Skip to content
This repository has been archived by the owner on Jan 18, 2024. It is now read-only.

Will not compile with libpcap.1.9.0 #245

Open
csbflyer opened this issue Jan 20, 2019 · 20 comments
Open

Will not compile with libpcap.1.9.0 #245

csbflyer opened this issue Jan 20, 2019 · 20 comments

Comments

@csbflyer
Copy link

I am unable to make barnyard2-master with the latest libpcap.1.9.0. Works fine with libpcap.1.8.1. Below is the error I receive:

make all-recursive
make[1]: Entering directory /home/analyst/installation_files/barnyard2-master' Making all in src make[2]: Entering directory /home/analyst/installation_files/barnyard2-master/src'
Making all in sfutil
make[3]: Entering directory /home/analyst/installation_files/barnyard2-master/src/sfutil' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c getopt_long.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfmemcap.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfprimetable.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sfxhash.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_ip.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_iph.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_ipvar.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_textlog.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c sf_vartable.c rm -f libsfutil.a ar cru libsfutil.a getopt_long.o sfmemcap.o sfprimetable.o sfxhash.o sf_ip.o sf_iph.o sf_ipvar.o sf_textlog.o sf_vartable.o ranlib libsfutil.a make[3]: Leaving directory /home/analyst/installation_files/barnyard2-master/src/sfutil'
Making all in output-plugins
make[3]: Entering directory /home/analyst/installation_files/barnyard2-master/src/output-plugins' gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_arubaaction.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_bro.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_cef.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_csv.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_fast.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_full.c gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/opt/snort/include -DDEBUG -g -O0 -fno-strict-aliasing -Wall -c spo_alert_fwsam.c make[3]: Leaving directory /home/analyst/installation_files/barnyard2-master/src/output-plugins'
make[2]: Leaving directory /home/analyst/installation_files/barnyard2-master/src' make[1]: Leaving directory /home/analyst/installation_files/barnyard2-master'
In file included from ../decode.h:49:0,
from ../plugbase.h:70,
from ../spooler.h:32,
from ../barnyard2.h:52,
from spo_alert_fwsam.c:91:
/opt/snort/include/sfbpf_dlt.h:642:0: warning: "DLT_IEEE802_15_4" redefined [enabled by default]
#define DLT_IEEE802_15_4 195
^
In file included from /opt/snort/include/pcap/bpf.h:109:0,
from /opt/snort/include/pcap/pcap.h:88,
from /opt/snort/include/pcap.h:43,
from ../barnyard2.h:46,
from spo_alert_fwsam.c:91:
/opt/snort/include/pcap/dlt.h:749:0: note: this is the location of the previous definition
#define DLT_IEEE802_15_4 DLT_IEEE802_15_4_WITHFCS
^
In file included from /opt/snort/include/pcap.h:43:0,
from ../barnyard2.h:46,
from spo_alert_fwsam.c:91:
/opt/snort/include/pcap/pcap.h:950:18: error: two or more data types in declaration specifiers
#define SOCKET int
^
spo_alert_fwsam.c:118:13: note: in expansion of macro ‘SOCKET’
typedef int SOCKET;
^
spo_alert_fwsam.c:118:1: warning: useless type name in empty declaration [enabled by default]
typedef int SOCKET;
^
spo_alert_fwsam.c: In function ‘AlertFWsam’:
spo_alert_fwsam.c:981:18: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable]
ClassType *cn = NULL;
^
spo_alert_fwsam.c:973:27: warning: variable ‘lastbsp’ set but not used [-Wunused-but-set-variable]
static unsigned short lastbsp[FWSAM_REPET_BLOCKS];
^
make[3]: *** [spo_alert_fwsam.o] Error 1
make[2]: *** [all-recursive] Error 1
make[1]: *** [all-recursive] Error 1
make: *** [all] Error 2
@csbflyer
Copy link
Author

This occurs when trying to compile with libpcap.1.9.0
snort, libpcap and daq all exist in /opt/snort.

@q2dg
Copy link

q2dg commented Mar 5, 2019

Well, it seems this project is pretty abandoned, isn't?

@YBSNNLRX
Copy link

I have the same problem as you，Have you solved it?

@csbflyer
Copy link
Author

I switched to previous version of libpcap, however, you can compile barnyard2 in separate directory from snort with libpcap 1.9.0.
/opt/snort
/opt/barnyard2

