Forest Global Training Partners

Cyber Risks · Cisco Talos

(Successfully) Building Shared Object Rules (and Snort) under OpenBSD

Summary: Cisco Talos's VRT worked through problems building Snort shared object rules under OpenBSD, tracing the failure to libdnet, which does not create a shared library under its default configuration and so blocks the dynamic library for lib_sfengine that the so rules depend on. The fix, tested on OpenBSD 4.8 for amd64, is to rebuild libdnet with ./configure --with-gnu-ld --enable-shared, symlink libdnet.1.1 to libdnet.so, run ldconfig -R, and add flags such as --disable-static-daq and the dnet include and library paths to the snort configure command.

Bottom line: The failure was not in Snort's detection logic but in a dependency's build defaults, which means a rule pack can appear deployed while the shared object rules it depends on never load. Talos says pre-compiled shared object rules for OpenBSD are coming to a rule pack soon, so teams running Snort on that platform should verify the engine and preprocessor .so links exist rather than assume the install succeeded.

Read the original at Cisco Talos ↗

Topics
Malware
Related