[Oisf-users] libhtp1 version woes.

[Russell Fulton]

> 
> Wired indeed...
> 
> Have you installed libhtp1 before on the same machine (through some
> scripts maybe?)\

No, this machine was rebuild from scratch this morning following a disk failure.  I used puppet to set things up after the OS install.  I have checked and there are no references to libhtp1 in the puppet configs.  The install of suricata failed because I had specified the beta4 version.  I then installed the 3.0RC from the command line.

> Which Ubuntu flavour is that?

12.04 

> 
> A simple  - apt-get update && apt-get upgrade should have done the trick.

Ah, I think I see what is happening:

root at secmonprd02:~# find /usr/ -name \*libhtp\*
/usr/lib/libhtp-0.5.18.so.1.0.0
/usr/lib/libhtp-0.5.18.so.1
/usr/share/doc/libhtp1

I’ve got .0.5.18 but suri expects 0.5.17.

root at secmonprd02:~# apt-get install libhtp1=0.5.x.201505061748~ubuntu12.04.1

fixes the issue.

root at secmonprd02:~# find /usr/ -name \*libhtp\*
/usr/lib/libhtp-0.5.17.so.1
/usr/lib/libhtp-0.5.17.so.1.0.0

I suspect that there needs to be some dependency information in the suricata .deb to tell it which version of libhtp1 to load.

Russell