Hello,
I am customizing ngrep for an internal application. It basically would
read filter from a file instead of, from the command line. I
apologize in advance for the wall-o-text.
High level description of the modification:
Each filter component is listed in a single line and the program would
read the entire file and compress all the arguments to one single
filter to be passed onto to pcap_compile. In case any error(s) is /are
detected it starts from line 1 to x , where x ranges from ( 1 .. n )
(where n is the last line) pointing out the line numbers of any
detected errors.
segfault does not seem to be because of repeated invocation of the
library calls.
The segfault is always in after the "last line has been processed".
Contents of file /etc/ngrep/ngrep.conf; that does not create segfault is
--
Ports=80,25,11
Protcols=ALL,TCP
Deny Ports=22,88
Deny Protocols=ICMP,UDP
GAR BAGE
.
..
--
Contents of file /etc/ngrep/ngrep.conf that *does* create segfault is
--
Ports=80,25,11
Protcols=ALL,TCP
Deny Ports=22,88
Deny Protocols=ICMP,UDP
GAR BAG
.
..
--
The only difference between the above two version of the files is "GAR
BAGE" replaced by "GAR BAG". It also segfaults if "GAR BAGE" is
replaced by "GAR BAG E" but it does not segfault if "GAR BAG" is
replaced by "GAR BAG EIS". There is also a segfault if "GAR BAG E" is
replace by "123 BAG E".
The below given file causes a backtrace:
--
Ports=80,25,11
Protcols=ALL,TCP
Deny Ports=22,88
Deny Protocols=ICMP,UDP
GAR BAG E
GAR BAG EIS
.
..
--
For the actual back-trace message see attachment 1. _Note_ breaking on
free while running the program under gdb causes no breakpoints to be
hit. and the output is ~ attachment1.
But on the other hand, the below file does not cause any problems:
--
Ports=80,25,11
Protcols=ALL,TCP
Deny Ports=22,88
123 BAG E
Deny Protocols=ICMP,UDP
.
..
--
Running pcap_compile multiple times on manually "compressed filter
text" multiple times in a single process seems to cause *no problems*.
In psuedo code :
</code>
for (i from 1 to 10)
str="Ports=80,25,11 Protcols=ALL,TCP Deny Ports=22,88 Deny
Protocols=ICMP,UDP GAR BAG . .."
dev = pcap_lookupdev(errbuf);
check dev != NULL
pcap_lookupnet(dev,&netp,&maskp,errbuf);
descr = pcap_open_live(dev,BUFSIZ,1,-1,errbuf);
check descr != NULL
pcap_compile($str);
forEnds
</code>
Here is the actual snippet of C code that is causing the errors (all
pcap calls are located in this function)
<code>
int pkmain(char *buffer)
{
/* ask pcap for the network address and mask of the device */
pcap_lookupnet(dev,&netp,&maskp,errbuf);
/* open device for reading this time lets set it in promiscuous
* mode so we can monitor traffic to another machine */
descr = pcap_open_live(dev,BUFSIZ,1,-1,errbuf);
if(descr == NULL)
{ printf("pcap_open_live(): %s\n",errbuf); exit(1); }
printf("pkmain:Trying to compile ((%s))\n",buffer);
if(pcap_compile(descr,&fp,buffer,0,netp) == -1)
{ fprintf(stderr,"Error calling pcap_compile\n");
if(descr)pcap_perror(descr,"pcap:");return 0; }
/* set the compiled program as the filter */
return 1;
}
</code>
In the gdb log attached (Attachment 2), things go haywire after line 96.
