Compile Wireshark in Ubuntu 12.04

Time to move on. 10.04 was a good LTS, now let's do the same for 12.04. The procedure is relatively the same, only few things have changed.

Download source from http://www.wireshark.org/download.html

Now the version is 1.10.2. The rest of the material is about 1.8.3, but the compilation works the same way.
Note the file image/wsicon32.xpm is missing by some reason. Before running compilation create it using  image/wsicon32.png and imagemagic like this:

$ convert image/wsicon32.png image/wsicon32.xpm

I'm also covering this issue later on the process.

Since 1.8.3 there were some additional features added, as example using c-ares, GNU ADNS and SMI MIB libraries. It also fixes http://www.wireshark.org/security/wnpa-sec-2012-26.html, http://www.wireshark.org/security/wnpa-sec-2012-27.html and http://www.wireshark.org/security/wnpa-sec-2012-29.html.

$ tar -jxf wireshark-1.8.3.tar.bz2

# read INSTALL and check dependencies
$ pkg-config glib-2.0 --modversion

$ gtk-config --version

# install dependencies
$ sudo aptitude install --add-user-tag wir libgtk2.0-dev
$ pkg-config glib-2.0 --modversion # confirm that it's working now

$ pkg-config gtk+-2.0 --modversion

# Good, let's install the rest of dependencies.
$ sudo aptitude install --add-user-tag wir libgtk2.0-dev libpcap0.8-dev bison flex libssl-dev libgnutls-dev libpcre3-dev libadns1-dev libc-ares-dev libsmi2-dev # I have libpcap0.8 installed already, you may need to install it as well.

./configure --with-ssl --with-gnutls --with-c-ares --with-libsmi

# two possible ways from here - traditional make, or Debian/Ubuntu making .deb pakages
## Use method #1 for 10.04, this way the compilation completes nowadays in this old Ubuntu version, making debian packages fail because of libraries dependencies. For making debian-package in 12.04 use #2

## 1
# this one was not tested for missing 
$ make -j4; make install # if make is followed by make debian-package the whole compilation runs from the beginning. Skip this step and go to #2 instead; using -j4 to better use my 4 core CPU

## 2
# add dependencies
$ sudo aptitude install --add-user-tag wir dpatch libtool automake1.9 autoconf autotools-dev libc-ares-dev docbook-xsl libpcre3-dev libcap-dev libgnutls-dev portaudio19-dev libkrb5-dev liblua5.1-0-dev libsmi2-dev libgeoip-dev xsltproc # adding dependent packages for .deb building, xsltproc is additional this time

# ...and make



$ if [  -f image/wsicon32.xpm ]; then convert image/wsicon32.png image/wsicon32.xpm; fi # fix missing image/wsicon32.xpm if not done already

$ make -j4 debian-package

# install (packages are one directory up)
$ sudo dpkg -i wireshark wireshark-common tshark

#now clean packages installed to resolve dependencies. This time it takes aptitude 4 steps to propose the solution we want:

$ sudo aptitude purge '?user-tag(wir)'


 The following packages will be REMOVED:   autoconf{p} ...
...
...
...  zlib1g-dev{p}
0 packages upgraded, 0 newly installed, 114 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 113 MB will be freed.
The following packages have unmet dependencies:
 libportaudio2 : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                          libjack-0.116 which is a virtual package.
 audacious-plugins : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                              libjack-0.116 which is a virtual package.
 gstreamer0.10-plugins-good : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                                       libjack-0.116 which is a virtual package.
 mplayer2 : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                     libjack-0.116 which is a virtual package.
 libfluidsynth1 : Depends: libjack-jackd2-0 (>= 1.9.5~dfsg-14) but it is not going to be installed. or
                           libjack-0.116 which is a virtual package.
 wireshark-common : Depends: libc-ares2 (>= 1.7.0) but it is not going to be installed.
                    Depends: liblua5.1-0 but it is not going to be installed.
                    Depends: libsmi2ldbl but it is not going to be installed.
The following actions will resolve these dependencies:

