zeek-dev December 2014

zeek-dev@lists.zeek.org

98 discussions

[Bro-Dev] [JIRA] (BIT-1299) topic/jsiwek/fix-ipv6

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1299?page=com.atlassian.jira.p… ] Jon Siwek reassigned BIT-1299: ------------------------------ Assignee: Robin Sommer > topic/jsiwek/fix-ipv6 > --------------------- > > Key: BIT-1299 > URL: https://bro-tracker.atlassian.net/browse/BIT-1299 > Project: Bro Issue Tracker > Issue Type: Problem > Components: pysubnettree > Reporter: Jon Siwek > Assignee: Robin Sommer > Fix For: 2.4 > > > This fixes problems with mixing both IPv4 and IPv6 addresses in the same trie/subnettree by converting IPv4 to the IPv4-mapped-IPv6 format before using it. (Bro's use of the underlying patricia trie code already does things like this, but the python module didn't). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1299) topic/jsiwek/fix-ipv6

by Jon Siwek (JIRA)

Jon Siwek created BIT-1299: ------------------------------ Summary: topic/jsiwek/fix-ipv6 Key: BIT-1299 URL: https://bro-tracker.atlassian.net/browse/BIT-1299 Project: Bro Issue Tracker Issue Type: Problem Components: pysubnettree Reporter: Jon Siwek Fix For: 2.4 This fixes problems with mixing both IPv4 and IPv6 addresses in the same trie/subnettree by converting IPv4 to the IPv4-mapped-IPv6 format before using it. (Bro's use of the underlying patricia trie code already does things like this, but the python module didn't). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1299) topic/jsiwek/fix-ipv6

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1299?page=com.atlassian.jira.p… ] Jon Siwek updated BIT-1299: --------------------------- Status: Merge Request (was: Open) > topic/jsiwek/fix-ipv6 > --------------------- > > Key: BIT-1299 > URL: https://bro-tracker.atlassian.net/browse/BIT-1299 > Project: Bro Issue Tracker > Issue Type: Problem > Components: pysubnettree > Reporter: Jon Siwek > Fix For: 2.4 > > > This fixes problems with mixing both IPv4 and IPv6 addresses in the same trie/subnettree by converting IPv4 to the IPv4-mapped-IPv6 format before using it. (Bro's use of the underlying patricia trie code already does things like this, but the python module didn't). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [Auto] Merge Status

by Merge Tracker

Open Merge Requests =================== ID Component Reporter Assignee Updated For Version Priority Summary ------------ ----------- ------------ ------------ ---------- ------------- ---------- ------------------------------------------------------------------------------------------------------- BIT-1298 [1] Bro Eric Asselin Robin Sommer 2014-12-10 - High IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault [1] BIT-1298 https://bro-tracker.atlassian.net/browse/BIT-1298

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1298) IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1298?page=com.atlassian.jira.p… ] Jon Siwek updated BIT-1298: --------------------------- Status: Merge Request (was: Open) > IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault > ------------------------------------------------------------------------------------------------------- > > Key: BIT-1298 > URL: https://bro-tracker.atlassian.net/browse/BIT-1298 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.3 > Environment: Debian > Reporter: Eric Asselin > Priority: High > Labels: analyzer > Attachments: core.zip, ntp-synchronized.pcap > > > From a child analyzer like NTP, the IP_Hdr pointer in the DeliverPacket method is empty and unusable causing a segmentation fault as soon as you try to access it. > To recreate the bug, just add an "assert(ip)" inside the DeliverPacket method of a UDP child analyzer and the execution will fail (instead of the segmentation fault). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1298) IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1298?page=com.atlassian.jira.p… ] Jon Siwek reassigned BIT-1298: ------------------------------ Assignee: Robin Sommer > IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault > ------------------------------------------------------------------------------------------------------- > > Key: BIT-1298 > URL: https://bro-tracker.atlassian.net/browse/BIT-1298 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.3 > Environment: Debian > Reporter: Eric Asselin > Assignee: Robin Sommer > Priority: High > Labels: analyzer > Attachments: core.zip, ntp-synchronized.pcap > > > From a child analyzer like NTP, the IP_Hdr pointer in the DeliverPacket method is empty and unusable causing a segmentation fault as soon as you try to access it. > To recreate the bug, just add an "assert(ip)" inside the DeliverPacket method of a UDP child analyzer and the execution will fail (instead of the segmentation fault). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1298) IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1298?page=com.atlassian.jira.p… ] Jon Siwek commented on BIT-1298: -------------------------------- There's a fix in git on branch topic/jsiwek/bit-1298 > IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault > ------------------------------------------------------------------------------------------------------- > > Key: BIT-1298 > URL: https://bro-tracker.atlassian.net/browse/BIT-1298 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.3 > Environment: Debian > Reporter: Eric Asselin > Priority: High > Labels: analyzer > Attachments: core.zip, ntp-synchronized.pcap > > > From a child analyzer like NTP, the IP_Hdr pointer in the DeliverPacket method is empty and unusable causing a segmentation fault as soon as you try to access it. > To recreate the bug, just add an "assert(ip)" inside the DeliverPacket method of a UDP child analyzer and the execution will fail (instead of the segmentation fault). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1298) IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault

by Eric Asselin (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1298?page=com.atlassian.jira.p… ] Eric Asselin commented on BIT-1298: ----------------------------------- Thanks for your quick reply. > IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault > ------------------------------------------------------------------------------------------------------- > > Key: BIT-1298 > URL: https://bro-tracker.atlassian.net/browse/BIT-1298 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.3 > Environment: Debian > Reporter: Eric Asselin > Priority: High > Labels: analyzer > Attachments: core.zip, ntp-synchronized.pcap > > > From a child analyzer like NTP, the IP_Hdr pointer in the DeliverPacket method is empty and unusable causing a segmentation fault as soon as you try to access it. > To recreate the bug, just add an "assert(ip)" inside the DeliverPacket method of a UDP child analyzer and the execution will fail (instead of the segmentation fault). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1298) IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault

by Jon Siwek (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1298?page=com.atlassian.jira.p… ] Jon Siwek commented on BIT-1298: -------------------------------- Thanks, I see what's happening now: the process for attaching analyzers via signature matches will buffer packet contents (excluding IP header) until a signature matches and then later replay those packets for analysis. Since it didn't save the IP header while buffering, those DeliverPacket calls which use replayed content end up with a null IP_Hdr*. I can see what it takes to fix that, but from your earlier description, you may be able to get the information you were looking for from a different place, e.g.: {noformat} diff --git a/src/analyzer/protocol/ntp/NTP.cc b/src/analyzer/protocol/ntp/NTP.cc index 5778da9..0ba5b3f 100644 --- a/src/analyzer/protocol/ntp/NTP.cc +++ b/src/analyzer/protocol/ntp/NTP.cc @@ -27,6 +27,9 @@ void NTP_Analyzer::Done() void NTP_Analyzer::DeliverPacket(int len, const u_char* data, bool is_orig, uint64 seq, const IP_Hdr* ip, int caplen) { + printf("%s:%d\n", + Conn()->OrigAddr().AsString().c_str(), + ntohs(Conn()->OrigPort())); Analyzer::DeliverPacket(len, data, is_orig, seq, ip, caplen); // Actually we could just get rid of the Request/Reply and simply use {noformat} > IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault > ------------------------------------------------------------------------------------------------------- > > Key: BIT-1298 > URL: https://bro-tracker.atlassian.net/browse/BIT-1298 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.3 > Environment: Debian > Reporter: Eric Asselin > Priority: High > Labels: analyzer > Attachments: core.zip, ntp-synchronized.pcap > > > From a child analyzer like NTP, the IP_Hdr pointer in the DeliverPacket method is empty and unusable causing a segmentation fault as soon as you try to access it. > To recreate the bug, just add an "assert(ip)" inside the DeliverPacket method of a UDP child analyzer and the execution will fail (instead of the segmentation fault). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

[Bro-Dev] [JIRA] (BIT-1298) IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault

by Eric Asselin (JIRA)

[ https://bro-tracker.atlassian.net/browse/BIT-1298?page=com.atlassian.jira.p… ] Eric Asselin updated BIT-1298: ------------------------------ Attachment: ntp-synchronized.pcap > IP_Hdr pointer do not propagate from udp to child analyzers via DeliverPacket method causing a segfault > ------------------------------------------------------------------------------------------------------- > > Key: BIT-1298 > URL: https://bro-tracker.atlassian.net/browse/BIT-1298 > Project: Bro Issue Tracker > Issue Type: Problem > Components: Bro > Affects Versions: 2.3 > Environment: Debian > Reporter: Eric Asselin > Priority: High > Labels: analyzer > Attachments: core.zip, ntp-synchronized.pcap > > > From a child analyzer like NTP, the IP_Hdr pointer in the DeliverPacket method is empty and unusable causing a segmentation fault as soon as you try to access it. > To recreate the bug, just add an "assert(ip)" inside the DeliverPacket method of a UDP child analyzer and the execution will fail (instead of the segmentation fault). -- This message was sent by Atlassian JIRA (v6.4-OD-11-014#64007)

7 years, 5 months

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

zeek-dev December 2014