The plugin build system makes packaging bro difficult



Let's make the bro plugin building system packaging friendly.

The current situation is that if you want to build a package, it needs a ./configure-ed bro source with certain headers built, for the plugin itself to build.

This breaks some package building system, that assume 1 source = 1 package with no external dependencies. Furthermore, some of them actually enforce that and disable networking so nothing extra can be downloaded. They also generate RPM spec files, so doing tricks with unpacking additional Bro source and temporary-building it is impossible.

I spent way too many hours and finally figured out what are the requirements for the plugin to build, i.e. what is the minimum viable Bro source they actually need. Here are my observations:

cd ./bro-2.5.9271b2032 && ./configure && cd build/src && make bifcl

./bifcl /home/clear/rpmbuild/BUILD/bro-plugin-afpacket-1.3.79edee2/bro-2.5.9271b2032/src/const.bif
./bifcl /home/clear/rpmbuild/BUILD/bro-plugin-afpacket-1.3.79edee2/bro-2.5.9271b2032/src/types.bif
./bifcl /home/clear/rpmbuild/BUILD/bro-plugin-afpacket-1.3.79edee2/bro-2.5.9271b2032/src/event.bif
./bifcl /home/clear/rpmbuild/BUILD/bro-plugin-afpacket-1.3.79edee2/bro-2.5.9271b2032/src/reporter.bif
cd ../../..
./configure --bro-dist=./bro-2.5.9271b2032 --install-root=${_prefix}/usr/lib/bro/plugins --with-kernel=/tmp/linux-4.14.21 && make %{?_smp_mflags}

So it looks like the ./configure process creates something (I guess, make files or cmake files) that allow the bifcl binary to build, and the bifcl binary can be used to build those 'bif' files plugins require.

What needs to happen so that is easier? If building a plugin would not require a full Bro source to be included, that would be ideal.

BTW, this is also a requirement for the BroIDS to be (ever) included in the Clear Linux. We have already included Suricata, as it does not have similar requirements.

I don't know anything about cmake - but people in the know told me that our configure + cmake process is awkward i.e. you either use autoconf or cmake, both aren't necessary. Just passing along.






Michal Purzynski



External issue ID



Fix versions

Affects versions