Bro v2.3.2 release

Zeek
1

Bro v2.3.2 is now available. For more details on vulnerabilities addressed, see this blog post:

  http://blog.bro.org/2015/01/bro-232-release.html

The new version can be downloaded from:

  https://www.bro.org/download/index.html

- Jon

2

Hi

I am getting this error on a fresh checkout:

git clone --recursive
cd bro
./configure --enable-debug

make[3]: Entering directory `/work/jpd/dyn/src/bro-fork/bro/build’
[ 20%] Building CXX object src/analyzer/protocol/bittorrent/CMakeFs/plugin-Bro-BitTorrent.dir/BitTorrent.cc.o
In file included from /work/jpd/dyn/src/bro-fork/bro/src/Net.h:12:0,
from /work/jpd/dyn/src/bro-fork/bro/src/RuleMatcher.h:15,
from /work/jpd/dyn/src/bro-fork/bro/src/Conn.h:13,
from /work/jpd/dyn/src/bro-fork/bro/src/analyzer/protocol/tcp/TCP.h:11,
from /work/jpd/dyn/src/bro-fork/bro/src/analyzer/protocol/bittorrent/BitTorrent.h:6,
from /work/jpd/dyn/src/bro-fork/bro/src/analyzer/protocol/bittorrent/BitTorrent.cc:3:
/work/jpd/dyn/src/bro-fork/bro/src/iosource/PktSrc.h: In constructor ‘iosource::PktSrc::Properties::Properties()’:
/work/jpd/dyn/src/bro-fork/bro/src/iosource/PktSrc.h:272:14: error: ‘PCAP_NETMASK_UNKNOWN’ was not declared in this scope
netmask = PCAP_NETMASK_UNKNOWN;
^

3

#define PCAP_NETMASK_UNKNOWN 0xffffffff

“/usr/include/pcap/pcap.h” 484L, 18147C

Is on my system;

Adding #include “pcap.h” to PktSrc.h doesn’t solve it.

So I added #define PCAP_NETMASK_UNKNOWN 0xfffffffff
to PktSrc,h to get get farther .

4

Yet another build failure:

make[3]: Leaving directory /work/jpd/dyn/src/bro-fork/bro/build' make[3]: Entering directory /work/jpd/dyn/src/bro-fork/bro/build’
[ 70%] Building CXX object src/iosource/CMakeFiles/bro_iosource.dir/BPF_Program.cc.o
[ 70%] Building CXX object src/iosource/CMakeFiles/bro_iosource.dir/Component.cc.o
[ 70%] Building CXX object src/iosource/CMakeFiles/bro_iosource.dir/Manager.cc.o
[ 70%] Building CXX object src/iosource/CMakeFiles/bro_iosource.dir/PktDumper.cc.o
[ 70%] Building CXX object src/iosource/CMakeFiles/bro_iosource.dir/PktSrc.cc.o
/work/jpd/dyn/src/bro-fork/bro/src/iosource/PktSrc.cc: In member function ‘bool iosource::PktSrc::ApplyBPFFilter(int, const pcap_pkthdr*, const u_char*)’:
/work/jpd/dyn/src/bro-fork/bro/src/iosource/PktSrc.cc:516:57: error: ‘pcap_offline_filter’ was not declared in this scope
return pcap_offline_filter(code->GetProgram(), hdr, pkt);
^
/work/jpd/dyn/src/bro-fork/bro/src/iosource/PktSrc.cc:517:2: warning: control reaches end of non-void function [-Wreturn-type]
}
^
make[3]: *** [src/iosource/CMakeFiles/bro_iosource.dir/PktSrc.cc.o] Error 1
make[3]: Leaving directory /work/jpd/dyn/src/bro-fork/bro/build' make[2]: *** [src/iosource/CMakeFiles/bro_iosource.dir/all] Error 2 make[2]: Leaving directory /work/jpd/dyn/src/bro-fork/bro/build’
make[1]: *** [all] Error 2
make[1]: Leaving directory `/work/jpd/dyn/src/bro-fork/bro/build’
make: *** [all] Error 2

shell returned 2

5

To use 2.3.2 from a git clone, you also have to checkout the v2.3.2 tag and ensure the git submodules are tracking correct versions. But I’ll follow up w/ your problem building the master branch in the tracker ticket you created.

- Jon