      Remove the following packages:
1)      audacious
2)      audacious-plugins
3)      gecko-mediaplayer
4)      gnome-mplayer
5)      gstreamer0.10-plugins-good
6)      guvcview
7)      libfarstream-0.1-0
8)      libfluidsynth1
9)      libportaudio2
10)     libpurple0
11)     mplayer2
12)     pidgin
13)     pidgin-microblog
14)     tshark
 15)     wireshark
16)     wireshark-common

      Leave the following dependencies unresolved:
17)     lubuntu-desktop recommends audacious
18)     lubuntu-desktop recommends audacious-plugins
19)     lubuntu-desktop recommends gecko-mediaplayer
20)     lubuntu-desktop recommends gnome-mplayer
21)     lubuntu-desktop recommends guvcview
22)     lubuntu-desktop recommends pidgin
23)     lubuntu-desktop recommends pidgin-microblog
24)     pidgin recommends gstreamer0.10-plugins-good
25)     audacious-plugins-data recommends audacious-plugins


Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Remove the following packages:
1)     tshark
2)     wireshark
3)     wireshark-common

     Install the following packages:
4)     libjack-jackd2-0 [1.9.8~dfsg.1-1ubuntu1 (now, precise)]



Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Remove the following packages:
1)     tshark
2)     wireshark
3)     wireshark-common

     Keep the following packages at their current version:
4)     libjack0 [1:0.121.0+svn4538-3ubuntu1 (now, precise)]



Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

     Install the following packages:
1)     libjack-jackd2-0 [1.9.8~dfsg.1-1ubuntu1 (now, precise)]

      Keep the following packages at their current version:
2)     libc-ares2 [1.7.5-1 (now, precise)]
3)     liblua5.1-0 [5.1.4-12ubuntu1 (now, precise)]
4)     libsmi2ldbl [0.4.8+dfsg2-4build1 (now, precise)]



Accept this solution? [Y/n/q/?]y

# final notes:  as this was an experiment, removing wireshark actually removes all the dependencies left from previous step:

$ sudo aptitude purge wireshark wireshark-common tshark
The following packages will be REMOVED: 
  libc-ares2{u} liblua5.1-0{u} libsmi2ldbl{u} tshark{p} wireshark{p} wireshark-common{p}
0 packages upgraded, 0 newly installed, 6 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 53.7 MB will be freed.

# final-final notes: doing new installation on the same machine fail because of dependencies:

 $ sudo dpkg -i wireshark_1.8.3_i386.deb wireshark-common_1.8.3_i386.deb tshark_1.8.3_i386.deb
Selecting previously unselected package wireshark.
(Reading database ... 104217 files and directories currently installed.)
Unpacking wireshark (from wireshark_1.8.3_i386.deb) ...
Selecting previously unselected package wireshark-common.
Unpacking wireshark-common (from wireshark-common_1.8.3_i386.deb) ...
Selecting previously unselected package tshark.
Unpacking tshark (from tshark_1.8.3_i386.deb) ...
dpkg: dependency problems prevent configuration of wireshark-common:
 wireshark-common depends on libc-ares2 (>= 1.7.0); however:
  Package libc-ares2 is not installed.
 wireshark-common depends on liblua5.1-0; however:
  Package liblua5.1-0 is not installed.
 wireshark-common depends on libsmi2ldbl; however:
  Package libsmi2ldbl is not installed.
dpkg: error processing wireshark-common (--install):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of tshark:
 tshark depends on wireshark-common (= 1.8.3); however:
  Package wireshark-common is not configured yet.
dpkg: error processing tshark (--install):
 dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of wireshark:
 wireshark depends on wireshark-common (= 1.8.3); however:
  Package wireshark-common is not configured yet.
dpkg: error processing wireshark (--install):
 dependency problems - leaving unconfigured
Processing triggers for desktop-file-utils ...
Processing triggers for man-db ...
Errors were encountered while processing:
 wireshark-common
 tshark
 wireshark

