Snort mailing list archives
Patch to running Snort on Solaris 10 SPARC
From: Stephan <Stephan () rheoli net>
Date: Wed, 29 Dec 2010 15:32:35 +0100
Hi, Since a long time I couldn't run snort on Solaris SPARC (8 and 10) there was always a 'bus error' after the setup of the rules. By doing some debugging I saw that the bus error always occurs in the HashKeyCmp function (of snort_stream5_session.c) on line 1004. After changing the comparision from 64 to 32 bit the bus error goes away but I got an 'segmentation error' in snort_stream5_tcp.c (for the fix look at patch-snort_stream5_tcp.c). The 'bus error' can also occurs on Frag3KeyCmpFunc. The other solution could be to comment out sfxhash_set_keyops(sessionCache->hashTable, HashFunc, HashKeyCmp); snort_stream5_session.c and sfxhash_set_keyops(f_cache, Frag3KeyHashFunc, Frag3KeyCmpFunc); in spp_frag3.c. In this case memcmp will be used. The patch in patch-snort_stream5_tcp.c is anyway needed to avoid the segemtation error. The patch patch-src-decode.c includes 2 fixes for systems without GRE protocol. Best regards, Stephan
Attachment:
snort-2.9.0.3-patch.tar.gz
Description:
------------------------------------------------------------------------------ Learn how Oracle Real Application Clusters (RAC) One Node allows customers to consolidate database storage, standardize their database environment, and, should the need arise, upgrade to a full multi-node Oracle RAC database without downtime or disruption http://p.sf.net/sfu/oracle-sfdevnl
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel
Current thread:
- Patch to running Snort on Solaris 10 SPARC Stephan (Dec 29)
- Re: Patch to running Snort on Solaris 10 SPARC Joel Esler (Dec 29)