Comments (9)
Hi,
it doesn't seems to be an error in your script. Could you run it with --debug
flag and check which packet is segfaulting haka ?
Each packet is identified with a number (which is the same in pcap and haka).
Then, could you provide us the extracted http flow from your pcap ?
from haka.
So, here is what i've done.
root@System-U14LTS:~/work# tail -20 serdbg.out
debug packet: dropping packet id=4393214
debug packet: received packet id=4393215
debug states: http: leave transition on state 'request'
debug states: http: finish from state 'request'
debug states: http: finish transition on state 'request'
alert: id = 3721718
time = Mon Feb 8 14:45:45 2016
severity = low
description = no connection found for tcp packet
sources = {
address: 172.24.143.231
service: tcp/5672
}
targets = {
address: 10.10.30.49
service: tcp/33752
}
debug packet: dropping packet id=4393215
debug packet: received packet id=4393216 <<<< Here we get the segmentation fault
I extract frame number 4393216 with tshark:
4393216 66.934873 10.10.192.240 -> 10.17.8.15 DNS 81 Standard query 0xd132
So it's a DNS query, not a HTTP packet. I think there is no need to attach the UDP flow, since it's nothing unussual.
I have extracted the flow and applied the script on it without receiving the segmentation fault.
The problem seems more related to the size of the capture...
from haka.
Thanks, I'll try to reproduce with some big pcap files we have here.
If you can provide us the pcap file it would be of a great help.
from haka.
Unfortunately, due to security enforcement, I cannot provide the pcap. However, I think a big pcap with my script will reproduce the issue. If you don't manage to reproduce, let me know and I'll try to do it with another pcap(which i will be able to provide)
from haka.
We have reproduced a similar stack trace. We are investigating...
from haka.
Could you try with a debug build of haka so we can confirm we are working on the same issue ?
cmake -DBUILD=Debug <path-to-haka-source>
make localinstall
source out/env.sh
hakapcap
from haka.
Could you try with a fresh build of develop branch as baef121 fixes a bug with double free on http over reseted tcp stream.
from haka.
I've tried with your latest commit and it worked. It seems that's the root cause. I'll be testing with other pcap files so we can be sure.
Thanks
from haka.
Great !
By the way, you could speed up your script by compiling your regular expression outside the haka rule:
local rem = require("regexp/pcre")
local tcp_connection = require('protocol/tcp_connection')
local http = require('protocol/http')
http.install_tcp_rule(80)
http.install_tcp_rule(8080)
local re1 = rem.re:compile('^.*%.[^%%]+$', rem.re.CASE_INSENSITIVE)
local re2 = rem.re:compile("([^%/.]+)$|([^%/]+)(%.[^%/.]+)$", rem.re.CASE_INSENSITIVE)
haka.rule {
hook = http.events.receive_data,
options = {
streamed = true,
},
eval = function (http, iter, dir)
if http.request ~= nil then
local split_uri = http.request.split_uri:normalize()
if re1:match(http.request.uri) then
local res, startpos, endpos = re2:match(split_uri.path)
filename = string.sub(split_uri.path,startpos+1,endpos)
local file = io.open("/root/work/download/" .. filename, "w")
for sub in iter:foreach_available() do
file:write(sub:asstring())
end
file:close()
end
end
end
}
I'll close the issue, feel free to reopen if you encounter the segfault again.
from haka.
Related Issues (20)
- Minor CMake warning HOT 1
- reserved identifier violation HOT 5
- Complete quoting for parameters of some CMake commands HOT 1
- Changing timestamps in PCAP files HOT 1
- error tcp: invalid tcp establishement handshake HOT 7
- Build issue on Centos 6 HOT 4
- Build issue on Fedora 22 HOT 3
- Build failing: lua/hakaLUA_wrap.c (-Werror) HOT 4
- Building doc fails: No such file or directory (external/breathe/testsuite/source/domains) HOT 3
- build on i686 broken (old patch from closed bugreport still not merged upstream) HOT 2
- OSX port wanted
- tcpLUA_wrap.c:3724: _wrap_tcp_stream_clear: Assertion `!0x1 || usr->own == 1' failed HOT 2
- exemple helloword fail HOT 1
- i create filter is not work HOT 1
- i load Hakabana.json in to hakabana but is not show graph。please help me find why?
- build failing with latest gcc (user_readline.c:49:31: error: assignment from incompatible pointer type) HOT 1
- `readdir_r` is deprecated in glibc 2.24, causes haka to no longer compile HOT 1
- Example: gettingstarted fails on default install HOT 1
- Still active?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from haka.