*HOST __OS__ DETAILS*
harish@embdbuild:~/ngrep/xml$ dpkg -l | grep libpca
ii libpcap-dev 1.0.0-2ubuntu1
development library for libpcap (transitiona
ii libpcap0.8 1.0.0-6
system interface for user-level packet captu
ii libpcap0.8-dbg 1.0.0-6
debugging symbols for libpcap0.8
ii libpcap0.8-dev 1.0.0-6
development library and header files for lib
uname -m
i686
uname -a
Linux embdbuild 2.6.31-14-generic-pae #48-Ubuntu SMP Fri Oct 16
15:22:42 UTC 2009 i686 GNU/Linux
harish@embdbuild:~/ngrep/xml$ dpkg -l | grep libc
ii klibc-utils 1.5.15-1ubuntu2
small utilities built with klibc for early b
ii libc-bin 2.10.1-0ubuntu19
GNU C Library: Binaries
ii libc-dev-bin 2.10.1-0ubuntu19
GNU C Library: Development binaries
ii libc6 2.10.1-0ubuntu19
GNU C Library: Shared libraries
ii libc6-dbg 2.10.1-0ubuntu19
GNU C Library: detached debugging symbols
ii libc6-dev 2.10.1-0ubuntu19
GNU C Library: Development Libraries and Hea
ii libc6-i686 2.10.1-0ubuntu19
GNU C Library: Shared libraries [i686 optimi
Thank you for your time,
Hope this information was useful
Harish Badrinath
*** glibc detected *** ./test: free(): invalid next size (fast): 0x09d922a0 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb75f40d1]
/lib/tls/i686/cmov/libc.so.6[0xb75f57d2]
/lib/tls/i686/cmov/libc.so.6(cfree+0x6d)[0xb75f88ad]
./test[0x8049464]
./test[0x804a9e5]
./test[0x8048a3f]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0xb759fb56]
./test[0x8048991]
======= Memory map: ========
08048000-0804c000 r-xp 00000000 08:03 2867242 /backed/harish/ngrep/xml/test
0804c000-0804d000 r--p 00003000 08:03 2867242 /backed/harish/ngrep/xml/test
0804d000-0804e000 rw-p 00004000 08:03 2867242 /backed/harish/ngrep/xml/test
09d8e000-09daf000 rw-p 00000000 00:00 0 [heap]
b7400000-b7421000 rw-p 00000000 00:00 0
b7421000-b7500000 ---p 00000000 00:00 0
b7564000-b7580000 r-xp 00000000 08:03 9265314 /lib/libgcc_s.so.1
b7580000-b7581000 r--p 0001b000 08:03 9265314 /lib/libgcc_s.so.1
b7581000-b7582000 rw-p 0001c000 08:03 9265314 /lib/libgcc_s.so.1
b7587000-b7589000 rw-p 00000000 00:00 0
b7589000-b76c7000 r-xp 00000000 08:03 9266344
/lib/tls/i686/cmov/libc-2.10.1.so
b76c7000-b76c8000 ---p 0013e000 08:03 9266344
/lib/tls/i686/cmov/libc-2.10.1.so
b76c8000-b76ca000 r--p 0013e000 08:03 9266344
/lib/tls/i686/cmov/libc-2.10.1.so
b76ca000-b76cb000 rw-p 00140000 08:03 9266344
/lib/tls/i686/cmov/libc-2.10.1.so
b76cb000-b76ce000 rw-p 00000000 00:00 0
b76ce000-b76fb000 r-xp 00000000 08:03 6825001 /usr/lib/libpcap.so.1.0.0
b76fb000-b76fc000 r--p 0002c000 08:03 6825001 /usr/lib/libpcap.so.1.0.0
b76fc000-b76fd000 rw-p 0002d000 08:03 6825001 /usr/lib/libpcap.so.1.0.0
b7701000-b7704000 rw-p 00000000 00:00 0
b7704000-b7705000 r-xp 00000000 00:00 0 [vdso]
b7705000-b7720000 r-xp 00000000 08:03 9265163 /lib/ld-2.10.1.so
b7720000-b7721000 r--p 0001a000 08:03 9265163 /lib/ld-2.10.1.so
b7721000-b7722000 rw-p 0001b000 08:03 9265163 /lib/ld-2.10.1.so
bfdc1000-bfdd6000 rw-p 00000000 00:00 0 [stack]
Aborted
Breakpoint 1 at 0x8048870
Starting program: /backed/harish/ngrep/xml/test
Breakpoint 1, pcap_compile (p=0x8052368, program=0x804d140,
buf=0x8052310 "Ports=80,25,11 Protcols=ALL,TCP Deny Ports=22,88 Deny
Protocols=ICMP,UDP GAR BAG . .\031\002", optimize=0, mask=108736) at
./gencode.c:374
374 ./gencode.c: No such file or directory.
