Suricata5.0.1 Hyperscan 安装

一.安装插件

1.安装cmake ragel
Ubuntu

apt-get install cmake ragel

Centos

yum install cmake ragel

2.安装libboost headers
Ubuntu

apt-get install libboost-dev #版本需要1.58以上

centos

yum install boost-devel

3.安装Trusty
(1)先安装python-dev libbz2-dev
ubuntu

sudo apt-get python-dev libbz2-dev

centos

yum install python-devel bzip2-devel

(2)安装 Trusty

wget https://dl.bintray.com/boostorg/release/1.66.0/source/boost_1_66_0.tar.gz
tar xvzf boost_1_66_0.tar.gz
cd boost_1_66_0
./bootstrap.sh --prefix=~/tmp/boost-1.66
./b2 install

4.安装hyperscan

git clone https://github.com/intel/hyperscan
cd hyperscan
mkdir build
cd build
cmake -DBUILD_STATIC_AND_SHARED=1 ../

如果是自己安装的Trusty，则cmake命令需要指定路径

cmake -DBUILD_STATIC_AND_SHARED=1 -DBOOST_ROOT=~/tmp/boost-1.66 ../

然后

make
make install

5.最后将lib路径加入到ld中

echo "/usr/local/lib" | sudo tee --append /etc/ld.so.conf.d/usrlocal.conf
sudo ldconfig

如果系统为64位，出现uricata: error while loading shared libraries: libhs.so.5: cannot open shared o bject file: No such file or directory错误的
改为

echo "/usr/local/lib64" | sudo tee --append /etc/ld.so.conf.d/usrlocal.conf
sudo ldconfig

6.编译和安装suricata

./configure --enable-pfring -with-libpfring-includes=/opt/pfring/include  -with-libpfring-libraries=/opt/pfring/lib -with-libjansson-libraries=/usr/lib64/ -with-libjansson-includes=/usr/includemake -with-libhs-includes=/usr/local/include/hs/ -with-libhs-libraries=/usr/local/lib/
make
make install

7.安装完成后，查看是否suricata是否已经支持hyperscan

suricata --build-info|grep Hyperscan