[Bro] Modifying Bro for NetBSD

[José María González]

Sean, 

Your patch deals mainly with NetBSD addition of an 
(extra) error parameter in libpcap's pcap_compile_nopcap(). 
I submitted a patch to detect this some time ago: 

http://mailman.icsi.berkeley.edu/pipermail/bro/2003-December/001364.html

[BTW, and off-topic, would it be possible to anonymize 
email addresses in the mailing list?] 

Unfortunately, I didn't have a NetBSD box to test it, 
and it seems it may not be working properly. 


On the other hand, your patch seems to add even a 
new extra parameter. I checked NetBSD 2.0, and the 
function API is: 

[ ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-release-2-0/src/lib/libpcap/gencode.c ]

pcap_compile_nopcap(int snaplen_arg, int linktype_arg,
             struct bpf_program *program,
	     char *buf, int optimize, bpf_u_int32 mask, char *errbuf)

I.e., just the error buffer parameter. This seems incoherent 
with your patch. 

Can you please send me your pcap.h file? It should be 
located at /usr/include/pcap.h, or maybe /usr/include/[lib]pcap/pcap.h 

Last, is there any NetBSD machine I can have access to? 

-Chema



On Tuesday 09 November 2004 13:42, Sean Peisert wrote:
> FYI, the changes in the attached diff were necessary to get Bro 
> 0.9a4a to compile on a NetBSD 2.0_RC4 (x86) installation.
> 
> Sean
> 





diff -r bro-pub-0.9a4a/src/BPF_Program.cc bro-pub-0.9a4a-sean/src/BPF_Program.cc
29c29,30
< #include "pcap-int.h"
---
> /*#include "pcap-int.h"*/
> #include "/usr/src/lib/libpcap/pcap-int.h"
63c64
<       int optimize, bpf_u_int32 mask)
---
>       int optimize, bpf_u_int32 mask, char* dummy)
125c126
<              (char *) filter, optimize, netmask, error);
---
>              (char *) filter, optimize, netmask, error, NULL);
130c131
<              (char*) filter, optimize, netmask);
---
>              (char*) filter, optimize, netmask, NULL);
diff -r bro-pub-0.9a4a/src/PktSrc.cc bro-pub-0.9a4a-sean/src/PktSrc.cc
31a32,33
> #define DLT_LINUX_SLL 113
> 
120c122
<       current_dumper = pcap_dump_open(pd, file);
---
>       current_dumper = pcap_dump_open(pd, (char*)file);
Only in bro-pub-0.9a4a-sean/src: libedit