|
|
|
Compile line
|
|
|
|
git clone https://github.com/oisf/suricata.git && cd suricata && \
|
|
git clone https://github.com/OISF/libhtp.git -b 0.5.x && \
|
|
./autogen.sh && \
|
|
CC=clang CFLAGS="-ggdb3 -O0 -Wchar-subscripts -Wshadow -Wall \
|
|
-Wextra -Wno-unused-parameter -Wno-unused-function \
|
|
-fno-strict-aliasing -fstack-protector-all -fsanitize=address \
|
|
-fno-omit-frame-pointer -Wno-unused-parameter -Wno-unused-function" \
|
|
ac_cv_func_malloc_0_nonnull=yes ac_cv_func_realloc_0_nonnull=yes \
|
|
./configure \
|
|
--prefix=/opt/suritest-tmp/ --sysconfdir=/opt/suritest-tmp/etc \
|
|
--localstatedir=/opt/suritest-tmp/var \
|
|
--enable-geoip --enable-rust-strict \
|
|
--enable-luajit --enable-ebpf \
|
|
--enable-ebpf-build && \
|
|
make clean && make -j && \
|
|
make install
|
|
|
|
|
|
|
|
|
|
On exit:
|
|
|
|
[35099] 1/11/2020 -- 13:32:48 - (counters.c:854) <Info> (StatsLogSummary) -- Alerts: 699211
|
|
[35099] 1/11/2020 -- 13:32:51 - (ippair.c:294) <Perf> (IPPairPrintStats) -- ippair memory usage: 414144 bytes, maximum: 16777216
|
|
[35099] 1/11/2020 -- 13:33:04 - (host.c:299) <Perf> (HostPrintStats) -- host memory usage: 527480 bytes, maximum: 33554432
|
|
[35099] 1/11/2020 -- 13:33:05 - (detect-engine-build.c:1722) <Info> (SigAddressCleanupStage1) -- cleaning up signature grouping structure... complete
|
|
=================================================================
|
|
==35099==ERROR: AddressSanitizer: dynamic-stack-buffer-overflow on address 0x7ffdd16db6a8 at pc 0x000000bd06a1 bp 0x7ffdd16db420 sp 0x7ffdd16db418
|
|
WRITE of size 1 at 0x7ffdd16db6a8 thread T0 (Suricata-Main)
|
|
#0 0xbd06a0 in Base64Encode /opt/suricata/src/util-crypt.c:307:7
|
|
#1 0x6df8ab in StringAsBase64 /opt/suricata/src/datasets-string.c:52:9
|
|
#2 0xced600 in THashWalk /opt/suricata/src/util-thash.c:394:24
|
|
#3 0x6d91bd in DatasetsSave /opt/suricata/src/datasets.c:809:17
|
|
#4 0xb8e55b in GlobalsDestroy /opt/suricata/src/suricata.c:340:5
|
|
#5 0xb84acc in SuricataMain /opt/suricata/src/suricata.c:2832:5
|
|
#6 0x5b869e in main /opt/suricata/src/main.c:22:12
|
|
#7 0x7f257260909a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
|
|
#8 0x4e1679 in _start (/opt/suritest-tmp/bin/suricata+0x4e1679)
|
|
|
|
Address 0x7ffdd16db6a8 is located in stack of thread T0 (Suricata-Main)
|
|
SUMMARY: AddressSanitizer: dynamic-stack-buffer-overflow /opt/suricata/src/util-crypt.c:307:7 in Base64Encode
|
|
Shadow bytes around the buggy address:
|
|
0x10003a2d3680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
0x10003a2d3690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
0x10003a2d36a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
0x10003a2d36b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
0x10003a2d36c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
=>0x10003a2d36d0: ca ca ca ca 00[cb]cb cb cb cb cb cb f1 f1 f1 f1
|
|
0x10003a2d36e0: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
|
|
0x10003a2d36f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
0x10003a2d3700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
0x10003a2d3710: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 00
|
|
0x10003a2d3720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|
|
Shadow byte legend (one shadow byte represents 8 application bytes):
|
|
Addressable: 00
|
|
Partially addressable: 01 02 03 04 05 06 07
|
|
Heap left redzone: fa
