> [1] http://Bro-AF_Packet.linux-x86_64.so