Re: [Snort-inline-users] Freebsd and IPFW and IP header checksums

[Will M. <wil...@gm...>]

I'll update CVS later today.  Resets are always sent to the source of
the attack.

Regards,

Will


On Sun, 16 Jan 2005 21:32:54 -0700 (MST), Nick Rogness <ni...@ro...> wrote:
> On Thu, 30 Dec 2004, Christopher Black wrote:
> 
> > Well, I've included patches I've generated so far.  The snort.h patch is
> > required to compile, decode.c is required for it to not drop every
> > packet, and inline.c adds a (commented out) ugly fix for the segfault,
> > and two debug statements demonstrating the problem.  All patches were
> > created outside the top-level snort_inline-2.2.0a directory.
> >
> > A rule triggering a "reject" will segfault the program.  I have traced
> > it to inline.c, roughly line 398 (400 after my patch).  Printing the
> > value once returns the same value as printing it anywhere prior in the
> > execution chain.  Printing it again returns 0 and a segfault.  My C
> > skills aren't up to par I guess, because I'm stumped here.
> >
> > [root@mobilebeast1 blackchr]# gdb /usr/local/bin/snort_inline
> > snort_inline.core
> > GNU gdb 6.1.1 [FreeBSD]
> > Copyright 2004 Free Software Foundation, Inc.
> > GDB is free software, covered by the GNU General Public License, and you
> > are
> > welcome to change it and/or distribute copies of it under certain
> > conditions.
> > Type "show copying" to see the conditions.
> > There is absolutely no warranty for GDB.  Type "show warranty" for
> > details.
> > This GDB was configured as "i386-marcel-freebsd"...
> > Core was generated by `snort_inline'.
> > Program terminated with signal 11, Segmentation fault.
> > Reading symbols from /usr/local/lib/libpcre.so.0...done.
> > Loaded symbols for /usr/local/lib/libpcre.so.0
> > Reading symbols from /usr/lib/libpcap.so.3...done.
> > Loaded symbols for /usr/lib/libpcap.so.3
> > Reading symbols from /lib/libm.so.3...done.
> > Loaded symbols for /lib/libm.so.3
> > Reading symbols from /lib/libc.so.5...done.
> > Loaded symbols for /lib/libc.so.5
> > Reading symbols from /libexec/ld-elf.so.1...done.
> > Loaded symbols for /libexec/ld-elf.so.1
> > #0  0x0806224d in HandlePacket () at inline.c:400
> > 400         iph->ip_src.s_addr = tmpP->iph->ip_dst.s_addr;
> > (gdb)
> >
> > Is there any more info I can provide?
> >
> 
>        I found the bug in the code.  Is there a cvs tree I can checkout
>        so I can send diffs against your current snapshot?
> 
>        Also, has anyone checked to see if the TCP reset (RejectSocket)
>        code actually sends TCP resets?  Which direction and to whom are
>        they suppose to be sent?
> 
> 
> Nick Rogness <ni...@ro...>
> -
>   How many people here have telekenetic powers? Raise my hand.
>                                -Emo Philips
> 
> -------------------------------------------------------
> The SF.Net email is sponsored by: Beat the post-holiday blues
> Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
> It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
> _______________________________________________
> Snort-inline-users mailing list
> Sno...@li...
> https://lists.sourceforge.net/lists/listinfo/snort-inline-users
>