关于PF_RING编译时出现的ip_defrag错误

tiger625

This directory contains:

kernel/                                Kernel related patches
userland/                        User space code
userland/lib/                        User space library used to manpulate PF_RING
userland/libpcap-XXX-ring/        Libpcap enhanced with PF_RING support
userland/examples/                P(acket)count application (use it for your tests)

See also:

- PF_RING and Snort
http://synfulpacket.blogspot.com/2006/11/pfring-and-snort.html

- Advanced Packet Capturing Howto: PF_RING, NAPI and extended libpcap on Debian Sarge
http://bjou.homeunix.net/blog/20 ... ap-on-debian-sarge/

NOTE
As of PF_RING 4.x you NO LONGER NEED to patch the linux kernel. If you are using
a patched kernel, please revert the patch otherwise you will capture the same
packet twice

------------
Luca Deri, Rocco Carbone
April 2004-09


这个是readme的内容，我原先就是按这边来做的，不需要给内核打补丁，直接编译，但这样也是有不少问题的才去网上找其他方法。我把直接make后的问题贴出来吧，
make -C /lib/modules/2.6.9-89.ELsmp/build SUBDIRS=/usr/src/PF_RING/kernel EXTRA_CFLAGS='-I/usr/src/PF_RING/kernel -DSVN_REV="\"4113\""' modules
make[1]: Entering directory `/usr/src/kernels/2.6.9-89.EL-smp-i686'
  CC [M]  /usr/src/PF_RING/kernel/pf_ring.o
/usr/src/PF_RING/kernel/pf_ring.c:203: warning: `MODULE_PARM_' is deprecated (declared at include/linux/module.h:554)
/usr/src/PF_RING/kernel/pf_ring.c:204: warning: `MODULE_PARM_' is deprecated (declared at include/linux/module.h:554)
/usr/src/PF_RING/kernel/pf_ring.c:205: warning: `MODULE_PARM_' is deprecated (declared at include/linux/module.h:554)
/usr/src/PF_RING/kernel/pf_ring.c:206: warning: `MODULE_PARM_' is deprecated (declared at include/linux/module.h:554)
/usr/src/PF_RING/kernel/pf_ring.c: In function `match_filtering_rule':
/usr/src/PF_RING/kernel/pf_ring.c:1072: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:1085: error: storage size of 'state' isn't known
/usr/src/PF_RING/kernel/pf_ring.c:1103: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:1107: warning: implicit declaration of function `textsearch_find_continuous'
/usr/src/PF_RING/kernel/pf_ring.c:1107: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:1085: warning: unused variable `state'
/usr/src/PF_RING/kernel/pf_ring.c: In function `register_device_handler':
/usr/src/PF_RING/kernel/pf_ring.c:2360: warning: assignment from incompatible pointer type
/usr/src/PF_RING/kernel/pf_ring.c: In function `ring_release':
/usr/src/PF_RING/kernel/pf_ring.c:2537: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:2538: warning: implicit declaration of function `textsearch_destroy'
/usr/src/PF_RING/kernel/pf_ring.c:2538: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c: In function `do_memory_mmap':
/usr/src/PF_RING/kernel/pf_ring.c:2806: warning: assignment makes integer from pointer without a cast
/usr/src/PF_RING/kernel/pf_ring.c:2807: warning: passing arg 1 of `kvirt_to_pa' makes integer from pointer without a cast
/usr/src/PF_RING/kernel/pf_ring.c:2812: warning: implicit declaration of function `remap_pfn_range'
/usr/src/PF_RING/kernel/pf_ring.c: In function `ring_setsockopt':
/usr/src/PF_RING/kernel/pf_ring.c:3588: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3591: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3602: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3625: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3626: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3627: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3627: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3627: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3627: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3741: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c:3742: error: structure has no member named `pattern'
/usr/src/PF_RING/kernel/pf_ring.c: In function `ring_exit':
/usr/src/PF_RING/kernel/pf_ring.c:4405: warning: implicit declaration of function `proto_unregister'
/usr/src/PF_RING/kernel/pf_ring.c:4405: error: `ring_proto' undeclared (first use in this function)
/usr/src/PF_RING/kernel/pf_ring.c:4405: error: (Each undeclared identifier is reported only once
/usr/src/PF_RING/kernel/pf_ring.c:4405: error: for each function it appears in.)
/usr/src/PF_RING/kernel/pf_ring.c: In function `ring_init':
/usr/src/PF_RING/kernel/pf_ring.c:4422: warning: implicit declaration of function `proto_register'
/usr/src/PF_RING/kernel/pf_ring.c:4422: error: `ring_proto' undeclared (first use in this function)
make[2]: *** [/usr/src/PF_RING/kernel/pf_ring.o] Error 1
make[1]: *** [_module_/usr/src/PF_RING/kernel] Error 2
make[1]: Leaving directory `/usr/src/kernels/2.6.9-89.EL-smp-i686'
make: *** [all] Error 2

实际上也是一个结构体中某个结构找不到的问题，当时就解决不了，请高手指点下

tiger625

pattern的使用是在这边。。。
filtering_rule_element * rule;
if(rule->pattern[0] != NULL)

Godbach

感觉主要原因可能是版本不对。这里面错误提示就说结构体成员的问题。很有可能是不同版本之间对该结构体进行了调整。

tiger625

是PF_RING的版本不对吗？不知道应该如何下载适合的版本，现在有有通过SNV才能下载，我linux内核的版本是2.6.9-89.ELsmp

Godbach

那就找和你内核版本对应的源码版本吧

tiger625

非常感谢版主来解决我的问题，但我目前没办法（网上一直找不着，官方网站上逛了一圈也没说这方面的内容）找着与我内核对应的版本，主要也就是pf_ring.c和pf_ring.h这两个文件，错误很多，

Godbach

LZ可以参考一下这篇文章：
http://www.cnblogs.com/bits/archive/2009/03/25/linux-pf_ring.html

tiger625

很悲剧，我主要就是在参考这篇文章，决定换linux版本了。。。

Godbach

如果可以换版本的话，你可以参考九贱兄那篇分析文章。他提供了内核源码版本和PF_RING的版本，应该是匹配的

tiger625

换了个版本，2.6.18的干净内核，一下子搞定，哎，确实是版本问题，谢谢各位啦