On 2017/10/16 11:54, kasak wrote:
>
> > 13 окт. 2017 г., в 18:39, Stuart Henderson <[email protected]>
> > написал(а):
> >
> > On 2017/10/13 13:49, Stuart Henderson wrote:
> >> Thanks. So looking at this and the source code, it shows it is using
> >> strchr()
> >> to look for the position of a space character in the payload data. But the
> >> str*
> >> functions expect a NUL-terminated string, and the string here is not, so
> >> strchr
> >> searches beyond the end of the payload, looking for either a NUL or a
> >> space.
> >>
> >> This code hasn't changed in 3.0, so the problem will still exist there.
> >>
> >> I have created an issue upstream:
> >> https://github.com/ntop/ntopng/issues/1518
> >>
> >
> > Upstream have committed a fix to their repository, which I have
> > applied to the ports tree.
> >
> > If you don't have the ports tree on your system already, follow "Getting
> > the ports and xenocara trees" on https://www.openbsd.org/anoncvs.html
> > (I have committed it to the -current and 6.2-stable branches).
> >
> > Before building, "pkg_add libtool autoconf%2.69 automake%1.15 gmake"
> > to save time building dependencies, then "cd /usr/ports/net/ntopng &&
> > make package && doas make update".
> >
> > Alternatively if you use -current snapshots it will show up in the
> > binary packages in a few days.
> >
>
> Hello again! I just built port and start testing it again,
> This time it crashed with this:
>
> Program received signal SIGSEGV, Segmentation fault.
> [Switching to thread 118222]
> 0x000006de1f6a6397 in ndpi_search_bgp () from /usr/local/bin/ntopng
> Current language: auto; currently minimal
>
> Here is bt full:
>
> #0 0x000006de1f6a6397 in ndpi_search_bgp () from /usr/local/bin/ntopng
> No symbol table info available.
> #1 0x000006de1f6a210b in check_ndpi_tcp_flow_func ()
> from /usr/local/bin/ntopng
> No symbol table info available.
Are you able to rebuild the port with debug symbols?
make clean=all
make DEBUG=-g repackage reinstall
Hopefully there will be some more information in the backtrace next time
it crashes. With a bit of luck, line numbers and more information about
variables.
If you get the same crash, do 'p packet' as well as the 'bt full'.
> #2 0x000006de1f6a2f68 in ndpi_detection_process_packet ()
> from /usr/local/bin/ntopng
> No symbol table info available.
> #3 0x000006de1f64c50e in NetworkInterface::processPacket (
> this=0x6e0d1b8a1d0, when=0x6e1011b07e8, time=1508133385021,
> eth=0x6e0b51f0fbe, vlan_id=0, iph=0x6e0b51f0fcc, ip6=0x0, ipsize=46,
> rawsize=60, h=0x6e1011b07e8, packet=0x6e0b51f0fbe "",
> shaped=0x6e04d0b714d, ndpiProtocol=0x6e04d0b714e)
> at src/NetworkInterface.cpp:897
> ndpi_flow = (ndpi_flow_struct *) 0x6e0bf67d800
> cli = (struct ndpi_id_struct *) 0x6e09236df00
> srv = (struct ndpi_id_struct *) 0x6e107270c00
> src2dst_direction = true
> l4_proto = 6 '\006'
> flow = (class Flow *) 0x6e09f185c00
> eth_src = (u_int8_t *) 0x6e0b51f0fc4 "T\004??\033?\b"
> eth_dst = (u_int8_t *) 0x6e0b51f0fbe ""
> src_ip = {addr = {ipVersion = 4 '\004', localHost = 0 '\0',
> privateIP = 1 '\001', multicastIP = 0 '\0', broadcastIP = 0 '\0',
> notUsed = 0 '\0', ipType = {ipv6 = {u6_addr = {
> u6_addr8 = 0x6e04d0b6d0c "??\003?", u6_addr16 = 0x6e04d0b6d0c,
> u6_addr32 = 0x6e04d0b6d0c}}, ipv4 = 3523455168}},
> ip_key = 3232236498}
> dst_ip = {addr = {ipVersion = 4 '\004', localHost = 0 '\0',
> privateIP = 0 '\0', multicastIP = 0 '\0', broadcastIP = 0 '\0',
> notUsed = 0 '\0', ipType = {ipv6 = {u6_addr = {
> u6_addr8 = 0x6e04d0b6cf4 "??p\v", u6_addr16 = 0x6e04d0b6cf4,
> u6_addr32 = 0x6e04d0b6cf4}}, ipv4 = 191949268}},
> ip_key = 3572068363}
> src_port = 24282
> dst_port = 36608
> payload_len = 6
> tcph = (ndpi_tcphdr *) 0x6e0b51f0fe0
> udph = (ndpi_udphdr *) 0x0
> l4_packet_len = 26
> l4 = (u_int8_t *) 0x6e0b51f0fe0 "?^"
> tcp_flags = 24 '\030'
> payload = (u_int8_t *) 0x6e0b51f0ff4 "DONE\r\n"
> ip = (u_int8_t *) 0x6e0b51f0fcc "E"
> is_fragment = false
> new_flow = true
> pass_verdict = true
> a_shaper_id = 0
> b_shaper_id = 0
> #4 0x000006de1f64e81d in NetworkInterface::dissectPacket (
> this=0x6e0d1b8a1d0, h=0x6e1011b07e8, packet=0x6e0b51f0fbe "",
> shaped=0x6e04d0b714d, ndpiProtocol=0x6e04d0b714e)
> at src/NetworkInterface.cpp:1403
> frag_off = 16384
> iph = (ndpi_iphdr *) 0x6e0b51f0fcc
> ip6 = (ndpi_ipv6hdr *) 0x0
> ba = (class std::bad_alloc &) @0x6e049dfaa20: {<std::exception> = {
> _vptr$exception = 0x6e085c1eec0}, <No data fields>}
> srcHost = (class Host *) 0x6e1094ca000
> dstHost = (class Host *) 0x6e078b60000
> lasttime = 1508133385021
> oom_warning_sent = false
> oom_warning_sent = false
> ethernet = (ndpi_ethhdr *) 0x6e0b51f0fbe
> dummy_ethernet = {h_dest = 0x6e04d0b7050 "\200p\vM?\006",
> h_source = 0x6e04d0b7056 "", h_proto = 1760}
> ---Type <return> to continue, or q <return> to quit---
> time = 1508133385021
> eth_type = 2048
> ip_offset = 14
> vlan_id = 0
> eth_offset = 0
> null_type = 2515945984
> pcap_datalink_type = 1
> pass_verdict = true
> #5 0x000006de1f602e3b in _ZL14packetPollLoopPv (ptr=0x6e0d1b8a1d0)
> at src/PcapInterface.cpp:187
> p = 37
> shaped = false
> pkt = (const u_char *) 0x6e0b51f0fbe ""
> hdr = (pcap_pkthdr *) 0x6e1011b07e8
> rc = 1
> iface = (PcapInterface *) 0x6e0d1b8a1d0
> pd = (pcap_t *) 0x6e1011b0600
> pcap_list = (FILE *) 0x0
> #6 0x000006e042a33cae in _rthread_start (v=Variable "v" is not available.
> )
> at /usr/src/lib/librthread/rthread.c:96
> retval = (void *) 0x6e0b51f0ff4
> #7 0x000006e07a1bce0b in __tfork_thread ()
> at /usr/src/lib/libc/arch/amd64/sys/tfork_thread.S:75
> No locals.
> #8 0x0000000000000000 in ?? ()
> No symbol table info available.