@YBSNNLRX
Copy link

YBSNNLRX commented May 14, 2019 •
edited
Loading

I switched to libpcap-1.8.1 or libpcap-1.5.3，then compile barnyard2 also display below error :
make all-recursive make[1]: Entering directory /etc/snort/barnyard2'
Making all in src
make[2]: Entering directory /etc/snort/barnyard2/src' Making all in sfutil make[3]: Entering directory /etc/snort/barnyard2/src/sfutil'
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c getopt_long.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfmemcap.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfprimetable.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sfxhash.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_ip.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_iph.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_ipvar.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_textlog.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c sf_vartable.c
rm -f libsfutil.a
ar cru libsfutil.a getopt_long.o sfmemcap.o sfprimetable.o sfxhash.o sf_ip.o sf_iph.o sf_ipvar.o sf_textlog.o sf_vartable.o
ranlib libsfutil.a
make[3]: Leaving directory /etc/snort/barnyard2/src/sfutil' Making all in output-plugins make[3]: Entering directory /etc/snort/barnyard2/src/output-plugins'
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_arubaaction.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_bro.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_cef.c
spo_alert_cef.c: In function ‘AlertCEF’:
spo_alert_cef.c:500:15: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable]
ClassType *cn;
^
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_csv.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_fast.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_full.c
gcc -DHAVE_CONFIG_H -I. -I../.. -I.. -I ../sfutil -I/usr/include/mysql -DENABLE_MYSQL -g -O2 -fno-strict-aliasing -Wall -c spo_alert_fwsam.c
spo_alert_fwsam.c: In function ‘AlertFWsam’:
spo_alert_fwsam.c:966:5: error: unknown type name ‘SOCKET’
SOCKET stationsocket;
^
spo_alert_fwsam.c:981:18: warning: variable ‘cn’ set but not used [-Wunused-but-set-variable]
ClassType *cn = NULL;
^
spo_alert_fwsam.c:980:18: warning: variable ‘sn’ set but not used [-Wunused-but-set-variable]
SigNode *sn = NULL;
^
spo_alert_fwsam.c:973:27: warning: variable ‘lastbsp’ set but not used [-Wunused-but-set-variable]
static unsigned short lastbsp[FWSAM_REPET_BLOCKS];
^
spo_alert_fwsam.c: In function ‘FWsamCheckOut’:
spo_alert_fwsam.c:1392:5: error: unknown type name ‘SOCKET’
SOCKET stationsocket;
^
spo_alert_fwsam.c: In function ‘FWsamCheckIn’:
spo_alert_fwsam.c:1543:5: error: unknown type name ‘SOCKET’
SOCKET stationsocket;
^
make[3]: *** [spo_alert_fwsam.o] Error 1
make[3]: Leaving directory /etc/snort/barnyard2/src/output-plugins' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory /etc/snort/barnyard2/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory /etc/snort/barnyard2' make: *** [all] Error 2

@csbflyer
Copy link
Author

This worked for me:
Make snort & libpcap 1.9 in /opt/snort
Make barnyard2 in /opt/barnyard2

@NathanGibbs3
Copy link

So as long as snort and barnyard2 are in separate directories, it's possible to build them both with libpcap 1.9. Am I understanding that correctly?

@YBSNNLRX
Copy link

Actually snort and barnyard2 is in separate directories, but this error is along exist,I haven't found a solution yet.
Do you think it necessary for me to reinstall it?

@miladstar77
Copy link

Hi
you can compile with libpcap-1.8.1

@YBSNNLRX
Copy link

Thanks,then I successfully reinstalled it with libpcap-1.8.1.

@Gerjo
Copy link

Gerjo commented Dec 13, 2019

My pull request here fixes this particular issue: #254

@ParagVadher
Copy link

My pull request here fixes this particular issue: #254

I am grateful for this great service! Thank you so very much.

@FalcoGer
Copy link

My pull request here fixes this particular issue: #254

Works fine. Thank you. Why isn't this merged yet?

@519seven
Copy link

519seven commented Oct 20, 2020 •
edited
Loading

@Gerjo Thank you for the fix! I applied this fix, too: #252 and things are moving along now.

@miladstar77
Copy link

miladstar77 commented Nov 11, 2020 via email

@Atsuyakitamago
Copy link

I'm sorry for my poor English.

My environment is Ubuntu 20.04 LTS.

I have some questions.

I use "apt" command to manage package.

(1)
Which libpcap means "libpcap-dev" or "libpcap0.8" ?

(2)
What should I do to uninstall libpcap 1.9.1 and install libpcap 1.8.1 ?

(3)
I unistalled libpcap-dev 1.9.1 and installed libpcap-dev 1.8.1.

Then, when I executed "snort -V", result includes a sentence of "Using libpcap version 1.9.1".

What should I do to make this sentence "Using libpcap version 1.8.1"?

I'm sorry for many questions.

@NathanGibbs3
Copy link

What you did in (3) should allow you to build barnyard2.
It does not matter which libpcap snort is using.

@Atsuyakitamago
Copy link

Sorry for the late reply. It worked. Thank you very much!

@Camanche827
Copy link

Hi to all! I have a problem! I'm trying to build barnyard2 on ubuntu 22.04. But some errors arise. As i saw from previous comments it happens because of libpcap 1.9.1. If its true, please provide me with strict commands for reinstalling libpcap to 1.8.1 version! Thank you!

@Camanche827
Copy link

Thanks,then I successfully reinstalled it with libpcap-1.8.1.

Hello! Do you still remember how you reinstall libpcap?

guyharris added a commit to guyharris/libpcap that referenced this issue Dec 23, 2023
@guyharris
Don't define SOCKET ourselves.
f503e16 
Doing so can cause namespace collisions, as per, for example,
firnsy/barnyard2#245.

Instead, define PCAP_SOCKET, and use that.

On Windows, this shouldn't break any APIs, as any code using the two
active-mode APIs that return a socket handle would probably be assigning
their return values to a SOCKET, and as, on Windows, we're defining
PCAP_SOCKET as SOCKET, there would be no type clash.

On UN*Xes, this might break code that uses one of the two active-mode
APIs that return a socket handle if those programs were written to
assign the return values of those APIs to a SOCKET, as we're no longer
defining SOCKET.  However, as those APIs are only provided if libpcap is
built with remote capture support - which is not the default - and as
they're somewhat painful to use, there's probably little if any code
that needs to compile for UN*X and that uses them.  If there *is* any
such code, it could do

    #ifndef PCAP_SOCKET
        #ifdef _WIN32
            #define PCAP_SOCKET SOCKET
        #else
            #defube PCAP_SOCKET int
        #endif
    #endif

and use PCAP_SOCKET.
@guyharris guyharris mentioned this issue Dec 23, 2023
Merged
@guyharris guyharris mentioned this issue Jan 26, 2024
Merged
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests