Error compiling packetbeat on OS X EI Capitan

Elastic Stack Beats
1

I'm running into a weird situation here, hope someone could help me out !

While I was compiling packetbeat source code, I got the following error,

go build
# github.com/elastic/beats/vendor/github.com/tsg/gopacket/pcap
could not determine kind of name for C.PCAP_ERROR_ACTIVATED
could not determine kind of name for C.PCAP_ERROR_IFACE_NOT_UP
could not determine kind of name for C.PCAP_ERROR_NO_SUCH_DEVICE
could not determine kind of name for C.PCAP_ERROR_PERM_DENIED
could not determine kind of name for C.PCAP_WARNING_PROMISC_NOTSUP
could not determine kind of name for C.pcap_activate
could not determine kind of name for C.pcap_can_set_rfmon    
could not determine kind of name for C.pcap_create
could not determine kind of name for C.pcap_free_datalinks
could not determine kind of name for C.pcap_offline_filter
could not determine kind of name for C.pcap_set_buffer_size
could not determine kind of name for C.pcap_set_promisc
could not determine kind of name for C.pcap_set_rfmon
could not determine kind of name for C.pcap_set_snaplen
could not determine kind of name for C.pcap_set_timeout
could not determine kind of name for C.pcap_statustostr

clang errors for preamble:
../vendor/github.com/tsg/gopacket/pcap/pcap.go:35:10: error: use of undeclared identifier                 'PCAP_ERROR'
    return PCAP_ERROR;
     ^
../vendor/github.com/tsg/gopacket/pcap/pcap.go:47:9: error: use of undeclared identifier 'PCAP_ERROR'
    return PCAP_ERROR;
           ^
2 errors generated.

make: *** [build] Error 2

I checked the pcap.go file and found the two error lines were within the annotation, seems the compiler took the annotation as program statements incorrectly, how did that happen ?

then I tried to build it on Linux, it worked. Below is my environment of GO:

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/yuzhiyu/Documents/programming/go"
GORACE=""
GOROOT="/usr/local/go"
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GO15VENDOREXPERIMENT="1"
CC="clang"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-        length=0 -fno-common"
CXX="clang++"
CGO_ENABLED="1"

Any idea is appreciated !!

2

it turned out that the annotation lines in GO code is cgo (C code in GO), then the problem becomes why cgo failed to include pcap.h header file which include PCAP_ERROR and some additional variables.

below is the code I found in beats/vendor/github.com/tsg/gopacket/pcap/pcap.go

package pcap
9 
10 /*
11 #cgo linux LDFLAGS: -lpcap
12 #cgo freebsd LDFLAGS: -lpcap
13 #cgo openbsd LDFLAGS: -lpcap
14 #cgo darwin LDFLAGS: -lpcap
15 #cgo solaris LDFLAGS: -lpcap
16 #cgo windows CFLAGS: -I C:/WpdPack/Include
17 #cgo windows,386 LDFLAGS: -L C:/WpdPack/Lib -lwpcap
18 #cgo windows,amd64 LDFLAGS: -L C:/WpdPack/Lib/x64 -lwpcap
19 #include <stdlib.h>
20 #include <pcap.h>
21 
22 // Some old versions of pcap don't define this constant.
23 #ifndef PCAP_NETMASK_UNKNOWN
24 #define PCAP_NETMASK_UNKNOWN 0xffffffff
25 #endif

seems line#20 is not functioning, really need your advices.

3

That's strange, libpcap should be installed by default on OS X, and the flags should be fine to work with the default installation.

Please check that the /usr/include/pcap.h exists on your system.

4

Thanks for the reply.

I do have a pcap.h in /usr/include.

The problem is solved as below.

I searched google about clang, found the following command which can show some info about clang.
clang -v -x c /dev/null
the output for this command is :

#include <...> search starts here:
 /usr/local/include
 /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/cl    ang/7.3.0/include
 /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/include
 /usr/include

which means clang search for pcap.h according to this order above.
then I checked first one /usr/local/include and found a pcap.h file but the version seemed to be incorrect 'cause it did not contain PCAP_ERROR, I have not idea how this file appeared.
The compiler possibly found this file and stop looking at the other lines, so missed the correct one under /usr/include.

Solve:
rename the pcap.h file to pcap_not_in_use.h, it works now.