# Bro 1.2 vs OpenBSD
**URL:** https://community.zeek.org/t/bro-1-2-vs-openbsd/1072
**Category:** Zeek
**Created:** [November 30, 2006, 5:08pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072 "2006-11-30T17:08:54Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)
#### Post date: [November 30, 2006, 5:08pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/1 "2006-11-30T17:08:54Z")
Hello All,
Good news... i was tired to still use the 1.0 so the last two days (i use an old but good
laptop) was dedicated to the stage of making Bro 1.2 working on OpenBSD.
I use OpenBSD 4.0 current and magically :
# uname -a
OpenBSD armada.mynetwork.local 4.0 GENERIC#1227 i386
# ps waux | grep bro
root 25579 0.0 0.4 888 800 p3 I 11:49AM 0:00.07 sh
./bro.rc start
root 14757 0.1 5.8 1868 11164 p3 S 11:49AM 0:01.03
/opt/share/bro-1.2/bin/bro -W -i rl0 brolite.bro
I just had to "slightly" modify "configure.in" and add some #ifdef in the
source tree.
The last surprise was with "bro.rc" and the "old" bug :
# sh ./bro.rc start
./bro.rc[478]: syntax error: (' unexpected
The problem was related to the name of the function in charge to stop the
process. It's called stop() in the script and i suspect a problem with the
shell. I just had to rename it to brostop() to make it functionnal.
so it now works, the next few days will be spent checking if the solution is stable.
Best regards.
---
### Author:  [@robin](https://community.zeek.org/u/robin)
#### Post date: [November 30, 2006, 6:10pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/2 "2006-11-30T18:10:11Z")
If so, please send us a patch with the changes you did!
Robin
---
### Author:  [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)
#### Post date: [November 30, 2006, 6:45pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/3 "2006-11-30T18:45:17Z")
Hello
Sure my friend. 🙂
Even if the solution seems to work, i think, it's the first stage of
porting Bro to OpenBSD.
But (IMHO), it'll be the first stage of the job. Next will be the add the
availibility of non blocking DNS request. I know how to do this,
i only have to test it.
Best regards.
---
### Author:  [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)
#### Post date: [November 30, 2006, 7:12pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/4 "2006-11-30T19:12:16Z")
Hello,
Just to be sure of my idea regarding the problem with the stop()
function inside "bro.rc", i changed the shell and used bash.
stop() now works as it.
May i suggest to modify the offending function's name ? 🙂
Best regards.
---
### Author:  [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)
#### Post date: [November 30, 2006, 9:59pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/5 "2006-11-30T21:59:22Z")
Hi,
> I just had to "slightly" modify "configure.in" and add some #ifdef in the
> source tree.
I just tried to build the 1.2 release on OpenBSD 3.8 and it bombs out
with yet another ARP header inclusion glitch. ☹ Is that what you fixed?
It seems what's needed is a header check for net/ethertypes.h.
---
### Author:  [@Andrew\_K\_Adams](https://community.zeek.org/u/Andrew_K_Adams)
#### Post date: [December 1, 2006, 12:50pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/6 "2006-12-01T12:50:09Z")
As an additional data point, NetBSD 3.x needs this check as well.
-aka
---
### Author:  [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)
#### Post date: [December 1, 2006, 3:00pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/7 "2006-12-01T15:00:42Z")
Hello Christian,
You're right, in fact, here's is the process i used :
- modify "configure.in" and define HAVE\_OPENBSD (current test as of 1.2 was to
check openbsd3) as i use OpenBSD's current.
note that i'm not sure of the need to specify the value "1" into
AC\_DEFINE... (i'm not yet a M4's wizard).
==== configure.in
openbsd3\*)
AM\_CONDITIONAL(USE\_NMALLOC, true)
AC\_DEFINE(HAVE\_OPENBSD,[We are on a OpenBSD system])
;;
openbsd4\*)
AM\_CONDITIONAL(USE\_NMALLOC, true)
AC\_DEFINE(HAVE\_OPENBSD,1,[We are on a OpenBSD system])
;;
---
### Author:  [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)
#### Post date: [December 1, 2006, 3:03pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/8 "2006-12-01T15:03:20Z")
Hello Andrew,
I just sent a mail with the details of the porting process i used for
OpenBSD and i think there's not too much work for using NetBSD.
