[Snort-devel] snort & sparc (bus error) again
Ricardo A. Gorosito
rgorosito at ...1077...
Thu Nov 28 17:52:03 EST 2002
I'll try to fix snort for get it running on sparc/linux. But I need some
Runing snort, first bus error that I get is on:
Program received signal SIGBUS, Bus error.
DecodeTCP (pkt=0x14bada "\004\021\f?\016c\016RE\201\231g\200\030\026?(?",
len=43, p=0xeffff230) at decode.c:1862
1862 ph.sip = (u_int32_t)(p->iph->ip_src.s_addr);
(gdb) *print &p->iph->ip_src*
$1 = (struct in_addr *) 0x14bad2
(gdb) *print p->iph*
$2 = (IPHdr *) 0x14bac6
(gdb) *print p*
$3 = (Packet *) 0xeffff230
sparc need that p->iph->ip_src be aligned to 32bits, and you can see
that it is not.
You can save the problem with:
pAux = *((char *)&(p->iph->ip_src.s_addr)+0);
pAux = *((char *)&(p->iph->ip_src.s_addr)+1);
pAux = *((char *)&(p->iph->ip_src.s_addr)+2);
pAux = *((char *)&(p->iph->ip_src.s_addr)+3);
but bus errors are in to much lines of code.
The problem is on DecodeIP:
/* lay the IP struct over the raw data */
p->iph = (IPHdr *) pkt;
because iph is not aligned on raw data (with an ethernet header).
1) fix all sites when unaligned data is used
2) alloc new mem for packet? ( where? if it is on DecodeIP wheres is
free()? need to modify ProcessPacket? )
3) see how cc from solaris make 'black magic' and make it run. (I don't
have that compiler)
What snort's hackers recommend me as start point?
Thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel