Open Information Security Foundation: Issueshttps://redmine.openinfosecfoundation.org/https://redmine.openinfosecfoundation.org/favicon.ico?17011170022020-08-17T13:25:40ZOpen Information Security Foundation
Redmine Suricata - Bug #3883 (Closed): Runmode Single Memory Leakhttps://redmine.openinfosecfoundation.org/issues/38832020-08-17T13:25:40ZJoshua Lumbjoshua.lumb@gmail.com
148857ERROR: LeakSanitizer: detected memory leaks
<p>Direct leak of 176 byte(s) in 1 object(s) allocated from:#0 0x7f2d59623dc6 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10ddc6)#1 0x561af4dcf19b in SCCallocFunc /home/user/suricata/src/util-mem.c:57#2 0x561af4c63df7 in ParseAFPConfig /home/user/suricata/src/runmode-af-packet.c:131#3 0x561af4e13479 in RunModeSetLiveCaptureSingle /home/user/suricata/src/util-runmodes.c:382#4 0x561af4c683f8 in RunModeIdsAFPSingle /home/user/suricata/src/runmode-af-packet.c:860#5 0x561af4c75f56 in RunModeDispatch /home/user/suricata/src/runmodes.c:374#6 0x561af4d6179d in SuricataMain /home/user/suricata/src/suricata.c:2780#7 0x561af489f72c in main /home/user/suricata/src/main.c:22#8 0x7f2d58e700b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)</p>
<p>SUMMARY: AddressSanitizer: 176 byte(s) leaked in 1 allocation(s).</p>
<p>An explanation:</p>
<p>During startup suricata parses config settings for af-packet threads in the function ParseAFPConfig and stores those settings in a memory-allocated AFPIfaceConfig struct. For efficiency this is only done once - but since the thread initialization function will need the AFPIfaceConfig once for each receiving thread the AFPIfaceConfig tracks the number of threads which will need to refer to it in AFPIfaceConfig->ref.</p>
<p>AFPIfaceConfig->ref is set based on the config file’s specified number of threads, which itself is usually determined here:</p>
<p>if (StringParseInt32(&aconf->threads, 10, 0, (const char *)threadsstr) < 0)</p>
<p>Which eventually ends up setting aconf->ref here:</p>
<p>SC_ATOMIC_RESET(aconf->ref);<br />(void) SC_ATOMIC_ADD(aconf->ref, aconf->threads);</p>
<p>If all is going well AFPIfaceConfig aconf is freed by the thread initialization function ReceiveAFPThreadInit's sub-function AFPDerefConfig using the following mechanism:</p>
<p>if (SC_ATOMIC_SUB(pfp->ref, 1) == 1) {<br />SCFree(pfp);</p>
<p>This means that as each thread finishes initialization it will decrement the counter until the last thread finally decrements it to 0, at which time AFPIfaceConfig aconf is freed.</p>
<p>The problem comes into play with --runmode single which overrides the number of threads to be created. There is no consideration for this currently in the assignment of aconf->ref so you can end up with only one thread calling AFPDerefConfig with aconf->ref > 1, meaning it is never freed.</p> Suricata - Bug #3282 (Closed): --list-app-layer-protos only uses default suricata.yaml location.https://redmine.openinfosecfoundation.org/issues/32822019-10-28T12:58:56ZJason Ishjason.ish@oisf.net
<p>--list-app-layer-protos depends on the configuration file to decide what protocols are enabled, but it will only attempt to load the suricata.yaml from the the location determined via ./configure, and not respect the -c command line parameter.</p> Suricata - Bug #3108 (Closed): Calculation of threads in autofp mode is wronghttps://redmine.openinfosecfoundation.org/issues/31082019-08-09T13:18:48ZAndreas Herzoisf@herzandreas.de
<p>In runmode autofp the calculation of packet processing threads is wrong IMHO. On a system with 16 cores I end up with 32 threads while detect-thread-ratio is set 1.0 (default) and threads:auto in the af-packet section. So it adds 16 due to the ratio and another 16 from the threads setting in the interface af-packet section. If I change threads: 3 for example I end up with 19 (16+3). If I change thread-ratio to 0.5 while threads: auto I end up with 24 (8 from ratio + 16 from threads auto).</p>
<p>So threads: auto in autofp means amount of cores and this will be added. This doesn't happen in runmode workers for example.</p>
<p>Switching affinity off/on doesn't change anything. Also the threads setting within that section doesn't work either, see <a class="issue tracker-1 status-5 priority-4 priority-default closed" title="Bug: Thread counter setting ignored within affinity section (Closed)" href="https://redmine.openinfosecfoundation.org/issues/3107">#3107</a>.</p>