[Snort-users] Segfault on fun funy rule

Jason Monroe "JC" monroe at ...5738...
Thu Feb 26 00:57:04 EST 2004


Ok Ok, don't burn me. I followed the FAQ and look where it got me ;) I
use gdb once in never ;)  This is what I meant to sent. For fear that
snipping will decrease reproducibility I've included it all :D 

In this case bad stuff first: 

Program received signal SIGSEGV, Segmentation fault.
0x001a9153 in strlen () from /lib/tls/libc.so.6

(gdb) where
#0  0x001a9153 in strlen () from /lib/tls/libc.so.6
#1  0x001a8e85 in strdup () from /lib/tls/libc.so.6
#2  0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at
sp_clientserver.c:143
#3  0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at
sp_clientserver.c:119
#4  0x08056ea4 in ParseRuleOptions (
    rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;", rule_type=2,
protocol=6) at parser.c:1776
#5  0x08055703 in ParseRule (rule_file=0x9e65a48,
    prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any
(msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;)", inclevel=1) at
parser.c:753
#6  0x08054870 in ParseRulesFile (file=0x9e65420
"/opt/snort/rules/local.rules", inclevel=1) at parser.c:254
#7  0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0
"include $RULE_PATH/local.rules", inclevel=0)
    at parser.c:525
#8  0x08054870 in ParseRulesFile (file=0x9e3ec60
"/etc/snort/snort.conf", inclevel=0) at parser.c:254
#9  0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480
#10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168

(gdb) bt
#0  0x001a9153 in strlen () from /lib/tls/libc.so.6
#1  0x001a8e85 in strdup () from /lib/tls/libc.so.6
#2  0x0807bfe3 in ParseFlowArgs (data=0x0, otn=0x9e66ad8) at
sp_clientserver.c:143
#3  0x0807bfc4 in FlowInit (data=0x0, otn=0x9e66ad8, protocol=6) at
sp_clientserver.c:119
#4  0x08056ea4 in ParseRuleOptions (
    rule=0xbfec0fb0 "alert tcp any any -> any any (msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;", rule_type=2,
protocol=6) at parser.c:1776
#5  0x08055703 in ParseRule (rule_file=0x9e65a48,
    prule=0xbfec3060 "alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS any
(msg:\"Telnet login as
root\";content:\"root\";flow:from_client:established;)", inclevel=1) at
parser.c:753
#6  0x08054870 in ParseRulesFile (file=0x9e65420
"/opt/snort/rules/local.rules", inclevel=1) at parser.c:254
#7  0x08054f6c in ParseRule (rule_file=0x9e40598, prule=0xbfec55b0
"include $RULE_PATH/local.rules", inclevel=0)
    at parser.c:525
#8  0x08054870 in ParseRulesFile (file=0x9e3ec60
"/etc/snort/snort.conf", inclevel=0) at parser.c:254
#9  0x0805cb2d in SnortMain (argc=5, argv=0xbfec5b24) at snort.c:480
#10 0x0805c572 in main (argc=5, argv=0xbfec5b24) at snort.c:168

Now the Rest of IT 


(gdb) run -T -v -c /etc/snort/snort.conf
Starting program: /opt/snort/bin/snort -T -v -c /etc/snort/snort.conf
Running in IDS mode
Log directory = /var/log/snort

Initializing Network Interface eth0

        --== Initializing Snort ==--
Initializing Output Plugins!
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
-------------------------------------------------
 Keyword     |       Preprocessor @
-------------------------------------------------
portscan     :       0x8084559
portscan-ignorehosts:       0x8085033
rpc_decode   :       0x80855e2
bo           :       0x80807bf
telnet_decode:       0x808f127
stream4      :       0x80870b3
stream4_reassemble:       0x8087bfa
frag2        :       0x8081478
arpspoof     :       0x807fd00
arpspoof_detect_host:       0x807fe1d
conversation :       0x80903a5
portscan2    :       0x80931b8
portscan2-ignorehosts:       0x8091c3c
portscan2-ignoreports-from:       0x8092059
portscan2-ignoreports-to:       0x8092079
http_inspect :       0x8096dc0
http_inspect_server:       0x8096dc0
PerfMonitor  :       0x808f70f
flow         :       0x8099ad3
flow-portscan:       0x809aa4a
-------------------------------------------------

-------------------------------------------------
 Keyword     |      Plugin Registered @
-------------------------------------------------
content      :      0x8078319
content-list :      0x807824c
offset       :      0x8078469
depth        :      0x80785ae
nocase       :      0x8078709
rawbytes     :      0x80787bd
regex        :      0x8078aa6
uricontent   :      0x80783c1
distance     :      0x8078812
within       :      0x807895c
flags        :      0x807af47
itype        :      0x80762fb
icode        :      0x8075a9f
ttl          :      0x807ba43
id           :      0x8076f9b
ack          :      0x807ad87
seq          :      0x807b623
dsize        :      0x8075507
ipopts       :      0x80777ff
rpc          :      0x8079fc7
icmp_id      :      0x8075eeb
icmp_seq     :      0x80760f3
session      :      0x807a66f
tos          :      0x807759b
fragbits     :      0x8076743
fragoffset   :      0x8076c6c
window       :      0x807b7bd
ip_proto     :      0x8077153
sameip       :      0x807741f
flow         :      0x807bf5b
byte_test    :      0x807c882
byte_jump    :      0x807d46e
isdataat     :      0x807ebca
pcre         :      0x807def4
flowbits     :      0x807f2cd
-------------------------------------------------

-------------------------------------------------
 Keyword     |          Output @
-------------------------------------------------
alert_syslog :       0x806de85
log_tcpdump  :       0x8072735
database     :       0x806fd3d
alert_fast   :       0x806d2f5
alert_full   :       0x806d93d
alert_unixsock:       0x806e8e5
alert_CSV    :       0x806ede5
log_null     :       0x8072671
log_unified  :       0x8073c98
alert_unified:       0x80739f5
unified      :       0x8072ccf
log_ascii    :       0x8074259
alert_sf_socket:       0x8074cfc
alert_sf_socket_sid:       0x8074e01
-------------------------------------------------

Parsing Rules file /etc/snort/snort.conf

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
,-----------[Flow Config]----------------------
| Stats Interval:  0
| Hash Method:     2
| Memcap:          10485760
| Rows  :          4099
| Overhead Bytes:  16400(%0.16)
`----------------------------------------------
No arguments to frag2 directive, setting defaults to:
    Fragment timeout: 60 seconds
    Fragment memory cap: 4194304 bytes
    Fragment min_ttl:   0
    Fragment ttl_limit: 5
    Fragment Problems: 0
    Self preservation threshold: 500
    Self preservation period: 90
    Suspend threshold: 1000
    Suspend period: 30
Stream4 config:
    Stateful inspection: ACTIVE
    Session statistics: INACTIVE
    Session timeout: 30 seconds
    Session memory cap: 8388608 bytes
    State alerts: INACTIVE
    Evasion alerts: INACTIVE
    Scan alerts: INACTIVE
    Log Flushed Streams: INACTIVE
    MinTTL: 1
    TTL Limit: 5
    Async Link: 0
    State Protection: 0
    Self preservation threshold: 50
    Self preservation period: 90
    Suspend threshold: 200
    Suspend period: 30
Stream4_reassemble config:
    Server reassembly: INACTIVE
    Client reassembly: ACTIVE
    Reassembler alerts: ACTIVE
    Zero out flushed packets: INACTIVE
    flush_data_diff_size: 500
    Ports: 21 23 25 53 80 110 111 143 513 1433
    Emergency Ports: 21 23 25 53 80 110 111 143 513 1433
HttpInspect Config:
    GLOBAL CONFIG
      Max Pipeline Requests:    0
      Inspection Type:          STATELESS
      Detect Proxy Usage:       NO
      IIS Unicode Map Filename: /etc/snort/unicode.map
      IIS Unicode Map Codepage: 1252
    DEFAULT SERVER CONFIG:
      Ports: 80 8080 8180
      Flow Depth: 300
      Max Chunk Length: 500000
      Inspect Pipeline Requests: YES
      URI Discovery Strict Mode: NO
      Allow Proxy Usage: NO
      Disable Alerting: NO
      Oversize Dir Length: 500
      Only inspect URI: NO
      Ascii: YES alert: NO
      Double Decoding: YES alert: YES
      %U Encoding: YES alert: YES
      Bare Byte: YES alert: YES
      Base36: OFF
      UTF 8: OFF
      IIS Unicode: YES alert: YES
      Multiple Slash: YES alert: NO
      IIS Backslash: YES alert: NO
      Directory: YES alert: NO
      Apache WhiteSpace: YES alert: YES
      IIS Delimiter: YES alert: YES
      IIS Unicode Map: GLOBAL IIS UNICODE MAP CONFIG
      Non-RFC Compliant Characters: NONE
rpc_decode arguments:
    Ports to decode RPC on: 111 32771
    alert_fragments: INACTIVE
    alert_large_fragments: ACTIVE
    alert_incomplete: ACTIVE
    alert_multiple_requests: ACTIVE
telnet_decode arguments:
    Ports to decode telnet on: 21 23 25 119

Program received signal SIGSEGV, Segmentation fault.
0x001a9153 in strlen () from /lib/tls/libc.so.6


> 
> Instead of "run snort ...." try just "run <options>" without the word
> 'snort'.  Libpcap is seeing that and trying to interpret it as a BPF style
> filter, hence the syntax error with OpenPcap.
> 
> Cheers!
> 
> -----




More information about the Snort-users mailing list