Impossible to install suricata with the lastest version repo of github

Developers
1

hello ,
i’ve this error : /usr/bin/suricata: symbol lookup error: /usr/bin/suricata: undefined symbol: htp_config_set_number_headers_limit
when i try to install suricata wih the lastest version on github , today at october 12 at 20:02 , french hour

I thought the htp bundle was automatically installed with suricata .

I installed suricata with this script :

./scripts/bundle.sh
./autogen.sh \
autoreconf -i \
sudo chmod +x ./autogen.sh
 ./configure --prefix=/usr/            --bindir=/usr/bin/            --sbindir=/usr/sbin/            --libdir=/usr/lib/             --sysconfdir=/etc/             --enable-python             --enable-debug             --enable-unittests             --enable-ebpf-build             --enable-geoip             --enable-af-packet             --enable-nflog             --with-libpcap-includes=/usr/local/include             --with-libpcap-libraries=/usr/lib/x86_64-linux-gnu/             --with-libhtp-includes=/usr/local/include/htp  --with-libhtp-libraries=/usr/lib --with-libyaml-libraries=/usr/lib/x86_64-linux-gnu --enable-nfqueue  \
  &&  cargo install --force cbindgen  && sudo make -j10 && sudo make install-full

could you help me ?
Regards

2

You need to update your libhtp to 0.5.49.

3

I think you may need a make clean before you start w the same commands again.

4

how can i do this ?
for the moment , i typed theses commands :
sudo make clean && sudo make uninstall , and,

sudo ./scripts/bundle.sh
sudo ./autogen.sh \
sudo autoreconf -i \
 ./configure --prefix=/usr/            --bindir=/usr/bin/            --sbindir=/usr/sbin/            --libdir=/usr/lib/             --sysconfdir=/etc/             --enable-python             --enable-debug             --enable-unittests             --enable-ebpf-build             --enable-geoip             --enable-af-packet             --enable-nflog             --with-libpcap-includes=/usr/local/include             --with-libpcap-libraries=/usr/lib/x86_64-linux-gnu/             --with-libhtp-includes=/usr/local/include/htp  --with-libhtp-libraries=/usr/lib --with-libyaml-libraries=/usr/lib/x86_64-linux-gnu --enable-nfqueue  \
  &&  cargo install --force cbindgen  && sudo make -j10 && sudo make install-full

regards

5

this command :

sudo ./scripts/bundle.sh

this command should be enough, isn’t it ?

6

ok ,
but please see the video demonstration of the problem :

Capture vidéo du 2024-10-14 10-55-38.webm - Google Drive,

and

and

The problem is deeper than a simple make clean

regards

7

I’d recommend starting clean from scratch.
Some tips that may be useful:

8

ok , but if i write this :

./scripts/bundle.sh
./autogen.sh \
autoreconf -i \
./configure --prefix=/usr/            --bindir=/usr/bin/            --sbindir=/usr/sbin/            --libdir=/usr/lib/             --sysconfdir=/etc/             --enable-python             --enable-debug             --enable-unittests             --enable-ebpf-build             --enable-geoip             --enable-af-packet             --enable-nflog             --with-libpcap-includes=/usr/local/include             --with-libpcap-libraries=/usr/lib/x86_64-linux-gnu/             --with-libhtp-includes=/usr/local/include/htp  --with-libhtp-libraries=/usr/lib --with-libyaml-libraries=/usr/lib/x86_64-linux-gnu --enable-nfqueue  \
  &&  cargo install --force cbindgen   && sudo make -j10 && sudo make install-full

i 've this problem :

 Making all in libhtp
make[1] : on entre dans le répertoire « /home/alexandre/Téléchargements/suricata/libhtp »
make[1]: *** Aucune règle pour fabriquer la cible « all ». Arrêt.
make[1] : on quitte le répertoire « /home/alexandre/Téléchargements/suricata/libhtp »
make: *** [Makefile:507 : all-recursive] Erreur 1
9

Since you’re unable to compile, it would be better to run one command at a time and not club them together. I’d still recommend to start clean.