in ./gencode.c
377 in ./gencode.c
381 in ./gencode.c
379 in ./gencode.c
Continuing.
Breakpoint 1, pcap_compile (p=0x8052980, program=0x804d140, buf=0x8052310
"Ports=80,25,11", optimize=0, mask=108736) at ./gencode.c:374
374 in ./gencode.c
377 in ./gencode.c
Continuing.
Breakpoint 1, pcap_compile (p=0x8053038, program=0x804d140, buf=0x8053010
"Ports=80,25,11 Protcols=ALL,TCP", optimize=0, mask=108736) at ./gencode.c:374
374 in ./gencode.c
Continuing.
Breakpoint 1, pcap_compile (p=0x8053688, program=0x804d140, buf=0x8053650
"Ports=80,25,11 Protcols=ALL,TCP Deny Ports=22,88", optimize=0, mask=108736)
at ./gencode.c:374
374 in ./gencode.c
Continuing.
Breakpoint 1, pcap_compile (p=0x8053d28, program=0x804d140, buf=0x8053cd8
"Ports=80,25,11 Protcols=ALL,TCP Deny Ports=22,88 Deny Protocols=ICMP,UDP",
optimize=0,
mask=108736) at ./gencode.c:374
374 in ./gencode.c
Continuing.
Breakpoint 1, pcap_compile (p=0x8054398, program=0x804d140, buf=0x8054340
"Ports=80,25,11 Protcols=ALL,TCP Deny Ports=22,88 Deny Protocols=ICMP,UDP GAR
BAG",
optimize=0, mask=108736) at ./gencode.c:374
374 in ./gencode.c
Continuing.
Breakpoint 1, pcap_compile (p=0x8054a08, program=0x804d140, buf=0x80549b0
"Ports=80,25,11 Protcols=ALL,TCP Deny Ports=22,88 Deny Protocols=ICMP,UDP GAR
BAG .",
optimize=0, mask=108736) at ./gencode.c:374
374 in ./gencode.c
Breakpoint 2 at 0x8048fc1: file test.c, line 213.
Continuing.
Breakpoint 2, pkmain (buffer=0x8053ca0 "Ports=80,25,11 Protcols=ALL,TCP Deny
Ports=22,88 Deny Protocols=ICMP,UDP GAR BAG . ..") at test.c:213
213 pcap_lookupnet(dev,&netp,&maskp,errbuf);
pcap_lookupnet (device=0x804d074 "eth0", netp=0x804d07c, maskp=0x804d14c,
errbuf=0x804d160 "") at ./inet.c:661
661 ./inet.c: No such file or directory.
in ./inet.c
651 in ./inet.c
661 in ./inet.c
672 in ./inet.c
*__GI_strstr (haystack_start=0x804d074 "eth0", needle_start=0xb7fc7824
"usbmon") at strstr.c:58
58 strstr.c: No such file or directory.
in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
60 in strstr.c
79 in strstr.c
two_way_short_needle (haystack_start=0x804d074 "eth0", needle_start=0xb7fc7824
"usbmon") at str-two-way.h:273
273 str-two-way.h: No such file or directory.
in str-two-way.h
*__GI_strstr (haystack_start=0x0, needle_start=0xb7fc7824 "usbmon") at
strstr.c:84
84 strstr.c: No such file or directory.
in strstr.c
pcap_lookupnet (device=0x804d074 "eth0", netp=0x804d07c, maskp=0x804d14c,
errbuf=0x804d160 "") at ./inet.c:661
661 ./inet.c: No such file or directory.
in ./inet.c
679 in ./inet.c
socket () at ../sysdeps/unix/sysv/linux/i386/socket.S:51
51 ../sysdeps/unix/sysv/linux/i386/socket.S: No such file or directory.
in ../sysdeps/unix/sysv/linux/i386/socket.S
Current language: auto
The current source language is "auto; currently asm".
