ERROR: Unknown record type read: 104
Fatal Error, Quitting..

I started looking for information on the internet (Google is our friend…), and found out that at least I was not alone

Similar problems

Basically, I found two types of reports:

1. some with record types like 2148576734, 1697542248, 3569595041, etc.
2. others more like the error I received, with the unknown record type being either 104 (like mine) or 105

Error type 1 (apparently random record types)

These errors are caused by reading a log from Snort that is not in the “unified2″ format. Barnyard2 only uses the newer unified2 log format from Snort as input.
The solution is to check your Snort configuration file and change it to use the newer format.

Error type 2 (record types 104 and 105)

The first “solution” I found was removing two parameters in the Snort configuration file for the unified2 log format, mpls_event_types and vlan_event_types.
The default line in the Snort 2.9.0 configuration reads:

output unified2: filename merged.log, limit 128, nostamp, mpls_event_types, vlan_event_types

For Barnyard I already had to remove the “nostamp” parameter, as it prefers to work with the time-stamp extensions.
I do not use the mpls option in Snort, but the vlan ID can be useful…

To get Snort working, I removed the two parameters, but was not satisfied.

Finding a real solution – Start examining the source code!

After reading through the source code of Barnyard2 and of the new u2spewfoo utility that comes with Snort 2.9.0, I found out that these record types are from version 2 of the Unified2 record format.
In the Barnyard2 source file unified2.h the definitions can be found:

#define UNIFIED2_EVENT 1
#define UNIFIED2_PACKET 2
#define UNIFIED2_IDS_EVENT 7
#define UNIFIED2_EVENT_EXTENDED 66
#define UNIFIED2_PERFORMANCE 67
#define UNIFIED2_PORTSCAN 68
#define UNIFIED2_IDS_EVENT_IPV6 72
#define UNIFIED2_IDS_EVENT_MPLS 99
#define UNIFIED2_IDS_EVENT_IPV6_MPLS 100
//version 2
#define UNIFIED2_IDS_EVENT_V2 104
#define UNIFIED2_IDS_EVENT_IPV6_V2 105

So, if Barnyard2 knows about the record types, why can’t it process them?
Well, I found that in spi_unified2.c there was this piece of code:

int Unified2ReadRecord(void *sph)
{
 DEBUG_WRAP(DebugMessage(DEBUG_LOG,"Reading record type=%u (%u bytes)\n", ntohl(u2hdr.type), ntohl(u2hdr.length)););
 switch (ntohl(u2hdr.type))
 {
 case UNIFIED2_IDS_EVENT:
 return Unified2ReadEventRecord(sph);
 break;
 case UNIFIED2_IDS_EVENT_IPV6:
 return Unified2ReadEvent6Record(sph);
 break;
 case UNIFIED2_PACKET:
 return Unified2ReadPacketRecord(sph);
 break;
 default:
 FatalError("Unknown record type read: %u\n", ntohl(u2hdr.type));
 break;
 }
 return -1;
}

This means that it will simply show an error message Unknown record type read: ... when it encounters anything different from type 7, 72 or 2. And that’s exactly what it does in our case

This gave me something to start working on…
I first wrote a quick patch to simply recognize and handle record type 104 and sent it to the development team to check if this was the way to go. They answered me that it was, so I completed the patch with record type 105 (which is for ip6) and included the necessary routines for the debugging mode.

This is the resulting patch:

