[Oisf-users] "suricata: double free or corruption" when I use bpf filter

[carlopmart]

On 11/09/2011 04:59 PM, Victor Julien wrote:
> On 11/09/2011 04:55 PM, carlopmart wrote:
>>    Am I doing something wrong or is a bug??
>>
>>    Suricata version: 1.1rc1
>>    Host OS: Ubuntu LTS 10.04.3
>
> Nope, looks like a bug. Checking it out, thanks!
>

FYI, If I do via command line:

suricata -c /data/config/etc/suricata/suricata.yaml -i eth8 'tcp port 80'

[1433] 9/11/2011 -- 16:00:17 - (suricata.c:651) <Info> (main) -- This is 
Suricata version 1.1rc1
[1433] 9/11/2011 -- 16:00:17 - (util-cpu.c:171) <Info> 
(UtilCpuPrintSummary) -- CPUs/cores online: 1
[1433] 9/11/2011 -- 16:00:17 - (util-ioctl.c:91) <Info> (GetIfaceMTU) -- 
Found an MTU of 1500 for 'eth8'
[1433] 9/11/2011 -- 16:00:17 - (detect-pcre.c:128) <Info> 
(DetectPcreRegister) -- Using PCRE match-limit setting of: 3500
[1433] 9/11/2011 -- 16:00:17 - (detect-pcre.c:138) <Info> 
(DetectPcreRegister) -- Using PCRE match-limit-recursion setting of: 1500
[1433] 9/11/2011 -- 16:00:17 - (suricata.c:1429) <Info> (main) -- 
preallocated 50 packets. Total memory 157000
[1433] 9/11/2011 -- 16:00:17 - (flow.c:840) <Info> (FlowInitConfig) -- 
initializing flow engine...
[1433] 9/11/2011 -- 16:00:17 - (flow.c:932) <Info> (FlowInitConfig) -- 
allocated 524288 bytes of memory for the flow hash... 65536 buckets of 
size 8
[1433] 9/11/2011 -- 16:00:17 - (flow.c:952) <Info> (FlowInitConfig) -- 
preallocated 10000 flows of size 176
[1433] 9/11/2011 -- 16:00:17 - (flow.c:954) <Info> (FlowInitConfig) -- 
flow memory usage: 2284288 bytes, maximum: 33554432
[1433] 9/11/2011 -- 16:00:17 - (detect.c:626) <Info> (SigLoadSignatures) 
-- No signatures supplied.
[1433] 9/11/2011 -- 16:00:17 - (util-threshold-config.c:135) <Warning> 
(SCThresholdConfInitContext) -- [ERRCODE: SC_ERR_FOPEN(44)] - Error 
opening file: "threshold.config": No such file or directory
[1433] 9/11/2011 -- 16:00:17 - (alert-fastlog.c:366) <Info> 
(AlertFastLogInitCtx) -- Fast log output initialized, filename: 
idpesx02.alerts
[1433] 9/11/2011 -- 16:00:17 - (alert-unified2-alert.c:1150) <Info> 
(Unified2AlertInitCtx) -- Unified2-alert initialized: filename 
suricata.out, limit 128 MB
[1433] 9/11/2011 -- 16:00:17 - (log-httplog.c:448) <Info> 
(LogHttpLogInitCtx) -- HTTP log output initialized, filename: http.log
[1433] 9/11/2011 -- 16:00:17 - (log-pcap.c:485) <Info> (PcapLogInitCtx) 
-- Using log dir /nsm/sguil_sensor/idpesx02/dailylogs
[1433] 9/11/2011 -- 16:00:17 - (log-pcap.c:490) <Info> (PcapLogInitCtx) 
-- using Sguil compatible logging
[1433] 9/11/2011 -- 16:00:17 - (log-droplog.c:176) <Info> 
(LogDropLogInitCtx) -- Drop log output initialized, filename: drop.log
[1433] 9/11/2011 -- 16:00:17 - (runmode-pcap.c:144) <Info> 
(ParsePcapConfig) -- BPF filter set from command line or via old 
'bpf-filter' option.
[1433] 9/11/2011 -- 16:00:17 - (runmode-pcap.c:227) <Info> 
(RunModeIdsPcapAuto) -- RunModeIdsPcapAuto initialised
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:346) <Info> 
(StreamTcpInitConfig) -- stream "max_sessions": 262144
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:358) <Info> 
(StreamTcpInitConfig) -- stream "prealloc_sessions": 32768
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:368) <Info> 
(StreamTcpInitConfig) -- stream "memcap": 33554432
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:374) <Info> 
(StreamTcpInitConfig) -- stream "midstream" session pickups: disabled
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:380) <Info> 
(StreamTcpInitConfig) -- stream "async_oneside": disabled
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:397) <Info> 
(StreamTcpInitConfig) -- stream "checksum_validation": enabled
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:407) <Info> 
(StreamTcpInitConfig) -- stream."inline": enabled
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:416) <Info> 
(StreamTcpInitConfig) -- stream.reassembly "memcap": 67108864
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:426) <Info> 
(StreamTcpInitConfig) -- stream.reassembly "depth": 1048576
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:449) <Info> 
(StreamTcpInitConfig) -- stream.reassembly "toserver_chunk_size": 2560
[1433] 9/11/2011 -- 16:00:17 - (stream-tcp.c:451) <Info> 
(StreamTcpInitConfig) -- stream.reassembly "toclient_chunk_size": 2560
[1434] 9/11/2011 -- 16:00:17 - (source-pcap.c:318) <Info> 
(ReceivePcapThreadInit) -- using interface eth8
[1434] 9/11/2011 -- 16:00:17 - (source-pcap.c:359) <Info> 
(ReceivePcapThreadInit) -- Going to use pcap buffer size of 0
[1433] 9/11/2011 -- 16:00:17 - (tm-threads.c:1802) <Info> 
(TmThreadWaitOnThreadInit) -- all 5 packet processing threads, 3 
management threads initialized, engine started.

  .. works ok.

Thanks.

-- 
CL Martinez
carlopmart {at} gmail {d0t} com