Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Building Wireshark on SuSE 11.4 fails, configure does not fi

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 12 Oct 2017 01:39:15 -0700
On Oct 12, 2017, at 12:09 AM, Anders Broman <anders.broman@xxxxxxxxxxxx> wrote:

> -----Original Message-----
> From: Wireshark-dev [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
> Sent: den 11 oktober 2017 22:00
> To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
> Subject: Re: [Wireshark-dev] Building Wireshark on SuSE 11.4 fails, configure does not find pcap functions.
> 
> On Oct 11, 2017, at 4:24 AM, Anders Broman <anders.broman@xxxxxxxxxxxx> wrote:
> 
>> Looking in configure.log
> 
>> What's the full config.log file?
> 
> Included the log file.

OK, so the configure script is not finding pcap_findalldevs(), and, as a result, isn't bothering to look for pcap_datalink_name_to_val() and is just assuming it's not present.

From looking at my collection of CVS/git trees for various libpcap release branches, pcap_datalink_name_to_val() first appeared in libpcap 0.8, and pcap_findalldevs() first appeared in libpcap 0.7, so, assuming a normal libpcap (rather than a libpcap that somebody upstream decided to tweak), the configure script is making a reasonable assumption.

The build log seems to suggest that pcap_datalink_name_to_val() is declared in pcap.h - and the version of the libpcap-devel package is "0.9.8-50.10.1", so *perhaps* it's based on libpcap 0.9.8 - or perhaps something newer (Debian tends, or at least has tended, to call their libpcap "0.8", although it's currently based on a much more recent libpcap; I guess that's just the shared library version number, for binary compatibility).  If it's based on 0.9.8, or a later release, it *should* have pcap_findalldevs() *and* pcap_datalink_name_to_val().

The command used by the configure script to compile the test-for-pcap_findalldevs() program is

	gcc -std=gnu99 -o conftest -I/usr/include/pcap -Wall 
	  -Wextra -Wendif-labels -Wpointer-arith -Wformat-security -fwrapv
	  -fno-strict-overflow -fno-delete-null-pointer-checks -Wvla -Waddress
	  -Wattributes -Wdiv-by-zero -Wignored-qualifiers -Wpragmas
	  -Wno-overlength-strings -Wno-long-long -Wc++-compat -Wshadow
	  -Wno-pointer-sign -Wold-style-definition -Wstrict-prototypes
	  -Werror=implicit -fvisibility=hidden -g -O2 -D_FORTIFY_SOURCE=2
	  -Wl,--as-needed conftest.c -lm

Notably absent from that command is the flag "-lpcap"; the absence of that flag might explain why it got the error

	undefined reference to `pcap_findalldevs'

If something's stored in the garage, you won't find it if you don't look in the garage....

In fact, the only place where it *does* appear to link with libpcap is the test for pcap_open_live().

A quick test of the configure script from a reasonably recent pull of the master branch shows it linking with -lpcap in all the tests for various pcap functions, so I'm not sure why it wouldn't be doing so with your configure script.

Is this a built from a git checkout or from a release tarball?  If it's from a git checkout, what happens if you do a "make maintainer-clean", a "./autogen.sh", and then a "./configure"?