If you want, i may try this at the end of the week.
Best regards.
---
### Author:  [@Andrew\_K\_Adams](https://community.zeek.org/u/Andrew_K_Adams)
#### Post date: [December 1, 2006, 3:53pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/9 "2006-12-01T15:53:49Z")
> I just sent a mail with the details of the porting process i used for
> OpenBSD and i think there's not too much work for using NetBSD.
Other than the ethertypes header, I remember running into some gcc C++ parsing issues.
> If you want, i may try this at the end of the week.
Please! I started to port Bro to NetBSD, but recently lost the spare cycles I had ... so, by all means, please go for it (thanks!)
-aka
---
### Author:  [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)
#### Post date: [December 1, 2006, 4:04pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/10 "2006-12-01T16:04:01Z")
Hello,
Ok, i'll do my best.
Best regards.
---
### Author:  [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)
#### Post date: [December 1, 2006, 6:58pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/11 "2006-12-01T18:58:10Z")
Hi again,
> Hello Christian,
>
> You're right, in fact, here's is the process i used :
>
> - modify "configure.in" and define HAVE\_OPENBSD (current test as of 1.2 was to
> check openbsd3) as i use OpenBSD's current.
right, "openbsd3" definitely needs to go.
> ==== configure.in
> openbsd3\*)
> AM\_CONDITIONAL(USE\_NMALLOC, true)
> AC\_DEFINE(HAVE\_OPENBSD,[We are on a OpenBSD system])
> ;;
>
> openbsd4\*)
> AM\_CONDITIONAL(USE\_NMALLOC, true)
> AC\_DEFINE(HAVE\_OPENBSD,1,[We are on a OpenBSD system])
> ;;
... or just "openbsd\*)"? I'll be damned if we actually need to
differentiate between the different releases.
> - modify ARP.h as you did with an #ifdef HAVE\_OPENBSD and in such this case
> use #include \
>
> # ==== ARP.h #elif HAVE\_SYS\_ETHERNET\_H #include \ #elif HAVE\_OPENBSD #include \ #endif
Yep. It'd be nicer to just add sys/ethernet.h to the header checks in
configure.in, so it'll be
#elif HAVE\_SYS\_ETHERTYPES\_H
along with the others. I'm also thinking of doing #ifdef/#endif for each
of those headers instead of #ifdef/#elif/#elif/#endif. The more the
merrier. 🙂
> - modify util.cc and util.h in order to use bpf\_timeval as structure for the
> double\_to\_timeval() function. (just used #ifdef HAVE\_OPENBSD)
Wow, this is so weird. I could swear we've fixed this before -- this is
due to OpenBSD's pcap using bpf\_timeval instead of just timeval like
everyone else, correct?
Rater than #ifdeffing different functions, it'd be nicer to make the
type difference transparent by typedefing the bpf\_timeval to a timeval
in the OpenBSD case.
> - modify bro.rc (changed the name of stop() to brostop() ).
Yeah.
I've also noticed that there seem to be pcap versions where our API
checks fail, causing the build to break since pcap\_open\_dead() isn't
defined. We already have our own version but only use it when pcap
doesn't provide pcap\_freecode(), which in those cases \*does\* exist. This
is at least the scenario I've encoutered in the OpenBSD setup on
Sourceforge's compile farm.
> ps1 : next stage will be the use of bind libraries in order to be able to use
> non blocking DNS routines.
Right. We don't currently have a clear picture of why exactly the nbdns
code doesn't build on OpenBSD. Patches welcome!
> ps2 : i mean by "porting", doing th job to use Bro with OpenBSD ... 🙂
Sure. 🙂
Thanks for your feedback.
Cheers,
Christian.
