[Bro] Modifying Bro for NetBSD

Sean Peisert speisert at alumni.ucsd.edu
Tue Nov 9 19:16:10 PST 2004


Chema,

I attached the /usr/include/pcap.h file. 
Offhand, the arguments appear to be the same as 
the ones I changed the Bro files to require.  Are 
you sure they're incongruent?

Unfortunately, I don't have a NetBSD machine to 
give you access to right at the moment, but I 
could probably get one up next week if nobody 
else on the list can help.  It'll even run on 
your toaster, in case you have time to try. :)

Sean

At 7:54 PM -0700 11/9/04, José María González wrote:
>Sean,
>
>Your patch deals mainly with NetBSD addition of an
>(extra) error parameter in libpcap's pcap_compile_nopcap().
>I submitted a patch to detect this some time ago:
>
>http://mailman.icsi.berkeley.edu/pipermail/bro/2003-December/001364.html
>
>[BTW, and off-topic, would it be possible to anonymize
>email addresses in the mailing list?]
>
>Unfortunately, I didn't have a NetBSD box to test it,
>and it seems it may not be working properly.
>
>
>On the other hand, your patch seems to add even a
>new extra parameter. I checked NetBSD 2.0, and the
>function API is:
>
>[ 
>ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-release-2-0/src/lib/libpcap/gencode.c 
>]
>
>pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
>              struct bpf_program *program,
>	     char *buf, int optimize, bpf_u_int32 mask, char *errbuf)
>
>I.e., just the error buffer parameter. This seems incoherent
>with your patch.
>
>Can you please send me your pcap.h file? It should be
>located at /usr/include/pcap.h, or maybe /usr/include/[lib]pcap/pcap.h
>
>Last, is there any NetBSD machine I can have access to?
>
>-Chema
>
>
>
>On Tuesday 09 November 2004 13:42, Sean Peisert wrote:
>  > FYI, the changes in the attached diff were necessary to get Bro
>  > 0.9a4a to compile on a NetBSD 2.0_RC4 (x86) installation.
>  >
>  > Sean
>  >
>
>
>
>
>
>diff -r bro-pub-0.9a4a/src/BPF_Program.cc 
>bro-pub-0.9a4a-sean/src/BPF_Program.cc
>29c29,30
>< #include "pcap-int.h"
>---
>>  /*#include "pcap-int.h"*/
>>  #include "/usr/src/lib/libpcap/pcap-int.h"
>63c64
><       int optimize, bpf_u_int32 mask)
>---
>>        int optimize, bpf_u_int32 mask, char* dummy)
>125c126
><              (char *) filter, optimize, netmask, error);
>---
>>               (char *) filter, optimize, netmask, error, NULL);
>130c131
><              (char*) filter, optimize, netmask);
>---
>>               (char*) filter, optimize, netmask, NULL);
>diff -r bro-pub-0.9a4a/src/PktSrc.cc bro-pub-0.9a4a-sean/src/PktSrc.cc
>31a32,33
>>  #define DLT_LINUX_SLL 113
>>
>120c122
><       current_dumper = pcap_dump_open(pd, file);
>---
>>        current_dumper = pcap_dump_open(pd, (char*)file);
>Only in bro-pub-0.9a4a-sean/src: libedit
>_______________________________________________
>Bro mailing list
>bro at bro-ids.org
>http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro


-- 
Sean Peisert                                (858) 822-3685 (voice)
peisert at sdsc.edu                            (858) 822-5443 (fax)
http://www.sdsc.edu/~peisert/

	Fellow,
	San Diego Supercomputer Center
	University of California, San Diego
	9500 Gilman Drive, MC 0505
	La Jolla, CA  92093-0505
-------------- next part --------------
A non-text attachment was scrubbed...
Name: pcap.h
Type: application/octet-stream
Size: 5168 bytes
Desc: not available
Url : http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20041109/e15a6a64/attachment.obj 


More information about the Bro mailing list