|
|
Freed heap region: fd
|
|
Stack left redzone: f1
|
|
Stack mid redzone: f2
|
|
Stack right redzone: f3
|
|
Stack after return: f5
|
|
Stack use after scope: f8
|
|
Global redzone: f9
|
|
Global init order: f6
|
|
Poisoned by user: f7
|
|
Container overflow: fc
|
|
Array cookie: ac
|
|
Intra object redzone: bb
|
|
ASan internal: fe
|
|
Left alloca redzone: ca
|
|
Right alloca redzone: cb
|
|
Shadow gap: cc
|
|
==35099==ABORTING
|
|
|
|
/opt/suritest-tmp/bin/suricata --build-info
|
|
This is Suricata version 6.0.1-dev (95729e923 2020-10-09)
|
|
Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST
|
|
SIMD support: SSE_4_2 SSE_4_1 SSE_3
|
|
Atomic intrinsics: 1 2 4 8 16 byte(s)
|
|
64-bits, Little-endian architecture
|
|
GCC version 4.2.1 Compatible Clang 7.0.1 (tags/RELEASE_701/final), C version 201112
|
|
compiled with _FORTIFY_SOURCE=0
|
|
L1 cache line size (CLS)=64
|
|
thread local storage method: _Thread_local
|
|
compiled with LibHTP v0.5.35, linked against LibHTP v0.5.35
|
|
|
|
Suricata Configuration:
|
|
AF_PACKET support: yes
|
|
eBPF support: yes
|
|
XDP support: yes
|
|
PF_RING support: no
|
|
NFQueue support: no
|
|
NFLOG support: no
|
|
IPFW support: no
|
|
Netmap support: no
|
|
DAG enabled: no
|
|
Napatech enabled: no
|
|
WinDivert enabled: no
|
|
|
|
Unix socket enabled: yes
|
|
Detection enabled: yes
|
|
|
|
Libmagic support: yes
|
|
libnss support: yes
|
|
libnspr support: yes
|
|
libjansson support: yes
|
|
hiredis support: no
|
|
hiredis async with libevent: no
|
|
Prelude support: no
|
|
PCRE jit: yes
|
|
LUA support: yes, through luajit
|
|
libluajit: yes
|
|
GeoIP2 support: yes
|
|
Non-bundled htp: no
|
|
Hyperscan support: yes
|
|
Libnet support: yes
|
|
liblz4 support: yes
|
|
|
|
Rust support: yes
|
|
Rust strict mode: yes
|
|
Rust compiler path: /root/.cargo/bin/rustc
|
|
Rust compiler version: rustc 1.47.0 (18bf6b4f0 2020-10-07)
|
|
Cargo path: /root/.cargo/bin/cargo
|
|
Cargo version: cargo 1.47.0 (f3c7e066a 2020-08-28)
|
|
Cargo vendor: yes
|
|
|
|
Python support: yes
|
|
Python path: /usr/bin/python3
|
|
Python distutils yes
|
|
Python yaml yes
|
|
Install suricatactl: yes
|
|
Install suricatasc: yes
|
|
Install suricata-update: not bundled
|
|
|
|
Profiling enabled: no
|
|
Profiling locks enabled: no
|
|
|
|
Plugin support (experimental): yes
|
|
|
|
Development settings:
|
|
Coccinelle / spatch: no
|
|
Unit tests enabled: no
|
|
Debug output enabled: no
|
|
Debug validation enabled: no
|
|
|
|
Generic build parameters:
|
|
Installation prefix: /opt/suritest-tmp
|
|
Configuration directory: /opt/suritest-tmp/etc/suricata/
|
|
Log directory: /opt/suritest-tmp/var/log/suricata/
|
|
|
|
--prefix /opt/suritest-tmp
|
|
--sysconfdir /opt/suritest-tmp/etc
|
|
--localstatedir /opt/suritest-tmp/var
|
|
--datarootdir /opt/suritest-tmp/share
|
|
|
|
Host: x86_64-pc-linux-gnu
|
|
Compiler: clang (exec name) / g++ (real)
|
|
GCC Protect enabled: no
|
|
GCC march native enabled: yes
|
|
GCC Profile enabled: no
|
|
Position Independent Executable enabled: no
|
|
CFLAGS -ggdb3 -O0 -Wchar-subscripts -Wshadow -Wall -Wextra -Wno-unused-parameter -Wno-unused-function -fno-strict-aliasing -fstack-protector-all -fsanitize=address -fno-omit-frame-pointer -Wno-unused-parameter -Wno-unused-function -std=c11 -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist
|
|
PCAP_CFLAGS -I/usr/include
|
|
SECCFLAGS
|
|
|
|
|
|
|