In 7.0.9 missing libpcre2-8-devel

1

openSUSE tumbleweed 20250313
Linux 6.13.6-1-default x86_64
I unpacked Suricata 7.0.9 and ran configure as usual.

$ ./configure --enable-nfqueue
  ... bunch o' success ...
checking for pcre2_compile_8 in -lpcre2-8... no
   ERROR!  pcre2 library not found, go get it
   from www.pcre.org. Or from packages:
   Debian/Ubuntu: apt install libpcre2-dev
   Fedora: dnf install pcre2-devel
   CentOS/RHEL: yum install pcre2-devel

Libraries libpcre2-8-0, libpcre2-16-0, libpcre2-32-0, are installed.
Searching for pcre2-devel in opensuse’s repos failed; none are offered for any of the pcre2 modules.
I tried dnf and yum. They both core dumped.
I do not recall needing a “devel” package for Suricata. Is this a new requirement? Have I misread the error message?

I have the pcre2 source package. How do I extract the devel file(s)?

2

Since libpcre2-32-0 is already installed, try adding
--with-libpcre2-libraries=/path/to/libdir and --with-libpcre2-includes=/path/to/include-dir to the configure line.

Perhaps they’re installed in nonstandard locations?

If this doesn’t help, please reply and post the snippet from config.log where the pcre2 components are probed (hint: search for pcre2_compile in config.log)

3

On a fresh Docker image of opensuse/tumbleweed:lastet which seems to be 20250321 based on /etc/os-release, a zypper install pcre2-devel finds and installs the package just fine. Maybe you’re missing a repo?

4

Huh! That worked today. I suppose the repo had been updated to include pcre2-devel since my last visit.

Alas! Now that I have all of the needed libraries, Suricata does not configure for NFQUEUE. I tried both ./configure and ./configure --enable-nfqueue. Both yield the result below.
config.log (194.8 KB)

Suricata Configuration:
  AF_PACKET support:                       yes
  AF_XDP support:                          no
  DPDK support:                            no
  eBPF support:                            no
  XDP support:                             no
  PF_RING support:                         no
  NFQueue support:                         no
  NFLOG support:                           no
  IPFW support:                            no
  Netmap support:                          no 
  DAG enabled:                             no
  Napatech enabled:                        no
5

I ran make anyway.

$ src/suricata --build-info
This is Suricata version 7.0.9 RELEASE
Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HTTP2_DECOMPRESSION HAVE_JA3 HAVE_JA4 HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST POPCNT64 
SIMD support: SSE_4_2 SSE_4_1 SSE_3 SSE_2 
Atomic intrinsics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 14.2.1 20250220 [revision 9ffecde121af883b60bbe60d00425036bc873048], C version 201112
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: _Thread_local
compiled with LibHTP v0.5.50, linked against LibHTP v0.5.50

Suricata Configuration:
  AF_PACKET support:                       yes
  AF_XDP support:                          no
  DPDK support:                            no
  eBPF support:                            no
  XDP support:                             no
  PF_RING support:                         no
  NFQueue support:                         no
  NFLOG support:                           no
  IPFW support:                            no
  Netmap support:                          no 
  DAG enabled:                             no
  Napatech enabled:                        no
  WinDivert enabled:                       no

  Unix socket enabled:                     yes
  Detection enabled:                       yes

  Libmagic support:                        yes
  libjansson support:                      yes
  hiredis support:                         no
  hiredis async with libevent:             no
  PCRE jit:                                yes
  LUA support:                             no
  libluajit:                               no
  GeoIP2 support:                          no
  JA3 support:                             yes
  JA4 support:                             yes
  Non-bundled htp:                         no
  Hyperscan support:                       no
  Libnet support:                          no
  liblz4 support:                          yes
  Landlock support:                        yes

  Rust support:                            yes
  Rust strict mode:                        no
  Rust compiler path:                      /usr/bin/rustc
  Rust compiler version:                   rustc 1.85.0 (4d91de4e4 2025-02-17) (built from a source tarball)
  Cargo path:                              /usr/bin/cargo
  Cargo version:                           cargo 1.85.0 (d73d2caf9 2024-12-31)

  Python support:                          yes
  Python path:                             /usr/bin/python3
  Install suricatactl:                     yes
  Install suricatasc:                      yes
  Install suricata-update:                 yes

  Profiling enabled:                       no
  Profiling locks enabled:                 no
  Profiling rules enabled:                 no

  Plugin support (experimental):           yes
  DPDK Bond PMD:                           no

Development settings:
  Coccinelle / spatch:                     no
  Unit tests enabled:                      no
  Debug output enabled:                    no
  Debug validation enabled:                no
  Fuzz targets enabled:                    no

Generic build parameters:
  Installation prefix:                     /usr/local
  Configuration directory:                 /usr/local/etc/suricata/
  Log directory:                           /usr/local/var/log/suricata/

  --prefix                                 /usr/local
  --sysconfdir                             /usr/local/etc
  --localstatedir                          /usr/local/var
  --datarootdir                            /usr/local/share

  Host:                                    x86_64-pc-linux-gnu
  Compiler:                                gcc (exec name) / g++ (real)
  GCC Protect enabled:                     no
  GCC march native enabled:                yes
  GCC Profile enabled:                     no
  Position Independent Executable enabled: no
  CFLAGS                                   -g -O2 -fPIC -std=c11 -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist
  PCAP_CFLAGS                               -I/usr/include
  SECCFLAGS
6

The library support for netfilter (nfqueue) couldn’t be located – these lines are from config.log that you posted

configure:20311: checking for libnetfilter_queue
configure:20318: $PKG_CONFIG --exists --print-errors "libnetfilter_queue"
Package libnfnetlink was not found in the pkg-config search path.
Perhaps you should add the directory containing `libnfnetlink.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libnfnetlink', required by 'libnetfilter_queue', not found
configure:20321: $? = 1
configure:20335: $PKG_CONFIG --exists --print-errors "libnetfilter_queue"
Package libnfnetlink was not found in the pkg-config search path.
Perhaps you should add the directory containing `libnfnetlink.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libnfnetlink', required by 'libnetfilter_queue', not found
configure:20338: $? = 1
configure:20352: result: no
Package 'libnfnetlink', required by 'libnetfilter_queue', not found
7

I had been searching for “nfqueue” and so missed “netfilter.” I installed libnfnetlink and libnetfilter_queue. I have achieved the coveted confirmation for enabling NFQueue:
NFQueue support: yes
Thank you.