Hi Justin,
You just might be right, but I'm curious to know presence or lack of a
trailing slash in the snort.conf affects the use "nm" when run against
the shared library itself?
Thanks in advance,
JC
________________________________
From: Justin Heath [mailto:justin.heath@gmail.com]
Sent: Wednesday, May 31, 2006 7:00 AM
To: Jason Monroe
Cc: snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] (Compile) undefined symbol:
InitializePreprocessor
Looks like you have you dynamic preprocessor directive set wrong in
snort.conf
im guessing you have something like:
dynamicpreprocessor directory /opt/snort/2.6/lib/snort_dynamicengine/
which should be changed to:
dynamicpreprocessor directory
/opt/snort/2.6/lib/snort_dynamicpreprocessor
On 5/30/06, Jason Monroe < monroe@arcsight.com
<mailto:monroe@arcsight.com> > wrote:
Hi All,
I've tried to compile snort 2.6RC2 on Fedora Core 5 as well as RHEL 4 AS
which are GCC 4.1.0 and 3.4.5-2 respectively. Both distros are producing
the same result.
./configure --enable-dynamicplugin --prefix=/opt/snort/2.6 && make &&
make install
Then with the paths modified in the snort.conf
[root@manager snort-2.6.0RC2]# grep '/opt/snort' /etc/snort/snort.conf
var RULE_PATH /opt/snort/rules
dynamicpreprocessor directory /opt/snort/2.6/lib/snort_dynamicengine/
dynamicengine /opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so
running snort with -c option
/opt/snort/2.6/bin/snort -c /etc/snort/snort.conf
yeilds:
+-----------------------[suppression]-----------------------------------
-------
| none
------------------------------------------------------------------------
-------
Rule application order: ->activation->dynamic->pass->drop->alert->log
Log directory = /var/log/snort
Loading dynamic engine
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so... done
Loading all dynamic preprocessor libs from
/opt/snort/2.6/lib/snort_dynamicengine/...
Loading dynamic preprocessor library
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so... ERROR: Failed
to find InitializePreprocessor() function in
/opt/snort/2.6/lib/snort_dynamicengine//libsf_engine.so:
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so: undefined
symbol: InitializePreprocessor
Fatal Error, Quitting..
Running nm
nm /opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so | grep 'U '
U calloc@@GLIBC_2.0
U __ctype_b_loc@@GLIBC_2.3
U __ctype_toupper_loc@@GLIBC_2.3
U fclose@@GLIBC_2.1
U fopen@@GLIBC_2.1
U fprintf@@GLIBC_2.0
U free@@GLIBC_2.0
U fwrite@@GLIBC_2.0
U malloc@@GLIBC_2.0
U memcmp@@GLIBC_2.0
U memcpy@@GLIBC_2.0
U pcre_compile
U pcre_exec
U pcre_study
U rand@@GLIBC_2.0
U snprintf@@GLIBC_2.0
U srand@@GLIBC_2.0
U strcmp@@GLIBC_2.0
U __strdup@@GLIBC_2.0
U strncpy@@GLIBC_2.0
U __strtol_internal@@GLIBC_2.0
U __strtoul_internal@@GLIBC_2.0
U time@@GLIBC_2.0
I have RPMs pcre-4.5 and pcre-devel-4.5 installed on the system
The only thing that I could find regarding symbol version was to make
possibly make use of --disable-symvers which would be given to the
configure script, however, I don't think that was the correct place.
I have:
/opt/snort/2.6/lib/snort_dynamicpreprocessor
/opt/snort/2.6/lib/snort_dynamicengine
both in /etc/ld.so.conf and re-ran /sbin/ldconfig
Perhaps I'm missing something simple that one of you folks could be so
kind as to point out.
Thanks in advance,
JC
