Skip to content

Commit 6340b98

Browse files
philrzphilrz
authored
Merge pull request #1 from brimdata/init
Initial version
2 parents d141f98 + e6437d9 commit 6340b98

File tree

5 files changed

+318
-1
lines changed

5 files changed

+318
-1
lines changed

‎.github/workflows/release.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: Build/release Zeek
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
tags:
9+
- v*brim*
10+
workflow_dispatch:
11+
12+
permissions:
13+
contents: write
14+
15+
jobs:
16+
release:
17+
strategy:
18+
matrix:
19+
platform: [macos-12, ubuntu-20.04, windows-2019]
20+
runs-on: ${{ matrix.platform }}
21+
22+
steps:
23+
- name: Checkout build-zeek
24+
uses: actions/checkout@v3
25+
26+
- name: Setup Go
27+
uses: actions/setup-go@v3
28+
with:
29+
go-version: 1.21
30+
31+
- name: Checkout zeek
32+
uses: actions/checkout@v3
33+
with:
34+
repository: zeek/zeek
35+
ref: v6.0.2
36+
fetch-depth: 1
37+
submodules: recursive
38+
path: zeek-src
39+
40+
- name: Build zeekrunner (Windows)
41+
if: startsWith(matrix.platform, 'windows-')
42+
run: go build -o zeekrunner.exe zeekrunner.go
43+
44+
# Includes workaround from https://github.com/maxmind/libmaxminddb/pull/334
45+
- name: Build libmaxminddb (Windows)
46+
if: startsWith(matrix.platform, 'windows-')
47+
run: |
48+
call "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x86_amd64
49+
curl -L https://github.com/maxmind/libmaxminddb/releases/download/1.8.0/libmaxminddb-1.8.0.tar.gz | tar xzvf -
50+
mkdir libmaxminddb-1.8.0\build
51+
cd libmaxminddb-1.8.0\build
52+
cmake ..
53+
cmake --build .
54+
cmake --build . --target install
55+
rename "C:\Program Files (x86)\maxminddb\include\maxminddb.h" maxminddb.h.bak
56+
sed "/typedef ADDRESS_FAMILY sa_family_t/d" "C:\Program Files (x86)\maxminddb\include\maxminddb.h.bak" > "C:\Program Files (x86)\maxminddb\include\maxminddb.h"
57+
shell: cmd
58+
59+
- name: Build Zeek (Windows)
60+
if: startsWith(matrix.platform, 'windows-')
61+
run: |
62+
choco install -y --no-progress conan --version=1.58.0
63+
choco install -y --no-progress winflexbison3
64+
call refreshenv
65+
call "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\VC\Auxiliary\Build\vcvarsall.bat" x86_amd64
66+
mkdir zeek-src\build
67+
cd zeek-src\build
68+
cmake.exe .. -DCMAKE_BUILD_TYPE=release -DENABLE_ZEEK_UNIT_TESTS=yes -D CMAKE_INSTALL_PREFIX="C:\Program Files\Git\usr\local\zeek" -DLibMMDB_INCLUDE_DIR="C:\Program Files (x86)\maxminddb\include" -DLibMMDB_LIBRARY="C:\Program Files (x86)\maxminddb\lib\maxminddb.lib" -G Ninja
69+
cmake.exe --build .
70+
cmake.exe --install .
71+
cd
72+
shell: cmd
73+
74+
- name: Install dependencies (Linux)
75+
if: startsWith(matrix.platform, 'ubuntu-')
76+
run: sudo apt-get -y install cmake make gcc g++ flex libfl-dev bison libpcap-dev libssl-dev python3 python3-dev python3-setuptools swig zlib1g-dev zip libmaxminddb-dev
77+
78+
- name: Install dependencies (macOS)
79+
if: startsWith(matrix.platform, 'macos-')
80+
run: brew install cmake swig openssl bison flex libmaxminddb
81+
82+
- name: Get number of CPU cores
83+
uses: SimenB/github-actions-cpu-cores@v1
84+
id: cpu-cores
85+
86+
- name: Build Zeek (Linux/macOS)
87+
if: "!startsWith(matrix.platform, 'windows-')"
88+
run: |
89+
cd zeek-src
90+
./configure --binary-package --enable-static-broker --enable-static-binpac --disable-spicy --disable-af-packet --disable-zeekctl --disable-python --disable-broker-tests --disable-auxtools --disable-archiver --osx-min-version=12
91+
make -j${{ steps.cpu-cores.outputs.count }}
92+
sudo make install
93+
sudo strip /usr/local/zeek/bin/zeek
94+
95+
- name: Finish packaging artifact
96+
run: ./release.sh
97+
shell: sh
98+
99+
- name: Upload artifact
100+
uses: actions/upload-artifact@v4
101+
with:
102+
name: ${{ matrix.platform }}
103+
path: zeek-*.zip
104+
105+
- name: Publish artifact as release
106+
if: startsWith(github.event.ref, 'refs/tags/')
107+
uses: svenstaro/[email protected]
108+
with:
109+
repo_token: ${{ secrets.GITHUB_TOKEN }}
110+
file: zeek-*.zip
111+
file_glob: true
112+
tag: ${{ github.ref }}
113+
overwrite: true

