Snort 2.9 into Snort 3 recipe

Snort 2.9 into Snort 3 recipe

[Rostanin Gleb SBR DIRCS]

[-- Attachment #1: Type: text/plain, Size: 1045 bytes --]

Hello OpenEmbedded Community,

currently I am working on implementing the Snort IDS on an embedded system with the Yocto Linux OS. As OpenEmbedded already provides a recipe for Snort 2.9 it is easy to install snort into the OS. Unfortunately, it is not easy to change the recipe so that the new Snort 3 version is installed. I tried to change the git repo link and the checksum (as a simple solution try), but unfortunately, I ran into multiple errors, and I am not sure at which point I need to make further changes. As I could understand, also a few changes to the source code of Snort must be done to make it work on the Yocto OS.
Was someone already successful in implementing a recipe to install the newer Snort 3 version directly on Yocto? What do I have to change in the Snort 2.9 recipe to install the Snort 3 version?
Of course, another solution could be cross compiling Snort for the embedded system, but maybe there is already a solution for this.
I happy about any help or comment on this topic!

Kind regards

G. Rostanin

[-- Attachment #2: Type: text/html, Size: 3625 bytes --]

Re: [yocto] Snort 2.9 into Snort 3 recipe

[Trevor Gamblin]

[-- Attachment #1: Type: text/plain, Size: 1700 bytes --]


On 2023-06-09 10:05, Rostanin Gleb SBR DIRCS wrote:
>
> Hello OpenEmbedded Community,
>
> currently I am working on implementing the Snort IDS on an embedded 
> system with the Yocto Linux OS. As OpenEmbedded already provides a 
> recipe for Snort 2.9 it is easy to install snort into the OS. 
> Unfortunately, it is not easy to change the recipe so that the new 
> Snort 3 version is installed. I tried to change the git repo link and 
> the checksum (as a simple solution try), but unfortunately, I ran into 
> multiple errors, and I am not sure at which point I need to make 
> further changes. As I could understand, also a few changes to the 
> source code of Snort must be done to make it work on the Yocto OS.
>
> Was someone already successful in implementing a recipe to install the 
> newer Snort 3 version directly on Yocto? What do I have to change in 
> the Snort 2.9 recipe to install the Snort 3 version?
>
The errors you're seeing when you try to build Snort 3 should provide a 
clue. If you post those, someone may be able to provide further suggestions.

Trevor

> Of course, another solution could be cross compiling Snort for the 
> embedded system, but maybe there is already a solution for this.
>
> I happy about any help or comment on this topic!
>
> Kind regards
>
> G. Rostanin
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#60239):https://lists.yoctoproject.org/g/yocto/message/60239
> Mute This Topic:https://lists.yoctoproject.org/mt/99428914/7611679
> Group Owner:yocto+owner@lists.yoctoproject.org
> Unsubscribe:https://lists.yoctoproject.org/g/yocto/unsub  [tgamblin@baylibre.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

[-- Attachment #2: Type: text/html, Size: 5255 bytes --]

AW: [yocto] Snort 2.9 into Snort 3 recipe

[Rostanin Gleb SBR DIRCS]

[-- Attachment #1: Type: text/plain, Size: 3875 bytes --]

Hello,

I did the following steps:

  *   Rename recipe file name to snort_3.1.62.0.bb
  *   Changed line 9 “SRC_URI = “…/snort/${BP}.tar.gz”” to https://www.snort.org/downloads/snortplus/snort3-3.1.62.0.tar.gz
  *   Added correct snort3 sha256sum in line 17
  *   Added correct MD5 checksum of the snort tar ball in line 5
The following error occurs in “0001-libpcap … headers.patch” file:
ERROR: Applying patch '0001-libpcap-search-sysroot-for-headers.patch' on target directory '/home/user/fsl-auto-yocto-bsp/build_s32g274ardb2/tmp/work/cortexa53-crypto-fsl-linux/snort/3.1.62.0-r0/snort-3.1.62.0'
CmdError('quilt --quiltrc /home/user/fsl-auto-yocto-bsp/build_s32g274ardb2/tmp/work/cortexa53-crypto-fsl-linux/snort/3.1.62.0-r0/recipe-sysroot-native/etc/quiltrc push', 0, "stdout: Applying patch 0001-libpcap-search-sysroot-for-headers.patch
can't find file to patch at input line 21
Perhaps you used the wrong -p or --strip option?