---
### Author:  [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)
#### Post date: [December 2, 2006, 1:05am UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/12 "2006-12-02T01:05:48Z")
Hello Christian,
Quoting Christian Kreibich \:
> Hi again,
>
> \> Hello Christian,
> \>
> \> You're right, in fact, here's is the process i used :
> \>
> \> - modify "configure.in" and define HAVE\_OPENBSD (current test as of 1.2 was
> to
> \> check openbsd3) as i use OpenBSD's current.
>
> right, "openbsd3" definitely needs to go.
I do not wish to take this point for asset, there's still v3 around, i even
use one.. 🙂
> \> ==== configure.in
> \> openbsd3\*)
> \> AM\_CONDITIONAL(USE\_NMALLOC, true)
> \> AC\_DEFINE(HAVE\_OPENBSD,[We are on a OpenBSD system])
> \> ;;
> \>
> \> openbsd4\*)
> \> AM\_CONDITIONAL(USE\_NMALLOC, true)
> \> AC\_DEFINE(HAVE\_OPENBSD,1,[We are on a OpenBSD system])
> \> ;;
>
> ... or just "openbsd\*)"? I'll be damned if we actually need to
> differentiate between the different releases.
Right, but as i don't wanted to change original things, i kept the old value.
> \>
> \> - modify ARP.h as you did with an #ifdef HAVE\_OPENBSD and in such this case
> \> use #include \
> \>
> \> ==== ARP.h
> \> #elif HAVE\_SYS\_ETHERNET\_H
> \> #include \
> \> #elif HAVE\_OPENBSD
> \> #include \
> \> #endif
> \> ====
>
> Yep. It'd be nicer to just add sys/ethernet.h to the header checks in
> configure.in, so it'll be
>
> #elif HAVE\_SYS\_ETHERTYPES\_H
That seems good like idea.
> along with the others. I'm also thinking of doing #ifdef/#endif for each
> of those headers instead of #ifdef/#elif/#elif/#endif. The more the
> merrier. 🙂
:-))
> \> - modify util.cc and util.h in order to use bpf\_timeval as structure for
> the
> \> double\_to\_timeval() function. (just used #ifdef HAVE\_OPENBSD)
>
> Wow, this is so weird. I could swear we've fixed this before -- this is
> due to OpenBSD's pcap using bpf\_timeval instead of just timeval like
> everyone else, correct?
In fact i was unable to find another idea to solve my problem.
I'll have to check if this is the only one solution.
> Rater than #ifdeffing different functions, it'd be nicer to make the
> type difference transparent by typedefing the bpf\_timeval to a timeval
> in the OpenBSD case.
You're right but as my first goal was to want to make Bro running with
OpenBSD. I showed as fast as possible if all functioned...
> \> - modify bro.rc (changed the name of stop() to brostop() ).
>
> Yeah.
Good idea as i spent most of the time to fix this so little thing..
I can't remember the number of 'echo "test"' i did in the script to find
where was the bug... 🙂
> I've also noticed that there seem to be pcap versions where our API
> checks fail, causing the build to break since pcap\_open\_dead() isn't
> defined. We already have our own version but only use it when pcap
> doesn't provide pcap\_freecode(), which in those cases \*does\* exist. This
> is at least the scenario I've encoutered in the OpenBSD setup on
> Sourceforge's compile farm.
I think we may use the same scheme used by FreeBSD. i'll have to check this
tomorrow (i already took a look to "bro\_config.in").
> \> ps1 : next stage will be the use of bind libraries in order to be able to
> use
> \> non blocking DNS routines.
>
> Right. We don't currently have a clear picture of why exactly the nbdns
> code doesn't build on OpenBSD. Patches welcome!
Ok, i'll do my best (in fact, trying of course)...
> \> ps2 : i mean by "porting", doing th job to use Bro with OpenBSD ... 🙂
>
> Sure. 🙂
Next there'll be an official port into packages...
> Thanks for your feedback.
Just normal, thanks for all the developpers.
Best regards.
---
### Author:  [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/bro-1-2-vs-openbsd/1072/13 "2022-05-06T15:38:04Z")