| Summary: | net-analyzer/snort-2.9.2.3 fails to compile with active response disabled | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Valentin Avram <valentin.avram> |
| Component: | Current packages | Assignee: | Joshua Kinard <kumba> |
| Status: | RESOLVED UPSTREAM | ||
| Severity: | normal | ||
| Priority: | Normal | ||
| Version: | 10.0 | ||
| Hardware: | x86 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
Patch to allow compilation of snort-2.9.2.3 with active-response disabled
ebuild based on latest official snort ebuild |
||
|
Description
Valentin Avram
2012-06-18 13:45:37 UTC
Snort 2.9.1 (marked as stable) compiles without any problem with the same USE-flags. .. of course, ignoring all the warnings about the not checked return values. Snort 2.9.2.1 fails to compile with the same error: configure: ./configure --prefix=/usr --build=i686-pc-linux-gnu --host=i686-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --enable-shared --disable-static --disable-so-with-static-lib --enable-dynamicplugin --enable-zlib --disable-gre --disable-mpls --disable-targetbased --enable-decoder-preprocessor-rules --disable-ppm --enable-perfprofiling --enable-linux-smp-stats --disable-inline-init-failopen --enable-pthread --disable-debug --disable-debug-msgs --disable-corefiles --enable-dlclose --disable-active-response --disable-normalizer --disable-reload-error-restart --disable-react --disable-flexresp3 --enable-paf --disable-large-pcap --disable-aruba --without-mysql --without-odbc --without-postgresql --enable-ipv6 --enable-reload --disable-prelude --disable-build-dynamic-examples --disable-profile --disable-ppm-test --disable-intel-soft-cpm --disable-static-daq --disable-rzb-saac --without-oracle Error: /bin/sh ../libtool --tag=CC --mode=link i686-pc-linux-gnu-gcc -O2 -march=i686 -pipe -fomit-frame-pointer -DSF_VISIBILITY -fvisibility=hidden -fno-strict-aliasing -Wall -Wl,-O1 -Wl,--as-needed -L/usr/lib -lpcre -L/usr/lib -ldnet -o snort debug.o decode.o encode.o active.o log.o mstring.o parser.o profiler.o plugbase.o snort.o strlcatu.o strlcpyu.o tag.o util.o detect.o signature.o mempool.o sf_sdlist.o fpcreate.o fpdetect.o pcrm.o byte_extract.o sfthreshold.o packet_time.o event_wrapper.o event_queue.o ppm.o log_text.o detection_filter.o detection_util.o rate_filter.o obfuscation.o sfdaq.o idle_processing.o output-plugins/libspo.a detection-plugins/libspd.a dynamic-plugins/libdynamic.a preprocessors/libspp.a parser/libparser.a target-based/libtarget_based.a preprocessors/HttpInspect/libhttp_inspect.a preprocessors/Stream5/libstream5.a sfutil/libsfutil.a control/libsfcontrol.a -lz -ldnet -lpcre -lpcap -lnsl -luuid -lm -lm -ldl -ldaq -lz -lpthread -lpthread libtool: link: i686-pc-linux-gnu-gcc -O2 -march=i686 -pipe -fomit-frame-pointer -DSF_VISIBILITY -fvisibility=hidden -fno-strict-aliasing -Wall -Wl,-O1 -o snort debug.o decode.o encode.o active.o log.o mstring.o parser.o profiler.o plugbase.o snort.o strlcatu.o strlcpyu.o tag.o util.o detect.o signature.o mempool.o sf_sdlist.o fpcreate.o fpdetect.o pcrm.o byte_extract.o sfthreshold.o packet_time.o event_wrapper.o event_queue.o ppm.o log_text.o detection_filter.o detection_util.o rate_filter.o obfuscation.o sfdaq.o idle_processing.o -Wl,--as-needed -L/usr/lib output-plugins/libspo.a detection-plugins/libspd.a dynamic-plugins/libdynamic.a preprocessors/libspp.a parser/libparser.a target-based/libtarget_based.a preprocessors/HttpInspect/libhttp_inspect.a preprocessors/Stream5/libstream5.a sfutil/libsfutil.a control/libsfcontrol.a /usr/lib/libdnet.so -lpcre -lpcap -lnsl -luuid -lm /usr/lib/libdaq.so -ldl -lz -lpthread dynamic-plugins/libdynamic.a(sf_dynamic_plugins.o): In function `DynamicSendBlockResponseMsg': sf_dynamic_plugins.c:(.text+0x934): undefined reference to `Active_SendData' dynamic-plugins/libdynamic.a(sf_dynamic_plugins.o): In function `DynamicActiveSetEnabled': sf_dynamic_plugins.c:(.text+0xa17): undefined reference to `Active_SetEnabled' collect2: ld returned 1 exit status make[3]: *** [snort] Error 1 make[3]: Leaving directory `/var/tmp/portage/net-analyzer/snort-2.9.2.1/work/snort-2.9.2.1/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/var/tmp/portage/net-analyzer/snort-2.9.2.1/work/snort-2.9.2.1/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/var/tmp/portage/net-analyzer/snort-2.9.2.1/work/snort-2.9.2.1' make: *** [all] Error 2 emake failed So the change that breaks it it between 2.9.1 and 2.9.2.1. Created attachment 315763 [details, diff]
Patch to allow compilation of snort-2.9.2.3 with active-response disabled
Hello again.
