Redux - source build on OpenBSD (5.3) and BIND libs

Zeek
1

Greetings,

CMake 2.8.10.2
Perl 5.12.2
libmagic 5.11
SWIG 1.3.36
Bison 2.3
Flex 2.5.4
Bash 4.2.42

Got stumped trying to build Bro on OpenBSD 5.3 i386 related to finding
BIND8 headers/libs.

I see a few past similar issues, notably:
http://marc.info/?l=bro&m=132806089033571

Installing Bro 2.1.

$ ./configure
Build Directory : build
Source Directory: /home/dspruell/downloads/bro-2.1
-- The C compiler identification is GNU 4.2.1
-- The CXX compiler identification is GNU 4.2.1
-- Check for working C compiler: /usr/bin/cc
-- Check for working C compiler: /usr/bin/cc -- works
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working CXX compiler: /usr/bin/c++
-- Check for working CXX compiler: /usr/bin/c++ -- works
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - done
-- Found sed: /usr/bin/sed
-- Found Perl: /usr/bin/perl (found version "5.12.2")
-- Found FLEX: /usr/bin/flex version 2.5.4
-- Found BISON: /usr/local/bin/bison
-- Found PCAP: /usr/lib/libpcap.so.7.0
-- Performing Test PCAP_LINKS_SOLO
-- Performing Test PCAP_LINKS_SOLO - Success
-- Looking for pcap_get_pfring_id
-- Looking for pcap_get_pfring_id - not found
-- Found OpenSSL: /usr/lib/libssl.so.19.0;/usr/lib/libcrypto.so.22.0
-- Performing Test ns_initparse_works_none
-- Performing Test ns_initparse_works_none - Failed
-- Performing Test res_mkquery_works_none
-- Performing Test res_mkquery_works_none - Success
-- Performing Test ns_initparse_works_resolv
-- Performing Test ns_initparse_works_resolv - Failed
-- Performing Test res_mkquery_works_resolv
-- Performing Test res_mkquery_works_resolv - Success
-- Performing Test ns_initparse_works_bind
-- Performing Test ns_initparse_works_bind - Failed
-- Performing Test res_mkquery_works_bind
-- Performing Test res_mkquery_works_bind - Success
-- Could NOT find BIND (missing: BIND_LIBRARY)
-- Found LibMagic: /usr/local/lib/libmagic.so.3.0
-- Found ZLIB: /usr/lib/libz.so.4.1 (found version "1.2.3")
CMake Error at aux/binpac/CMakeLists.txt:17 (message):
   Could not find prerequisite package 'BIND'

CMake Error at aux/binpac/CMakeLists.txt:19 (message):
  Configuration aborted due to missing prerequisites

-- Configuring incomplete, errors occurred!

I'm hung up trying to figure out where the necessary
routines/libraries would be. OpenBSD ships with BIND 9 by default, and
has res_* functions in libc (there is no libresolv.a, etc.; libresolv
was removed ~2005). The previously referenced thread mentions libbind
package; this doesn't seem to exist any more, although there is an an
upstream ISC BIND 9 package (isc-bind 9.9.2-P2). When this package is
installed, I can see the following library:

$ ldconfig -r |egrep 'bind'
        398:-lbind9.0.0 => /usr/local/lib/libbind9.so.0.0

...but the library does not provide ns_* symbols and the error at
configure is still the same (maybe because of BIND 9 vs. BIND 8?):

-- Performing Test ns_initparse_works_none
-- Performing Test ns_initparse_works_none - Failed
-- Performing Test res_mkquery_works_none
-- Performing Test res_mkquery_works_none - Success
-- Performing Test ns_initparse_works_resolv
-- Performing Test ns_initparse_works_resolv - Failed
-- Performing Test res_mkquery_works_resolv
-- Performing Test res_mkquery_works_resolv - Success
-- Performing Test ns_initparse_works_bind
-- Performing Test ns_initparse_works_bind - Failed
-- Performing Test res_mkquery_works_bind
-- Performing Test res_mkquery_works_bind - Success
-- Could NOT find BIND (missing: BIND_LIBRARY)

CMake Error at aux/binpac/CMakeLists.txt:17 (message):
   Could not find prerequisite package 'BIND'

It looks to me that OpenBSD doesn't include the ns_* routines; this
discussion might support that:

http://bugs.bitlbee.org/bitlbee/ticket/421

Wondering if I'm at a dead end on this. Any ideas?

