Re: Snort 2.3.0 RC2 with INLINE compilation problems

[Jeremy Hewlett <jh () sourcefire com>]

Sending this to you again, Julio, as I forgot to send to the list. Sorry
that you'll receive two :D

On Thu, Dec 16, Julio E. Gonzalez P. wrote:
>    I  trying  to  compile snort 2.3.0rc2 with inline support, in a Fedora
>    Core 2 distro.
>    First  I  install  libnet-1.0.2a.tar.gz   (./configure  ;  make ; make
>    install ).
>    Then,  I  install snort-2.3.0RC2.tar.gz (./configure --enable-inline ;
>    make )... but the compile fails with this messages....
>    Anyone know why this happens?

[...]

>    In file included from /usr/include/linux/netfilter_ipv4/ip_queue.h:10,
>                     from /usr/include/libipq.h:37,
>                     from ../../src/inline.h:8,
>                     from ../../src/snort.h:36,
>                     from spo_alert_fast.c:51:
>    /usr/include/linux/if.h:59: error: redefinition of `struct ifmap'
>    /usr/include/linux/if.h:77: error: redefinition of `struct ifreq'
>    /usr/include/linux/if.h:126: error: redefinition of `struct ifconf'
>    make[3]: *** [spo_alert_fast.o] Error 1
>    make[3]: Leaving directory
>    `/root/snort/snort-2.3.0RC2/src/output-plugins'
>    make[2]: *** [all-recursive] Error 1
>    make[2]: Leaving directory `/root/snort/snort-2.3.0RC2/src'
>    make[1]: *** [all-recursive] Error 1
>    make[1]: Leaving directory `/root/snort/snort-2.3.0RC2'
>    make: *** [all] Error 2
 
 
Answer:  You need to update the kernel headers used by your glibc.  A
quick fix is to create a link between /usr/include and the include
directory of your kernel source.  For example, if you are trying to
use this with kernel version 2.4.24, you can do the following:

cd /usr/include
mv linux linux.orig
ln -s /usr/src/linux-2.4.24/include/linux linux

Now simply go to your snort_inline directory and recompile (make clean
first).

** That is, point to a set of "real" kernel includes instead of RH's
glibc-kernheaders package. ** 


(From http://snort-inline.com/FAQ.html#compiling). This works for me. I'll
make sure the documentation references the FAQ in future releases.
Thanks.




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now. 
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users