--- barnyard2-1.8_orig/src/input-plugins/spi_unified2.c 2010-03-03 08:03:12.000000000 -0300
+++ barnyard2-1.8/src/input-plugins/spi_unified2.c 2010-10-09 23:31:17.000000000 -0300
@@ -62,11 +62,15 @@
 int Unified2ReadEventRecord(void *);
 int Unified2ReadEvent6Record(void *);
+int Unified2ReadEventRecordV2(void *);
+int Unified2ReadEvent6RecordV2(void *);
 int Unified2ReadPacketRecord(void *);
 void Unified2PrintCommonRecord(Unified2EventCommon *evt);
 void Unified2PrintEventRecord(Unified2Event *);
 void Unified2PrintEvent6Record(Unified2Event6 *evt);
+void Unified2PrintEventRecordV2(Unified2Event_v2 *);
+void Unified2PrintEvent6RecordV2(Unified2Event6_v2 *evt);
 void Unified2PrintPacketRecord(Unified2Packet *);
 /* restart/shutdown functions */
@@ -163,9 +167,15 @@
 case UNIFIED2_IDS_EVENT:
 return Unified2ReadEventRecord(sph);
 break;
+ case UNIFIED2_IDS_EVENT_V2:
+ return Unified2ReadEventRecordV2(sph);
+ break;
 case UNIFIED2_IDS_EVENT_IPV6:
 return Unified2ReadEvent6Record(sph);
 break;
+ case UNIFIED2_IDS_EVENT_IPV6_V2:
+ return Unified2ReadEvent6RecordV2(sph);
+ break;
 case UNIFIED2_PACKET:
 return Unified2ReadPacketRecord(sph);
 break;
@@ -221,6 +231,50 @@
 return -1;
 }
+int Unified2ReadEventRecordV2(void *sph)
+{
+ ssize_t bytes_read;
+ int record_size;
+ Spooler *spooler = (Spooler *)sph;
+
+ record_size = sizeof(Unified2Event_v2);
+
+ if(!spooler->record.data)
+ {
+ // SnortAlloc will FatalError if memory can't be assigned.
+ spooler->record.data=SnortAlloc(record_size);
+ }
+
+ if (spooler->offset < record_size)
+ {
+ /* in case we don't have it already */
+ bytes_read = read(spooler->fd, spooler->record.data + spooler->offset,
+ record_size - spooler->offset);
+
+ if(bytes_read == -1)
+ {
+ LogMessage("ERROR: read error: %s\n", strerror(errno));
+ return BARNYARD2_FILE_ERROR;
+ }
+
+ if(bytes_read + spooler->offset != record_size)
+ {
+ spooler->offset += bytes_read;
+ return BARNYARD2_READ_PARTIAL;
+ }
+
+#ifdef DEBUG
+ Unified2PrintEventRecordV2((Unified2Event_v2 *)spooler->record.data);
+#endif
+
+ spooler->offset = 0;
+
+ return 0;
+ }
+
+ return -1;
+}
+
 int Unified2ReadEvent6Record(void *sph)
 {
 ssize_t bytes_read;
@@ -265,6 +319,50 @@
 return -1;
 }
+int Unified2ReadEvent6RecordV2(void *sph)
+{
+ ssize_t bytes_read;
+ int record_size;
+ Spooler *spooler = (Spooler *)sph;
+
+ record_size = sizeof(Unified2Event6_v2);
+
+ if(!spooler->record.data)
+ {
+ /* SnortAlloc will FatalError if memory can't be assigned */
+ spooler->record.data=SnortAlloc(record_size);
+ }
+
+ if (spooler->offset < record_size)
+ {
+ /* in case we don't have it already */
+ bytes_read = read(spooler->fd, spooler->record.data + spooler->offset,
+ record_size - spooler->offset);
+
+ if(bytes_read == -1)
+ {
+ LogMessage("ERROR: read error: %s\n", strerror(errno));
+ return BARNYARD2_FILE_ERROR;
+ }
+
+ if(bytes_read + spooler->offset != record_size)
+ {
+ spooler->offset += bytes_read;
+ return BARNYARD2_READ_PARTIAL;
+ }
+
+#ifdef DEBUG
+ Unified2PrintEvent6RecordV2((Unified2Event6_v2 *)spooler->record.data);
+#endif
+
+ spooler->offset = 0;
+
+ return 0;
+ }
+
+ return -1;
+}
+
 int Unified2ReadPacketRecord(void *sph)
 {
 ssize_t bytes_read;
@@ -366,10 +464,66 @@
 " packet_action = %d\n", evt->packet_action););
 }
+void Unified2PrintEventRecordV2(Unified2Event_v2 *evt)
+{
+ char sip4[INET_ADDRSTRLEN];
+ char dip4[INET_ADDRSTRLEN];
+
+ if(evt == NULL)
+ return;
+
+ Unified2PrintEventCommonRecord((Unified2EventCommon *)evt);
+
+ inet_ntop(AF_INET, &(evt->ip_source), sip4, INET_ADDRSTRLEN);
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " ip_source = %s\n", sip4););
+
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " sport_itype = %d\n", ntohs(evt->sport_itype)););
+ inet_ntop(AF_INET, &(evt->ip_destination), dip4, INET_ADDRSTRLEN);
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " ip_destination = %s\n", dip4););
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " dport_icode = %d\n", ntohs(evt->dport_icode)););
+
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " ip_protocol = %d\n", evt->protocol););
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " packet_action = %d\n", evt->packet_action););
+}
+
 void Unified2PrintEvent6Record(Unified2Event6 *evt)
 {
 char sip6[INET6_ADDRSTRLEN];
 char dip6[INET6_ADDRSTRLEN];
+
+ if(evt == NULL)
+ return;
+
+ Unified2PrintEventCommonRecord((Unified2EventCommon *)evt);
+
+ inet_ntop(AF_INET6, &(evt->ip_source), sip6, INET6_ADDRSTRLEN);
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " ip_source = %s\n", sip6););
+
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " sport_itype = %d\n", ntohs(evt->sport_itype)););
+ inet_ntop(AF_INET6, &(evt->ip_destination), dip6, INET6_ADDRSTRLEN);
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " ip_destination = %s\n", dip6););
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " dport_icode = %d\n", ntohs(evt->dport_icode)););
+
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " ip_protocol = %d\n", evt->protocol););
+ DEBUG_WRAP(DebugMessage(DEBUG_LOG,
+ " packet_action = %d\n", evt->packet_action););
+}
+
+void Unified2PrintEvent6RecordV2(Unified2Event6_v2 *evt)
+{
+ char sip6[INET6_ADDRSTRLEN];
+ char dip6[INET6_ADDRSTRLEN];
 if(evt == NULL)
 return;