2

I'm hung up trying to figure out where the necessary
routines/libraries would be. OpenBSD ships with BIND 9 by default, and
has res_* functions in libc (there is no libresolv.a, etc.; libresolv
was removed ~2005). The previously referenced thread mentions libbind
package; this doesn't seem to exist any more, although there is an an
upstream ISC BIND 9 package (isc-bind 9.9.2-P2).

There's a libbind 6.0 package at [1] (third from bottom of list) that might have what's needed. From what I read [2], the resolver library and headers it provides used to be part of BIND 8/9, but later removed as its own separate package. Not sure if OpenBSD has it's own package corresponding to that.

- Jon

[1] Downloads - ISC
[2] ISC libbind 6.0

3

5.3 doesn't. I had to grab libbind 6.0 from isc.org in order to get it
to compile. IIRC that's the only thing I had to do.

- --
I prefer encrypted email. Get my key here:
http://www.louruppert.com/keys/115DCF62.asc
PGP Fingerprint: 3261 B9F9 9363 D512 56F8 12DD 127F 4D6A 115D CF62

4

Indeed, appears that the libbind port disappeared for 5.2 and 5.3 but
has since been reinstated.

http://www.openbsd.org/cgi-bin/cvsweb/ports/net/libbind/
http://marc.info/?l=openbsd-ports&m=136465613319561&w=2

I'll give it a go with the source package, thanks for the help.

5

Hi everybody,

As Lou said, getting libbind6 is the solution.

Here is the process I followed today :

1) Packages

I had to install some of them (maybe others are needed but as my VPS was up and running...)

# pkg_add flex bison libmagic swig ruby python gmake

Note : ruby is ruby 1.9 and python is 2.7

2) Libbind 6.0

- Get libbind 6 from : http://www.isc.org/downloads/
- Extract it somewhere then compile/install it. Note that the directory I used (/opt/share/libbind-6.0) could be another one.

# tar zxvf libbind-6.0.tar.gz
# cd libbind-6.0
# ./configure --prefix=/opt/share/libbind-6.0; make; make install

3) Bro 2.1

- Extract bro-2.1 then compile it

# tar zxvf bro-2.1.tar.gz
# cd bro-2.1
# CFLAGS="-I/usr/include/ -I/usr/local/include/ -I/usr/local/include/ruby-1.9.1/ruby/backward/" ./configure --prefix=/opt/share/bro-2.1 --with-bind=/opt/share/libbind-6.0/
# gmake; gmake install

Please note I use "/opt/share/bro-2.1" as install directory and I use "gmake".

The whole process should work but if not, just send a mail, I will be happy helping about it :slight_smile:

Cheers.

Jean-Philippe.

PS: I will try to provide a complete document in the next weeks

6

Very nice.

I completed install in very similar manner, although things appeared
to work without requiring CFLAGS to be set for the configure script;
my built completed with:

./configure --with-bind=/opt/libbind
gmake; gmake install

That said, I do notice that when invoking some bro commands I get the
following output about symbol size mismatches:

$ bro --help
bro:/usr/lib/libc.so.66.2: bro : WARNING: symbol(__p_class_syms) size
mismatch, relink your program
bro:/usr/lib/libc.so.66.2: bro : WARNING: symbol(_res) size mismatch,
relink your program
bro:/usr/lib/libc.so.66.2: bro : WARNING: symbol(__p_type_syms) size
mismatch, relink your program
bro version 2.1
[...]

I can see this has been encountered several times over the years:

(2003) http://comments.gmane.org/gmane.comp.security.detection.bro/222
(2006) http://comments.gmane.org/gmane.comp.security.detection.bro/1382
(2007) http://comments.gmane.org/gmane.comp.security.detection.bro/1890
(2008) http://comments.gmane.org/gmane.os.openbsd.ports/18520
(2012) http://comments.gmane.org/gmane.comp.security.detection.bro/4254

Someone suggested it was related to issue between libbind and libc
resolver routines. Anyone know more?

7

Hi,

I encountered the same messages but didn't have the time to find the reason and explain it.
I put this problem on hold and try to get a response as soon as possible.

Speaking of "CFLAGS", I had to use it because of the Ruby binding.
I think Broccoli wants to use "rubyio.h" which is in "/usr/local/include/ruby-1.9.1/ruby/backward/".
This is the only reason I need to use this specific flag.

Cheers.

Jean-Philippe.

8

Yeah, that's probably because the ruby bindings are still stuck at 1.8.x support only. I've never had the motivation to update them to a newer version of Ruby. On the other hand, the ruby bindings aren't necessary for anything unless you happen to be using them in scripts you've written locally. BroControl only uses the python bindings.

  .Seth