‎README.md‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,22 @@
11
# build-zeek
2-
Build Zeek for packaging with Brimcap and Zui
2+
3+
Build [Zeek](https://zeek.org/) for packaging with
4+
[Brimcap](https://github.com/brimdata/brimcap) and
5+
[Zui](https://zui.brimdata.io/).
6+
7+
## Background
8+
9+
Before there was official support for compiling Zeek on Windows, developers
10+
at Brim Data created a [working port](https://github.com/brimdata/zeek) and an
11+
[artifact based on Zeek v3.2.1](https://github.com/brimdata/zeek/releases/tag/v3.2.1-brim10).
12+
Because the effort of keeping the port in sync with ongoing Zeek development
13+
would have been prohibitive, that artifact shipped with Brimcap and Zui for
14+
years.
15+
16+
In late 2022, work began to officially support
17+
[Zeek on Windows](https://zeek.org/2022/11/28/zeek-on-windows/),
18+
and in late 2023 this repo was created to take advantage of that. The minimal
19+
glue found here starts from the official Zeek source code and makes only the
20+
changes necessary to build in GitHub Actions, add some needed
21+
[Zeek Packages](https://packages.zeek.org/), and produce artifacts ready for
22+
use in Brimcap/Zui.

‎release.sh‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#!/bin/sh -ex
2+
3+
case $(uname) in
4+
Darwin|Linux)
5+
sudo=sudo
6+
zip=zip
7+
;;
8+
*_NT-*)
9+
exe=.exe
10+
zip=/c/msys64/usr/bin/zip
11+
;;
12+
*)
13+
echo "unknown OS: $(uname)" >&2
14+
exit 1
15+
;;
16+
esac
17+
18+
#
19+
# Install Zeek packages. We don't use zkg because it didn't work
20+
# out-of-the-box in recent attempts and our package installation
21+
# requirements are little more than copying scripts. We already had
22+
# the approach below working in our prior Windows port so we'll
23+
# stick with it for now.
24+
#
25+
26+
zkg_meta() {
27+
section=${1:?'section required'}
28+
option=${2:?'option required'}
29+
python3 <<EOF
30+
import configparser
31+
c = configparser.ConfigParser()
32+
c.read('zkg.meta')
33+
print(c.get('$section', '$option', fallback=''))
34+
EOF
35+
}
36+
37+
install_zeek_package() {
38+
github_repo=${1:?'github_repo required'}
39+
git_ref=${2:?'git_ref required'}
40+
package=${github_repo#*/}
41+
mkdir $package
42+
(
43+
export PATH=/usr/local/zeek/bin:$PATH
44+
cd $package
45+
curl -sL https://github.com/$github_repo/tarball/$git_ref |
46+
tar -xzf - --strip-components 1
47+
48+
script_dir=$(zkg_meta package script_dir)
49+
$sudo cp -r "$script_dir" /usr/local/zeek/share/zeek/site/$package/
50+
51+
build_command=$(zkg_meta package build_command)
52+
if [ "$build_command" ]; then
53+
echo "building plugins not currently supported"
54+
exit 1
55+
fi
56+
57+
test_command=$(zkg_meta package test_command)
58+
if [ "$test_command" ]; then
59+
# Btest fails without explanation on the GitHub Actions
60+
# Windows runners, so skip tests there.
61+
if [ "$GITHUB_ACTIONS" != true -o "$OS" != Windows_NT ]; then
62+
sh -c "$test_command"
63+
fi
64+
fi
65+
66+
echo "@load $package" | $sudo tee -a /usr/local/zeek/share/zeek/site/local.zeek
67+
)
68+
rm -r $package
69+
}
70+
71+
$sudo pip3 install btest wheel
72+
73+
install_zeek_package brimdata/geoip-conn c9dd7f0f8d40573189b2ed2bae9fad478743cfdf
74+
install_zeek_package salesforce/hassh 76a47abe9382109ce9ba530e7f1d7014a4a95209
75+
install_zeek_package salesforce/ja3 421dd4f3616b533e6971bb700289c6bb8355e707
76+
echo "@load policy/protocols/conn/community-id-logging" | $sudo tee -a /usr/local/zeek/share/zeek/site/local.zeek
77+
78+
#
79+
# Create zip file.
80+
#
81+
82+
mkdir -p zeek/bin zeek/lib/zeek zeek/share/zeek
83+
cp zeekrunner$exe zeek/
84+
cp /usr/local/zeek/bin/zeek$exe zeek/bin/
85+
for d in base policy site builtin-plugins; do
86+
cp -R /usr/local/zeek/share/zeek/$d zeek/share/zeek/
87+
done
88+
89+
$zip -r zeek-$(git describe --always --tags).$(go env GOOS)-$(go env GOARCH).zip zeek

