python-nids import error from python (undefnied symbol: nids_errbuf)

[I. Sanchez]

Binary package hint: python-nids

After having installed the python-nids package, I am unable to import it from python. libnids1.21 and libnids1.21-dev packages are installed as well.

From a python shell:

Python 2.7.1+ (r271:86832, Apr 11 2011, 18:13:53)
[GCC 4.5.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import nids
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: /usr/lib/pymodules/python2.7/nidsmodule.so: undefined symbol: nids_errbuf
>>>

[Bertrand Blackburn (b-blackburn)]

I confirm this problem. If you cannot wait for a fix, you can rebuild the package yourself :

  aptitude update
  # these packages are only needed for the build :
  aptitude install build-essential debhelper dpatch libglib2.0-dev libnet1-dev libnids-dev libpcap0.8-dev python-all-dev
  apt-get source python-nids
  cd python-nids-0.6.1
  dpkg-buildpackage -b
  # these are the dependencies of python-nids :
  aptitude install libnet1 libnids1.21
  dpkg -i ../python-nids_0.6.1-1build1_amd64.deb
  aptitude markauto libnet1 libnids1.21
  # be careful with the hold as you will prevent any upgrade of the package
  aptitude hold python-nids

[Oguz Yarimtepe (oguzy)]

I confirm this bug for the ubuntu 11.10. Rebuilding the packade didn't solve the problem. Below is the ipython result when i try to import nids

In [1]: import nids
---------------------------------------------------------------------------
ImportError Traceback (most recent call last)

/home/oguz/Downloads/<ipython console> in <module>()

ImportError: /usr/lib/pymodules/python2.7/nidsmodule.so: undefined symbol: nids_last_pcap_header

[Coops (coops)]

I can confirm this bug exists in Ubuntu 12.04 too. The suggestion of rebuilding the package made no difference.

~$ python
Python 2.7.3 (default, Apr 20 2012, 22:39:59)
[GCC 4.6.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import nids
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: /usr/lib/pymodules/python2.7/nidsmodule.so: undefined symbol: nids_errbuf

Using the python-nids 0.6.1-1build1 package.

[Andris Berzins (pkix)]

The same here on 12.10.

Traceback (most recent call last):
  File "parser2.py", line 3, in <module>
    import nids
ImportError: /usr/lib/pymodules/python2.7/nidsmodule.so: undefined symbol: nids_errbuf

Basically a dead package.

[Gurcan GERCEK (gurcangercek)]

I think the problem with the package is version mismatch. pynids is looking for libnids1.24 but the repo contains the source of 1.23 although apt-cache search libnids list the package as 1.21 anyway,

Here are 2 solutions,

1) From original web site (http://jon.oberheide.org/pynids/)
wget http://jon.oberheide.org/pynids/downloads/pynids-0.6.1.tar.gz
tar xzvf pynids-0.6.1.tar.gz
cd pynids-0.6.1/libnids-1.24
./configure
# install any missing library according to ./configure output
nano src/Makefile
# add -fPIC to CFLAGS variable. Repeat this step after each ./configure if you need to rerun configure somehow
CFLAGS = -g -O2 -D_BSD_SOURCE -DLIBNET_VER=1 -DHAVE_ICMPHDR=1 -DHAVE_TCP_STATES=1 -DHAVE_BSD_UDPHDR=1 -fPIC
# build the libnids-1.24 with make
make
cd ..
# just in case first build to see everything is ok
python setup.py build
# then install it
python setup.py install

2) From github: https://github.com/MITRECND/pynids

# Clone the repository
git clone https://github.com/MITRECND/pynids
# build it, install any missing library according to output
sudo python setup.py build
# install it
sudo python setup.py install

Here is the libnids 1.25, if you want to check.
https://github.com/MITRECND/libnids

Both of the approach worked for me, I can import nids now, and tested with Example script in both of the projects.

I hope this will help.
I am using Xubuntu 12.10 64 bit

[Russell Sim (russell-sim)]

Hey,

This doesn't seem to be a version problem. Debian has exactly the same packages and they work.

It seems like it's not liked to the libnis SO at all.

# ldd -v /usr/lib/pyshared/python2.7/nidsmodule.so
        linux-vdso.so.1 => (0x00007fffdba83000)
        libpcap.so.0.8 => /usr/lib/x86_64-linux-gnu/libpcap.so.0.8 (0x00007f998373d000)
        libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f9983520000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f9983160000)
        /lib64/ld-linux-x86-64.so.2 (0x00007f9983b84000)

        Version information:
        /usr/lib/pyshared/python2.7/nidsmodule.so:
                libc.so.6 (GLIBC_2.2.5) => /lib/x86_64-linux-gnu/libc.so.6
        /usr/lib/x86_64-linux-gnu/libpcap.so.0.8:
                libc.so.6 (GLIBC_2.11) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_2.3) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_2.7) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_2.4) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_2.2.5) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_2.3.4) => /lib/x86_64-linux-gnu/libc.so.6
        /lib/x86_64-linux-gnu/libpthread.so.0:
                ld-linux-x86-64.so.2 (GLIBC_2.2.5) => /lib64/ld-linux-x86-64.so.2
                ld-linux-x86-64.so.2 (GLIBC_2.3) => /lib64/ld-linux-x86-64.so.2
                ld-linux-x86-64.so.2 (GLIBC_PRIVATE) => /lib64/ld-linux-x86-64.so.2
                libc.so.6 (GLIBC_2.14) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_2.3.2) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_PRIVATE) => /lib/x86_64-linux-gnu/libc.so.6
                libc.so.6 (GLIBC_2.2.5) => /lib/x86_64-linux-gnu/libc.so.6
        /lib/x86_64-linux-gnu/libc.so.6:
                ld-linux-x86-64.so.2 (GLIBC_2.3) => /lib64/ld-linux-x86-64.so.2
                ld-linux-x86-64.so.2 (GLIBC_PRIVATE) => /lib64/ld-linux-x86-64.so.2

When i added the following patch to the package i was able to successfully build the use the package

diff -u a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -67,7 +67,7 @@
                             #define_macros = [ ("DEBUG", None), ],
                             sources=["nidsmodule.c"],
                             include_dirs = INCLUDE_DIRS,
- libraries = ["pcap", "net", "glib-2.0", "gthread-2.0"],
+ libraries = ["pcap", "net", "glib-2.0", "gthread-2.0", "nids"],
                             library_dirs = LIBRARY_DIRS,
                             extra_objects = EXTRA_OBJECTS
                         )

This patch adjusts the gcc argumnents in a very subtle way that seems to fix the problem.

Before the patch:
gcc -pthread -shared -Wl,-O1 -Wl,-Bsymbolic-functions -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-Bsymbolic-functions -Wl,-z,relro -g -O2 -fstack-protector --param=ssp-buffer-size=4 -Wformat -Wformat-security -lnids -D_FORTIFY_SOURCE=2 build/temp.linux-x86_64-2.7/nidsmodule.o -L/usr/local/lib -L/opt/local/lib -lpcap -lnet -lglib-2.0 -lgthread-2.0 -o build...

[marcus hunger (marcus-hunger)]

This bug still exists in 14.04.2.