Re: [Snort-inline-users] release of snort_inline-2.1.3

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 422-6466

Hi Rob,

I tried to compile it, but it failed. This is the error message:

<snip>
gcc -DHAVE_CONFIG_H -I. -I. -I.. -I.. -I../src -I../src/sfutil -I/usr/include/pcap -I../src/output-plugins -I../src/detection-plugins -I../src/preprocessors -I../src/preprocessors/flow -I../src/preprocessors/portscan  -I../src/preprocessors/flow/int-snort  -I../src/preprocessors/HttpInspect/include  -I/usr/include/libipq/ -I/usr/include  -g -O2 -Wall -DGIDS -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DLIBNET_LIL_ENDIAN -c parser.c
parser.c:3496:45: missing terminating " character
parser.c:3497:4: missing terminating " character
parser.c:3517:45: missing terminating " character
parser.c:3518:4: missing terminating " character
parser.c:3539:45: missing terminating " character
parser.c:3540:4: missing terminating " character
parser.c:3560:45: missing terminating " character
parser.c:3561:4: missing terminating " character
parser.c:3581:45: missing terminating " character
parser.c:3582:4: missing terminating " character
parser.c:4170:1: unterminated argument list invoking macro "DEBUG_WRAP"
parser.c: In function `ParseConfig':
parser.c:3496: error: `DEBUG_WRAP' undeclared (first use in this function)
parser.c:3496: error: (Each undeclared identifier is reported only once
parser.c:3496: error: for each function it appears in.)
parser.c:3496: error: parse error at end of input
make[3]: *** [parser.o] Error 1
make[3]: Leaving directory `/usr/src/snort_inline-2.1.3a/src'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/usr/src/snort_inline-2.1.3a/src'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/usr/src/snort_inline-2.1.3a'
make: *** [all-recursive-am] Error 2
debian:/usr/src/snort_inline-2.1.3a#

It was easily fixed. It seems DEBUG_WRAP is not called right. On line 3496 I saw this: 

DEBUG_WRAP(DebugMessage(DEBUG_INIT, "disabling the drop of tcpopt exprimental alert
s\n"););

There was a hard newline in the line inside the word 'alerts'. This error is on 6 lines or so. Removing the hard newline fixed the problem.

If i'm unclear or you need more info about my setup please let me know...

Regards,
Victor Julien

On Sunday 27 June 2004 05:17, Rob McMillen wrote:
> OK.  snort_inline-2.1.3a is now available.  Good catch.
>
> Rob
>
> On Sat, 26 Jun 2004, William Metcalf wrote:
> > Date: Sat, 26 Jun 2004 16:39:45 -0500
> > From: William Metcalf <Wil...@kc...>
> > To: Rob McMillen <ro...@ho...>
> > Cc: sno...@li...,
> >      sno...@li...
> > Subject: Re: [Snort-inline-users] release of snort_inline-2.1.3
> >
> >
> >
> >
> >
> >
> > I'm currently working on getting resets to work with snort_inline via
> > physical device rather than a raw socket.  The dev will be user specified
> > via the snort_inline.conf file.  This is probably all that I will be
> > doing development wise for the next couple month's due to the fact that
> > I'm going for my GCIH cert and I haven't yet started my research paper :
> > - ).  Is there anything else that you guy's want to see in snort_inline
> > that I can work on while I'm messing with InlineReject()?
> >
> > Regards,
> >
> > Will
> >
> >
> >
> >
> >
> >              Rob McMillen
> >              <ro...@ho...
> >
> >              >                                                         
> >              > To
> >
> >              Sent by:                 
> > sno...@li...urceforg snort-inline-user         e.net
> >              s-...@li...u                                         
> > cc rceforge.net
> >                                                                   
> > Subject [Snort-inline-users] release of 06/26/2004 01:57         
> > snort_inline-2.1.3
> >              PM
> >
> >
> >              Please respond to
> >                Rob McMillen
> >              <ro...@ho...
> >
> >
> >
> >
> >
> >
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > List,
> >     I have uploaded snort_inline-2.1.3.  Thanks to William Metcalf, we
> > now have a database output plugin that works in inline mode, a decoder
> > that can drop bad packets, and a working stream4 preprocessor.
> >     It is currently only available in source.  I will upload the
> > statically
> >
> > compiled binary and diff later today.
> >
> >     As always, feedback, patches, and comments are welcome.
> >
> >     You can find the source at http://snort-inline.sf.net/download.html
> >
> > Rob
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.2.4 (GNU/Linux)
> >
> > iD8DBQFA3ccm+cDJj70ouN0RAn6YAKD8x4We65NtMBWYumbWH7VVbdYzKQCgunux
> > H8yY0k+av62dPQlSNijUm0g=
> > =Zod4
> > -----END PGP SIGNATURE-----
> >
> >
> > -------------------------------------------------------
> > This SF.Net email sponsored by Black Hat Briefings & Training.
> > Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> > digital self defense, top technical experts, no vendor pitches,
> > unmatched networking opportunities. Visit www.blackhat.com
> > _______________________________________________
> > Snort-inline-users mailing list
> > Sno...@li...
> > https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> digital self defense, top technical experts, no vendor pitches,
> unmatched networking opportunities. Visit www.blackhat.com
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users