Include in Jan's AF_PACKET plugin as builtin plugin

This has come up a few times and the motivation is mainly better "first timer"
experience with Zeek. Concretely, if one wants to run a Zeek cluster with
multiple workers and reasonable load balancing on Linux, AF_PACKET is a decent
start. Without AF_PACKET support being built into Zeek, however, a new user's
next experience is that of setting up a development environment in order
to compile an external plugin (think compiler, kernel headers, zkg, ...).
Only to get what could be termed basic functionality.

This is using the ZEEK_INCLUDE_PLUGINS infrastructure. I've used the all
upper case spelling of AF_PACKET in the help output because it seems everyone
else references/writes it like that. I think we should also write it
like that in the docs.
This commit is contained in:
Arne Welzel 2022-09-06 21:18:09 +02:00
parent a4ad4a34b2
commit 0bc7d0905e
12 changed files with 88 additions and 3 deletions

10
testing/scripts/have-af-packet Executable file
View file

@ -0,0 +1,10 @@
#!/bin/sh
if [ "$(uname -s)" != "Linux" ]; then
exit 1
fi
if grep -q "DISABLE_AF_PACKET:BOOL=true" "${BUILD}"/CMakeCache.txt; then
exit 1
fi
exit 0