Bug with zone filter loading

[xerxes]

When I am editing zone filters, depending on what I select in the Filters menu, sometimes it updates the filters in /usr/local/share/showeq/filters, and sometimes it creates a local copy in /root/.showeq/filters.

It's pretty annoying when suddently all of my filters go poof. Removing the one in my home directory /root/.showeq/filters and doing a reload correctly gets the filters back.

Can we remove or disable the functionality where it is creating additional copies in your home directory? It is intermittent when it is happening. I am usually updating filters as I actively hunt something, and it makes for a few "WTF" moments.

[cn187]

Did you start with the existing filter tarball, and if so, where did you unpack it - /usr/share/showeq/filters or /root/.showeq/filters? Or are you starting with empty/nonexistent filter files?

Asking because I've used filters a lot and have never seen this issue, so this could help narrow it down.

Also, you said "depending on what I select in the Filters menu" - can you elaborate on this?

[xerxes]

I started with the existing tarball and it was extracted to "/usr/local/share/showeq/filters"

I have been in a hurry sometimes while editing filters when tracking rare NPCs/placeholders. The combination that always correctly edits the zone filters and reloads is this workflow:



Filters > Edit Zone Filters > (correctly shows the filters under /usr)
Save File
Filters > Reload Zone Filters
Changes correctly show up


There are other filter settings in the menu that I don't normally use. SEQ is always ran as root, so permissions shouldn't be an issue. I'm guessing whatever app logic that determines to use the local filters in the user's home directory is incorrectly saving an old/default copy to ~/.showeq/filters instead of updating the main file. I did not have any filters in ~/.showeq/filters and have to periodically clear them out, as something is causing them to occasionally be created there. The app seems to prefer filters in ~/.showeq/filters over the /usr location. That logic can probably be stripped out completely, as SEQ seems to always need to be ran as root, and should have access to /usr.

[cn187]

Your 4-step process is the same thing I do for filters, so that looks fine to me. Though, if I'm not mistaken, the save/reload isn't strictly necessary if you just want the filters temporarily (you'll lose them on zone unless you save).

The app does prioritize data in the user's home directory over data in /usr/. I think part of the intent was to eventually separate the program into to parts so that only the part that needs root (the packet capture) would run as root, and the rest of the program would run as an unprivileged user. So in that context, it makes sense. Also, historically, /usr was sometimes mounted read-only except for when upgrades were being done. So it makes sense in that context as well.

Since the app prioritizes the data in the user's home dir, it should load from there if data is found there. So the base filters could be in /usr, changes made and saved (to /root/.showeq), and then reloading the filter would load from /root/.showeq if it was there, or /usr if it wasn't. This is the same way loading/saving of maps and preferences works.

So it sounds to me like the actual bug here is that it's sometimes saving to /usr and sometimes to /root/.showeq, when it should really only be saving to /root/.showeq. I've added it my list of stuff to look at, but I don't have a lot of EQ/SEQ time right now, so it may be a bit before it's fixed.

In the short term, I think you should be able to work around this by moving all the filters from /usr to /root/.showeq/filters.

[xerxes]

Yeah, it's definitely odd behavior. The zoneName.xml in ~/.showeq/filters didn't even remotely resemble what I had in /usr. It had started as blank, and took my additions. At one point, I must have tried to edit it and it couldn't load the one in /usr and created another copy. Which is odd, since I have the showeq binary set to always run with sudo permissions. I had been clearing the filters out in ~/.showeq/filters regularly because it kept randomly creating new copies.

I don't really have any context to the history of why it has the separation, so thank you for that. I imagine for most, it's probably unnecessary though and slightly complicates the install. Pick a location for filters and stick with it. iirc, it doesn't come with any, so the install location should just be in ~/.showeq/filters and not even look elsewhere.

Thank you for adding it to the list :)