libcrypto.so.30 and libssl.so.30 missing after updating Snort to 4.1.6_13, Pfsense CE 2.7.0-Release

pool15

I upgraded Snort to 4.1.6_13 this morning, and it failed to restart. On investigation the log states:

<11>1 2023-11-19T07:19:30.856802+00:00 pfSense.x86box.com php 83483 - - /tmp/snort_em1_startcmd.php: The command '/usr/local/bin/snort -R _35858 -D -q --suppress-config-log --daq pcap --daq-mode passive --treat-drop-as-alert -l /var/log/snort/snort_em135858 --pid-path /var/run --nolock-pidfile --no-interface-pidfile -G 35858 -c /usr/local/etc/snort/snort_35858_em1/snort.conf -i em1' returned exit code '1', the output was 'ld-elf.so.1: Shared object "libcrypto.so.30" not found, required by "snort"'

I've temporarily got it going again by symlinking /lib/libcrypto.so.111 to /usr/lib/libcrypto.so.30, but the same trick for /usr/lib/libssl.so.30 doesn't appear to work, at least for 'pkg':

ld-elf.so.1: /usr/lib/libssl.so.30: version OPENSSL_3_0_9 required by /usr/local/sbin/pkg not found

Reading through other posts it looks like non-community Pfsense users have been hit by something similar, so I'm worried a) it's only a matter of time till process or system restarts will expose more such broken dependencies and ultimately result in an inoperable system, and b) because I'm running CE this problem will be at the back of the queue for assistance.

How can I reinstall the version 30 libraries before the problem is completely irretrievable?

TIA,
James

pool15

OK missed the 2.7.1 update notice! Will unwind that symlink and run the update

pool15

Think I need to have a stern word or two with myself ... all good now

bmeeks

@pool15 said in libcrypto.so.30 and libssl.so.30 missing after updating Snort to 4.1.6_13, Pfsense CE 2.7.0-Release:

OK missed the 2.7.1 update notice! Will unwind that symlink and run the update

Yep, always login to the Dashboard page first and let it check for any available pfSense updates BEFORE you do anything with a package. If there is a pfSense update available, install that before you touch any package update.

As you found, updating a package when there is a pfSense update out there also will bring down all new versions of shared libraries. Those new versions will almost certainly break things in the existing non-upgraded pfSense installation.