The patch can also be downloaded here.

The code could probably be optimized since there are many duplicate lines now, but I did not want to change too much.
I sent the patch to the Barnyard2 developers and they may commit it in their git repository.
It looks like this patch should work on the 1.9-beta version as well, but I have not tested this… YMMV!

I have been running the patched Barnyard2 for several hours now on my Snort server without problems, using the vlan_event_types parameter.

So now that 6.40.1 was available for Slackware, I decided to get back at the problem and investigate some more.
I found several problems with the newest version, all in the code of the ECTestTools subdirectory. My impression is that the authors were in a bit of a hurry to get 6.40.2 out (that solves some bugs in the previous versions), but forgot the check / alter the test tools.

In total I found three problems, which I managed to solve by patching the code (2x) and Makefile (1x).

These were my findings:

Problem1: rectest.cpp:82: error: no matching function for call to 'RecurrenceState::ParseBlob(char*, size_t)'

The ParseBlob function was changed in 6.40.2 but the rectest.cpp file was not altered accordingly. It needs and extra parameter, so I checked the code to see how it was called in other places and patched it like this:

--- zarafa-6.40.2/ECtools/ECTestTools/RecurrenceTest/rectest.cpp 2010-08-30 08:01:44.000000000 -0300
+++ zarafa-6.40.2_patched/ECtools/ECTestTools/RecurrenceTest/rectest.cpp 2010-09-04 13:27:42.000000000 -0300
@@ -79,7 +79,7 @@
 RecurrenceState r;
- hr = r.ParseBlob((char *)strBin.c_str(), strBin.size());
+ hr = r.ParseBlob((char *)strBin.c_str(), strBin.size(), 0);
 if(hr == hrSuccess) {
 cerr << "Recurrence OK" << std::endl;

Problem 2: mapi2ical.cpp:173: error: no matching function for call to 'MapiToICal::AddMessage(IMessage*&, int)'

This was also caused by a change in the number of parameters, this time in the AddMessage function. Again, I checked the code to understand how this function was called and noticed that in several places it was altered by using std::string() for the extra parameter, so I added this patch:

--- zarafa-6.40.2/ECtools/ECTestTools/ICalTests/mapi2ical.cpp 2010-08-30 08:01:44.000000000 -0300
+++ zarafa-6.40.2_patched/ECtools/ECTestTools/ICalTests/mapi2ical.cpp 2010-09-04 13:55:38.000000000 -0300
@@ -170,7 +170,7 @@
 goto next;
- hr = lpMapiToICal->AddMessage(lpMessage, 0);
+ hr = lpMapiToICal->AddMessage(lpMessage, std::string(), 0);
 if (hr != hrSuccess) {
 cerr << "-- broken message!" << stringify(hr, 1) << endl;
 goto next;

