0

While looking to test suricata from the Debian Wheezy repo I ran into an issue.

cat /var/log/suricata/suricata-start.log 

23/9/2013 -- 19:25:03 - <Info> - This is Suricata version 1.2.1 (rev 872e3cb)
23/9/2013 -- 19:25:03 - <Warning> - [ERRCODE: SC_WARN_OUTDATED_LIBHTP(200)] - libhtp < 0.2.7 detected. Keyword http_raw_header will not be able to inspect response headers.
23/9/2013 -- 19:25:03 - <Info> - CPUs/cores online: 1
23/9/2013 -- 19:25:03 - <Info> - NFQ running in standard ACCEPT/DROP mode
23/9/2013 -- 19:25:03 - <Info> - Using PCRE match-limit setting of: 3500

While I've download the libhtp source for 0.5.7 , installed a .deb archive from Debian Jessy ( 0.2.12 ) the lib keeps pointing at the old lib.

I've added include /usr/local/lib/ to /etc/ld.so.conf Ran and reran ldconfig -v , manually erased the cache /etc/ld.co.cache and reran what I could figure out to no avail.

Creating /etc/ld.so.conf.d/libhtp.conf containing /usr/local/lib/libhtp* seemed to result in

ldconfig -p | grep libhtp
libhtp-0.5.7.so.1 (libc6,x86-64) => /usr/local/lib/libhtp-0.5.7.so.1
libhtp-0.2.so.1 (libc6,x86-64) => /usr/lib/x86_64-linux-gnu/libhtp-0.2.so.1

What's going, what am I doing wrong? There is extremely little to find on this.

1

Both are outdated. Suricata stable is at 1.4.6 and the libhtp version that should be used with it at 0.2.14, see http://suricata-ids.org/download/

libhtp 0.5.x is what we use in Suricata 2.0, which is currently in beta. It will not work with Suricata 1.4.6 due to API changes.

In general, using tools like Suricata from the distribution repositories is not a great idea. The versions are always quite far behind. I recommend installing from source.

0
23/9/2013 -- 19:25:03 - <Warning> - [ERRCODE: SC_WARN_OUTDATED_LIBHTP(200)] - libhtp < 0.2.7 detected. Keyword http_raw_header will not be able to inspect response headers.

This is just a warning, not an error. Do you really require the http_raw_header? If not, just ignore it.

installed a .deb archive from Debian Jessy ( 0.2.12 )

This is a bad idea. Even though it may be possible to install packages from a more recent Debian version without breaking anything, it does have repercussions.

For example, imagine that someone finds a critical security hole in libhtp1. Debian would then release new libhtp1 packages that fix this security vulnerability, but it would release two packages, for example:

 Debian wheezy: libhtp1 (0.2.6-3)  (instead of 0.2.6-2)
 Debian jessy:  libhtp1 (0.2.12-2) (instead of 0.2.12-1)

Your system would see the 0.2.6-3 update because it is configured to pull the wheezy updates, but it already has 0.2.12-2 installed. 0.2.12-2 is higher (=newer) than 0.2.6-3, so it won't install the update at all. You have now introduced a security vulnerability into your system that the Debian updater is unable to fix.

While i've download the libhtp source for 0.5.7

Compiling and installing something from source is even worse. Don't do it.

I've added include /usr/local/lib/ to /etc/ld.so.conf

Oh god, please stop before you've completely hosed your system :(

  • That must be the most educated yet pointless reply i ever saw. – Saint Crusty Sep 23 '13 at 21:18
  • Why is it pointless? – Martin von Wittich Sep 23 '13 at 21:19
  • I was a bit (overly) agitated yesterday so pointless is a senseless use of words here. As i indicated i seen no error in any of your arguments.My aim though was, not to upset you, but to learn ;) <br/> Sticking to DFHS is what i believe to achieve with using /usr/local/lib/libhtp/ for any of my unholy attempts. I actually made it partially work. The new lib is in the output of ldconfig -p but the old one is still perferred. If you'd be willing to tell me on how to fix this without removing the libhtp1 package on which suricata depends ? I've removed the package i installed from Testing. – Saint Crusty Sep 24 '13 at 10:28
  • You still haven't clarified whether you actually need that http_raw_header keyword... – Martin von Wittich Sep 24 '13 at 10:32
  • Do i really need to clarify that ? What if i continue thinking i don't need it and after many months i run into a time consuming issue which ... turns out to be http_raw_header is missing ? Less and less i understand the decisions made by package maintainers. Which obviously i'm not. – Saint Crusty Sep 24 '13 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.