# Geo Location Plugin **URL:** \ **Category:** Development\ **Tags:** development\ **Created:** [October 5, 2014, 9:30am UTC](https://community.zeek.org/t/geo-location-plugin/3300 "2014-10-05T09:30:10Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Anthony\_Kasza](https://avatars.discourse-cdn.com/v4/letter/a/41988e/32.png) [@Anthony\_Kasza](https://community.zeek.org/u/Anthony_Kasza)\ **Post date:** [October 5, 2014, 9:30am UTC](https://community.zeek.org/t/geo-location-plugin/3300/1 "2014-10-05T09:30:10Z")
Hello All, I recently have been looking at how Bro's plugins work. I was able to recreate the rot13 functionality from the online documentation and wanted to do something a little more challenging in hopes of learning more about plugin development. On a suggestion from Seth, I've been attempting to move the geoIP stuff, which is currently baked into the core, into a self contained plugin. I've gotten Bro and my plugin to compile together (mostly by simply moving existing code into their proper files within aux/bro-aux/plugin-support/Geo). However, I cannot seem to find the plugin listed in 'bro -NN' and I cannot use the data types or functions my bif defines. I'm hoping someone has a suggestion or a tip on troubleshooting the interaction between plugins and the core. Many thanks, -AK ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 5, 2014, 3:16pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/2 "2014-10-05T15:16:33Z")
If you haven't yet, try compiling Bro with --enable-debug (and then recompiling your plugin as well). Then run with "-B plugins" and see if debug.log says anything helpful. Robin ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 6, 2014, 6:00am UTC](https://community.zeek.org/t/geo-location-plugin/3300/3 "2014-10-06T06:00:37Z")
I can at least now see why my plugin isn’t working as excepted. Thanks Robin. -AK ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 6, 2014, 3:10pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/4 "2014-10-06T15:10:04Z")
Great, let me know if it's anything that the plugin documentation could make more clear. Robin ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 7, 2014, 4:46am UTC](https://community.zeek.org/t/geo-location-plugin/3300/5 "2014-10-07T04:46:41Z")
Thanks Robin. Everything on the “Writing Bro Plugins” page is clear although the debugging section seems thin to me. Then again, I’ve have never compiled Bro with debugging enabled before. I’m running into issues with my plugin’s shared object. Bro is complaining about an undefined symbol (likely due to a bug in my source). Are there plans to expand the Types section of that page? I think I’m not declaring a scriptland record type correctly. -AK ---
**Author:** ![Clark\_Gilbert](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Clark\_Gilbert](https://community.zeek.org/u/Clark_Gilbert)\ **Post date:** [October 7, 2014, 1:36pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/6 "2014-10-07T13:36:34Z")
Hi: A mismatched function definition in .h / implementation in .cc usually causes this issue for me. Maybe try running the mangled symbol that's reported as missing through c++filt to see what it really is (if you haven't already) and use nm or the like to make sure the plugin library file contains that symbol? -Gilbert ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 7, 2014, 3:05pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/7 "2014-10-07T15:05:11Z")
I ran into a similar issue recently with the approxidate plugin I've been working on. Jon reminded me that I need to do this... #ifdef \_\_cplusplus extern "C" { #endif unsigned long approxidate\_relative(const char \*date, const struct timeval \*tv); #ifdef \_\_cplusplus } #endif   .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 7, 2014, 3:25pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/8 "2014-10-07T15:25:55Z")
> Thanks Robin. Everything on the "Writing Bro Plugins" page is clear > although the debugging section seems thin to me. Then again, I've have > never compiled Bro with debugging enabled before. Ok, I'll try to extend that a bit more, it's written mainly from the perspective of adding debugging output to your plugin; not in terms of leveraging the existing output to see why something's not working. > Are there plans to expand the Types section of that page? I would like to, but it's quite a bit of work to fill in the TODOs, so honestly I don't see that coming very soon. The problem is that most of the missing TODOs are actually not really a matter per se of writing a plugin or not, but require text on how to write the corresponding code for Bro in general (in other words, even before moving to plugins, much of that would have been quite similar). For now, the best way to figure this out is to look at existing code, i.e., for the builtin-in stuff other \*.bif files. > I think I'm not declaring a scriptland record type correctly. Feel free to post error messages here. Robin ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 15, 2014, 12:48am UTC](https://community.zeek.org/t/geo-location-plugin/3300/9 "2014-10-15T00:48:56Z")
Thanks all. After moving declarations around, nm shows all my expected symbols to be defined. I'm now receiving "internal error in /usr/local/bro/share/bro/base/init-bare.bro, line 1: internal type geo\_location missing". It seems this error is being caused by the check on the return value of lookup\_ID() done within the internal\_type() function in Var.cc. From what I can tell, I don't have geo\_location = internal\_type("geo\_location")-\>AsRecordType(); in the right location. This line is from the init\_net\_var() function from NetVar.cc, which gets called by main.cc. I thought it might be a clash in name/module spaces and tried using the init-plugin script with some unique values, but I still receive the same error. I'm not sure if it matters but I when I run "bro -NNb" I can see my inactive dynamic plugin, so I know Bro is aware of it. I currently have everything sitting in a single .bif file. Would it be useful to post that? -AK ---