54 in ../sysdeps/unix/sysv/linux/i386/socket.S
57 in ../sysdeps/unix/sysv/linux/i386/socket.S
58 in ../sysdeps/unix/sysv/linux/i386/socket.S
61 in ../sysdeps/unix/sysv/linux/i386/socket.S
64 in ../sysdeps/unix/sysv/linux/i386/socket.S
68 in ../sysdeps/unix/sysv/linux/i386/socket.S
69 in ../sysdeps/unix/sysv/linux/i386/socket.S
socket () at ../sysdeps/unix/sysv/linux/i386/socket.S:73
73 in ../sysdeps/unix/sysv/linux/i386/socket.S
pcap_lookupnet (device=0x804d074 "eth0", netp=0x804d07c, maskp=0x804d14c,
errbuf=0x804d160 "") at ./inet.c:680
680 ./inet.c: No such file or directory.
in ./inet.c
Current language: auto
The current source language is "auto; currently c".
679 in ./inet.c
680 in ./inet.c
warning: Source file is more recent than executable.
85 return __builtin___memset_chk (__dest, __ch, __len, __bos0 (__dest));
122 return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
688 ./inet.c: No such file or directory.
in ./inet.c
122 return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
*__GI_strncpy (s1=0xbffff6bc "", s2=0x804d074 "eth0", n=16) at strncpy.c:33
33 strncpy.c: No such file or directory.
in strncpy.c
35 in strncpy.c
61 in strncpy.c
35 in strncpy.c
37 in strncpy.c
41 in strncpy.c
25 in strncpy.c
42 in strncpy.c
43 in strncpy.c
42 in strncpy.c
43 in strncpy.c
45 in strncpy.c
46 in strncpy.c
47 in strncpy.c
46 in strncpy.c
47 in strncpy.c
49 in strncpy.c
50 in strncpy.c
51 in strncpy.c
50 in strncpy.c
51 in strncpy.c
53 in strncpy.c
54 in strncpy.c
55 in strncpy.c
54 in strncpy.c
55 in strncpy.c
25 in strncpy.c
57 in strncpy.c
41 in strncpy.c
25 in strncpy.c
42 in strncpy.c
43 in strncpy.c
42 in strncpy.c
43 in strncpy.c
60 in strncpy.c
61 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
82 in strncpy.c
83 in strncpy.c
86 in strncpy.c
pcap_lookupnet (device=0x804d074 "eth0", netp=0x804d07c, maskp=<value optimized
out>, errbuf=0x804d160 "") at ./inet.c:691
691 ./inet.c: No such file or directory.
in ./inet.c
704 in ./inet.c
705 in ./inet.c
704 in ./inet.c
705 in ./inet.c
711 in ./inet.c
712 in ./inet.c
713 in ./inet.c
712 in ./inet.c
713 in ./inet.c
726 in ./inet.c
727 in ./inet.c
728 in ./inet.c
pkmain (buffer=0x8053ca0 "Ports=80,25,11 Protcols=ALL,TCP Deny Ports=22,88 Deny
Protocols=ICMP,UDP GAR BAG . ..") at test.c:216
216 descr = pcap_open_live(dev,BUFSIZ,1,-1,errbuf);
pcap_open_live (source=0x804d074 "eth0", snaplen=8192, promisc=1, to_ms=-1,
errbuf=0x804d160 "") at ./pcap.c:231
231 ./pcap.c: No such file or directory.