Problem 3: ../../../libicalmapi/.libs/libicalmapi.so: undefined reference to `RecurrenceState::ParseBlob(char*, unsigned int, unsigned int)' (plus several other similar messages)

This one was a bit more complicated to trace, but I found out that some files had changed position in the source tree and I managed to solve this in the Makefile.in that is used by ./configure to create the Makefile:

--- zarafa-6.40.2/ECtools/ECTestTools/ICalTests/Makefile.in 2010-08-30 04:31:48.000000000 -0300
+++ zarafa-6.40.2_patched/ECtools/ECTestTools/ICalTests/Makefile.in 2010-09-04 15:09:39.000000000 -0300
@@ -272,6 +272,7 @@
 ${top_builddir}/common/libcommon_mapi.la \
 ${top_builddir}/common/libcommon_util.la \
 ${top_builddir}/libicalmapi/libicalmapi.la \
+ ${top_builddir}/libfreebusy/libfreebusy.la \
 $(PROG_LIBS) $(ICAL_LIBS)
 mapi2ical_SOURCES = mapi2ical.cpp

After applying this patch the SlackBuild completed without problems!
I posted these patches on the Zarafa forum as well so I hope that the author will fix it for the next official release.

I'm testing the resulting binaries on my server, and if they continue running without problems for a few days, I'll submit the new script and upload the new packages to my site.

update: The patch can be downloaded here and the packages are available on my site.

I used to use MySQL Control Center (’mysqlcc’) quite a lot until a few years ago, when I switched to phpMyAdmin.
The biggest advantage of phpMyAdmin is that it is actively maintained, while mysqlcc has not seen updates for almost three years.
mysqlcc’s interface also had a bit of an “old-fashioned” look, as it is still based on the Qt3 library (known from KDE3).

Anyway, these days I took a second look at it, because of a question about building it on Slackware 13.1 on the SlackBuilds mailing list.
My first reaction was like “Hey, try something more modern”, but on second thoughts I decided to give it a try and examine the source code and the build-time error messages from gcc.

The error messages

Without any modification, gcc throws several messages at you like this:
src/main.cpp:93: error: 'gptr' was not declared in this scope

So I took a look at main.cpp and noticed that the lines causing the error message are part of a structure of ‘my_option’ lines:

static struct my_option my_long_options[] =

The lines that give the error are:

 {"connect_timeout", OPT_CONNECT_TIMEOUT, "", (gptr*) &opt_connect_timeout,
 (gptr*) &opt_connect_timeout, 0, GET_ULONG, REQUIRED_ARG, 0, 0, 3600*12, 0,
 0, 1},
 {"select_limit", OPT_SELECT_LIMIT, "", (gptr*) &select_limit,
 (gptr*) &select_limit, 0, GET_ULONG, REQUIRED_ARG, 1000L, 1, ~0L, 0, 1, 0},
 {"net_buffer_length", OPT_NET_BUFFER_LENGTH, "",
 (gptr*) &my_net_buffer_length, (gptr*) &my_net_buffer_length, 0, GET_ULONG,
 REQUIRED_ARG, 16384, 1024, 512*1024*1024L, 0, 1024, 0},
 {"max_allowed_packet", OPT_MAX_ALLOWED_PACKET, "",
 (gptr*) &my_max_allowed_packet, (gptr*) &my_max_allowed_packet, 0, GET_ULONG,
 REQUIRED_ARG, 16 *1024L*1024L, 4096, 512*1024L*1024L, 0,
 1024, 0},
 {"local-infile", OPT_LOCAL_INFILE, "Enable/disable LOAD DATA LOCAL INFILE.",
 (gptr*) &opt_local_infile,
 (gptr*) &opt_local_infile, 0, GET_BOOL, OPT_ARG, 0, 0, 0, 0, 0, 0},
 {"max_join_size", OPT_MAX_JOIN_SIZE, "", (gptr*) &max_join_size,
 (gptr*) &max_join_size, 0, GET_ULONG, REQUIRED_ARG, 1000000L, 1, ~0L, 0, 1,
 0},

These errors are caused by the newer versions of MySQL, where mysql.h does not define the type of gptr any longer.

The next logical step was to check the definition of ‘my_option’ and see what types were expected here.
‘my_option’ is a structure defined in <my_getopt.h>, included in main.cpp.

