# Need help! Link failed during compile 0.8a34 version

**URL:** <https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403>\
**Category:** Zeek\
**Created:** [July 22, 2003, 8:04pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403 "2003-07-22T20:04:25Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hongjie\_Xin](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@Hongjie\_Xin](https://community.zeek.org/u/Hongjie_Xin)\
**Post date:** [July 22, 2003, 8:04pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/1 "2003-07-22T20:04:25Z")

</div>

Hi,

I am new here.  
I tried to get whole archive from majordomo for previous mailing messages and looks like I am still waiting.

I was trying to compile the package under redhat 9.0.

I got the following error message in last link sentence.  
I still got the same error even after I upgraded the bind to latest redhat update (glibc-2.3.2-27.9).

nb\_dns.o(.text+0x62d): In function `nb\_dns\_activity':  
: undefined reference to `\_\_ns\_initparse'  
nb\_dns.o(.text+0x6f2): In function `nb\_dns\_activity':  
: undefined reference to `\_ns\_flagdata'  
nb\_dns.o(.text+0x6f8): In function `nb\_dns\_activity':  
: undefined reference to `\_ns\_flagdata'  
nb\_dns.o(.text+0x870): In function `nb\_dns\_activity':  
: undefined reference to `\_\_ns\_parserr'  
collect2: ld returned 1

Could anyone help me? Thanks!

Hongjie

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [July 22, 2003, 9:11pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/2 "2003-07-22T21:11:12Z")

</div>

Please try the attached patch. It works at least for Debian-based  
systems.

Robin

P.S.: If anyone happens to know enough about autoconf to include  
this into configure.ac, it would be a nice thing to add.

[bro-cvs-libresolv.diff](https://community.zeek.org/uploads/short-url/e4JJIJP73FCc1TxDNHEAS5Y7G0l.diff) (553 Bytes)

---

<div class="post-metadata">

**Author:** ![Hongjie\_Xin](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@Hongjie\_Xin](https://community.zeek.org/u/Hongjie_Xin)\
**Post date:** [July 22, 2003, 9:19pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/3 "2003-07-22T21:19:21Z")

</div>

Appreciate. It works.

Meanwhile I searched something from google newsgroup.  
It may explain the reason.

# nm /usr/lib/libresolv.a | sed "s/[^]\* //" |sort \> a  
# nm /usr/lib/libresolv.so | sed "s/[^]\* //" |sort \> so  
# diff a so |grep \_\_ns\_initparse  
&nbsp;&nbsp;\< T \_\_ns\_initparse  
&nbsp;&nbsp;\> t \_\_ns\_initparse  
&nbsp;&nbsp;\< U \_\_ns\_initparse

From 'info nm', lowercase t means local, uppercase T means global

That's different among libresolv.a and libresolv.so.

No idea why glibc leaves such arrangement.

Hongjie

Robin Sommer wrote:

---

<div class="post-metadata">

**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\
**Post date:** [July 23, 2003, 2:31pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/4 "2003-07-23T14:31:43Z")

</div>

Hi all,

> \> I was trying to compile the package under redhat 9.0.
> 
> Please try the attached patch. It works at least for Debian-based  
> systems.

here's an attempt of a configure check for this; it works for my RH9.  
Open questions:

- what to do if workaround test fails  
- whether to test for other locations of libresolv.a

Let me know if it works for you -- I'm far from an autoconf expert. In  
particular, I don't know if it'll work with other autoconf versions  
(that's always where the fun starts ...).

Cheers,  
Christian.

[bro-ns.diff](https://community.zeek.org/uploads/short-url/i4lWMSgRRuraJktQJTjDxZjLnnd.diff) (863 Bytes)

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [July 24, 2003, 8:31am UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/5 "2003-07-24T08:31:11Z")

</div>

Works fine on Debian, too (and also on Solaris and FreeBSD which  
don't need the work-around).

Thanks!

Robin

---

<div class="post-metadata">

**Author:** ![Anton\_Chuvakin\_Ph.D](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Anton\_Chuvakin\_Ph.D](https://community.zeek.org/u/Anton_Chuvakin_Ph.D)\
**Post date:** [August 22, 2003, 1:26pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/6 "2003-08-22T13:26:29Z")

</div>

Vern and all,

I reported bro dieing here before, but now (with 0.34) it happens EVERY  
DAY. I suspect the ongoing ICMP "rain" is to blame as well, since I don't  
think it was happening that often before that. As usual, there are no  
messages in the logs and no core file (ulimit is set).

I would appreciate any hints for finding out what happens. I can send my  
policy file over, if needed.

Best,

---

<div class="post-metadata">

**Author:** ![Scott\_Campbell](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Scott\_Campbell](https://community.zeek.org/u/Scott_Campbell)\
**Post date:** [August 22, 2003, 3:05pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/7 "2003-08-22T15:05:15Z")

</div>

Anton Chuvakin, Ph.D. wrote:

> Vern and all,
> 
> I reported bro dieing here before, but now (with 0.34) it happens EVERY  
> DAY. I suspect the ongoing ICMP "rain" is to blame as well, since I don't  
> think it was happening that often before that. As usual, there are no  
> messages in the logs and no core file (ulimit is set).
> 
> I would appreciate any hints for finding out what happens. I can send my  
> policy file over, if needed.
> 
> Best,

I experienced the same problem and tracked down a possible source of the  
problem.

I took a quick look at the icmp code, and did a little testing. During  
this I noticed the following: when \*any\* tracefile with icmp in it is  
run through bro, there will be an exception at close time (ie after  
net\_done() is called).