10

Are you certain that your cleaning order is properly cleaning everything you need?!

vidéo démonstration of the problem :

11

ok , i succeed it, with this :

 ./scripts/bundle.sh
./autogen.sh \
autoreconf -i \

, and then , this :

./configure --prefix=/usr/            --bindir=/usr/bin/            --sbindir=/usr/sbin/            --libdir=/usr/lib/             --sysconfdir=/etc/             --enable-python             --enable-debug             --enable-unittests             --enable-ebpf-build             --enable-geoip             --enable-af-packet             --enable-nflog             --with-libpcap-includes=/usr/local/include             --with-libpcap-libraries=/usr/lib/x86_64-linux-gnu/             --with-libhtp-includes=/usr/local/include/htp  --with-libhtp-libraries=/usr/lib --with-libyaml-libraries=/usr/lib/x86_64-linux-gnu --enable-nfqueue  \
   && sudo make -j10 && sudo make install-full

but now i’ve this problem :

sudo /usr/bin/suricata -c /etc/suricata/suricata.yaml -q 0 
/usr/bin/suricata: symbol lookup error: /usr/bin/suricata: undefined symbol: htp_config_set_number_headers_limit
alexandre@alexandre-developpeur:~/Documents$

linked to this post : Impossible to configure suricata cause to libhtp bundle - #7 by ish

could you help me ?
Regards

12

Ok, so, it seems that suricata is not correctly configured with libhtp option

13

I think that the issue may be that using ./scripts/bundle.sh without any arguments will install libhtp to the current directory from which it was called, but later on you pass different locations for libhtp with your configure options…

14

I have multiple librairies libhtp* files in my computer, there seems to be conflicts

15

ok 've this error with this commande :

./scripts/bundle.sh
===> Bundling https://github.com/OISF/libhtp (0.5.x)
Clonage dans './libhtp'...
remote: Enumerating objects: 247, done.
remote: Counting objects: 100% (247/247), done.
remote: Compressing objects: 100% (203/203), done.
remote: Total 247 (delta 71), reused 139 (delta 35), pack-reused 0 (from 0)
Réception d'objets: 100% (247/247), 555.84 Kio | 2.75 Mio/s, fait.
Résolution des deltas: 100% (71/71), fait.
~/Téléchargements/suricata/libhtp ~/Téléchargements/suricata
Depuis https://github.com/OISF/libhtp
 * branch            0.5.x      -> FETCH_HEAD
HEAD est maintenant sur b28eadc Update for 0.5.49
~/Téléchargements/suricata
===> Bundling https://github.com/OISF/suricata-update (master)
Clonage dans './suricata-update.tmp'...
remote: Enumerating objects: 109, done.
remote: Counting objects: 100% (109/109), done.
remote: Compressing objects: 100% (101/101), done.
remote: Total 109 (delta 10), reused 60 (delta 1), pack-reused 0 (from 0)
Réception d'objets: 100% (109/109), 4.65 Mio | 6.06 Mio/s, fait.
Résolution des deltas: 100% (10/10), fait.
~/Téléchargements/suricata/suricata-update.tmp ~/Téléchargements/suricata
Depuis https://github.com/OISF/suricata-update
 * branch            master     -> FETCH_HEAD
HEAD est maintenant sur a81f805 version: 1.3.3
~/Téléchargements/suricata

cp: impossible de créer le fichier standard

, and even i typed before :

sudo find / -path /home -prune -o -iname "*suricata*" -exec rm -rf {} +
find: ‘/run/user/1000/doc’: Permission non accordée
find: ‘/run/user/1000/gvfs’: Permission non accordée
find: ‘/proc/5727/task/5727/net’: Argument invalide
find: ‘/proc/5727/net’: Argument invalide
find: ‘/proc/45316’: Aucun fichier ou dossier de ce nom
find: ‘/proc/45317’: Aucun fichier ou dossier de ce nom
find: ‘/proc/45318’: Aucun fichier ou dossier de ce nom
find: ‘/tmp/.mount_jetbraBTvf7B’: Permission non accordée

and :
git stash
what can i do ?
vidéo proof : Capture vidéo du 2024-10-19 15-24-49.webm - Google Drive
Regards

16

Are you trying to run the bundle script from a folder you don’t have permissions to? Seems that that’s going on…

17

normally before 'I do a chmod 777 on file or directory suricacate for installation but I can retry as soon as possible
Regards

18

on my smallest pc , I managed to reinstall everything correctly after having properly removed the executable containing the word “suricata” and then “git stash” in suricata directory in the installation folder I did sudo chmod 777. /* -R

I will recheck on the computer which is more grois and that poses me the most problem

19

This is not the recommended way to install it. You seem to have a working deployment, but note that mode 777 removes most access restrictions fo filesystem objects that would hinder malicious or unintentional changes.

20

how to do in this case with the problems I had ?