Skip to content

good solution to snort compilation on RHEL4

February 17, 2010

Important: On Red Hat/Fedora systems, you will need to perform an extra step before you can compile snort_inline. This has not been tested on other systems, but, if your build fails later with the error shown below…

In file included from /usr/include/linux/netfilter_ipv4/ip_queue.h:10,
from /usr/include/libipq.h:37,
from ../../src/inline.h:8,
from ../../src/snort.h:38,
from spo_alert_fast.c:51:
/usr/include/linux/if.h:59: redefinition of `struct ifmap’
/usr/include/linux/if.h:77: redefinition of `struct ifreq’
/usr/include/linux/if.h:126: redefinition of `struct ifconf’
make[3]: *** [spo_alert_fast.o] Error 1
make[3]: Leaving directory
`/usr/src/snort_inline-2.3.0-RC1/src/output-plugins’
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory `/usr/src/snort_inline-2.3.0-RC1/src’
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/usr/src/snort_inline-2.3.0-RC1′
make: *** [all] Error 2

…you may need to perform the corrective steps below: The build fails because your glibc headers need to be updated [1], and this is why the kernel source is required, as stated above. To temporarily fix this problem, please make the following adjustments. This step assumes you have your kernel’s source installed, and that it resides in linux-2.6.9. This directory is likely to change, depending on your kernel/distro version.

cd /usr/include
mv linux linux.orig
ln -s /usr/src/redhat/SOURCES/linux-2.6.9/include/linux/ linux

This step can always be reversed at a later date, should problems arise.
Read more

Advertisements
No comments yet

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: