[Snort-users] dcerpc2 build problem

Seth Art sethsec at ...11827...
Sat Apr 11 11:54:34 EDT 2009


Yep.  I ran into the same issue and was planning on sending it in
Monday.  It is an issue with the spec file.

Make these following changes to the snort.spec file in the rpm
directory of the tarball:

Old:

(In the %install section)

        %__install -p -m 0755
plain/src/dynamic-preprocessors/build/%{_prefix}/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.so.0
$RPM_BUILD_ROOT%{_libdir}/%{realname}-%{version}_dynamicpreprocessor

 %__ln_s -f %{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dcerpc_preproc.so.0
$RPM_BUILD_ROOT%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dcerpc_preproc.so

(In the %files section)

%attr(0755,root,root)
%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dcerpc_preproc.*


New

(In the %install section)

        %__install -p -m 0755
plain/src/dynamic-preprocessors/build/%{_prefix}/lib/snort_dynamicpreprocessor/libsf_dcerpc_preproc.so.0
$RPM_BUILD_ROOT%{_libdir}/%{realname}-%{version}_dynamicpreprocessor
        %__install -p -m 0755
plain/src/dynamic-preprocessors/build/%{_prefix}/lib/snort_dynamicpreprocessor/libsf_dce2_preproc.so.0
$RPM_BUILD_ROOT%{_libdir}/%{realname}-%{version}_dynamicpreprocessor

 %__ln_s -f %{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dcerpc_preproc.so.0
$RPM_BUILD_ROOT%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dcerpc_preproc.so
 %__ln_s -f %{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dce2_preproc.so.0
$RPM_BUILD_ROOT%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dce2_preproc.so

(In the %files section)

%attr(0755,root,root)
%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dcerpc_preproc.*
%attr(0755,root,root)
%{_libdir}/%{realname}-%{version}_dynamicpreprocessor/libsf_dce2_preproc.*


That should do the trick!  Rebuild the rpm (rpm -ba snort.spec) and
you should get an RPM that does in fact inlclude the new dce2 preproc.
  Good luck.

-Seth








On Fri, Apr 10, 2009 at 4:17 PM, Ritter, Nicholas
<Nicholas.Ritter at ...14550...> wrote:
> Has anyone had dcerpc2 errors with their snort config and a missing dcerpc2
> shared module (libsf_dce2_preproc.so) in the 2.8.4 snort rpm and tarball?
>
>
>
> My snort gives errors about not recognizing the config directives, and I
> have no libsf_dce2_preproc.so anywhere, just libsf_dcerpc_preproc.so.
>
>
>
> I am running CentOS 5.3 on x86_64.
>
>
>
> Nick
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by:
> High Quality Requirements in a Collaborative Environment.
> Download a free trial of Rational Requirements Composer Now!
> http://p.sf.net/sfu/www-ibm-com
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
>




More information about the Snort-users mailing list