Re: Unable to compile snort3 plugin

Hello guy's !
I have found the problem , it was a source version issue.
Sorry !

CL

On Tue, May 28, 2019 at 12:34 PM <[email protected]>
wrote:

> Send Snort-devel mailing list submissions to
>         [email protected]
>
> To subscribe or unsubscribe via the World Wide Web, visit
>         https://lists.snort.org/mailman/listinfo/snort-devel
> or, via email, send a message with subject or body 'help' to
>         [email protected]
>
> You can reach the person managing the list at
>         [email protected]
>
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Snort-devel digest..."
>
>
> Today's Topics:
>
>    1. Unable to compile snort3 plugin (Christian Leclerc)
>    2. Re: Developing new IPS action plugin (?zkan KIRIK)
>    3. Re: Developing new IPS action plugin (?zkan KIRIK)
>    4. libsf_sorules in 2.9.13 (Markus Lude)
>
>
> ----------------------------------------------------------------------
>
> Message: 1
> Date: Mon, 27 May 2019 09:04:34 -0400
> From: Christian Leclerc <[email protected]>
> To: [email protected]
> Subject: [Snort-devel] Unable to compile snort3 plugin
> Message-ID:
>         <
> CA+VMzsJDVC5xcr_k7ku_2MSXstmHBQedGL92ASjnDzQxTxGV4Q@mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> Hello community,
> I am trying to create a new snort3 plugin for my personal project and I
> have problem compiling the code .. I know , I am a noob ..
>
> Iv'e took the code from snort3_extra in git, everything's seams to work
> fine so I remove everything I didn't need and create my own logger.
>
> The create configure script works just fine, without any problem but when I
> am trying to compile my plugin ( based on the alert_all code) I am stuck
> (for like an hour now) on this error :
>
>
>
> *CONFIDENTIALIT?* L'information apparaissant dans ce message ?lectronique
> est de nature l?galement privil?gi?e et confidentielle. Si ce message vous
> est parvenu par erreur et que vous n'?tes pas le destinataire vis?, vous
> ?tes par les pr?sentes avis? que tout usage, copie ou distribution de ce
> message est strictement interdit. Vous ?tes donc pri? de nous informer
> imm?diatement de cette erreur et de d?truire ce message.
>
> *CONFIDENTIALITY* The information in this message is legally privileged and
> confidential. In the event of a transmission error and if you are not the
> individual or entity mentioned above, you are hereby advised that any use,
> copying or reproduction of this document is strictly forbidden. Please
> advise us of this error and destroy this message.
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.snort.org/pipermail/snort-devel/attachments/20190527/ec9df105/attachment.html
> >
>
> ------------------------------
>
> Message: 2
> Date: Mon, 27 May 2019 17:11:20 +0300
> From: ?zkan KIRIK <[email protected]>
> To: Russ <[email protected]>
> Cc: [email protected]
> Subject: Re: [Snort-devel] Developing new IPS action plugin
> Message-ID:
>         <CAAcX-AGjAfEZkT-wE23q+SrkQ0kvf=
> [email protected]>
> Content-Type: text/plain; charset="utf-8"
>
> Thank you Russ,
>
> It is just configuring the new action for detection.
>
> For example,
>
> reroute tcp any any -> any any ( msg: "new route test", dst_router_mac:
> "11:22:33:44:55:66"; sid: 123 )
>
> or is there any way to pass arguments to newaction?
>
> Thanks
>
>
> On Sat, May 25, 2019 at 3:57 PM Russ via Snort-devel <
> [email protected]> wrote:
>
> > Hmm.  Is your newvar used for detection or just for configuring your
> > action?  The goal was to move all action related stuff out of the rule
> > body.  You can look at the replace option which works with the reject
> > action for probably the closest example but I don't that does what you
> want.
> >
> > On 5/24/19 4:24 AM, ?zkan KIRIK via Snort-devel wrote:
> >
> > Hello,
> >
> > I'm trying to develop a simple ips_action plugin. I need to use arguments
> > per rule for action.
> >
> > newaction tcp any any -> any any ( msg: "new action test", newvar: "abc";
> > sid: 123 )
> >
