[Snort-users] Ubuntu 18 and so rules error

Russ rucombs at cisco.com
Wed Jun 13 21:08:15 EDT 2018


The ldd output below doesn't show the dependency on the math lib so it 
should work if you add that dependency to the build foo for 
protocol-dns.so.  Adding this around line 227 of src/Makefile should do it:

LD_FLAGS += -lm

That would impact all libs (probably insignificant) so you could get 
fancy and create a separate rule for protocol-dns.so.

If mucking with make isn't your thing, a quick and dirty workaround 
would be to add the dependency directly into Snort by having it call log 
(eg add log(1); to main in snort.c).

Hope that helps.
Russ

On 6/13/18 5:51 PM, James Lay wrote:
>
> Ran like a champ:
>
> now we're having some fun!
>
> James
>
> On 2018-06-13 09:20, Patrick Mullen (pamullen) wrote:
>
>> James,
>>
>> Here's a quick test.  If this doesn't work, then install whatever 
>> google tells you and it should fix the snort loading problem.  If it 
>> does, then I'm a little confused and we'll have to look into this 
>> further.
>>
>> $ cat test.c
>>
>> #include <stdio.h>
>>
>> #include <math.h>
>>
>> int main(void) {
>>
>> printf("log(100) = %0.3f\n", log(100));
>>
>> }
>>
>> $ gcc -lm test.c -o test
>>
>> $ ./test
>>
>> log(100) = 4.605
>>
>> Notice the "-lm" (dash lowercase 'L' 'm').  That tells the linker to 
>> link the math library, which is included in the source file.
>>
>> Thanks,
>>
>> ~Patrick
>>
>> *From: *James Lay <jlay at slave-tothe-box.net>
>> *Reply-To: *"jlay at slave-tothe-box.net" <jlay at slave-tothe-box.net>
>> *Date: *Wednesday, June 13, 2018 at 7:46 AM
>> *To: *"Patrick Mullen (pamullen)" <pamullen at cisco.com>
>> *Cc: *"snort-users at lists.snort.org" <snort-users at lists.snort.org>
>> *Subject: *Re: [Snort-users] Ubuntu 18 and so rules error
>>
>> So it looks like I've got all the "standard" libraries that get 
>> installed.  Here's the ldd on this:
>>
>> linux-vdso.so.1 (0x00007ffe449ba000)
>> libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f8c33611000)
>> /lib64/ld-linux-x86-64.so.2 (0x00007f8c33c34000)
>>
>> What's next...blissfully still in dev so eh.
>>
>> James
>>
>> On 2018-06-11 08:49, Patrick Mullen (pamullen) wrote:
>>
>>     James,
>>
>>     That is part of the Math C library and should be loaded at
>>     runtime.  Please make sure the entire C development libraries are
>>     installed on your system.
>>
>>     Thanks,
>>
>>     ~Patrick
>>
>>     *From: *"Joel Esler (jesler)" <jesler at cisco.com>
>>     *Date: *Sunday, June 10, 2018 at 9:58 AM
>>     *To: *"Patrick Mullen (pamullen)" <pamullen at cisco.com>, "James Su
>>     (shesu)" <shesu at cisco.com>
>>     *Subject: *Fwd: [Snort-users] Ubuntu 18 and so rules error
>>
>>     Sent from my iPad
>>
>>
>>     Begin forwarded message:
>>
>>         *From:* James Lay <jlay at slave-tothe-box.net
>>         <mailto:jlay at slave-tothe-box.net>>
>>         *Date:* June 10, 2018 at 7:25:08 AM EDT
>>         *To:* Snort <snort-users at lists.snort.org
>>         <mailto:snort-users at lists.snort.org>>
>>         *Subject:* *[Snort-users] Ubuntu 18 and so rules error*
>>         *Reply-To:* <jlay at slave-tothe-box.net
>>         <mailto:jlay at slave-tothe-box.net>>
>>
>>         Bummer:
>>
>>         Generating Stub Rules....
>>
>>         An error occurred:   Loading dynamic detection library
>>         /opt/snort/lib/snort_dynamicrules/protocol-dns.so... ERROR:
>>         Failed to load
>>         /opt/snort/lib/snort_dynamicrules/protocol-dns.so:
>>         /opt/snort/lib/snort_dynamicrules/protocol-dns.so: undefined
>>         symbol: log
>>
>>         Tried all the other Ubuntu versions in the precompiled
>>         directory, but no dice. Anything I can provide to
>>         troubleshoot this beastie? Danke ☺
>>
>>         James
>>
>>         _______________________________________________
>>         Snort-users mailing list
>>         Snort-users at lists.snort.org <mailto:Snort-users at lists.snort.org>
>>         Go to this URL to change user options or unsubscribe:
>>         https://lists.snort.org/mailman/listinfo/snort-users
>>
>>         Please visit http://blog.snort.org to stay current on all the
>>         latest Snort news!
>>
>>         Please follow these rules:
>>         https://snort.org/faq/what-is-the-mailing-list-etiquette
>>         <https://snort.org/faq/what-is-the-mailing-list-etiquette>
>>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.snort.org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20180613/090767cf/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 2018-06-13 15_50_09-zone-y.png
Type: image/png
Size: 6066 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20180613/090767cf/attachment.png>


More information about the Snort-users mailing list