bro on freebsd 7-RC1

Zeek
1

is anyone using bro on freebsd 7-RC1?

thanks,
Anne

2

Anne,

I have a new box with FreeBSD 7.0-RELEASE installed (selected developer install). When compiling BRO (1.3.2), I get an error ...

Making install in src
source='DNS-binpac.cc' object='DNS-binpac.o' libtool=no depfile='.deps/DNS-binpac.Po' tmpdepfile='.deps/DNS-binpac.TPo' depmode=gcc3 /usr/local/bin/bash ../depcomp g++ -DHAVE_CONFIG_H -I. -I. -I.. -I. -I../aux/binpac/lib -I../src -I. -I.. -Ilibedit -O -W -Wall -Wno-unused -g -O2 -c -o DNS-binpac.o `test -f 'DNS-binpac.cc'

echo './'`DNS-binpac.cc

In file included from ARP.h:43,
                  from Sessions.h:28,
                  from RuleMatcher.h:12,
                  from Conn.h:32,
                  from Analyzer.h:11,
                  from UDP.h:25,
                  from DNS-binpac.h:6,
                  from DNS-binpac.cc:3:
NetVar.h:260:30: error: const.bif.netvar_h: No such file or directory
NetVar.h:261:30: error: event.bif.netvar_h: No such file or directory
In file included from DNS-binpac.cc:3:
DNS-binpac.h:9:21: error: dns_pac.h: No such file or directory
DNS-binpac.h:40:25: error: dns_tcp_pac.h: No such file or directory
In file included from DNS-binpac.h:7,
                  from DNS-binpac.cc:3:
TCP.h: In static member function 'static bool TCPStats_Analyzer::Available()':
TCP.h:360: error: 'conn_stats' was not declared in this scope
TCP.h:360: error: 'tcp_rexmit' was not declared in this scope
In file included from DNS-binpac.cc:3:
DNS-binpac.h: At global scope:
DNS-binpac.h:37: error: 'binpac' has not been declared
(this goes on and on)

It looks like there is a DNS dependency that I need to figure out??

Randy Reitz
Fermilab

3

Randolph Reitz wrote:

Anne,

I have a new box with FreeBSD 7.0-RELEASE installed (selected developer install). When compiling BRO (1.3.2), I get an error ...

try using bro 1.2.1 (stable) rather than current to see if that compiles. However, I found that bro-1.2.1 just stopped collecting after a while.

I will try 1.3.2 as well.

Anne

4

I'm the FreeBSD port maintainer for bro. I'm running 7.0 RELEASE (i386), and I'm not having a problems compiling bro. (I just compiled it after reading your email.) Make sure that your sources, kernel and ports are up to date and try it again. Also, what architechture are you trying to compile on? I'm running i386 SMP.

On a different note, I updated this port on request. I don't use bro personally, so I'd appreciate any comments about improvements, changes, etc. For example, if you'd like to see more options available (we call them KNOBS), let me know, *in detail*, what you're looking for, and I'll work on improving the port further. Since I don't know how people use the program, it's hard for me to know what functionality to include by default or highlight, offer as an option, etc., etc.

5

Just a wild guess: You've been trying a parallel build ('make -j
...')? As far as I know the Bro Makefile is not yet save for parallel
building, so just leave the '-j' out.

  Bernhard

6

I didn't notice the bro port. Yes, the bro port compiles fine on 7.0-RELEASE. You get bro-1.2.1 which is the current stable release. I was trying to compile bro-1.3.2 which is the current development release.

Are FreeBSD ports made for development releases?

Thanks,
Randy

7

In general, no. FreeBSD devel ports are usually the libraries associated with or required by a port.

I thought about creating one for the devel release, but the problem is, the code is constantly changing, so maintaining the port would be a PITA. It's much easier to maintain a stable release version.

However, when I said "I'm not having any problems compiling bro", I was referring to the 1.3.1 devel release that you were trying to compile. I downloaded and compiled it before posting my response.

Did you ever say what ARCH you're running?

8

I'm the FreeBSD port maintainer for bro. I'm running 7.0 RELEASE
(i386), and
I'm not having a problems compiling bro. (I just compiled it after
reading
your email.) Make sure that your sources, kernel and ports are up
to date and
try it again. Also, what architechture are you trying to compile
on? I'm
running i386 SMP.

I didn't notice the bro port. Yes, the bro port compiles fine on
7.0-RELEASE. You get bro-1.2.1 which is the current stable release. I was
trying to compile bro-1.3.2 which is the current development release.

Are FreeBSD ports made for development releases?

In general, no. FreeBSD devel ports are usually the libraries associated with
or required by a port.

I thought about creating one for the devel release, but the problem is, the
code is constantly changing, so maintaining the port would be a PITA. It's
much easier to maintain a stable release version.

However, when I said "I'm not having any problems compiling bro", I was
referring to the 1.3.1 devel release that you were trying to compile. I
downloaded and compiled it before posting my response.

Did you ever say what ARCH you're running?

I have ...
[root@dtmb ~]# uname -a
FreeBSD dtmb.dhcp.fnal.gov 7.0-RELEASE FreeBSD 7.0-RELEASE #0: Sun Feb 24 19:59:52 UTC 2008 root@logan.cse.buffalo.edu:/usr/obj/usr/src/sys/GENERIC i386

Humm, I tried to 'make install' bro 1.3.2 again and it worked.

[root@dtmb /home/rreitz/bro-1.3.2]# /usr/local/bro/bin/bro -v
/usr/local/bro/bin/bro version 1.3.2

I can't say what is different today from last Friday. I thought that installing the bro port may have added a dependency, but that doesn't seem to be the case...

[root@dtmb /usr/ports/security/bro]# make depends
===> bro-1.2_1 depends on file: /usr/local/bin/perl5.8.8 - found
===> bro-1.2_1 depends on executable: bison - found
===> bro-1.2_1 depends on file: /usr/local/bin/perl5.8.8 - found
[root@dtmb /usr/ports/security/bro]# whereis bison
bison: /usr/local/bin/bison /usr/local/man/man1/bison.1.gz /usr/ports/devel/bison
[root@dtmb /usr/ports/security/bro]# ls -l /usr/local/bin/bison
-r-xr-xr-x 1 root wheel 228028 Mar 5 14:37 /usr/local/bin/bison

Thanks for looking at this. I'll install my 10GB network card and see what new trouble I can find.

Randy