Gentoo Full Text Bug Listing

Description:

Opened: 2003-09-26 04:36 0000

Snort 2.x dies shortly after start.  This seems to be related to some of the
pre/post processors.  Working with the snort-devel folks to look into it.

This is presumably a vendor bug, just creating if others are interested.

------- Comment #2 From Jason Wever (RETIRED) 2004-01-03 06:13:14 0000 -------

Looking into this further, I found the following comments from davem on the
debian-sparc mailing list;

** start davem **
I think the PACKET_FORWARD() macro is the source of the problem:

#define PACKET_FORWARD(a) (*((unsigned int*)&a->iph->ip_dst) > *((unsigned  
int*)&a->iph->ip_src))

The a->iph->ip_dst and a->iph->ip_src objects are probably not aligned
enough to be accessed as an "unsigned int" (ie. it doesn't have 4 byte
alignment) and making such an unaligned access is illegal on sparc
(and most risc systems).

There appears to be some logic in the snort sources to attempt to
deal with these alignment issues, see the WORDS_MUSTALIGN macro
which should be getting set in the header file generated by the
configure script.

However, this is only used for accessor macros defined in decode.h.
I think PACKET_FORWARD() need to be making use of these macros instead
of directly accessing the IP header pieces via direct pointer
derefernces.
** end davem **

The thread can be referenced at
http://lists.debian.org/debian-sparc/2003/debian-sparc-200310/msg00282.html

Additionally, the INSTALL doc from snort mentions problems building snort on
SGI and SunOS with gcc, and suggest building it with the native compilers for
the respective OSs, or build in 64 bit.

While 64 bit may be an option in the semi-near future, it's not currently. 
Also this wouldn't fix sparc32.  I've added mboman to the CC so that as the
package's maintainer, he's aware of the problem and can comment if there are
any RISC based arches under Gentoo that seem to work successfully with this.

------- Comment #3 From Jason Wever (RETIRED) 2004-02-16 18:14:39 0000 -------

From all the info I've seen, short of a gcc rework, this will never work on
sparc32.  As for sparc64, this will work once 64 bit glibc support is added. 
Marking as resolve:later

Bug#: 29661	Product: Gentoo Linux	Version: unspecified	Platform: Sparc
OS/Version: Linux	Status: RESOLVED	Severity: normal	Priority: P2
Resolution: FIXED	Assigned To: sparc@gentoo.org	Reported By: weeve@gentoo.org
Component: Applications
URL:
Summary: snort 2.x dies on sparc
Keywords:
Status Whiteboard:
Opened: 2003-09-26 04:36 0000