> > Is it possible to access newvar variable within void
> > NewAction::exec(Packet* p) function?
> > Or do you suggest another way to pass per rule arguments to action?
> >
> > Thanks,
> > Ozkan
> >
> > _______________________________________________
> > Snort-devel mailing [email protected]://
> lists.snort.org/mailman/listinfo/snort-devel
> >
> > Please visit http://blog.snort.org for the latest news about Snort!
> >
> >
> > _______________________________________________
> > Snort-devel mailing list
> > [email protected]
> > https://lists.snort.org/mailman/listinfo/snort-devel
> >
> > Please visit http://blog.snort.org for the latest news about Snort!
> >
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.snort.org/pipermail/snort-devel/attachments/20190527/92c4b3b5/attachment.html
> >
>
> ------------------------------
>
> Message: 3
> Date: Mon, 27 May 2019 17:15:26 +0300
> From: ?zkan KIRIK <[email protected]>
> To: Russ <[email protected]>
> Cc: [email protected]
> Subject: Re: [Snort-devel] Developing new IPS action plugin
> Message-ID:
>         <
> CAAcX-AHBKAbA8r3C+P0GSj+Gues2-HXFEBqUjOxJ_nOX3JsaZg@mail.gmail.com>
> Content-Type: text/plain; charset="utf-8"
>
> It's type err.
> It is just configuring the new action.
>
> On Mon, May 27, 2019 at 5:11 PM ?zkan KIRIK <[email protected]> wrote:
>
> > Thank you Russ,
> >
> > It is just configuring the new action for detection.
> >
> > For example,
> >
> > reroute tcp any any -> any any ( msg: "new route test", dst_router_mac:
> > "11:22:33:44:55:66"; sid: 123 )
> >
> > or is there any way to pass arguments to newaction?
> >
> > Thanks
> >
> >
> > On Sat, May 25, 2019 at 3:57 PM Russ via Snort-devel <
> > [email protected]> wrote:
> >
> >> Hmm.  Is your newvar used for detection or just for configuring your
> >> action?  The goal was to move all action related stuff out of the rule
> >> body.  You can look at the replace option which works with the reject
> >> action for probably the closest example but I don't that does what you
> want.
> >>
> >> On 5/24/19 4:24 AM, ?zkan KIRIK via Snort-devel wrote:
> >>
> >> Hello,
> >>
> >> I'm trying to develop a simple ips_action plugin. I need to use
> arguments
> >> per rule for action.
> >>
> >> newaction tcp any any -> any any ( msg: "new action test", newvar:
> "abc";
> >> sid: 123 )
> >>
> >> Is it possible to access newvar variable within void
> >> NewAction::exec(Packet* p) function?
> >> Or do you suggest another way to pass per rule arguments to action?
> >>
> >> Thanks,
> >> Ozkan
> >>
> >> _______________________________________________
> >> Snort-devel mailing [email protected]://
> lists.snort.org/mailman/listinfo/snort-devel
> >>
> >> Please visit http://blog.snort.org for the latest news about Snort!
> >>
> >>
> >> _______________________________________________
> >> Snort-devel mailing list
> >> [email protected]
> >> https://lists.snort.org/mailman/listinfo/snort-devel
> >>
> >> Please visit http://blog.snort.org for the latest news about Snort!
> >>
> >
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL: <
> https://lists.snort.org/pipermail/snort-devel/attachments/20190527/ff5eef69/attachment.html
> >
>
> ------------------------------
>
> Message: 4
> Date: Mon, 27 May 2019 21:53:13 +0200
> From: Markus Lude <[email protected]>
> To: [email protected]
> Subject: [Snort-devel] libsf_sorules in 2.9.13
> Message-ID: <[email protected]>
> Content-Type: text/plain; charset=us-ascii
>
> Hi,
>
> libsf_sorules appears in snort 2.9.13.
>
> Is there some easy way to disable building that library?
> Or do I have to patch the configure script?
>
> What is this library for? It seems not to be used so far.
>
> Regards
> Markus Lude
>
>
> ------------------------------
>
> Subject: Digest Footer
>
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.snort.org/mailman/listinfo/snort-devel
>
>
> ------------------------------
>
> End of Snort-devel Digest, Vol 23, Issue 15
> *******************************************
>

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!