Thursday, December 29, 2011

Old Computer....New Problems

The year was 2006 and flush with some bonus cash we decided to buy a new computer. We settled on a Sony Vaio RS710GX package because it was on sale and had everything we needed.

As time passed, prices dropped, and next thing you know everyone had their own laptop. So, the Vaio was relegated to being a print server/file store...and the computer on which I did the taxes/bills/job hunting/etc.

Eventually I upgraded it to 1GB RAM and Windows7. We bought the Windows7 family upgrade which comes with 3 licenses. However, we have 3 other laptops in the house and eventually I decided that instead of wasting a license on the Vaio I'd use it to upgrade the new and more powerful laptops.

So, I've got to decide what I want to do...which OS will I go with?

First, lets look at what I HAVE to be able to do on the new OS:
  • Manage my Ipod
  • Spreadsheets for finances
  • Web
  • DVD/CD creation
  • Ease of use/updates/support
My first choice would have been Solaris, I use it at work and I love it for the servers I manage....but....its performance is not great on the home desktop. Add to that the fact that Oracle is clamping down on licenses and support for Solaris and that OpenSolaris isn't as active as it had been in the past. Also, I don't want to spend a lot of time compiling OpenSource programs for Solaris...when the Linux support for those Apps is already there.

So, I decide on Linux....Ubuntu in particular. It's known for its ease of use, it clean interface and packaging, it's large repository of Software packages, active support community....it seemed like the way to go.

I first try 11.10 which was the latest version at the time. Running from the live CD worked great...but all attempts to install failed during the grub install. You can see that adventure here: https://answers.launchpad.net/ubuntu/+source/grub-installer/+question/182142

Ubuntu 11.x based distro's (LinuxMint) also failed with the same error. However, other distro's succeeded (Solaris, Backtrack, Auditor). In fact BackTrack5 which is an ubuntu 10.x based distro installs. So, instead of using the 11.x I decide to go with Ubuntu 10.04 LTS. BOOOSH! it works like a champ.

The Nvidia drivers installed easy enough through the Hardware Drivers GUI, although I did need to manually edit the xorg.conf to set the refresh rates for the monitor. I didn't HAVE to install the nvidia drivers, the default nouveau drivers worked pretty well at 1024x768...but I wanted 1280x1024 which required the drivers.

I then used ndiswrapper to set-up the Netgear WG311v3 wireless interface...and biggity bam...I was up and running.

So let's look to see if it met my requirements:
  • Rythmbox - Manage my Ipod
  • OpenOffice - Spreadsheets for finances
  • Firefox/Chrome - Web
  • Brasero/cmd line - DVD/CD creation
  • Community/update manager/etc.. - Ease of use/updates/support
10.04 is still a gnome distro, which I find I like better than the newer unbiquity interface in 11.10 (from the liveCD...since I couldn't resolve the grub install issue).






Saturday, December 10, 2011

Snort 2.9.1.2 Solaris and SegFaults

As previously posted, I was able to compile and run Snort 2.9.1.2 on Solaris10 with a little work.

However, that was on my development system which is a Solaris VM running on my MacBook, and I found that when I take the Solaris Package I built on the VM and install it on a SunFire X4400 M2 (x86 NOT SPARC)...it would crash with a SegFault and drop a core file:
       --== Initialization Complete ==--

  ,,_     -*> Snort! <*-
 o"  )~   Version 2.9.1.2 IPv6 GRE (Build 84)
  ''''    By Martin Roesch & The Snort Team: http://www.snort.org/snort/snort-team
          Copyright (C) 1998-2011 Sourcefire, Inc., et al.
          Using libpcap version 1.1.1
          Using PCRE version: 8.12 2011-01-15
          Using ZLIB version: 1.1.4

          Rules Engine: SF_SNORT_DETECTION_ENGINE  Version 1.15

          Preprocessor Object: SF_SSLPP (IPV6)  Version 1.1  
4>
          Preprocessor Object: SF_SSH (IPV6)  Version 1.1  
          Preprocessor Object: SF_SMTP (IPV6)  Version 1.1  
          Preprocessor Object: SF_SIP (IPV6)  Version 1.1  
          Preprocessor Object: SF_SDF (IPV6)  Version 1.1  
          Preprocessor Object: SF_REPUTATION (IPV6)  Version 1.1

          Preprocessor Object: SF_POP (IPV6)  Version 1.0  
          Preprocessor Object: SF_IMAP (IPV6)  Version 1.0  
          Preprocessor Object: SF_FTPTELNET (IPV6)  Version 1.2

          Preprocessor Object: SF_DNS (IPV6)  Version 1.1  
          Preprocessor Object: SF_DCERPC2 (IPV6)  Version 1.0  
3>
Commencing packet processing (pid=24487)
Segmentation Fault (core dumped)
Obviously this annoyed me to no end...because it wasn't my dev system that I wanted to run this package on.  It was also the first time I've had a package built on my Dev VM crash when moved the the SunFire server. In theory they're both x86 Sol10...it should work...in theory.

So, I tried building the package on the SunFire, thinking that maybe there was something different (libraries, patch levels, etc..) between the systems that I wasn't taking into account. However, it didn't matter where I built the package...it would still SegFault.

Now, I looked at the pstack, flags, and even did a backtrace using adb against the core file to see if it was anything obvious. It wasn't. So, at this point I had to put it out to the Snort community.

I was contacted by Russ one of the developers at SourceFire who was able to spot and fix the issue rather quickly. Here's the response:
Looks like you are getting burned by some faulty alignment foo.  Try forcing SPARC_TWIDDLE to zero in decode.h and recompiling.  It should look like this (zero in both cases):

#if defined (SOLARIS) || defined (SUNOS) || defined (__sparc__) || defined(__sparc64__) || defined (HPUX)
#define SPARC_TWIDDLE       0
#else
#define SPARC_TWIDDLE       0
#endif

Let me know if this fixes the problems for you.
So, I edited decode.h and changed the first value (SPARC_TWIDDLE was set to 2 ) to 0.

Then I did:
  • make clean
  • make
  • make install
That's it, that fixed it! Thanks to Russ at SourceFire for the fix!  I love Solaris and I love Snort...so I am slap happy that I can keep running the two together.