[Bro] Bro 2.6 beta feedback?

[Jon Siwek]

On Tue, Oct 2, 2018 at 6:15 PM Seth Hall <seth at corelight.com> wrote:
>
> Hm, that makes me wonder if we should do something like set an RPATH to make sure the correct libcaf is used.
>
> Jon, does that make sense?  It seems that this problem will only come up more frequently as caf is packaged by more systems.

An RPATH is already set by default (regardless of platform):

$ readelf -d /usr/local/bro/bin/bro | grep RPATH
 0x000000000000000f (RPATH)              Library rpath: [/usr/local/bro/lib]
$ readelf -d /usr/local/bro/lib/libbroker.so | grep RPATH
 0x000000000000000f (RPATH)              Library rpath: [/usr/local/bro/lib]
$ freebsd-version
10.3-RELEASE-p29

I tried reproducing the problem by faking it out with CAF libs
installed in /usr/local:

$ ls /usr/local/lib/libcaf_*
/usr/local/lib/libcaf_core.so
/usr/local/lib/libcaf_core.so.0.15.3
/usr/local/lib/libcaf_io.so
/usr/local/lib/libcaf_io.so.0.15.3

But that still works fine for me:

$ /usr/bin/ldd /usr/local/bro/bin/bro
/usr/local/bro/bin/bro:
libpcap.so.8 => /lib/libpcap.so.8 (0x80162b000)
libssl.so.7 => /usr/lib/libssl.so.7 (0x801870000)
libcrypto.so.7 => /lib/libcrypto.so.7 (0x801adc000)
libz.so.6 => /lib/libz.so.6 (0x801ed1000)
libbroker.so.0 => /usr/local/bro/lib/libbroker.so.0 (0x802200000)
libthr.so.3 => /lib/libthr.so.3 (0x802e71000)
libcaf_core.so.0.16.0 => /usr/local/bro/lib/libcaf_core.so.0.16.0 (0x803200000)
libcaf_io.so.0.16.0 => /usr/local/bro/lib/libcaf_io.so.0.16.0 (0x803c00000)
libcaf_openssl.so.0.16.0 =>
/usr/local/bro/lib/libcaf_openssl.so.0.16.0 (0x80453e000)
libc++.so.1 => /usr/lib/libc++.so.1 (0x804844000)
libcxxrt.so.1 => /lib/libcxxrt.so.1 (0x804b03000)
libm.so.5 => /lib/libm.so.5 (0x804d20000)
libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x804f49000)
libc.so.7 => /lib/libc.so.7 (0x805157000)

So not sure why Aashish or others had problems with alternate CAF installations.

- Jon