Hi there, I saw your post on the snort-users list (link: http://seclists.org/snort/2017/q2/78) and it looks like you've managed to solve this issue. Please do let us know if you have any further feedback/questions on the Hyperscan patch, though! Best regards, Justin From: Hyperscan [mailto:hyperscan-bounces@lists.01.org] On Behalf Of Sec Aficionado Sent: Saturday, April 22, 2017 1:36 AM To: hyperscan(a)lists.01.org Subject: [Hyperscan] Fwd: Problem with autoreconf in FreeBSD Hi there, I'm confident this is not a hyperscan issue, but I'm forwarding this message in case someone here has some insight that might help me. I can't build snort on a FreeBSD 10.3 machine because autoreconf breaks the configure script for snort. Thanks in advance for your time, From: Sec Aficionado Sent: Friday, April 21, 9:32 AM Subject: Problem with autoreconf in FreeBSD To: snort-users@lists.sourceforge.net<mailto:snort-users@lists.sourceforge.net> Hi everybody, I'm trying to build snort 2.9.9.0 on a FreeBSD 10.3, fresh install. Downloading and building the code works well. However, I want to build snort with Hyperscan support. This requires some changes to the configure.in and other files, so I ran autoreconf -fi before building. The command gives a bunch of warnings but completes successfully. The problem I have is that configure is broken after this point. Right after checking for lzma_stream_decoder in -llzma, I get a syntax error. It breaks on the check for luajit, but the whole thing seems out of place in the script. The check is done differently than in the original configure script. In order to rule out Hyperscan, I removed the entire folder, decompressed snort and built it. As I mentioned before, this worked. Next, I deleted everything again and decompressed the snort source, but before building, I ran autoreconf -fi on the unmodified source. This resulted in a broken configure script, at the same spot as before, with the same syntax error. Is this an issue with autoconf, or a sign that perhaps I am missing a library/package? As I mentioned before, this is a fresh install of FreeBSD 10.3. Other information that may be pertinent: * Running as a virtualbox guest on Win 7 Enterprise host. * VM has 2 CPUs, 4GB of RAM * All extra stuff was installed via pkg, only snort was downloaded as source. * Daq built ok, it doesn't require modifications by Hyperscan. * I installed X11 and gnome desktop. Thanks in advance for your time, Sent from my mobile

Hi, I'm glad you got everything up and running! The mechanism we use for the fat runtime is the gcc/glibc "ifunc" attribute, which requires compiler, binutils and libc support. As far as we're aware, this is only available in Linux, because of the GNU toolchain dependency. I haven't used FreeBSD's Linux compat layer in a very long time, but my guess is that you would have to build/get a Linux version of Snort and all its dependencies (including Hyperscan), which would be a lot of work. If you're not deploying pre-built Hyperscan libraries to lots of machines with different hardware (which is where the fat library is useful) then just building Hyperscan natively on your platform will provide the same level of performance. Best regards, Justin From: Hyperscan [mailto:hyperscan-bounces@lists.01.org] On Behalf Of Sec Aficionado Sent: Thursday, April 27, 2017 10:59 AM To: Hyperscan regular expression matching library <hyperscan(a)lists.01.org&gt; Subject: Re: [Hyperscan] Problem with autoreconf in FreeBSD Hi Justin, Thanks for following up. Yes, I indeed fixed it and got it to compile. Other than this one issue (which I blame on me for missing a package), it was smooth sailing. You guys have really done a great job. I do have a follow up question: the files say that FAT_RUNTIME is only available in Linux. Do you happen to know if I can make it work in FreeBSD by using the improved Linux compatibility layer? Sent from my mobile ________________________________ From: Hyperscan <hyperscan-bounces@lists.01.org<mailto:hyperscan-bounces@lists.01.org>> on behalf of Viiret, Justin <justin.viiret@intel.com<mailto:justin.viiret@intel.com>> Sent: Tuesday, April 25, 2017 7:43:07 PM To: Hyperscan regular expression matching library Subject: Re: [Hyperscan] Problem with autoreconf in FreeBSD Hi there, I saw your post on the snort-users list (link: http://seclists.org/snort/2017/q2/78) and it looks like you've managed to solve this issue. Please do let us know if you have any further feedback/questions on the Hyperscan patch, though! Best regards, Justin From: Hyperscan [mailto:hyperscan-bounces@lists.01.org] On Behalf Of Sec Aficionado Sent: Saturday, April 22, 2017 1:36 AM To: hyperscan@lists.01.org<mailto:hyperscan@lists.01.org> Subject: [Hyperscan] Fwd: Problem with autoreconf in FreeBSD Hi there, I'm confident this is not a hyperscan issue, but I'm forwarding this message in case someone here has some insight that might help me. I can't build snort on a FreeBSD 10.3 machine because autoreconf breaks the configure script for snort. Thanks in advance for your time, From: Sec Aficionado Sent: Friday, April 21, 9:32 AM Subject: Problem with autoreconf in FreeBSD To: snort-users@lists.sourceforge.net<mailto:snort-users@lists.sourceforge.net> Hi everybody, I'm trying to build snort 2.9.9.0 on a FreeBSD 10.3, fresh install. Downloading and building the code works well. However, I want to build snort with Hyperscan support. This requires some changes to the configure.in and other files, so I ran autoreconf -fi before building. The command gives a bunch of warnings but completes successfully. The problem I have is that configure is broken after this point. Right after checking for lzma_stream_decoder in -llzma, I get a syntax error. It breaks on the check for luajit, but the whole thing seems out of place in the script. The check is done differently than in the original configure script. In order to rule out Hyperscan, I removed the entire folder, decompressed snort and built it. As I mentioned before, this worked. Next, I deleted everything again and decompressed the snort source, but before building, I ran autoreconf -fi on the unmodified source. This resulted in a broken configure script, at the same spot as before, with the same syntax error. Is this an issue with autoconf, or a sign that perhaps I am missing a library/package? As I mentioned before, this is a fresh install of FreeBSD 10.3. Other information that may be pertinent: * Running as a virtualbox guest on Win 7 Enterprise host. * VM has 2 CPUs, 4GB of RAM * All extra stuff was installed via pkg, only snort was downloaded as source. * Daq built ok, it doesn't require modifications by Hyperscan. * I installed X11 and gnome desktop. Thanks in advance for your time, Sent from my mobile