undefined symbol: read_keytab_file

[Laszlo]

Hello,
just upgraded from tshark 3.6.7 to 4.0.3 but it fails at startup.
(sudo apt purge --autoremove -y tshark and apt-get install tshark)

root@host:/var/lib/jenkins# dpkg -l tshark
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-==========================-============-==========================================
ii tshark 4.0.3-1~ubuntu20.04.0~ppa1 amd64 network traffic analyzer - console version
root@host:/var/lib/jenkins# apt-get install strace
Reading package lists... Done
Building dependency tree
Reading state information... Done
strace is already the newest version (5.5-3ubuntu1).

root@host:/var/lib/jenkins# strace -eopen tshark
tshark: symbol lookup error: tshark: undefined symbol: read_keytab_file
+++ exited with 127 +++

can you help me whats wrong?

lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 20.04.5 LTS
Release: 20.04
Codename: focal

[Balint Reczey (rbalint)]

I could not reproduce the issue in a clean LXC container installing tshark from https://launchpad.net/~wireshark-dev/+archive/ubuntu/stable , where the tshark package came from.

Please attach the output of:

dpkg -l | grep shark
strace -eopenat tshark

(open() translates to the openat syscall)

[Laszlo (milkuci)]

Hello,
Thank you for the quick reply!

root@host:/var/lib/jenkins# dpkg -l | grep shark
ii libwireshark-data 4.0.3-1~ubuntu20.04.0~ppa1 all network packet dissection library -- data files
ii libwireshark16:amd64 4.0.3-1~ubuntu20.04.0~ppa1 amd64 network packet dissection library -- shared library
ii tshark 4.0.3-1~ubuntu20.04.0~ppa1 amd64 network traffic analyzer - console version
ii wireshark-common 4.0.3-1~ubuntu20.04.0~ppa1 amd64 network traffic analyzer - common files

root@host:/var/lib/jenkins# strace -eopenat tshark
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/local/lib/libwireshark.so.16", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libpcap.so.0.8", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/local/lib/libwiretap.so.13", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/local/lib/libwsutil.so.14", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libgmodule-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libpcre2-8.so.0", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/local/lib/tls/haswell/x86_64/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/local/lib/tls/haswell/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/local/lib/tls/x86_64/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/local/lib/tls/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/local/lib/haswell/x86_64/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/local/lib/haswell/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/local/lib/x86_64/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/local/lib/libcares.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libcares.so.2", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/local/lib/libgcrypt.so.20", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libgcrypt.so.20", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/usr/local/lib/libgpg-error.so.0", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libgpg-error.so.0", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpcre.so.3", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libpthread.so.0", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOE...

[Laszlo (milkuci)]

reinstalled but the result is the same

root@home:/var/lib/jenkins# sudo apt-get install wireshark
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  libminizip1 libqt5multimedia5-plugins wireshark-qt
The following NEW packages will be installed:
  libminizip1 libqt5multimedia5-plugins wireshark wireshark-qt
0 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 4510 kB of archives.
After this operation, 11.0 MB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://ppa.launchpad.net/wireshark-dev/stable/ubuntu focal/main amd64 wireshark-qt amd64 4.0.3-1~ubuntu20.04.0~ppa1 [4247 kB]
Get:2 http://archive.ubuntu.com/ubuntu focal/universe amd64 libminizip1 amd64 1.1-8build1 [20.2 kB]
Get:3 http://archive.ubuntu.com/ubuntu focal/universe amd64 libqt5multimedia5-plugins amd64 5.12.8-0ubuntu1 [197 kB]
Get:4 http://ppa.launchpad.net/wireshark-dev/stable/ubuntu focal/main amd64 wireshark amd64 4.0.3-1~ubuntu20.04.0~ppa1 [46.5 kB]
Fetched 4510 kB in 1s (3017 kB/s)
Selecting previously unselected package libminizip1:amd64.
(Reading database ... 156808 files and directories currently installed.)
Preparing to unpack .../libminizip1_1.1-8build1_amd64.deb ...
Unpacking libminizip1:amd64 (1.1-8build1) ...
Selecting previously unselected package libqt5multimedia5-plugins:amd64.
Preparing to unpack .../libqt5multimedia5-plugins_5.12.8-0ubuntu1_amd64.deb ...
Unpacking libqt5multimedia5-plugins:amd64 (5.12.8-0ubuntu1) ...
Selecting previously unselected package wireshark-qt.
Preparing to unpack .../wireshark-qt_4.0.3-1~ubuntu20.04.0~ppa1_amd64.deb ...
Unpacking wireshark-qt (4.0.3-1~ubuntu20.04.0~ppa1) ...
Selecting previously unselected package wireshark.
Preparing to unpack .../wireshark_4.0.3-1~ubuntu20.04.0~ppa1_amd64.deb ...
Unpacking wireshark (4.0.3-1~ubuntu20.04.0~ppa1) ...
Setting up libminizip1:amd64 (1.1-8build1) ...
Setting up wireshark-qt (4.0.3-1~ubuntu20.04.0~ppa1) ...
Setting up libqt5multimedia5-plugins:amd64 (5.12.8-0ubuntu1) ...
Setting up wireshark (4.0.3-1~ubuntu20.04.0~ppa1) ...
Processing triggers for libc-bin (2.31-0ubuntu9.9) ...
Processing triggers for man-db (2.9.1-1) ...
Processing triggers for desktop-file-utils (0.24-1ubuntu3) ...
Processing triggers for mime-support (3.64ubuntu1) ...
Processing triggers for gnome-menus (3.36.0-1ubuntu1) ...
root@home:/var/lib/jenkins# sudo apt-get install tshark
Reading package lists... Done
Building dependency tree
Reading state information... Done
tshark is already the newest version (4.0.3-1~ubuntu20.04.0~ppa1).
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
root@home:/var/lib/jenkins# tshark -v
tshark: symbol lookup error: tshark: undefined symbol: read_keytab_file

[Balint Reczey (rbalint)]

There is a locally installed libwireshark.so.16 that takes precedence over the packaged one:

...
 openat(AT_FDCWD, "/usr/local/lib/libwireshark.so.16", O_RDONLY|O_CLOEXEC) = 3
...

Please remove locally installed wireshark related files and the packaged tshark will work nicely.

You can check if you run the packaged tshark:

which tshark

[Laszlo (milkuci)]

thank you, it really solved!