As the patches are not written for snort 3 I tried again but deleted the patches from the “.bb” file. Now the following error occurs:
DEBUG: Executing python function autotools_aclocals
DEBUG: SITE files ['endian-little', 'bit-64', 'arm-common', 'arm-64', 'common-linux', 'common-glibc', 'aarch64-linux', 'common']
DEBUG: Python function autotools_aclocals finished
DEBUG: Executing shell function do_compile
NOTE: make -j 6
make: *** No targets specified and no makefile found.  Stop.
ERROR: oe_runmake failed
WARNING: exit code 1 from a shell command.

Now I am not sure where and at which point the make file should be created and why it is missing. Could you give some tips on how to transfer this recipe to an snort 3 recipe?

Thank you for reading

G. Rostanin

Von: Trevor Gamblin <tgamblin@baylibre.com>
Gesendet: Freitag, 9. Juni 2023 18:25
An: Rostanin Gleb SBR DIRCS <Gleb.Rostanin@zf.com>; yocto@lists.yoctoproject.org
Betreff: Re: [yocto] Snort 2.9 into Snort 3 recipe



On 2023-06-09 10:05, Rostanin Gleb SBR DIRCS wrote:
Hello OpenEmbedded Community,

currently I am working on implementing the Snort IDS on an embedded system with the Yocto Linux OS. As OpenEmbedded already provides a recipe for Snort 2.9 it is easy to install snort into the OS. Unfortunately, it is not easy to change the recipe so that the new Snort 3 version is installed. I tried to change the git repo link and the checksum (as a simple solution try), but unfortunately, I ran into multiple errors, and I am not sure at which point I need to make further changes. As I could understand, also a few changes to the source code of Snort must be done to make it work on the Yocto OS.
Was someone already successful in implementing a recipe to install the newer Snort 3 version directly on Yocto? What do I have to change in the Snort 2.9 recipe to install the Snort 3 version?

The errors you're seeing when you try to build Snort 3 should provide a clue. If you post those, someone may be able to provide further suggestions.

Trevor
Of course, another solution could be cross compiling Snort for the embedded system, but maybe there is already a solution for this.
I happy about any help or comment on this topic!

Kind regards

G. Rostanin





-=-=-=-=-=-=-=-=-=-=-=-

Links: You receive all messages sent to this group.

View/Reply Online (#60239): https://lists.yoctoproject.org/g/yocto/message/60239<https://lists.yoctoproject.org/g/yocto/message/60239>

Mute This Topic: https://lists.yoctoproject.org/mt/99428914/7611679<https://lists.yoctoproject.org/mt/99428914/7611679>

Group Owner: yocto+owner@lists.yoctoproject.org<mailto:yocto+owner@lists.yoctoproject.org>

Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub<https://lists.yoctoproject.org/g/yocto/unsub> [tgamblin@baylibre.com<mailto:tgamblin@baylibre.com>]

-=-=-=-=-=-=-=-=-=-=-=-



[-- Attachment #2: Type: text/html, Size: 15670 bytes --]

Re: AW: [yocto] Snort 2.9 into Snort 3 recipe

[Trevor Gamblin]

[-- Attachment #1: Type: text/plain, Size: 4772 bytes --]