On a trace file of ~500 icmp packets (and only icmp), the following data  
was provided from the exec trace file:

0.000000 \<no location\>:0 event called: bro\_init()

1060118249.065749 \<no location\>:0 event called: net\_done(t =  
'1060118249.06575')

1060118249.065749 \<no location\>:0 event called:  
connection\_state\_remove(c = '[orig\_h=128.55.128.84, resp\_h=128.3.11.35,  
itype=8, icode=0]')

In the info (ie stderr) file the following can be found:

1060118249.065749 \<no location\> (128.3.11.35): bad tag in Val::CONVERTER

which seems to correlate with the last event logged. Regular logged  
data seems to indicate that only the last icmp packet seems to tickle  
this bug.

When a single pair of icmp ping request-response are run through, the  
same problem presents itself, with the 'connection\_state\_remove' call  
getting the orig\_h and resp\_h IPs \*backwards\* with respect to the icmp  
flow object defined when icmp.bro is loaded.

Loading the icmp.bro module seems not to effect this problem, although I  
am seeing strange behavior with regard to some packet payload analysis  
that is going on (modified icmp.bro).

If anyone has a good idea as to the location of the problem, I would be  
most happy in working with them in resolving this issue. Recently a  
modified sk rootkit with an icmp backdoor was discovered at another lab,  
so keeping an eye on this protocol has just been rased in priority.

thanks!

scott campbell

- -----  
Scott Campbell  
NERSC Network Security

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [August 22, 2003, 4:03pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/8 "2003-08-22T16:03:39Z")

</div>

Could you try the attached patch and see if it helps?

Robin

[bro-0.8a34-icmpfix.diff](https://community.zeek.org/uploads/short-url/rPgwDUFlm0SGw9BpadFv3WSNCg5.diff) (1.41 KB)

---

<div class="post-metadata">

**Author:** ![Anton\_Chuvakin\_Ph.D](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Anton\_Chuvakin\_Ph.D](https://community.zeek.org/u/Anton_Chuvakin_Ph.D)\
**Post date:** [August 22, 2003, 4:06pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/9 "2003-08-22T16:06:09Z")

</div>

> Could you try the attached patch and see if it helps?

Hmm, what does it actually do?

---

<div class="post-metadata">

**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\
**Post date:** [August 22, 2003, 5:56pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/10 "2003-08-22T17:56:44Z")

</div>

> \>Could you try the attached patch and see if it helps?  
> Hmm, what does it actually do?

The original code uses the same variable 'conn\_val' for two different  
purposes. This patch fixes this problem by using a separate variable.

Ruoming

---

<div class="post-metadata">

**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\
**Post date:** [August 22, 2003, 6:10pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/11 "2003-08-22T18:10:36Z")

</div>

Below is a newer version of Robin's patch.

Ruoming

diff -c bro-pub-0.8a34/ICMP.cc bro/ICMP.cc  
\*\*\* bro-pub-0.8a34/ICMP.cc Sun Jul 13 12:23:45 2003  
--- bro/ICMP.cc Fri Aug 22 11:04:22 2003

---

<div class="post-metadata">

**Author:** ![Anton\_Chuvakin\_Ph.D](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Anton\_Chuvakin\_Ph.D](https://community.zeek.org/u/Anton_Chuvakin_Ph.D)\
**Post date:** [August 22, 2003, 8:36pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/12 "2003-08-22T20:36:58Z")

</div>

> Below is a newer version of Robin's patch.

[anton@bastion anton]$ patch -p0 \< bro.patch  
patching file bro-pub-0.8a34/ICMP.cc  
Hunk #1 FAILED at 30.  
Hunk #2 FAILED at 83.  
Hunk #3 FAILED at 99.  
3 out of 3 hunks FAILED -- saving rejects to file  
bro-pub-0.8a34/ICMP.cc.rej  
patching file bro-pub-0.8a34/ICMP.h  
Hunk #1 FAILED at 43.  
Hunk #2 FAILED at 54.  
2 out of 2 hunks FAILED -- saving rejects to file  
bro-pub-0.8a34/ICMP.h.rej

Maybe sending as attachment is better?

Best,

---

<div class="post-metadata">

**Author:** ![Ruoming\_Pang](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@Ruoming\_Pang](https://community.zeek.org/u/Ruoming_Pang)\
**Post date:** [August 22, 2003, 9:25pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/13 "2003-08-22T21:25:39Z")

</div>

Sorry. Please either use 'patch -l' (to ignore whitespace -- it worked for  
me) or the attached patch file.

Ruoming

[icmp-fix.diff](https://community.zeek.org/uploads/short-url/d5k8f3md8RBlZ2FVTbvR6wOv2ey.diff) (2.44 KB)

---

<div class="post-metadata">

**Author:** ![Anton\_Chuvakin\_Ph.D](https://avatars.discourse-cdn.com/v4/letter/a/eb8c5e/32.png) [@Anton\_Chuvakin\_Ph.D](https://community.zeek.org/u/Anton_Chuvakin_Ph.D)\
**Post date:** [August 29, 2003, 4:43pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/14 "2003-08-29T16:43:23Z")

</div>

> Sorry. Please either use 'patch -l' (to ignore whitespace -- it worked for  
> me) or the attached patch file.

This patch made bro much more stable and it didn't die in 5 days, BUT it  
now spews thousand of "1061597578.544274 WeirdActivity \*\* non\_IPv4\_packet"  
messages, all the time.

Any fixes for that?

Best,

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/need-help-link-failed-during-compile-0-8a34-version/403/15 "2022-05-06T15:36:49Z")

</div>