Hello,<br><br>As I have loads and loads of HTTP (and smtp) parsing errors on my Suricata instance I wanted to analyze why they occur and try debugging/solving the issue myself. However I'm having a weird behavior with Suricata once I enable --enable-debug.<br>
<br>I compiled Suricata from the git master repo. <br><br>I load a PCAP file that throws HTTP parsing errors and get the following output.<br>I get the same output I run this Suricata in gdb. <br>Pcap file contains a single tcp session in 82kB<br>
<br><span style="font-family:courier new,monospace">[6659] 14/12/2011 -- 11:18:10 - (source-pcap-file.c:212) <Info> (ReceivePcapFileThreadInit) -- reading pcap file ../proxytraff-error-parsing.pcap</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">[2059] 14/12/2011 -- 11:18:10 - (tm-threads.c:1810) <Info> (TmThreadWaitOnThreadInit) -- all 5 packet processing threads, 3 management threads initialized, engine started.</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">[6659] 14/12/2011 -- 11:18:10 - (app-layer-htp.c:550) <Error> (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error in parsing HTTP server response: [1] [htp_response.c] [677] Unable to match response to request</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">[6659] 14/12/2011 -- 11:18:10 - (app-layer-parser.c:977) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 10.80.96.37, destination IP address 10.7.108.10, src port 63272 and dst port 8080</span><br>
<span style="font-family:courier new,monospace">[6659] 14/12/2011 -- 11:18:10 - (source-pcap-file.c:189) <Info> (ReceivePcapFileLoop) -- pcap file end of file reached (pcap err code 0)</span><br><br><br>When I compile ./configure --enable-debug , and load exactly the same PCAP I get the following output:<br>
(also the same with ./configure --enable-debug --enable-debug-validation )<br><br><span style="font-family:courier new,monospace">[6659] 14/12/2011 -- 11:24:37 - (source-pcap-file.c:212) <Info> (ReceivePcapFileThreadInit) -- reading pcap file ../proxytraff-error-parsing.pcap</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">[2059] 14/12/2011 -- 11:24:37 - (tm-threads.c:1810) <Info> (TmThreadWaitOnThreadInit) -- all 5 packet processing threads, 3 management threads initialized, engine started.</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">Bus error: 10 (core dumped)</span><br><br><br>Running that DEBUG enabled Suricata in gdb I get (After a first breakpoint I 'continue'd )<br><span style="font-family:courier new,monospace">[3091] 14/12/2011 -- 11:39:33 - (tm-threads.c:1810) <Info> (TmThreadWaitOnThreadInit) -- all 5 packet processing threads, 3 management threads initialized, engine started.</span><br style="font-family:courier new,monospace">
<br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">Program received signal EXC_BAD_ACCESS, Could not access memory.</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">Reason: KERN_PROTECTION_FAILURE at address: 0x00000001029920f8</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">[Switching to process 93462 thread 0x1a03]</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">0x00000001001b5205 in ?? ()</span><br style="font-family:courier new,monospace">
<br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">(gdb) bt</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#0 0x00000001001b5205 in ?? ()</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">#1 0x00000001001acfb7 in ?? ()</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#2 0x00000001001a5336 in ?? ()</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">#3 0x000000010018911a in ?? ()</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#4 0x00000001001906c9 in ?? ()</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">#5 0x000000010016ddd7 in ?? ()</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#6 0x000000010017b9ce in ?? ()</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">#7 0x00000001001667c0 in ?? ()</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#8 0x000000010014fe72 in ?? ()</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">#9 0x00000001000140f3 in ?? ()</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#10 0x000000010034872c in pcap_offline_read ()</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">#11 0x0000000100013814 in ?? ()</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#12 0x000000010014e92b in ?? ()</span><br style="font-family:courier new,monospace">
<span style="font-family:courier new,monospace">#13 0x00007fff883548bf in _pthread_start ()</span><br style="font-family:courier new,monospace"><span style="font-family:courier new,monospace">#14 0x00007fff88357b75 in thread_start ()</span><br>
<br>It's weird that I don't get resolved functions in the backtrace, no? <br>Any advice what I should do next?<br><br>Thanks<br>Christophe<br>