Home page logo
/

snort logo Snort mailing list archives

Patch to running Snort on Solaris 10 SPARC
From: Stephan <Stephan () rheoli net>
Date: Wed, 29 Dec 2010 15:32:35 +0100

Hi,

Since a long time I couldn't run snort on Solaris SPARC
(8 and 10) there was always a 'bus error' after the setup
of the rules.
By doing some debugging I saw that the bus error always occurs
in the HashKeyCmp function (of snort_stream5_session.c) on line
1004. After changing the comparision from 64 to 32 bit the bus
error goes away but I got an 'segmentation error' in snort_stream5_tcp.c
(for the fix look at patch-snort_stream5_tcp.c). The 'bus error'
can also occurs on Frag3KeyCmpFunc.

The other solution could be to comment out 
sfxhash_set_keyops(sessionCache->hashTable, HashFunc, HashKeyCmp);
snort_stream5_session.c and
sfxhash_set_keyops(f_cache, Frag3KeyHashFunc, Frag3KeyCmpFunc);
in spp_frag3.c. In this case memcmp will be used.
The patch in patch-snort_stream5_tcp.c is anyway needed to avoid
the segemtation error.

The patch patch-src-decode.c includes 2 fixes for systems
without GRE protocol.


Best regards,
Stephan

Attachment: snort-2.9.0.3-patch.tar.gz
Description:

------------------------------------------------------------------------------
Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault