Snort mailing list archives
Re: Patch to running Snort on Solaris 10 SPARC
From: Joel Esler <jesler () sourcefire com>
Date: Wed, 29 Dec 2010 10:15:02 -0500
Stephan said:
Hi, Since a long time I couldn't run snort on Solaris SPARC (8 and 10) there was always a 'bus error' after the setup of the rules. By doing some debugging I saw that the bus error always occurs in the HashKeyCmp function (of snort_stream5_session.c) on line 1004. After changing the comparision from 64 to 32 bit the bus error goes away but I got an 'segmentation error' in snort_stream5_tcp.c (for the fix look at patch-snort_stream5_tcp.c). The 'bus error' can also occurs on Frag3KeyCmpFunc. The other solution could be to comment out sfxhash_set_keyops(sessionCache->hashTable, HashFunc, HashKeyCmp); snort_stream5_session.c and sfxhash_set_keyops(f_cache, Frag3KeyHashFunc, Frag3KeyCmpFunc); in spp_frag3.c. In this case memcmp will be used. The patch in patch-snort_stream5_tcp.c is anyway needed to avoid the segemtation error. The patch patch-src-decode.c includes 2 fixes for systems without GRE protocol. Best regards, Stephan
Stephan, Thanks, I'll get this filed in a bug. Joel ------------------------------------------------------------------------------ Learn how Oracle Real Application Clusters (RAC) One Node allows customers to consolidate database storage, standardize their database environment, and, should the need arise, upgrade to a full multi-node Oracle RAC database without downtime or disruption http://p.sf.net/sfu/oracle-sfdevnl _______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel
Current thread:
- Patch to running Snort on Solaris 10 SPARC Stephan (Dec 29)
- Re: Patch to running Snort on Solaris 10 SPARC Joel Esler (Dec 29)