‎zeekrunner‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/usr/bin/env bash
2+
3+
dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
4+
5+
export ZEEKPATH=$dir/share/zeek:$dir/share/zeek/policy:$dir/share/zeek/site
6+
7+
# The packet filter and loaded scripts are disabled because they emit either
8+
# timeless logs or logs with timestamp set to execution time rather than time
9+
# of capture.
10+
exec "$dir/bin/zeek" \
11+
-C -r - \
12+
--exec "event zeek_init() { Log::disable_stream(PacketFilter::LOG); Log::disable_stream(LoadedScripts::LOG); Log::disable_stream(Telemetry::LOG); }" \
13+
local

‎zeekrunner.go‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
// +build windows
2+
3+
// This tool executes zeek on windows, constructing the required ZEEK*
4+
// environment variables. It embeds knowledge of the locations of the zeek
5+
// executable and zeek script locations in the expanded 'zdeps/zeek' directory
6+
// inside a Brim installation.
7+
package main
8+
9+
import (
10+
"log"
11+
"os"
12+
"os/exec"
13+
"path"
14+
"path/filepath"
15+
"strings"
16+
)
17+
18+
// These paths are relative to the zdeps/zeek directory.
19+
var (
20+
zeekExecRelPath = "bin/zeek.exe"
21+
zeekPathRelPaths = []string{
22+
"share/zeek",
23+
"share/zeek/policy",
24+
"share/zeek/site",
25+
}
26+
)
27+
28+
func pathEnvVar(name, topDir string, subdirs []string) string {
29+
var s []string
30+
for _, d := range subdirs {
31+
s = append(s, path.Join(filepath.ToSlash(topDir), d))
32+
}
33+
val := strings.Join(s, ";")
34+
return name + "=" + val
35+
}
36+
37+
var ExecScript = `
38+
event zeek_init() {
39+
Log::disable_stream(PacketFilter::LOG);
40+
Log::disable_stream(LoadedScripts::LOG);
41+
Log::disable_stream(Telemetry::LOG);
42+
}`
43+
44+
func launchZeek(zdepsZeekDir, zeekExecPath string) error {
45+
zeekPath := pathEnvVar("ZEEKPATH", zdepsZeekDir, zeekPathRelPaths)
46+
47+
cmd := exec.Command(zeekExecPath, "-C", "-r", "-", "--exec", ExecScript, "local")
48+
cmd.Stdin = os.Stdin
49+
cmd.Stdout = os.Stdout
50+
cmd.Stderr = os.Stderr
51+
cmd.Env = append(os.Environ(), zeekPath)
52+
53+
return cmd.Run()
54+
}
55+
56+
// zdepsZeekDirectory returns the absolute path of the zdeps/zeek directory,
57+
// based on the assumption that this executable is located directly in it.
58+
func zdepsZeekDirectory() (string, error) {
59+
execFile, err := os.Executable()
60+
if err != nil {
61+
return "", err
62+
}
63+
64+
return filepath.Dir(execFile), nil
65+
}
66+
67+
func main() {
68+
zdepsZeekDir, err := zdepsZeekDirectory()
69+
if err != nil {
70+
log.Fatalln("zdepsZeekDirectory failed:", err)
71+
}
72+
73+
zeekExecPath := filepath.Join(zdepsZeekDir, filepath.FromSlash(zeekExecRelPath))
74+
if _, err := os.Stat(zeekExecPath); err != nil {
75+
log.Fatalln("zeek executable not found at", zeekExecPath)
76+
}
77+
78+
err = launchZeek(zdepsZeekDir, zeekExecPath)
79+
if err != nil {
80+
log.Fatalln("launchZeek failed", err)
81+
}
82+
}

0 commit comments

Comments
 (0)