Considering the problem should be fixed by either patching ./src/dynamic-plugins/sf_dynamic_plugins.c or active.h/c and since the active-response USE-flag should affect only the active response support, i decided to try to make a patch that should allow the compilation of the package.
I have attached the patch. It changes the location as well as adds some
#ifdef ACTIVE_RESPONSE [...] #endif
so that the two functions which are not available when active-response is disabled (Active_SendData and Active_SetEnabled) are now available but don't do anything (of course, only when active-response is disabled). Since both functions return void, unless the callers expect some changes in the data they pass, the patch should work just fine.
Since it's the first time i see the snort source code, i have no idea if the patch keeps the full functionality or breaks something else. All i know is that with the patch applied the ./configure (as posted previously) and make commands complete successfully.
So, somebody who has more experience than me in snort code, please take a look at the patch and advise if it should be added to the Gentoo snort package to allow snort to compile with active-response disabled.
Also, please tell me if the USE-flags i'm using are not as they should be (although the ebuild lets me use them), maybe i'm not supposed to use this configuration (however, if that is the case, then why did the ./configure let me, or the ebuild).
Thank you for your time.
I'll take this and see what fix the developers on snort-devel implement. Snort 2.9.3.0 has been released. Changelog: http://www.snort.org/downloads/1797 Nothing in the Changelog about this issue (there is an issue referring to compilation error when active response is disabled, but it was part of snort 2.9.1). I downloaded the source of 2.9.3.0, fixed the ./configure (snort no longer supports outputs to databases, aruba or prelude), and it still crashed in the same place as 2.9.2.3. New ./configure: ./configure --prefix=/usr --build=i686-pc-linux-gnu --host=i686-pc-linux-gnu --mandir=/usr/share/man --infodir=/usr/share/info --datadir=/usr/share --sysconfdir=/etc --localstatedir=/var/lib --enable-shared --disable-static --disable-so-with-static-lib --enable-dynamicplugin --enable-zlib --disable-gre --disable-mpls --disable-targetbased --disable-ppm --enable-perfprofiling --enable-linux-smp-stats --disable-inline-init-failopen --enable-pthread --disable-debug --disable-debug-msgs --disable-corefiles --enable-dlclose --disable-active-response --disable-normalizer --disable-reload-error-restart --disable-react --disable-flexresp3 --enable-paf --disable-large-pcap --disable-ipv6 --enable-reload --disable-build-dynamic-examples --disable-profile --disable-ppm-test --disable-intel-soft-cpm --disable-static-daq --disable-rzb-saac Error compiling: /bin/sh ../libtool --tag=CC --mode=link i686-pc-linux-gnu-gcc -g -O2 -DSF_VISIBILITY -fvisibility=hidden -fno-strict-aliasing -Wall -lpcre -L/usr/lib -ldnet -o snort debug.o decode.o encode.o active.o log.o mstring.o parser.o profiler.o plugbase.o snort.o strlcatu.o strlcpyu.o tag.o util.o detect.o signature.o mempool.o sf_sdlist.o fpcreate.o fpdetect.o pcrm.o byte_extract.o sfthreshold.o packet_time.o event_wrapper.o event_queue.o ppm.o log_text.o detection_filter.o detection_util.o rate_filter.o obfuscation.o sfdaq.o idle_processing.o output-plugins/libspo.a detection-plugins/libspd.a dynamic-plugins/libdynamic.a dynamic-output/plugins/liboutput.a preprocessors/libspp.a parser/libparser.a target-based/libtarget_based.a preprocessors/HttpInspect/libhttp_inspect.a preprocessors/Stream5/libstream5.a sfutil/libsfutil.a control/libsfcontrol.a -lz -ldnet -lpcre -lpcap -lnsl -luuid -lm -lm -ldl -ldaq -lz -lpthread -lpthread libtool: link: i686-pc-linux-gnu-gcc -g -O2 -DSF_VISIBILITY -fvisibility=hidden -fno-strict-aliasing -Wall -o snort debug.o decode.o encode.o active.o log.o mstring.o parser.o profiler.o plugbase.o snort.o strlcatu.o strlcpyu.o tag.o util.o detect.o signature.o mempool.o sf_sdlist.o fpcreate.o fpdetect.o pcrm.o byte_extract.o sfthreshold.o packet_time.o event_wrapper.o event_queue.o ppm.o log_text.o detection_filter.o detection_util.o rate_filter.o obfuscation.o sfdaq.o idle_processing.o -L/usr/lib output-plugins/libspo.a detection-plugins/libspd.a dynamic-plugins/libdynamic.a dynamic-output/plugins/liboutput.a preprocessors/libspp.a parser/libparser.a target-based/libtarget_based.a preprocessors/HttpInspect/libhttp_inspect.a preprocessors/Stream5/libstream5.a sfutil/libsfutil.a control/libsfcontrol.a -ldnet -lpcre -lpcap -lnsl -luuid -lm /usr/lib/libdaq.so -ldl -lz -lpthread dynamic-plugins/libdynamic.a(sf_dynamic_plugins.o): In function `DynamicSendBlockResponseMsg': /home/knight/Desktop/tempview/snort-2.9.3/src/dynamic-plugins/sf_dynamic_plugins.c:1559: undefined reference to `Active_SendData' dynamic-plugins/libdynamic.a(sf_dynamic_plugins.o): In function `DynamicActiveSetEnabled': /home/knight/Desktop/tempview/snort-2.9.3/src/dynamic-plugins/sf_dynamic_plugins.c:1452: undefined reference to `Active_SetEnabled' collect2: ld returned 1 exit status make[3]: *** [snort] Error 1 make[3]: Leaving directory `/home/knight/Desktop/tempview/snort-2.9.3/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/home/knight/Desktop/tempview/snort-2.9.3/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/home/knight/Desktop/tempview/snort-2.9.3' make: *** [all] Error 2 So the issue this bug was created for still exists. Thank you for your time. Hello. It seems snort-2.9.3.1 includes the fix for this bug. I can confirm 2.9.3.0 does not. Sourcefire feedback reported this: "Hi Valentin-- 2.9.3 was already packaged up and with our test group. Given that there is a work-around, the changes for this issue didn't make the 2.9.3 release. The changes are already in for the next patch release of Snort, so you should see it there. Cheers. -steve" I have attached an ebuild for 2.9.3.1 which is a modified version of snort-2.9.2.3.ebuild from official Portage. It successfully compiles snort without the active response part. I believe so after looking in the build log and seeing no -DACTIVE_RESPONSE that I used to see in previous builds. Modifications to the 2.9.2.3 build include the following: - removed decoder-preprocessor-rules useflag - does not exist in snort-2.9.3+ such ./configure flag. - removed aruba mysql odbc postgres useflags - snort-2.9.3+ does not longer support output to such backends. - removed --disable-prelude and --without-oracle ./configure flags - snort 2.9.3+ does not have those flags anymore. - removed foldes schemas/* from dodoc - source code for snort-2.9.3+ does not include the schemas folder anymore. I also must mention that is order to build a snort IDS sensor without any active response support, ALL USE-flags about inline deployment MUST be disabled. These flags include: -active-response, -flexresp3, -react. The following flags mention inline deployment but do not auto-magic-enable active response: normalizer, ppm. Please verify the ebuild I have attached and confirm the issue can be closed. Thank you for your time. Created attachment 327130 [details]
ebuild based on latest official snort ebuild
|