In previous versions of MySQL this was defined as:

struct my_option
{
 const char *name; /* Name of the option */
 int id; /* unique id or short option */
 const char *comment; /* option comment, for autom. --help */
 gptr *value; /* The variable value */
 gptr *u_max_value; /* The user def. max variable value */
 const char **str_values; /* Pointer to possible values */
 ulong var_type;
 enum get_opt_arg_type arg_type;
 longlong def_value; /* Default value */
 longlong min_value; /* Min allowed value */
 longlong max_value; /* Max allowed value */
 longlong sub_size; /* Subtract this from given value */
 long block_size; /* Value should be a mult. of this */
 int app_type; /* To be used by an application */
};

But in newer versions of MySQL it is defined as:

struct my_option
{
 const char *name; /* Name of the option */
 int id; /* unique id or short option */
 const char *comment; /* option comment, for autom. --help */
 uchar **value; /* The variable value */
 uchar **u_max_value; /* The user def. max variable value */
 struct st_typelib *typelib; /* Pointer to possible values */
 ulong var_type;
 enum get_opt_arg_type arg_type;
 longlong def_value; /* Default value */
 longlong min_value; /* Min allowed value */
 longlong max_value; /* Max allowed value */
 longlong sub_size; /* Subtract this from given value */
 long block_size; /* Value should be a mult. of this */
 void *app_type; /* To be used by an application */
};

So we find that:

• gptr* has been replaced by uchar**

The solution was to change the (gptr*) casts in main.cpp to (uchar**).

After the change, trying to compile mysqlcc again, the next error jumped at me:
src/main.cpp:158: warning: deprecated conversion from string constant to 'char*'

This one was simple and caused by the new gcc compiler… Just changed line 158 from:

add_argument(id, "");

to

add_argument(id, (char*)"");

But, trying once more to compile mysqlcc, we get one more error message:
src/main.cpp:118: error: invalid conversion from 'int' to 'void*'

Now, line 118 is actually the end of the structure of my_option lines, so the error is hidden inside.
After re-reading the new and old definitions of my_option I found that:

• app_type was defined as int and is now defined as void*

Knowing this, the error message makes sense, and there is one line (93-95) in the structure that uses a non-zero value. Changing that line from:

 {"connect_timeout", OPT_CONNECT_TIMEOUT, "", (gptr*) &opt_connect_timeout,
 (gptr*) &opt_connect_timeout, 0, GET_ULONG, REQUIRED_ARG, 0, 0, 3600*12, 0,
 0, 1},

to:

 {"connect_timeout", OPT_CONNECT_TIMEOUT, "", (uchar**) &opt_connect_timeout,
 (uchar**) &opt_connect_timeout, 0, GET_ULONG, REQUIRED_ARG, 0, 0, 3600*12, 0,
 0, (void*)1},

solved this last error and now mysqlcc built without problems

The result

And yes, the result worked fine as can be seen here:

The patches

Instead of applying all the changes manually, you can use the following file to patch your sources:

