Errors installing af_packet-plugin

Zeek
1

I installed Zeek 2.6.4 for Debian 10 following the instructions for adding the repo and manually installing the package. Next, I attempted to “bro-pkg install bro-af_package-plugin” and received an error message in bro-af_packet-plugin-build.log (see below). I have been unsuccessful in searching for information online to help me solve the problem. What should I be doing?

Note: the kernel header package for the running kernel (4.19.0-0.bpo.4-amd64) is installed. No idea why cmake can’t find them.

Mark

=== STDERR ===
CMake Error at CMakeLists.txt:6 (include):
include could not find load file:

BroPlugin

CMake Warning at CMakeLists.txt:8 (find_package):
By not providing “FindKernelHeaders.cmake” in CMAKE_MODULE_PATH this
project has asked CMake to find a package configuration file provided by
“KernelHeaders”, but CMake did not find one.

Could not find a package configuration file provided by “KernelHeaders”
with any of the following names:

KernelHeadersConfig.cmake
kernelheaders-config.cmake

Add the installation prefix of “KernelHeaders” to CMAKE_PREFIX_PATH or set
“KernelHeaders_DIR” to a directory containing one of the above files. If
“KernelHeaders” provides a separate development package or SDK, be sure it
has been installed.

CMake Error at CMakeLists.txt:22 (message):
Kernel headers not found.

2

You need to install deb kernel header package...do:

apt-cache search linux-headers

and find the package that matches your running kernel.

James

3

You need to install deb kernel header package…do:

apt-cache search linux-headers

and find the package that matches your running kernel.

I have the kernel headers installed:

$ uname -a
Linux zeekmgr 4.19.0-6-amd64 #1 SMP Debian 4.19.67-2+deb10u1 (2019-09-20) x86_64 GNU/Linux

$ dpkg -l linux-headers-4.19.0-6-amd64
Desired=Unknown/Install/Remove/Purge/Hold

4

Ah....so yea you're looking at my point of contention with bro-pkg, so per:

https://github.com/J-Gras/bro-af_packet-plugin

it looks like you might have to try and manually install after all.

James

5

I installed by hand the last time. I was hoping that the problem was fixed. No problem. Thanks for your help.

Mark

6

You bet...I was in the same boat...gave up on bro-pkg and just installed manually....won't look back...too much hassle.

James

7

Where are the headers located? Especially where can you find "include/linux/user.h"? This is what cmake is looking for...

Jan

8

Oh I see where this might be the issue...looks like common needs installed:

/usr/src/linux-headers-4.9.0-3-common/include/linux/user.h

ii linux-headers-4.9.0-3-amd64 4.9.30-2+deb9u5 amd64 Header files for Linux 4.9.0-3-amd64
ii linux-headers-4.9.0-3-common 4.9.30-2+deb9u5 all Common header files for Linux 4.9.0-3

Debian is funky :wink:

James

9

$ dpkg -L linux-headers-4.19.0-6-common | grep include/linux/user.h
/usr/src/linux-headers-4.19.0-6-common/include/linux/user.h

Mark

10

Both common and amd64 kernel header packages are installed on my system. (The common package is a dependency of the amd64 package.)

Besides the kernel headed not being found, there was the error message about not finding BroPlugin. Any idea what that is about?

Mark