author | James Chang <james.c.chang@Oracle.COM> |
Fri, 02 Oct 2015 10:50:45 -0700 | |
changeset 4915 | 48f204cc245c |
parent 2198 | 168b8acace5f |
child 7650 | 2e39c59b83f8 |
permissions | -rw-r--r-- |
1345
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
1 |
Provide the directory where snort will initially look for DAQ modules. |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
2 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
3 |
This patch has not been sent upstream, because the Solaris integration |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
4 |
of libdaq is different from the way that Linux systems do this. |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
5 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
6 |
On Linux systems, DAQ installs two static libraries: |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
7 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
8 |
/usr/lib/libdaq_static.a |
2198
168b8acace5f
PSARC 2014/346 Data Acquisition library (DAQ) 2.0.2
Rich Burridge <rich.burridge@oracle.com>
parents:
1345
diff
changeset
|
9 |
/usr/lib/libdaq_static_modules.a |
1345
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
10 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
11 |
When snort is being configured, you see: |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
12 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
13 |
... |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
14 |
checking for daq_load_modules in -ldaq_static... yes |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
15 |
... |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
16 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
17 |
and at link time we see "-ldaq_static ... -ldaq_static_modules ...". |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
18 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
19 |
This means that when you start snort running, it knows where to |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
20 |
look for a set of DAQ modules that it loads. This is done with |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
21 |
with a call to the DAQ routine daq_load_modules(). |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
22 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
23 |
On Solaris, we do not provide those two static libraries (or their 64-bit |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
24 |
equivalents). Therefore, by default, a call to daq_load_modules() using |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
25 |
the dynamic libraries doesn't know where to look for any DAQ modules. |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
26 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
27 |
Now you can override this by starting snort with: |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
28 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
29 |
$ sudo /usr/bin/snort --daq-dir /usr/lib/64/daq |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
30 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
31 |
or |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
32 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
33 |
$ sudo /usr/bin/snort -c /etc/snort.conf |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
34 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
35 |
or something similar, but that doesn't allow: |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
36 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
37 |
$ sudo /usr/bin/snort |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
38 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
39 |
to work, right out of the box, which is what snort users would expect. |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
40 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
41 |
To resolve this, at snort initialization time on Solaris, the code has |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
42 |
been adjusted to specify a single default DAQ module directory: |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
43 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
44 |
/usr/lib/64/daq |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
45 |
|
2198
168b8acace5f
PSARC 2014/346 Data Acquisition library (DAQ) 2.0.2
Rich Burridge <rich.burridge@oracle.com>
parents:
1345
diff
changeset
|
46 |
--- src/snort.c.orig 2014-09-25 07:53:43.356728058 -0700 |
168b8acace5f
PSARC 2014/346 Data Acquisition library (DAQ) 2.0.2
Rich Burridge <rich.burridge@oracle.com>
parents:
1345
diff
changeset
|
47 |
+++ src/snort.c 2014-09-25 07:55:05.650780347 -0700 |
168b8acace5f
PSARC 2014/346 Data Acquisition library (DAQ) 2.0.2
Rich Burridge <rich.burridge@oracle.com>
parents:
1345
diff
changeset
|
48 |
@@ -4039,6 +4039,9 @@ |
1345
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
49 |
{ |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
50 |
SnortConfig *sc = (SnortConfig *)SnortAlloc(sizeof(SnortConfig)); |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
51 |
|
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
52 |
+ /* Define where to look for DAQ modules. */ |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
53 |
+ ConfigDaqDir(sc, "/usr/lib/64/daq"); |
ee87318d9935
PSARC 2013/113 snort 2.9.2
Rich Burridge <rich.burridge@oracle.com>
parents:
diff
changeset
|
54 |
+ |
2198
168b8acace5f
PSARC 2014/346 Data Acquisition library (DAQ) 2.0.2
Rich Burridge <rich.burridge@oracle.com>
parents:
1345
diff
changeset
|
55 |
sc->pkt_cnt = 0; |
168b8acace5f
PSARC 2014/346 Data Acquisition library (DAQ) 2.0.2
Rich Burridge <rich.burridge@oracle.com>
parents:
1345
diff
changeset
|
56 |
#ifdef REG_TEST |
168b8acace5f
PSARC 2014/346 Data Acquisition library (DAQ) 2.0.2
Rich Burridge <rich.burridge@oracle.com>
parents:
1345
diff
changeset
|
57 |
sc->pkt_skip = 0; |