--- mysqlcc-0.9.8-src/src/main.cpp 2006-08-11 17:29:12.000000000 -0300
+++ mysqlcc-0.9.8-src_patched/src/main.cpp 2010-06-17 20:49:35.000000000 -0300
@@ -90,28 +90,28 @@
 {"version", 'V', "Print version information and exit.", 0, 0, 0, GET_NO_ARG, NO_ARG, 0, 0, 0, 0, 0, 0},
- {"connect_timeout", OPT_CONNECT_TIMEOUT, "", (gptr*) &opt_connect_timeout,
- (gptr*) &opt_connect_timeout, 0, GET_ULONG, REQUIRED_ARG, 0, 0, 3600*12, 0,
- 0, 1},
+ {"connect_timeout", OPT_CONNECT_TIMEOUT, "", (uchar**) &opt_connect_timeout,
+ (uchar**) &opt_connect_timeout, 0, GET_ULONG, REQUIRED_ARG, 0, 0, 3600*12, 0,
+ 0, (void*)1},
- {"select_limit", OPT_SELECT_LIMIT, "", (gptr*) &select_limit,
- (gptr*) &select_limit, 0, GET_ULONG, REQUIRED_ARG, 1000L, 1, ~0L, 0, 1, 0},
+ {"select_limit", OPT_SELECT_LIMIT, "", (uchar**) &select_limit,
+ (uchar**) &select_limit, 0, GET_ULONG, REQUIRED_ARG, 1000L, 1, ~0L, 0, 1, 0},
 {"net_buffer_length", OPT_NET_BUFFER_LENGTH, "",
- (gptr*) &my_net_buffer_length, (gptr*) &my_net_buffer_length, 0, GET_ULONG,
+ (uchar**) &my_net_buffer_length, (uchar**) &my_net_buffer_length, 0, GET_ULONG,
 REQUIRED_ARG, 16384, 1024, 512*1024*1024L, 0, 1024, 0},
 {"max_allowed_packet", OPT_MAX_ALLOWED_PACKET, "",
- (gptr*) &my_max_allowed_packet, (gptr*) &my_max_allowed_packet, 0, GET_ULONG,
+ (uchar**) &my_max_allowed_packet, (uchar**) &my_max_allowed_packet, 0, GET_ULONG,
 REQUIRED_ARG, 16 *1024L*1024L, 4096, 512*1024L*1024L, 0,
 1024, 0},
 {"local-infile", OPT_LOCAL_INFILE, "Enable/disable LOAD DATA LOCAL INFILE.",
- (gptr*) &opt_local_infile,
- (gptr*) &opt_local_infile, 0, GET_BOOL, OPT_ARG, 0, 0, 0, 0, 0, 0},
+ (uchar**) &opt_local_infile,
+ (uchar**) &opt_local_infile, 0, GET_BOOL, OPT_ARG, 0, 0, 0, 0, 0, 0},
- {"max_join_size", OPT_MAX_JOIN_SIZE, "", (gptr*) &max_join_size,
- (gptr*) &max_join_size, 0, GET_ULONG, REQUIRED_ARG, 1000000L, 1, ~0L, 0, 1,
+ {"max_join_size", OPT_MAX_JOIN_SIZE, "", (uchar**) &max_join_size,
+ (uchar**) &max_join_size, 0, GET_ULONG, REQUIRED_ARG, 1000000L, 1, ~0L, 0, 1,
 0},
 { 0, 0, 0, 0, 0, 0, GET_NO_ARG, NO_ARG, 0, 0, 0, 0, 0, 0}
@@ -155,7 +155,7 @@
 break;
 }
 if (opt->var_type == GET_NO_ARG && opt->arg_type == NO_ARG) //Boolean options
- add_argument(id, "");
+ add_argument(id, (char*)"");
 else
 add_argument(id, argument);
 }

The patch can also be downloaded here.

On the TRS-80 mailing list I subscribe there was a discussion about an old (from 1977!) game I used to play on my TRS-80 Model I called Space Warp. This game was originally called “Time Trek”, based on the popular television series Star Trek. When Tandy/Radio Shack released this game commercially, they changed some of the terms, probably for copyright reasons.

Someone mentioned that it had been ported to X and that the sources were available. But, when I downloaded the sources from x.org and tried to build it, I noticed that this port was from 1995 and many things have changed since then… It simply threw tons of errors instead of building the program. For sentimental reasons I did not give up though, and decided to try to solve the incompatibilities with the modern Gnu C++ compiler.

What needed to be adapted

Some of the needed changes were quite obvious, others required a bit of “Googling” to discover. All in all, it was a nice exercise for me. The major items were:

• #include <iostream.h> – Modern versions of gcc expect #include <iostream> and a line defining the namespace (”using namespace std“)
• string literals needed to be defined as (char*) like: invalid((char*)"columns"); instead of invalid("columns");

Other changes were less obvious, but all in all I had to create a patch file of 999 lines

After all these patches, XSpaceWarp built fine on Slackware 13.0 and the 13.1 beta, both 32 & 64-bits. I also tested it on ARMedslack.

The result

Here are two screenshots from the game:

It’s not exactly a graphic-intensive game, but don’t forget that this was written over thirty years ago

Get it!

If you use Slackware, you can get packages from Slackware 13.0 32 & 64-bits and for ARMedslack from my site.
As soon as SlackBuilds.org opens for submissions again (after the release of Slackware 13.1), I’ll submit the SlackBuild.

If you want to build the program yourself, get the original sources from x.org or the patched version for newer compilers here.
The patch is also separately available here, so that you can study it and patch your own sources.