**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\ **Post date:** [October 15, 2014, 2:46pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/10 "2014-10-15T14:46:37Z")
> From what I can tell, I don't have > > geo\_location = internal\_type("geo\_location")-\>AsRecordType(); > > in the right location. This line is from the init\_net\_var() function > from NetVar.cc, which gets called by main.cc. Maybe that can just be completely removed if Bro proper no longer relies on that type since all the related functionality is now provided by the plugin? > everything sitting in a single .bif file. Would it be useful to post > that? How about putting the entire plugin source directory in a github repo? That should make it easy for others to start poking at the same code as you. - Jon ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 15, 2014, 3:28pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/11 "2014-10-15T15:28:35Z")
Agreed. Any code related to GeoIP should move into the plugin, including types.   .Seth ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 15, 2014, 5:22pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/12 "2014-10-15T17:22:34Z")
I moved that line from NetVar to my plugin source. I also moved some things from bifs to the plugin source (honestly, just copied and pasted). Posting just the plugin directory won’t show which lines in the core I moved to the plugin. Should I make a branch off master? What are the general conventions for doing this? -AK ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 15, 2014, 5:29pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/13 "2014-10-15T17:29:25Z")
Yes, you'd make a branch of master and make your changes there and build your plugin against that branch. When your plugin is merged, it will also require a merge of your branch against Bro as well.   .Seth ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 15, 2014, 5:29pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/14 "2014-10-15T17:29:58Z")
Oh, also: [https://www.bro.org/development/howtos/process.html](https://www.bro.org/development/howtos/process.html)   .Seth ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 16, 2014, 1:02pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/15 "2014-10-16T13:02:23Z")
One question here: are we prepated to ask people to install a plugin if they want geoip functionality? I'm asking because while generally I think it's the right way going forward to move external dependencies into plugins, this one we have offered for a while so, in some way, not having it out of the box is a regression (unless we decide to build (some) plugins by default, which currently isn't happening). Robin ---
**Author:** ![Slagell\_Adam\_J](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@Slagell\_Adam\_J](https://community.zeek.org/u/Slagell_Adam_J)\ **Post date:** [October 16, 2014, 1:21pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/16 "2014-10-16T13:21:02Z")
I think that is reasonable for some things. ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 16, 2014, 3:40pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/17 "2014-10-16T15:40:44Z")
I think having some plugins distributed and built with Bro is reasonable, too. As long as functionality and interfaces don’t change current users shouldn’t notice a difference. How eventually moving the plugin to a package manager will affect users is something else to consider. -AK ---
**Author:** ![Clark\_Gilbert](https://avatars.discourse-cdn.com/v4/letter/c/57b2e6/32.png) [@Clark\_Gilbert](https://community.zeek.org/u/Clark_Gilbert)\ **Post date:** [October 16, 2014, 4:21pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/18 "2014-10-16T16:21:24Z")
+1 that core plugins be built / distributed with bro. Re: package / plugin management, coming from a Java EE background, one of the things I don’t like about some of the OSGi software (read: highly modular, plugin-driven) I’ve worked with is how confusing it can get to track versions of each specific bundle / plugin to know how / when to update them. Binding a specific set of core plugin versions to application releases mitigates some of that complexity in my experience. In other words, I’d be a bit hesitant to agree that bro should individually package _core_ plugins and offer them independently through a repo, just because it will probably require a great deal of care to update those (since there could be e.g. side effects / dependencies that aren’t immediately obvious). An external repository / package manager seems like a good fit for non-core plugins, though. -Gilbert I think having some plugins distributed and built with Bro is reasonable, too. As long as functionality and interfaces don’t change current users shouldn’t notice a difference. How eventually moving the plugin to a package manager will affect users is something else to consider. -AK ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [October 16, 2014, 6:54pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/19 "2014-10-16T18:54:05Z")
That makes sense. The next logical question would be, what makes a plugin special enough to be included the core? I think GeoIP, being legacy like Robin mentioned, qualifies. -AK ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [October 16, 2014, 8:29pm UTC](https://community.zeek.org/t/geo-location-plugin/3300/20 "2014-10-16T20:29:17Z")
Yep. This is going to just remain as-always a careful balance between providing extra functionality and keeping the number of dependencies low for Bro.   .Seth [Next page](https://community.zeek.org/t/geo-location-plugin/3300.md?page=2)