RE: (Compile 2.6RC2) undefined symbol: InitializePreprocessor

["Jason Monroe" <monroe () arcsight com>]

Hi Justin,

 

You just might be right, but I'm curious to know presence or lack of a
trailing slash in the snort.conf affects the use "nm" when run against
the shared library itself?

 

Thanks in advance,

 

JC

 

 

 

 

________________________________

From: Justin Heath [mailto:justin.heath () gmail com] 
Sent: Wednesday, May 31, 2006 7:00 AM
To: Jason Monroe
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] (Compile) undefined symbol:
InitializePreprocessor

 

Looks like you have you dynamic preprocessor directive set wrong in
snort.conf

im guessing you have something like:

dynamicpreprocessor directory /opt/snort/2.6/lib/snort_dynamicengine/

which should be changed to: 

dynamicpreprocessor directory
/opt/snort/2.6/lib/snort_dynamicpreprocessor

On 5/30/06, Jason Monroe < monroe () arcsight com
<mailto:monroe () arcsight com> > wrote:

Hi All,

I've tried to compile snort 2.6RC2 on Fedora Core 5 as well as RHEL 4 AS
which are GCC 4.1.0 and 3.4.5-2 respectively. Both distros are producing
the same result.

./configure --enable-dynamicplugin --prefix=/opt/snort/2.6  && make &&
make install
Then with the paths modified in the snort.conf
[root@manager snort-2.6.0RC2]# grep '/opt/snort' /etc/snort/snort.conf
var RULE_PATH /opt/snort/rules
dynamicpreprocessor directory /opt/snort/2.6/lib/snort_dynamicengine/
dynamicengine /opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so


running snort with -c option
/opt/snort/2.6/bin/snort -c /etc/snort/snort.conf

yeilds:
+-----------------------[suppression]-----------------------------------
-------
| none
------------------------------------------------------------------------
-------
Rule application order: ->activation->dynamic->pass->drop->alert->log
Log directory = /var/log/snort
Loading dynamic engine
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so... done
Loading all dynamic preprocessor libs from
/opt/snort/2.6/lib/snort_dynamicengine/...
  Loading dynamic preprocessor library
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so... ERROR: Failed
to find InitializePreprocessor() function in
/opt/snort/2.6/lib/snort_dynamicengine//libsf_engine.so:
/opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so: undefined
symbol: InitializePreprocessor 
Fatal Error, Quitting..


Running nm
nm /opt/snort/2.6/lib/snort_dynamicengine/libsf_engine.so | grep 'U '
         U calloc@@GLIBC_2.0
         U __ctype_b_loc@@GLIBC_2.3
         U __ctype_toupper_loc@@GLIBC_2.3
         U fclose@@GLIBC_2.1
         U fopen@@GLIBC_2.1
         U fprintf@@GLIBC_2.0
         U free@@GLIBC_2.0
         U fwrite@@GLIBC_2.0
         U malloc@@GLIBC_2.0
         U memcmp@@GLIBC_2.0
         U memcpy@@GLIBC_2.0
         U pcre_compile
         U pcre_exec
         U pcre_study
         U rand@@GLIBC_2.0
         U snprintf@@GLIBC_2.0
         U srand@@GLIBC_2.0
         U strcmp@@GLIBC_2.0
         U __strdup@@GLIBC_2.0
         U strncpy@@GLIBC_2.0
         U __strtol_internal@@GLIBC_2.0
         U __strtoul_internal@@GLIBC_2.0
         U time@@GLIBC_2.0

I have RPMs pcre-4.5 and pcre-devel-4.5 installed on the system

The only thing that I could find regarding symbol version was to make
possibly make use of --disable-symvers which would be given to the
configure script, however, I don't think that was the correct place.

I have:
/opt/snort/2.6/lib/snort_dynamicpreprocessor
/opt/snort/2.6/lib/snort_dynamicengine
both in /etc/ld.so.conf and re-ran /sbin/ldconfig

Perhaps I'm missing something simple that one of you folks could be so
kind as to point out.

Thanks in advance,

JC