On 2023-06-12 07:33, Rostanin Gleb SBR DIRCS wrote:
>
> Hello,
>
> I did the following steps:
>
>   * Rename recipe file name to snort_3.1.62.0.bb
>   * Changed line 9 “SRC_URI = “…/snort/${BP}.tar.gz”” to
>     https://www.snort.org/downloads/snortplus/snort3-3.1.62.0.tar.gz
>   * Added correct snort3 sha256sum in line 17
>   * Added correct MD5 checksum of the snort tar ball in line 5
>
> The following error occurs in “0001-libpcap … headers.patch” file:
>
> /ERROR: Applying patch '0001-libpcap-search-sysroot-for-headers.patch' 
> on target directory 
> '/home/user/fsl-auto-yocto-bsp/build_s32g274ardb2/tmp/work/cortexa53-crypto-fsl-linux/snort/3.1.62.0-r0/snort-3.1.62.0'/
>
> /CmdError('quilt --quiltrc 
> /home/user/fsl-auto-yocto-bsp/build_s32g274ardb2/tmp/work/cortexa53-crypto-fsl-linux/snort/3.1.62.0-r0/recipe-sysroot-native/etc/quiltrc 
> push', 0, "stdout: Applying patch 
> 0001-libpcap-search-sysroot-for-headers.patch/
>
> /can't find file to patch at input line 21/
>
> /Perhaps you used the wrong -p or --strip option?/
>
> //
>
> As the patches are not written for snort 3 I tried again but deleted 
> the patches from the “.bb” file. Now the following error occurs:
>
> /DEBUG: Executing python function autotools_aclocals
> DEBUG: SITE files ['endian-little', 'bit-64', 'arm-common', 'arm-64', 
> 'common-linux', 'common-glibc', 'aarch64-linux', 'common']
> DEBUG: Python function autotools_aclocals finished
> DEBUG: Executing shell function do_compile
> NOTE: make -j 6
> make: *** No targets specified and no makefile found. Stop.
> ERROR: oe_runmake failed
> WARNING: exit code 1 from a shell command.///
>
> Now I am not sure where and at which point the make file should be 
> created and why it is missing. Could you give some tips on how to 
> transfer this recipe to an snort 3 recipe?
>
It looks like snort 2.x uses Autotools for setup, while 3.x uses CMake 
instead. You would have to adjust the recipe so that it uses the latter 
and passes the correct build flags for the "default" snort configuration 
(I'm not sure what those would be). You may also need to spend some time 
making sure that the changes provided by those deleted patches aren't 
still required somewhere in the new source files.

If you do 'grep -r "inherit cmake"' on openembedded-core/meta, you can 
find many examples of other recipes that use CMake for building that you 
could use as references.

> Thank you for reading
>
> G. Rostanin
>
> *Von:*Trevor Gamblin <tgamblin@baylibre.com>
> *Gesendet:* Freitag, 9. Juni 2023 18:25
> *An:* Rostanin Gleb SBR DIRCS <Gleb.Rostanin@zf.com>; 
> yocto@lists.yoctoproject.org
> *Betreff:* Re: [yocto] Snort 2.9 into Snort 3 recipe
>
> On 2023-06-09 10:05, Rostanin Gleb SBR DIRCS wrote:
>
>     Hello OpenEmbedded Community,
>
>     currently I am working on implementing the Snort IDS on an
>     embedded system with the Yocto Linux OS. As OpenEmbedded already
>     provides a recipe for Snort 2.9 it is easy to install snort into
>     the OS. Unfortunately, it is not easy to change the recipe so that
>     the new Snort 3 version is installed. I tried to change the git
>     repo link and the checksum (as a simple solution try), but
>     unfortunately, I ran into multiple errors, and I am not sure at
>     which point I need to make further changes. As I could understand,
>     also a few changes to the source code of Snort must be done to
>     make it work on the Yocto OS.
>
>     Was someone already successful in implementing a recipe to install
>     the newer Snort 3 version directly on Yocto? What do I have to
>     change in the Snort 2.9 recipe to install the Snort 3 version?
>
> The errors you're seeing when you try to build Snort 3 should provide 
> a clue. If you post those, someone may be able to provide further 
> suggestions.
>
> Trevor
>
>     Of course, another solution could be cross compiling Snort for the
>     embedded system, but maybe there is already a solution for this.
>
>     I happy about any help or comment on this topic!
>
>     Kind regards
>
>     G. Rostanin
>
>
>
>     -=-=-=-=-=-=-=-=-=-=-=-
>
>     Links: You receive all messages sent to this group.
>
>     View/Reply Online (#60239):
>     https://lists.yoctoproject.org/g/yocto/message/60239  <https://lists.yoctoproject.org/g/yocto/message/60239>
>
>     Mute This Topic: https://lists.yoctoproject.org/mt/99428914/7611679  <https://lists.yoctoproject.org/mt/99428914/7611679>
>
>     Group Owner: yocto+owner@lists.yoctoproject.org  <mailto:yocto+owner@lists.yoctoproject.org>
>
>     Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub  <https://lists.yoctoproject.org/g/yocto/unsub>[tgamblin@baylibre.com  <mailto:tgamblin@baylibre.com>]
>
>     -=-=-=-=-=-=-=-=-=-=-=-
>

[-- Attachment #2: Type: text/html, Size: 14825 bytes --]