Ulogd crashes - NFCT polling mode + NACCT

Ulogd crashes - NFCT polling mode + NACCT

[Gomathivinayagam Muthuvinayagam]

Hi,

I try to use ulogd with NFCT polling mode and NACCT output. Ulogd
crashes with this options, and stacktrace is given as below
Could someone help me the reason for this failure?

== Stacktrace =================================
#0  0x00007fe46c334445 in raise () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#1  0x00007fe46c337bab in abort () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#2  0x00007fe46c32d10e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#3  0x00007fe46c32d1b2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
No symbol table info available.
#4  0x00007fe46b8d6274 in nfct_query (h=0x0, qt=<optimized out>,
data=<optimized out>) at api.c:942
        u = {buffer = 0x7fffa7a06bd0
"\377\377\377\377\377\377\377\377", req = {nlh = {nlmsg_len = 0,
nlmsg_type = 0, nlmsg_flags = 0, nlmsg_seq = 0, nlmsg_pid = 0}, nfmsg
= {nfgen_family = 0 '\000', version = 0 '\000', res_id = 0}}}
        __PRETTY_FUNCTION__ = "nfct_query"
#5  0x00007fe46bae8615 in polling_timer_cb (t=<optimized out>,
data=0xe5c8a0) at ulogd_inpflow_NFCT.c:999
        upi = 0xe5c8a0
        family = 0
#6  0x00000000004047d8 in ulogd_do_timer_run (next_run=0x7fffa7a07c80)
at timer.c:162
        alarm_run_queue = {next = 0xe5c998, prev = 0xe5a408}
        node = <optimized out>
        this = <optimized out>
        tv = {tv_sec = 1342590477, tv_usec = 250967}
#7  0x000000000040214a in ulogd_main_loop () at ulogd.c:907
        ret = <optimized out>
        next_alarm = {tv_sec = 0, tv_usec = 0}
        next = 0x7fffa7a07c80
#8  main (argc=<optimized out>, argv=<optimized out>) at ulogd.c:1248
        argch = <optimized out>
        daemonize = 1
        change_uid = 0
        user = 0x0
        pw = <optimized out>
        uid = 0
        gid = 0

Thanks & Regards,

Re: Ulogd crashes - NFCT polling mode + NACCT

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 1185 bytes --]

Hello,

Le mercredi 18 juillet 2012 à 08:21 -0700, Gomathivinayagam
Muthuvinayagam a écrit :
> Hi,
> 
> I try to use ulogd with NFCT polling mode and NACCT output. Ulogd

Can you send us information about your configuration like the stack used
for logging.

Other questions: do conntrack -L work ?

> crashes with this options, and stacktrace is given as below
> Could someone help me the reason for this failure?
> 
> == Stacktrace =================================
> #0  0x00007fe46c334445 in raise () from /lib/x86_64-linux-gnu/libc.so.6
> No symbol table info available.
> #1  0x00007fe46c337bab in abort () from /lib/x86_64-linux-gnu/libc.so.6
> No symbol table info available.
> #2  0x00007fe46c32d10e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
> No symbol table info available.
> #3  0x00007fe46c32d1b2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
> No symbol table info available.
> #4  0x00007fe46b8d6274 in nfct_query (h=0x0, qt=<optimized out>,

If we have a NULL handle that explain the crash. Question is how we
manage to get this.

BR,
-- 
Eric Leblond 
Blog: http://home.regit.org/ - Portfolio: http://regit.500px.com/

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: Ulogd crashes - NFCT polling mode + NACCT

[Gomathivinayagam Muthuvinayagam]

I used the following stacks in my configuration file

stack=ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,emu1:LOGEMU
stack=ct1:NFCT,ip2str1:IP2STR,nacct1:NACCT


[ct1]
netlink_socket_buffer_size=217088
netlink_socket_buffer_maxsize=1085440
#netlink_resync_timeout=60 # seconds to wait to perform resynchronization
pollinterval=30 # use poll-based logging instead of event-driven
hash_enable=1

This morning, I tried out commenting
stack=ct1:NFCT,ip2str1:IP2STR,print1:PRINTFLOW,emu1:LOGEMU, and
launched ulogd(polling mode + NACCT) only. It successfully works.

