Snort + snortsam-patch troubles

[oleg_skat]

Hi to the FreeBSD community!

I got some trouble with snortsam-patch-2.8 & and want to ask for some help. About the system: FreeBSD 9.2-STABLE, amd64. Self-compiled kernel and world ten days ago. Actual ports collection.

Snort 2.9.5 has been installed, was adjusted and worked without problems but I needs the barnyard2 & and snortsam functions. All of the packages installed correctly, but got the trouble with the snortsam plugin installation. The patches in the snort-2.9.5 directory:

snortsam-patch-2.8.tar.gz
snortsam-2.9.5.3-2.diff.gz

My actions were:

cp ./m4/libprelude.m4 /usr/share/aclocal 
patch < snortsam-2.9.5.3-2.diff.gz
chmod +x autojunk.sh
./autojunk.sh 
./configure
make

I got an error, at the last part of the output:

libtool: link: gcc -g -O2 -DSF_VISIBILITY -fvisibility=hidden -fno-strict-aliasing -Wall -Wl,-R/usr/local/lib -o snort debug.o decode.o encode.o active.o log.o mstring.o parser.o profiler.o plugbase.o snort.o strlcatu.o strlcpyu.o tag.o util.o detect.o signature.o mempool.o sf_sdlist.o fpcreate.o fpdetect.o pcrm.o byte_extract.o sfthreshold.o packet_time.o event_wrapper.o event_queue.o ppm.o log_text.o detection_filter.o detection_util.o rate_filter.o obfuscation.o sfdaq.o idle_processing.o  -L/usr/local/lib output-plugins/libspo.a detection-plugins/libspd.a dynamic-plugins/libdynamic.a dynamic-output/plugins/liboutput.a preprocessors/libspp.a parser/libparser.a target-based/libtarget_based.a preprocessors/HttpInspect/libhttp_inspect.a preprocessors/Stream5/libstream5.a sfutil/libsfutil.a control/libsfcontrol.a file-process/libfileAPI.a file-process/libs/libfile.a /usr/local/lib/libdaq_static.a /usr/local/lib/libdnet -lcrypto /usr/local/lib/libpcre.so -lm /usr/local/lib/libdaq_static_modules.a /usr/local/lib/libsfbpf.so -lpcap -lz -lpthread -pthread -Wl,-rpath -Wl,/usr/local/lib -Wl,-rpath -Wl,/usr/local/lib
plugbase.o: In function `RegisterOutputPlugins':
/root/snort/snort-2.9.5/src/plugbase.c:1551: undefined reference to `AlertFWsamSetup'
*** [snort] Error code 1

Stop in /root/snort/snort-2.9.5/src.
*** [all-recursive] Error code 1

Stop in /root/snort/snort-2.9.5/src.
*** [all-recursive] Error code 1

Stop in /root/snort/snort-2.9.5.
*** [all] Error code 1

Or another way, instead of autojunk.sh`s

libtoolize --automake --copy 
aclocal -I m4
autoheader 
automake --add-missing --copy 
autoconf 
./configure
make

The similar result. I'm at a deadlock.

I want to know your opinion about this. Maybe somebody has good skills or light ideas.

Thanks .

P.S
automake-1.14
automake-wrapper-20131203

 

[oleg_skat]

That thread is closed. .... just must update the ports, and snortsam unsupported already. Need to use barnyard2 functions