Skip to content
This repository has been archived by the owner on Jan 18, 2024. It is now read-only.

Will not compile with libpcap.1.9.0 #245

Open
csbflyer opened this issue Jan 20, 2019 · 20 comments
Open

Will not compile with libpcap.1.9.0 #245

csbflyer opened this issue Jan 20, 2019 · 20 comments

Comments

@csbflyer
Copy link

I am unable to make barnyard2-master with the latest libpcap.1.9.0. Works fine with libpcap.1.8.1. Below is the error I receive:

make all-recursive
make[1]: Entering directory /home/analyst/installation_files/barnyard2-master' Making all in src make[2]: Entering directory /home/analyst/installation_files/barnyard2-master/src'
Making all in sfutil
make[3]: Entering directory /home/analyst/installation_files/barnyard2-master/src/sfutil' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c getopt_long.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfmemcap.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfprimetable.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfxhash.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_ip.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_iph.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_ipvar.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_textlog.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_vartable.c rm -f libsfutil.a ar cru libsfutil.a getopt_long.o sfmemcap.o sfprimetable.o sfxhash.o sf_ip.o sf_iph.o sf_ipvar.o sf_textlog.o sf_vartable.o ranlib libsfutil.a make[3]: Leaving directory /home/analyst/installation_files/barnyard2-master/src/sfutil'
Making all in output-plugins
make[3]: Entering directory /home/analyst/installation_files/barnyard2-master/src/output-plugins' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_arubaaction.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_bro.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_cef.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_csv.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_fast.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_full.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_fwsam.c make[3]: Leaving directory /home/analyst/installation_files/barnyard2-master/src/output-plugins'
make[2]: Leaving directory /home/analyst/installation_files/barnyard2-master/src' make[1]: Leaving directory /home/analyst/installation_files/barnyard2-master'
In file included from ../decode.h:49:0,
from ../plugbase.h:70,
from ../spooler.h:32,
from ../barnyard2.h:52,
from spo_alert_fwsam.c:91:
/opt/snort/include/sfbpf_dlt.h:642:0: warning: "DLT_IEEE802_15_4" redefined [enabled by default]
#define DLT_IEEE802_15_4 195
^
In file included from /opt/snort/include/pcap/bpf.h:109:0,
from /opt/snort/include/pcap/pcap.h:88,
from /opt/snort/include/pcap.h:43,
from ../barnyard2.h:46,
from spo_alert_fwsam.c:91:
/opt/snort/include/pcap/dlt.h:749:0: note: this is the location of the previous definition
#define DLT_IEEE802_15_4 DLT_IEEE802_15_4_WITHFCS
^
In file included from /opt/snort/include/pcap.h:43:0,
from ../barnyard2.h:46,
from spo_alert_fwsam.c:91:
/opt/snort/include/pcap/pcap.h:950:18: error: two or more data types in declaration specifiers
#define SOCKET int
^
spo_alert_fwsam.c:118:13: note: in expansion of macro ‘SOCKET’
typedef int SOCKET;
^
spo_alert_fwsam.c:118:1: warning: useless type name in empty declaration [enabled by default]
typedef int SOCKET;
^
spo_alert_fwsam.c: In function ‘AlertFWsam’:
spo_alert_fwsam.c:981:18: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable]
ClassType *cn = NULL;
^
spo_alert_fwsam.c:973:27: warning: variable ‘lastbsp’ set but not used [-Wunused-but-set-variable]
static unsigned short lastbsp[FWSAM_REPET_BLOCKS];
^
make[3]: *** [spo_alert_fwsam.o] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2

@csbflyer
Copy link
Author

This occurs when trying to compile with libpcap.1.9.0
snort, libpcap and daq all exist in /opt/snort.

@q2dg
Copy link

q2dg commented Mar 5, 2019

Well, it seems this project is pretty abandoned, isn't?

@YBSNNLRX
Copy link

I have the same problem as you,Have you solved it?

@csbflyer
Copy link
Author

I switched to previous version of libpcap, however, you can compile barnyard2 in separate directory from snort with libpcap 1.9.0.
/opt/snort
/opt/barnyard2