in ./pcap.c
227 in ./pcap.c
231 in ./pcap.c
pcap_create (device=0x804d074 "eth0", ebuf=0x804d160 "") at ./pcap-linux.c:297
297 ./pcap-linux.c: No such file or directory.
in ./pcap-linux.c
303 in ./pcap-linux.c
325 in ./pcap-linux.c
*__GI_strstr (haystack_start=0x804d074 "eth0", needle_start=0xb7fc7824
"usbmon") at strstr.c:58
58 strstr.c: No such file or directory.
in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
59 in strstr.c
58 in strstr.c
60 in strstr.c
79 in strstr.c
two_way_short_needle (haystack_start=0x804d074 "eth0", needle_start=0xb7fc7824
"usbmon") at str-two-way.h:273
273 str-two-way.h: No such file or directory.
in str-two-way.h
*__GI_strstr (haystack_start=0x0, needle_start=0xb7fc7824 "usbmon") at
strstr.c:84
84 strstr.c: No such file or directory.
in strstr.c
pcap_create (device=0x804d074 "eth0", ebuf=0x804d160 "") at ./pcap-linux.c:330
330 ./pcap-linux.c: No such file or directory.
in ./pcap-linux.c
pcap_create_common (source=0x804d074 "eth0", ebuf=0x804d160 "") at ./pcap.c:104
104 ./pcap.c: No such file or directory.
in ./pcap.c
*__GI___libc_malloc (bytes=532) at malloc.c:3598
3598 malloc.c: No such file or directory.
in malloc.c
3599 in malloc.c
3602 in malloc.c
3635 in malloc.c
3638 in malloc.c
_int_malloc (av=0xb7fa93a0, bytes=532) at malloc.c:4253
4253 in malloc.c
4225 in malloc.c
4253 in malloc.c
4261 in malloc.c
4253 in malloc.c
4261 in malloc.c
4300 in malloc.c
4336 in malloc.c
4337 in malloc.c
4338 in malloc.c
malloc_consolidate (av=0xb7fa93a0) at malloc.c:5027
5027 in malloc.c
5049 in malloc.c
5050 in malloc.c
5052 in malloc.c
5071 in malloc.c
5052 in malloc.c
5069 in malloc.c
5071 in malloc.c
5069 in malloc.c
5095 in malloc.c
5071 in malloc.c
5095 in malloc.c
5076 in malloc.c
5078 in malloc.c
5131 in malloc.c
5076 in malloc.c
5078 in malloc.c
5131 in malloc.c
5076 in malloc.c
5078 in malloc.c
5131 in malloc.c
5076 in malloc.c
5078 in malloc.c
5080 in malloc.c
5084 in malloc.c
5087 in malloc.c
5091 in malloc.c
5088 in malloc.c
5089 in malloc.c
5091 in malloc.c
5089 in malloc.c
5098 in malloc.c
5089 in malloc.c
5098 in malloc.c
5099 in malloc.c
5105 in malloc.c
5107 in malloc.c
5111 in malloc.c
5107 in malloc.c
5108 in malloc.c
5109 in malloc.c
5111 in malloc.c
5116 in malloc.c
5117 in malloc.c
5118 in malloc.c
5119 in malloc.c
5117 in malloc.c
5125 in malloc.c
5128 in malloc.c
5131 in malloc.c
5076 in malloc.c
5078 in malloc.c
5080 in malloc.c
5084 in malloc.c
5087 in malloc.c
5091 in malloc.c
5088 in malloc.c
5089 in malloc.c
5091 in malloc.c
5092 in malloc.c
5094 in malloc.c
5093 in malloc.c
5095 in malloc.c
Program received signal SIGSEGV, Segmentation fault.
malloc_consolidate (av=<value optimized out>) at malloc.c:5095
5095 in malloc.c
Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
The program is not being run.
The program is not being run.
The program is not being run.
The program is not being run.
The program is not being run.
The program is not being run.
The program is not being run.
The program is not being run.
The program is not being run.
quit
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
