[Snort-devel] Snort 2.8.6.1, "Error: Failed to find LibVerion()" while trying to develop a preprocessor module

Joel Esler jesler at ...402...
Wed Jul 28 18:55:32 EDT 2010


BlackLight said:
> I need to work on Snort for my master thesis, developing a preprocessor
> module on Snort 2.8.6.1. I started from the spp_example.c code,
> creating a directory called "testpreproc" in snort_dynamicpreprocessor
> with the following content:
> 
> spp_example.c -> http://sprunge.us/GYUA
> sf_dynamic_preproc_lib.c -> http://sprunge.us/HUZZ
> sf_preproc_info.h -> http://sprunge.us/dIaU
> 
> and this is the Makefile: 
> 
> all:
>         gcc -I${HOME}/local/snort-src/src/dynamic-preprocessors/include -g -O2 -DDYNAMIC_PLUGIN -DSUP_IP6 -g -O2 -fvisibility=hidden -fno-strict-aliasing -Wall -fPIC -DPIC -shared sf_dynamic_preproc_lib.c spp_example.c -o ../libsf_dynamic_preprocessor_example.so.0.0.0
>         ln -sf ${PWD}/../libsf_dynamic_preprocessor_example.so.0.0.0 ${PWD}/../libsf_dynamic_preprocessor_example.so.0
>         ln -sf ${PWD}/../libsf_dynamic_preprocessor_example.so.0.0.0 ${PWD}/../libsf_dynamic_preprocessor_example.so
> 
> The compilation problem is OK, but when I try to start Snort I get the
> following error:
> 
> Loading dynamic preprocessor library /home/blacklight/local/snort/lib/snort_dynamicpreprocessor//libsf_dynamic_preprocessor_example.so...  ERROR: Failed to find LibVersion() function in /home/blacklight/local/snort/lib/snort_dynamicpreprocessor//libsf_dynamic_preprocessor_example.so: /home/blacklight/local/snort/lib/snort_dynamicpreprocessor//libsf_dynamic_preprocessor_example.so: undefined symbol: LibVersion Fatal Error, Quitting..
> 
> Googling around I noticed it's quite a common error, but the solution
> everybody offers is to remove the binary file of the preprocessor
> example from the preprocessor directory. Of course, this solution is OK
> and works if you're just trying to run Snort and you don't care about
> creating new preprocessor modules. In my case I want to create one, so
> the solution of removing my own compiled .so file won't work. What's
> the cause of that issue? Of course, as you may notice, the LibVersion()
> function is correctly declared and instantiated in
> sf_dynamic_preproc_lib.c, so there's no apparent reason why Snort
> shouldn't find that function.
> 

You need to delete the libsf_dynamic_preprocessor_example.* files in
order to have Snort function.

j




More information about the Snort-devel mailing list