Home page logo

snort logo Snort mailing list archives

Re: Patch to running Snort on Solaris 10 SPARC
From: Joel Esler <jesler () sourcefire com>
Date: Wed, 29 Dec 2010 10:15:02 -0500

Stephan said:

Since a long time I couldn't run snort on Solaris SPARC
(8 and 10) there was always a 'bus error' after the setup
of the rules.
By doing some debugging I saw that the bus error always occurs
in the HashKeyCmp function (of snort_stream5_session.c) on line
1004. After changing the comparision from 64 to 32 bit the bus
error goes away but I got an 'segmentation error' in snort_stream5_tcp.c
(for the fix look at patch-snort_stream5_tcp.c). The 'bus error'
can also occurs on Frag3KeyCmpFunc.

The other solution could be to comment out 
sfxhash_set_keyops(sessionCache->hashTable, HashFunc, HashKeyCmp);
snort_stream5_session.c and
sfxhash_set_keyops(f_cache, Frag3KeyHashFunc, Frag3KeyCmpFunc);
in spp_frag3.c. In this case memcmp will be used.
The patch in patch-snort_stream5_tcp.c is anyway needed to avoid
the segemtation error.

The patch patch-src-decode.c includes 2 fixes for systems
without GRE protocol.

Best regards,


Thanks, I'll get this filed in a bug.


Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment, and, 
should the need arise, upgrade to a full multi-node Oracle RAC database 
without downtime or disruption
Snort-devel mailing list
Snort-devel () lists sourceforge net

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]