@YBSNNLRX
Copy link

YBSNNLRX commented May 14, 2019

I switched to libpcap-1.8.1 or libpcap-1.5.3,then compile barnyard2 also display below error :
make all-recursive make[1]: Entering directory /etc/snort/barnyard2'
Making all in src
make[2]: Entering directory /etc/snort/barnyard2/src' Making all in sfutil make[3]: Entering directory /etc/snort/barnyard2/src/sfutil'
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c getopt_long.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfmemcap.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfprimetable.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfxhash.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_ip.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_iph.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_ipvar.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_textlog.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_vartable.c
rm -f libsfutil.a
ar cru libsfutil.a getopt_long.o sfmemcap.o sfprimetable.o sfxhash.o sf_ip.o sf_iph.o sf_ipvar.o sf_textlog.o sf_vartable.o
ranlib libsfutil.a
make[3]: Leaving directory /etc/snort/barnyard2/src/sfutil' Making all in output-plugins make[3]: Entering directory /etc/snort/barnyard2/src/output-plugins'
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_arubaaction.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_bro.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_cef.c
spo_alert_cef.c: In function ‘AlertCEF’:
spo_alert_cef.c:500:15: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable]
ClassType *cn;
^
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_csv.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_fast.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_full.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_fwsam.c
spo_alert_fwsam.c: In function ‘AlertFWsam’:
spo_alert_fwsam.c:966:5: error: unknown type name ‘SOCKET’
SOCKET stationsocket;
^
spo_alert_fwsam.c:981:18: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable]
ClassType *cn = NULL;
^
spo_alert_fwsam.c:980:18: warning: variable ‘sn’ set but not used [-Wunused-but-set-variable]
SigNode *sn = NULL;
^
spo_alert_fwsam.c:973:27: warning: variable ‘lastbsp’ set but not used [-Wunused-but-set-variable]
static unsigned short lastbsp[FWSAM_REPET_BLOCKS];
^
spo_alert_fwsam.c: In function ‘FWsamCheckOut’:
spo_alert_fwsam.c:1392:5: error: unknown type name ‘SOCKET’
SOCKET stationsocket;
^
spo_alert_fwsam.c: In function ‘FWsamCheckIn’:
spo_alert_fwsam.c:1543:5: error: unknown type name ‘SOCKET’
SOCKET stationsocket;
^
make[3]: *** [spo_alert_fwsam.o] Error 1
make[3]: Leaving directory /etc/snort/barnyard2/src/output-plugins' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory /etc/snort/barnyard2/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory /etc/snort/barnyard2' make: *** [all] Error 2

@csbflyer
Copy link
Author

This worked for me:
Make snort & libpcap 1.9 in /opt/snort
Make barnyard2 in /opt/barnyard2

@NathanGibbs3
Copy link

So as long as snort and barnyard2 are in separate directories, it's possible to build them both with libpcap 1.9. Am I understanding that correctly?

@YBSNNLRX
Copy link

Actually snort and barnyard2 is in separate directories, but this error is along exist,I haven't found a solution yet.
Do you think it necessary for me to reinstall it?

@miladstar77
Copy link

Hi
you can compile with libpcap-1.8.1

@YBSNNLRX
Copy link

Thanks,then I successfully reinstalled it with libpcap-1.8.1.

@Gerjo
Copy link

Gerjo commented Dec 13, 2019

My pull request here fixes this particular issue: #254

@ParagVadher
Copy link

My pull request here fixes this particular issue: #254

I am grateful for this great service! Thank you so very much.

@FalcoGer
Copy link

My pull request here fixes this particular issue: #254

Works fine. Thank you. Why isn't this merged yet?

@519seven
Copy link

519seven commented Oct 20, 2020

@Gerjo Thank you for the fix! I applied this fix, too: #252 and things are moving along now.

@miladstar77
Copy link

miladstar77 commented Nov 11, 2020 via email

@Atsuyakitamago
Copy link

I'm sorry for my poor English.

My environment is Ubuntu 20.04 LTS.

I have some questions.

I use "apt" command to manage package.

(1)
Which libpcap means "libpcap-dev" or "libpcap0.8" ?

(2)
What should I do to uninstall libpcap 1.9.1 and install libpcap 1.8.1 ?

(3)
I unistalled libpcap-dev 1.9.1 and installed libpcap-dev 1.8.1.

Then, when I executed "snort -V", result includes a sentence of "Using libpcap version 1.9.1".

What should I do to make this sentence "Using libpcap version 1.8.1"?

I'm sorry for many questions.

@NathanGibbs3
Copy link

What you did in (3) should allow you to build barnyard2.
It does not matter which libpcap snort is using.

@Atsuyakitamago
Copy link

Sorry for the late reply. It worked. Thank you very much!

@Camanche827
Copy link

Hi to all! I have a problem! I'm trying to build barnyard2 on ubuntu 22.04. But some errors arise. As i saw from previous comments it happens because of libpcap 1.9.1. If its true, please provide me with strict commands for reinstalling libpcap to 1.8.1 version! Thank you!

@Camanche827
Copy link

Thanks,then I successfully reinstalled it with libpcap-1.8.1.

Hello! Do you still remember how you reinstall libpcap?

guyharris added a commit to guyharris/libpcap that referenced this issue Dec 23, 2023
Doing so can cause namespace collisions, as per, for example,
firnsy/barnyard2#245.

Instead, define PCAP_SOCKET, and use that.

On Windows, this shouldn't break any APIs, as any code using the two
active-mode APIs that return a socket handle would probably be assigning
their return values to a SOCKET, and as, on Windows, we're defining
PCAP_SOCKET as SOCKET, there would be no type clash.

On UN*Xes, this might break code that uses one of the two active-mode
APIs that return a socket handle if those programs were written to
assign the return values of those APIs to a SOCKET, as we're no longer
defining SOCKET.  However, as those APIs are only provided if libpcap is
built with remote capture support - which is not the default - and as
they're somewhat painful to use, there's probably little if any code
that needs to compile for UN*X and that uses them.  If there *is* any
such code, it could do

    #ifndef PCAP_SOCKET
        #ifdef _WIN32
            #define PCAP_SOCKET SOCKET
        #else
            #defube PCAP_SOCKET int
        #endif
    #endif

and use PCAP_SOCKET.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests