Compile Wireshark in Ubuntu 12.04

Time to move on. 10.04 was a good LTS, now let's do the same for 12.04. The procedure is relatively the same, only few things have changed.

Download source from http://www.wireshark.org/download.html

Now the version is 1.10.2. The rest of the material is about 1.8.3, but the compilation works the same way.
Note the file image/wsicon32.xpm is missing by some reason. Before running compilation create it using  image/wsicon32.png and imagemagic like this:

$ convert image/wsicon32.png image/wsicon32.xpm

I'm also covering this issue later on the process.

Since 1.8.3 there were some additional features added, as example using c-ares, GNU ADNS and SMI MIB libraries. It also fixes http://www.wireshark.org/security/wnpa-sec-2012-26.html, http://www.wireshark.org/security/wnpa-sec-2012-27.html and http://www.wireshark.org/security/wnpa-sec-2012-29.html.

$ tar -jxf wireshark-1.8.3.tar.bz2

# read INSTALL and check dependencies
$ pkg-config glib-2.0 --modversion

$ gtk-config --version

# install dependencies
$ sudo aptitude install --add-user-tag wir libgtk2.0-dev
$ pkg-config glib-2.0 --modversion # confirm that it's working now

$ pkg-config gtk+-2.0 --modversion

# Good, let's install the rest of dependencies.
$ sudo aptitude install --add-user-tag wir libgtk2.0-dev libpcap0.8-dev bison flex libssl-dev libgnutls-dev libpcre3-dev libadns1-dev libc-ares-dev libsmi2-dev # I have libpcap0.8 installed already, you may need to install it as well.

./configure --with-ssl --with-gnutls --with-c-ares --with-libsmi

# two possible ways from here - traditional make, or Debian/Ubuntu making .deb pakages
## Use method #1 for 10.04, this way the compilation completes nowadays in this old Ubuntu version, making debian packages fail because of libraries dependencies. For making debian-package in 12.04 use #2

## 1
# this one was not tested for missing 
$ make -j4; make install # if make is followed by make debian-package the whole compilation runs from the beginning. Skip this step and go to #2 instead; using -j4 to better use my 4 core CPU

## 2
# add dependencies
$ sudo aptitude install --add-user-tag wir dpatch libtool automake1.9 autoconf autotools-dev libc-ares-dev docbook-xsl libpcre3-dev libcap-dev libgnutls-dev portaudio19-dev libkrb5-dev liblua5.1-0-dev libsmi2-dev libgeoip-dev xsltproc # adding dependent packages for .deb building, xsltproc is additional this time

# ...and make



$ if [  -f image/wsicon32.xpm ]; then convert image/wsicon32.png image/wsicon32.xpm; fi # fix missing image/wsicon32.xpm if not done already

$ make -j4 debian-package

# install (packages are one directory up)
$ sudo dpkg -i wireshark wireshark-common tshark

#now clean packages installed to resolve dependencies. This time it takes aptitude 4 steps to propose the solution we want:

$ sudo aptitude purge '?user-tag(wir)'


 The following packages will be REMOVED:   autoconf{p} ...
...
...
...  zlib1g-dev{p}
0 packages upgraded, 0 newly installed, 114 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 113 MB will be freed.
The following packages have unmet dependencies:
 libportaudio2 : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                          libjack-0.116 which is a virtual package.
 audacious-plugins : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                              libjack-0.116 which is a virtual package.
 gstreamer0.10-plugins-good : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                                       libjack-0.116 which is a virtual package.
 mplayer2 : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                     libjack-0.116 which is a virtual package.
 libfluidsynth1 : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                           libjack-0.116 which is a virtual package.
 wireshark-common : Depends: libc-ares2 (>= 1.7.0) but it is not going to be installed.
                    Depends: liblua5.1-0 but it is not going to be installed.
                    Depends: libsmi2ldbl but it is not going to be installed.
The following actions will resolve these dependencies:

      Remove the following packages:
1)      audacious
2)      audacious-plugins
3)      gecko-mediaplayer
4)      gnome-mplayer
5)      gstreamer0.10-plugins-good
6)      guvcview
7)      libfarstream-0.1-0
8)      libfluidsynth1
9)      libportaudio2
10)     libpurple0
11)     mplayer2
12)     pidgin
13)     pidgin-microblog
14)     tshark
 15)     wireshark
16)     wireshark-common

      Leave the following dependencies unresolved:
17)     lubuntu-desktop recommends audacious
18)     lubuntu-desktop recommends audacious-plugins
19)     lubuntu-desktop recommends gecko-mediaplayer
20)     lubuntu-desktop recommends gnome-mplayer
21)     lubuntu-desktop recommends guvcview
22)     lubuntu-desktop recommends pidgin
23)     lubuntu-desktop recommends pidgin-microblog
24)     pidgin recommends gstreamer0.10-plugins-good
25)     audacious-plugins-data recommends audacious-plugins


Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Remove the following packages:
1)     tshark
2)     wireshark
3)     wireshark-common

     Install the following packages:
4)     libjack-jackd2-0 [1.9.8~dfsg.1-1ubuntu1 (now, precise)]



Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Remove the following packages:
1)     tshark
2)     wireshark
3)     wireshark-common

     Keep the following packages at their current version:
4)     libjack0 [1:0.121.0+svn4538-3ubuntu1 (now, precise)]



Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Install the following packages:
1)     libjack-jackd2-0 [1.9.8~dfsg.1-1ubuntu1 (now, precise)]

      Keep the following packages at their current version:
2)     libc-ares2 [1.7.5-1 (now, precise)]
3)     liblua5.1-0 [5.1.4-12ubuntu1 (now, precise)]
4)     libsmi2ldbl [0.4.8+dfsg2-4build1 (now, precise)]



Accept this solution? [Y/n/q/?]y

# final notes:  as this was an experiment, removing wireshark actually removes all the dependencies left from previous step:

$ sudo aptitude purge wireshark wireshark-common tshark
The following packages will be REMOVED: 
  libc-ares2{u} liblua5.1-0{u} libsmi2ldbl{u} tshark{p} wireshark{p} wireshark-common{p}
0 packages upgraded, 0 newly installed, 6 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 53.7 MB will be freed.

# final-final notes: doing new installation on the same machine fail because of dependencies:

 $ sudo dpkg -i wireshark_1.8.3_i386.deb wireshark-common_1.8.3_i386.deb tshark_1.8.3_i386.deb
Selecting previously unselected package wireshark.
(Reading database ... 104217 files and directories currently installed.)
Unpacking wireshark (from wireshark_1.8.3_i386.deb) ...
Selecting previously unselected package wireshark-common.
Unpacking wireshark-common (from wireshark-common_1.8.3_i386.deb) ...
Selecting previously unselected package tshark.
Unpacking tshark (from tshark_1.8.3_i386.deb) ...
dpkg: dependency problems prevent configuration of wireshark-common:
 wireshark-common depends on libc-ares2 (>= 1.7.0); however:
  Package libc-ares2 is not installed.
 wireshark-common depends on liblua5.1-0; however:
  Package liblua5.1-0 is not installed.
 wireshark-common depends on libsmi2ldbl; however:
  Package libsmi2ldbl is not installed.
dpkg: error processing wireshark-common (--install):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of tshark:
 tshark depends on wireshark-common (= 1.8.3); however:
  Package wireshark-common is not configured yet.
dpkg: error processing tshark (--install):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of wireshark:
 wireshark depends on wireshark-common (= 1.8.3); however:
  Package wireshark-common is not configured yet.
dpkg: error processing wireshark (--install):
 dependency problems - leaving unconfigured
Processing triggers for desktop-file-utils ...
Processing triggers for man-db ...
Errors were encountered while processing:
 wireshark-common
 tshark
 wireshark

Hopefully we know how to fix:

$ sudo aptitude -f install
The following partially installed packages will be configured:
  tshark wireshark wireshark-common{b}
No packages will be installed, upgraded, or removed.
0 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 0 B will be used.
The following packages have unmet dependencies:
 wireshark-common : Depends: libc-ares2 (>= 1.7.0) but it is not going to be installed.
                    Depends: liblua5.1-0 but it is not going to be installed.
                    Depends: libsmi2ldbl but it is not going to be installed.
The following actions will resolve these dependencies:

     Remove the following packages:
1)     tshark
2)     wireshark
3)     wireshark-common



Accept this solution? [Y/n/q/?] n
 The following actions will resolve these dependencies:

     Install the following packages:
1)     libc-ares2 [1.7.5-1 (now, precise)]
2)     liblua5.1-0 [5.1.4-12ubuntu1 (now, precise)]
3)     libsmi2ldbl [0.4.8+dfsg2-4build1 (now, precise)]



Accept this solution? [Y/n/q/?] y

# and finally:

 Current status: 0 broken [-1].

aptitude fun!

We all know how to use aptitude user tags, don't we?

sudo aptitude install --add-user-tag tag_name package_name

sudo aptitude purge '?user-tag(tag_name)'

Well, that was simple. Let's do some more complicated stuff. Let's try to list all packages in our system that has user tag set:

aptitude show "?user-tag(d*)"

Got it? I didn't. You should add a letter (any letter) before your wildcard to get results. How and why it is working that way - no idea. The only thing I know is I run into it by accident. Of course it's a good idea to combine with grep:

aptitude show "?user-tag(d*)" | grep "User Tags"

Now it's more simple. We have a list of our user tags
(OK, OK, I know:

aptitude show "?user-tag(d*)" | grep "User Tags" | awk '{print $3}' | sort -u

)
But what now? Let's assume we want to remove some user tag from a package:

sudo aptitude remove-user-tag tag_name package_name

What if we want to remove user tag from all packages where it's set. Easy: just two commands:
1.

aptitude show "?user-tag(tag_name)" | grep ^Package | awk '{print $2}'

2. make a list of packages and run

sudo aptitude remove-user-tag tag_name [long list of packages here]

Is it really long list? If it really is you should experience a lot of hassle doing copy/paste into the aptitude command. But hopefully there is hope!

USER_TAG=tag_name; for i in $(aptitude show "?user-tag($USER_TAG)" | grep ^Package | awk '{print $2}'); do sudo aptitude remove-user-tag $USER_TAG $i; done

Not so bad, isn't it?

2.6.37-rc7-sched - (засега) краят

Махам EasyTag и системата казва - 3 пакета за ъпгрейд. Добре тогава, хайде:

drago@ubuntu:~$ sudo aptitude update
Get:1 http://security.ubuntu.com lucid-security Release.gpg [198B]
...
Fetched 1,066kB in 8s (121kB/s)
Reading package lists... Done

Current status: 3 updates [+3].
drago@ubuntu:~$ sudo aptitude safe-upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
The following packages will be upgraded:
libgudev-1.0-0 libudev0 udev
3 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 637kB of archives. After unpacking 0B will be used.
Do you want to continue? [Y/n/?]
Writing extended state information... Done
Get:1 http://us.archive.ubuntu.com/ubuntu/ lucid-updates/main libudev0 151-12.3 [119kB]
Get:2 http://us.archive.ubuntu.com/ubuntu/ lucid-updates/main udev 151-12.3 [410kB]
Get:3 http://us.archive.ubuntu.com/ubuntu/ lucid-updates/main libgudev-1.0-0 1:151-12.3 [108kB]
Fetched 637kB in 5s (126kB/s)
(Reading database ... 175210 files and directories currently installed.)
Preparing to replace libudev0 151-12.2 (using .../libudev0_151-12.3_i386.deb) ...
Unpacking replacement libudev0 ...
Preparing to replace udev 151-12.2 (using .../udev_151-12.3_i386.deb) ...
Adding `local diversion of /sbin/udevadm to /sbin/udevadm.upgrade'
Unpacking replacement udev ...
Preparing to replace libgudev-1.0-0 1:151-12.2 (using .../libgudev-1.0-0_1%3a151-12.3_i386.deb) ...
Unpacking replacement libgudev-1.0-0 ...
Processing triggers for ureadahead ...
ureadahead will be reprofiled on next reboot
Processing triggers for man-db ...
Setting up libudev0 (151-12.3) ...

Setting up udev (151-12.3) ...
udev start/running, process 8824
Removing `local diversion of /sbin/udevadm to /sbin/udevadm.upgrade'
update-initramfs: deferring update (trigger activated)

Setting up libgudev-1.0-0 (1:151-12.3) ...

Processing triggers for libc-bin ...
ldconfig deferred processing now taking place
Processing triggers for initramfs-tools ...
update-initramfs: Generating /boot/initrd.img-2.6.32-27-generic
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done

Current status: 0 updates [-3].

Всичко това много прекрасно, но гледам нещо интересно:

update-initramfs: Generating /boot/initrd.img-2.6.32-27-generic

И така в играта влиза update-initramfs, но защо генерира образ само за последното ядро е странно. Преглеждам списъка с ядра, и най-накрая решавам да почистя висящите "за поколенията" конфигурации на 2.6.32-[22-25] (самите ядра отдавна са махнати):

drago@ubuntu:~$ sudo aptitude purge linux-image-2.6.32-25-generic linux-image-2.6.32-24-generic linux-image-2.6.32-23-generic linux-image-2.6.32-22-generic
Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
The following packages will be REMOVED:
linux-image-2.6.32-22-generic{p} linux-image-2.6.32-23-generic{p} linux-image-2.6.32-24-generic{p}
linux-image-2.6.32-25-generic{p}
0 packages upgraded, 0 newly installed, 4 to remove and 0 not upgraded.
Need to get 0B of archives. After unpacking 0B will be used.
Do you want to continue? [Y/n/?]
Writing extended state information... Done
(Reading database ... 183831 files and directories currently installed.)
Removing linux-image-2.6.32-22-generic ...
Purging configuration files for linux-image-2.6.32-22-generic ...
Running postrm hook script /usr/sbin/update-grub.
Generating grub.cfg ...
Found linux image: /boot/vmlinuz-2.6.37-rc7-sched
Found initrd image: /boot/initrd.img-2.6.37-rc7-sched
Found linux image: /boot/vmlinuz-2.6.32-27-generic
Found initrd image: /boot/initrd.img-2.6.32-27-generic
Found linux image: /boot/vmlinuz-2.6.32-26-generic
Found initrd image: /boot/initrd.img-2.6.32-26-generic
Found memtest86+ image: /boot/memtest86+.bin
done

Парчето GRUB се повтаря 4 пъти съответно броя на махнатите ядра. Дотук всичко изглежда прекрасно, всичко което трябва да се случи за 2.6.37-rc7-sched се случва и ето и последния тест:

# shutdown -r now

Не мръдвам и пръст и машината стартира. Епопеята приключи до следващия път с нова компилация на ядро. Вероятно ще зарежа 2.6.37 и неговата стабилизация, така и така няма да има бог знае каква разлика с rc7 и ще чакам излизането на 2.6.38. Там вече "магическия" 200 реда пач ще е включен по подразбиране, ако Линус и компания не решат друго. За мен обаче остава момента на оптимизиране на ядрото, конфигурацията която ползвам е твърде далеч от оптималната за моя частен случай, но пък е преносима на всяка i386 машина под Убунту. Не че това е утешение... Страдам и от бъгове на apparmor 680485 и 670318. За тях обаче не може да се направи много. Както казва John Johansen:

"The upstream kernel does not have the compatibility patches, and never will. So mainline kernels will report this problem, and Ubuntu kernels that have not the patches forward ported yet will report this temporarily."

Освен да докопам пачове и да си пачвам сам ядрото преди компилация на пионерски начала. Интересно дали старите връзки ще свършат работа в случая?