On 2021-10-15, Peter J. Philipp <[email protected]> wrote: > On Fri, Oct 15, 2021 at 08:05:08PM +0200, Otto Moerbeek wrote: > [ some cut ] > >> > Anything else I can collect. >> >> You might want to compile and install nsd wit debug symbols info: >> >> cd /usr/src/usr.sbin/nsd >> make -f Makefile.bsd-wrapper obj >> make -f Makefile.bsd-wrapper clean >> DEBUG=-g make -f Makefile.bsd-wrapper >> make -f Makefile.bsd-wrapper install >> >> >> Then: collect a gdb trace from a running process: install gdb from ports, >> run >> egdb --pid=pidofnsdchild /usr/sbin/nsd >> >> and wait for the crash. >> >> But I'm mostly unfamiliar with the nsd code and what has been changed >> recently. I's say make sure sthen@ and florian@ see this: move to >> bugs@ as I do not know if they read misc@. >> >> -Otto > > Hi Otto and Mischa, > > I'm watching this unfold and I'm trying to convert this packet with tr and > sed but I'm having a hard time, getting this to 101 bytes. It would be cool > if you could show this packet in a hex dump ie. kdump -X or kdump -x. > > If you feel this really is a packet of nsd-death then I'd be interested in > seeing the hexdump privately. I know how to read some DNS formats but the > way it is in the kdump I'm having trouble converting that. > > Best Regards, > -peter > >> > >> > Mischa >> > >> > >> > > >> > > -Otto >> > > >> > > > 91127 nsd CALL >> > > > recvfrom(7,0xb2ac85b8000,0x20109,0,0xb2acfa96018,0xb27e485a968) >> > > > 91127 nsd GIO fd 7 read 101 bytes >> > > > "By\0\0\0\^A\0\0\0\0\0\^A\^A6\^A0\^A1\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A1\^A0\^A0\^A0\^A4\^A0\^A0\^A1\^A0\^A0\^A0\^A6\^A3\^A0\^Aa\^A2\^Cip6\^Darpa\0\0\f\0\ >> > > > \^A\0\0)\^E\M-,\0\0\M^@\0\0\0" >> > > > 91127 nsd STRU struct sockaddr { AF_INET, >> > > > 141.101.75.185:10029 } >> > > > 91127 nsd RET recvfrom 101/0x65 >> > > > 91127 nsd PSIG SIGSEGV SIG_DFL code SEGV_MAPERR<1> addr=0x10 >> > > > trapno=6 >> > > > 36104 nsd STRU struct pollfd [2] { fd=16, events=0x1<POLLIN>, >> > > > revents=0<> } { fd=15, events=0x1<POLLIN>, revents=0<> } >> > > > 36104 nsd PSIG SIGCHLD caught handler=0xb27e47fa340 mask=0<> >> > >
$ echo 'By\0\0\0\^A\0\0\0\0\0\^A\^A6\^A0\^A1\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A0\^A1\^A0\^A0\^A0\^A4\^A\^A\0\0)\^E\M-,\0\0\M^@\0\0\0' | unvis | hexdump -C 00000000 42 79 00 00 00 01 00 00 00 00 00 01 01 36 01 30 |By...........6.0| 00000010 01 31 01 30 01 30 01 30 01 30 01 30 01 30 01 30 |.1.0.0.0.0.0.0.0| 00000020 01 30 01 30 01 30 01 30 01 30 01 30 01 31 01 30 |.0.0.0.0.0.0.1.0| 00000030 01 30 01 30 01 34 01 01 00 00 29 05 ac 00 00 80 |.0.0.4....).....| 00000040 00 00 00 0a |....| 00000044 -- Please keep replies on the mailing list.