Hopefully we know how to fix:

$ sudo aptitude -f install
The following partially installed packages will be configured:
  tshark wireshark wireshark-common{b}
No packages will be installed, upgraded, or removed.
0 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 0 B will be used.
The following packages have unmet dependencies:
 wireshark-common : Depends: libc-ares2 (>= 1.7.0) but it is not going to be installed.
                    Depends: liblua5.1-0 but it is not going to be installed.
                    Depends: libsmi2ldbl but it is not going to be installed.
The following actions will resolve these dependencies:

     Remove the following packages:
1)     tshark
2)     wireshark
3)     wireshark-common



Accept this solution? [Y/n/q/?] n
 The following actions will resolve these dependencies:

     Install the following packages:
1)     libc-ares2 [1.7.5-1 (now, precise)]
2)     liblua5.1-0 [5.1.4-12ubuntu1 (now, precise)]
3)     libsmi2ldbl [0.4.8+dfsg2-4build1 (now, precise)]



Accept this solution? [Y/n/q/?] y

# and finally:

 Current status: 0 broken [-1].

Отново и отново

Wireshark отново излиза с бъг фикс версия 1.4.4, и разбира се ми предстои нова компилация. Повече подробности на сайта на проекта:
http://www.wireshark.org/docs/relnotes/wireshark-1.4.4.html

Компилацията досега правех винаги на домашния комп, но сега ще я пусна на ВМ на работния - и без това резултатът в края е .deb пакети, а после е лесно. Също не е зле да се провери дали kismet излиза с нова версия. Да не забравяме и ядрото, моят звяр е 2.6.37.1, а на линия е вече 2.6.37.2, т.е. - още една компилация ;-)

Компилиране "на части"

След целия sturm und drang покрай 2.6.37-sched както обикновено се сещам за липсващ модул. "Липсващ" в смисъл не влязал в компилацията. Досещате се става дума за UAS (USB attached SCSI). Който вече се разбрахме не ми влиза още в работа, но какъв шанс да се научиш да компилираш модул отделно от ядрото. И винаги започваме с google: "compile single kernel module" е първото предположение. Постепенно се изчитат разни видове и родове документи до достигането до TLDP и The Linux Kernel Module Programming Guide. Вече подкован теоретично пробвам:

find src/linux-2.6.37/ -name uas*c
cd src/linux-2.6.37/drivers/usb/storage/
ll uas*
cd ../../../
make M=drivers/usb/storage/
make CONFIG_USB_UAS=m drivers/usb/storage/

Наблюдава се известен ефект от рода на "CC [M] drivers/usb/storage/uas.o", не точно каквото се търси. А се търси модул uas.ko. Тогава да сменя src/linux-2.6.37/drivers/usb/storage/Makefile? Речено-сторено:

$ cat Makefile
obj-m += uas.o

all:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules

clean:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean

Нова компилация:

cd src/linux-2.6.37/drivers/usb/storage/
$ make
make -C /lib/modules/2.6.37-sched/build M=/home/drago/tmp/linux-2.6.37/drivers/usb/storage modules
make[1]: Entering directory `/home/drago/tmp/linux-2.6.37'
CC [M] /home/drago/tmp/linux-2.6.37/drivers/usb/storage/uas.o
Building modules, stage 2.
MODPOST 1 modules
LD [M] /home/drago/tmp/linux-2.6.37/drivers/usb/storage/uas.ko
make[1]: Leaving directory `/home/drago/tmp/linux-2.6.37'

Това беше, остават проби от сорта "защо ги ручахме жабетата":

$ modinfo ./uas.ko
filename: ./uas.ko
author: Matthew Wilcox and Sarah Sharp
license: GPL
srcversion: A6AD03F37C0CDE765E33F4B
alias: usb:v*p*d*dc*dsc*dp*ic08isc06ipAA*
alias: usb:v*p*d*dc*dsc*dp*ic08isc06ip62*
alias: usb:v*p*d*dc*dsc*dp*ic08isc06ip50*
depends:
vermagic: 2.6.37 SMP mod_unload modversions 686

