[Snort-devel] RE: Getting bus errors on the Sparc - SPARC_TWIDDLE?

Eloy A. Paris peloy at ...2034...
Mon Jun 23 08:30:25 EDT 2003


Philipp,

On Sun, Jun 22, 2003 at 10:19:38PM +0200, Philipp Stucke wrote:
> Hey,
> 
> I have exactly the same problem Eloy described, but on Snort 2.0.0 on
> OpneBSD 3.2 (Sparc).
> 
> Program received signal SIGBUS, Bus error.
> 0x424e0 in BuildPacket (s=0x290b148, stream_size=65, p=0xf7fff190,
> direction=1)    at spp_stream4.c:3936
> 3936            stream_pkt->iph->ip_src.s_addr = p->iph->ip_src.s_addr;
> 
> 
> Looking forward for help - Please CC since I'm not subscribed.

I am running my Snort on Sparc Linux with the following little patch:

------------------------------- Cut Here -----------------------------
--- snort-2.0.0.orig/src/preprocessors/spp_stream4.c
+++ snort-2.0.0/src/preprocessors/spp_stream4.c
@@ -153,11 +153,7 @@
 /* We must twiddle to align the offset the ethernet header and align
    the IP header on solaris -- maybe this will work on HPUX too.
 */
-#if defined (SOLARIS) || defined (SUNOS) || defined (HPUX) 
 #define SPARC_TWIDDLE       2
-#else
-#define SPARC_TWIDDLE       0
-#endif

 /* values for the smartbits detector/self perservation */
 #define SELF_PRES_THRESHOLD        50
------------------------------- Cut Here -----------------------------

I basically define SPARC_TWIDDLE as 2 regardless of the Operating
System. This causes the IP header to be aligned on a 32-bit boundary,
which is required on some architectures (like the Sparc) if you want to
read/write 32-bit words in one memory access.

I don't see why this SPARC_TWIDDLE thing is required. I would think that
it is OK to always align the IP header, regardless of operating system.
You only lose a couple of bytes if you align the IP header, but I think
it is worth because it makes the core easier to read and maintain by not
creating special cases.

I have been running Snort 2.0.0 on Sparc Linux with the above patch for
several weeks now and haven't had a single problem. Without the patch it
would start and run for a few minutes and then crash with the bus error
when certain traffic arrived.

Hope this helps.

Eloy.-





More information about the Snort-devel mailing list