Bugzilla Bug 29661

Snort 2.x dies shortly after start.  This seems to be related to some of the
pre/post processors.  Working with the snort-devel folks to look into it.

This is presumably a vendor bug, just creating if others are interested.

snort-2.0.2 seems to fix this problem.  Going to test for a bit longer, then
mark stable

Looking into this further, I found the following comments from davem on the
debian-sparc mailing list;

** start davem **
I think the PACKET_FORWARD() macro is the source of the problem:

#define PACKET_FORWARD(a) (*((unsigned int*)&a->iph->ip_dst) > *((unsigned  
int*)&a->iph->ip_src))

The a->iph->ip_dst and a->iph->ip_src objects are probably not aligned
enough to be accessed as an "unsigned int" (ie. it doesn't have 4 byte
alignment) and making such an unaligned access is illegal on sparc
(and most risc systems).

There appears to be some logic in the snort sources to attempt to
deal with these alignment issues, see the WORDS_MUSTALIGN macro
which should be getting set in the header file generated by the
configure script.

However, this is only used for accessor macros defined in decode.h.
I think PACKET_FORWARD() need to be making use of these macros instead
of directly accessing the IP header pieces via direct pointer
derefernces.
** end davem **

The thread can be referenced at
http://lists.debian.org/debian-sparc/2003/debian-sparc-200310/msg00282.html

Additionally, the INSTALL doc from snort mentions problems building snort on
SGI and SunOS with gcc, and suggest building it with the native compilers for
the respective OSs, or build in 64 bit.

While 64 bit may be an option in the semi-near future, it's not currently. 
Also this wouldn't fix sparc32.  I've added mboman to the CC so that as the
package's maintainer, he's aware of the problem and can comment if there are
any RISC based arches under Gentoo that seem to work successfully with this.

From all the info I've seen, short of a gcc rework, this will never work on
sparc32.  As for sparc64, this will work once 64 bit glibc support is added. 
Marking as resolve:later

Reopening this bug. sparc team, please, test any version of snort in the tree.
I suppose this bug should already be fixed.

Seems to work fine...

(In reply to comment #5)
> Seems to work fine...

Well, lets close this then.