$ sudo insmod ./uas.ko
$ lsmod | grep uas
uas 7100 0
$ sudo rmmod uas
$ lsmod | grep uas
$ sudo tail /var/log/messages
Jan 10 19:14:26 ubuntu kernel: [10517.104535] usbcore: registered new interface driver uas
Jan 10 19:15:07 ubuntu kernel: [10558.230712] usbcore: deregistering interface driver uas
$ sudo cp uas.ko /lib/modules/2.6.37-sched/kernel/drivers/usb/storage/
$ sudo depmod -a
$ sudo modprobe uas
$ lsmod | grep uas
uas 7100 0
$ sudo rmmod uas

Толкова за днес...

Compile wireshark in Ubuntu 10.04

Download source from http://www.wireshark.org/download.html

Now the version is 1.8.0, procedure still works, but there are some additional bits added, as example using c-ares, GNU ADNS and SMI MIB libraries.

$ tar -jxf wireshark-1.2.10.tar.bz2

# read INSTALL and check dependencies
$ pkg-config glib-2.0 --modversion
$ glib-config --version
$ gtk-config --version

# install dependencies
$ sudo aptitude install --add-user-tag wir libgtk2.0-dev
$ pkg-config glib-2.0 --modversion # confirm that it's working now
$ glib-config --version
$ pkg-config gtk+-2.0 --modversion

Good, let's install the rest of dependencies.
$ sudo aptitude install --add-user-tag wir libgtk2.0-dev libpcap0.8-dev bison flex libssl-dev libgnutls-dev libpcre3-dev libadns1-dev libc-ares-dev libsmi2-dev # I have libpcap0.8 installed already, you may need to install it as well.

./configure --with-ssl --with-gnutls --with-c-ares --with-libsmi
# two possible ways from here - traditional make, or Debian/Ubuntu making .deb pakages
Use method #1 for 10.04, this way the compilation completes nowadays in this old Ubuntu version, making debian packages fail because of libraries dependencies.
## 1
$ make; make install # if make is followed by make debian-package the whole compilation runs from the beginning. Skip this step and go to #2 instead

## 2
# add dependencies
$ sudo aptitude install --add-user-tag wir dpatch libtool automake1.9 autoconf autotools-dev libc-ares-dev docbook-xsl libpcre3-dev libcap-dev libgnutls-dev portaudio19-dev libkrb5-dev liblua5.1-0-dev libsmi2-dev libgeoip-dev # adding dependent packages for .deb building

# ...and make
$ make debian-package
Note: Right now there is a bug in 1.8.0, which is fixed in SVN and for 1.8.1, but debian-package fails under 12.04 LTS

# install (packages are one directory up)
$ sudo dpkg -i wireshark wireshark-common tshark

#now clean packages installed to resolve dependencies, but accept the second solution, leaving dependent packages intact:

$ sudo aptitude purge '?user-tag(wir)'

Reading package lists... Done
Building dependency tree
Reading state information... Done
Reading extended state information
Initializing package states... Done
The following packages are BROKEN:
wireshark-common
The following packages will be REMOVED:
autoconf{p}...
...
...
... xtrans-dev{p}
0 packages upgraded, 0 newly installed, 92 to remove and 0 not upgraded.
Need to get 0B of archives. After unpacking 114MB will be freed.
The following packages have unmet dependencies:
wireshark-common: Depends: libc-ares2 (>= 1.7.0) but it is not installable
Depends: libsmi2ldbl but it is not installable
The following actions will resolve these dependencies:

Remove the following packages:
tshark
wireshark
wireshark-common

Score is -463

Accept this solution? [Y/n/q/?] n
The following actions will resolve these dependencies:

Keep the following packages at their current version:
libc-ares2 [1.7.0-1 (lucid, now)]
libsmi2ldbl [0.4.8+dfsg2-2 (lucid, now)]

Score is -19930

Accept this solution? [Y/n/q/?] y