It seems I cannot use the same input plugin in polling mode for two
different stacks.

Thanks & Regards,




On Wed, Jul 18, 2012 at 11:52 AM, Eric Leblond <eric@regit.org> wrote:
> Hello,
>
> Le mercredi 18 juillet 2012 à 08:21 -0700, Gomathivinayagam
> Muthuvinayagam a écrit :
>> Hi,
>>
>> I try to use ulogd with NFCT polling mode and NACCT output. Ulogd
>
> Can you send us information about your configuration like the stack used
> for logging.
>
> Other questions: do conntrack -L work ?
>
>> crashes with this options, and stacktrace is given as below
>> Could someone help me the reason for this failure?
>>
>> == Stacktrace =================================
>> #0  0x00007fe46c334445 in raise () from /lib/x86_64-linux-gnu/libc.so.6
>> No symbol table info available.
>> #1  0x00007fe46c337bab in abort () from /lib/x86_64-linux-gnu/libc.so.6
>> No symbol table info available.
>> #2  0x00007fe46c32d10e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
>> No symbol table info available.
>> #3  0x00007fe46c32d1b2 in __assert_fail () from /lib/x86_64-linux-gnu/libc.so.6
>> No symbol table info available.
>> #4  0x00007fe46b8d6274 in nfct_query (h=0x0, qt=<optimized out>,
>
> If we have a NULL handle that explain the crash. Question is how we
> manage to get this.
>
> BR,
> --
> Eric Leblond
> Blog: http://home.regit.org/ - Portfolio: http://regit.500px.com/
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[PATCH 0/1] Fix NFCT crash

[Eric Leblond]

Hello,

Great diagnostic! it was in fact polling mode and the same NFCT
instance on two stacks.

Can you try the following patch. It fixes the problem for on my
test setup.

BR,
--
Eric

[PATCH] Fix crash when the same NFCT is used by two stacks.

[Eric Leblond]

The polling timer initialisation code was put in the configurator
code. It was then created for all instances. But only first one has
a valid NFCT handle. This was resulting in a crash.
This patch moves the timer initialisation in the constructor which
is called only once on the main NFCT instance.

Signed-off-by: Eric Leblond <eric@regit.org>
Reported-by: Gomathivinayagam Muthuvinayagam <sankarmail@gmail.com>
---
 input/flow/ulogd_inpflow_NFCT.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/input/flow/ulogd_inpflow_NFCT.c b/input/flow/ulogd_inpflow_NFCT.c
index b45a435..dcba58f 100644
--- a/input/flow/ulogd_inpflow_NFCT.c
+++ b/input/flow/ulogd_inpflow_NFCT.c
@@ -982,11 +982,6 @@ static int configure_nfct(struct ulogd_pluginstance *upi,
 	if (ret < 0)
 		return ret;
 
-	ulogd_init_timer(&cpi->timer, upi, polling_timer_cb);
-	if (pollint_ce(upi->config_kset).u.value != 0)
-		ulogd_add_timer(&cpi->timer,
-				pollint_ce(upi->config_kset).u.value);
-
 	return 0;
 }
 
@@ -1152,6 +1147,11 @@ static int constructor_nfct_polling(struct ulogd_pluginstance *upi)
 	if (cpi->ct == NULL)
 		goto err_ct_cache;
 
+	ulogd_init_timer(&cpi->timer, upi, polling_timer_cb);
+	if (pollint_ce(upi->config_kset).u.value != 0)
+		ulogd_add_timer(&cpi->timer,
+				pollint_ce(upi->config_kset).u.value);
+
 	ulogd_log(ULOGD_NOTICE, "NFCT working in polling mode\n");
 	return 0;
 
-- 
1.7.10.4

Re: [PATCH] Fix crash when the same NFCT is used by two stacks.

[Pablo Neira Ayuso]

On Thu, Jul 19, 2012 at 08:56:04AM +0200, Eric Leblond wrote:
> The polling timer initialisation code was put in the configurator
> code. It was then created for all instances. But only first one has
> a valid NFCT handle. This was resulting in a crash.
> This patch moves the timer initialisation in the constructor which
> is called only once on the main NFCT instance.

Applied, thanks Eric!