[OISF/outreachy] Claim new issue

[Shivani Bhardwaj]

>
> I checked out to the revision mentioned in the error, but my build fails at `make` with the following error:
>
> source-af-packet.c: In function ‘AFPRead’:
> source-af-packet.c:646:28: error: ‘SIOCGSTAMP’ undeclared (first use in this function); did you mean ‘SIOCGRARP’?
>   646 |     if (ioctl(ptv->socket, SIOCGSTAMP, &p->ts) == -1) {
>       |                            ^~~~~~~~~~
>       |                            SIOCGRARP
> source-af-packet.c:646:28: note: each undeclared identifier is reported only once for each function it appears in
> source-af-packet.c: In function ‘AFPReadAndDiscard’:
> source-af-packet.c:1308:28: error: ‘SIOCGSTAMP’ undeclared (first use in this function); did you mean ‘SIOCGRARP’?
>  1308 |     if (ioctl(ptv->socket, SIOCGSTAMP, &ts) == -1) {
>       |                            ^~~~~~~~~~
>       |                            SIOCGRARP
>   CC       source-erf-file.o
> make[2]: *** [Makefile:2122: source-af-packet.o] Error 1
> make[2]: *** Waiting for unfinished jobs....
> make[2]: Leaving directory '/home/sumera/Elantris/suricata/src'
> make[1]: *** [Makefile:499: all-recursive] Error 1
> make[1]: Leaving directory '/home/sumera/Elantris/suricata'
> make: *** [Makefile:425: all] Error 2
>
> From what I found out, SIOCGSTAMP  belongs to <sys/socket.h> and is used to return received timestamp of the last packet passed to user.  I tried including the header in the source-af-packet.c but still get the same error. Surprisingly, this does not pop up in Suricata-6.0.x for me- both versions have SIOCGSTAMP used in the same places. Should I put this up on the forum instead?
>
This was a reported issue long ago but was fixed in the code according
to https://redmine.openinfosecfoundation.org/issues/3094 by
https://github.com/OISF/suricata/pull/4119/commits/8717c3d52fee9f5ec4b4c806d932f1d8d87ccbe4.
Could you please confirm you are with the latest master-4.1.x that has
this commit? If this does not help, yes please create a post on forum.

>>
>> > Another error I keep coming across is
>> >
>> >  ~/Elantris/suricata/qa  master ?4  sudo LSAN_OPTIONS=suppressions=qa/lsan.suppress ASAN_SYMBOLIZER_PATH=/usr/bin/llvm-symbolizer-10 suricata -c /etc/suricata/suricata.yaml -S /dev/null  -k none -r empty.pcap -l log/ -v
>> > AddressSanitizer: failed to read suppressions file '/usr/local/bin/qa/lsan.suppress'
>> >
>> > I am unable to figure out why the path issue arises as this worked fine the first time. I would be glad if you could give me some pointers regarding how to proceed.
>> I see after looking up that some common mistakes can be:
>> - names
>> - paths
>> - variable exports
>>
>> So, I am not really sure if it would work but could you please try
>> exporting the variables that I mentioned before? Maybe you closed the
>> shell and the export was over. You could add it to your .bashrc to
>> make it persistent. Please let me know if this does help.
>
>
> Actually, the first time I had changed the shell after exporting and it caused make to fail. Thereafter, I added it to .zshrc and it has stayed.
> So, I don't think this is the reason.
>
OK. Thanks.

> I have a feeling this issue might take longer to resolve. If it is okay, can I work on a different issue in the meanwhile, while I am waiting for feedback ?
>
Yes, please. Sending an email regarding this shortly.

> thanks,
> sumera


>

--
Shivani
Junior Developer, OISF