Re: Segmentation fault upon startup of Prelude-LML

Hello Sebastien!

Sebastien Tricaud wrote:
> On Wed, Mar 25, 2009 at 11:04 PM, Trevor McLeod <[email protected]> wrote:
>   
>> Hello,
>>
>>     
>
> Hi Trevor!
>
>
>   
>>  23 Mar 11:32:54 (process:3489) INFO: PCRE plugin loaded 443 rules.
>>
>>  23 Mar 11:32:54 (process:3489) INFO: Connecting to 127.0.0.1:4690
>>
>>    prelude Manager server.
>>
>>    Segmentation fault
>>
>>     
>
> Can you compile prelude-lml with debug options (CFLAGS="-g" make) and
> run prelude-lml through gdb to post the backtrace here ?
>
> (gdb prelude-lml; and after segfault, run bt).
>   
The prelude-lml Makefile already had "CFLAGS = -g 02".  Here's the
result of the backtrace:

Program received signal SIGSEGV, Segmentation fault.
0xb7e4c0f4 in ?? () from /usr/lib/libgnutls.so.26
(gdb) bt
#0  0xb7e4c0f4 in ?? () from /usr/lib/libgnutls.so.26
#1  0xb7e50ffa in ?? () from /usr/lib/libgnutls.so.26
#2  0xb7e51ed2 in ?? () from /usr/lib/libgnutls.so.26
#3  0xb7e52741 in gnutls_x509_crt_list_verify () from
/usr/lib/libgnutls.so.26
#4  0xb7e3857c in _gnutls_x509_cert_verify_peers () from
/usr/lib/libgnutls.so.26
#5  0xb7e2a5f1 in gnutls_certificate_verify_peers2 () from
/usr/lib/libgnutls.so.26
#6  0xb7ed0d5b in tls_auth_connection (cp=0x807db48, io=0x81440c0,
crypt=1, analyzerid=0x814391c, permission=0x8143924)
    at tls-auth.c:108
#7  0xb7ed89b6 in handle_authentication (cnx=0x81438f0,
reqperms=3221212520, cp=0x807db48, crypt=1) at prelude-connection.c:296
#8  0xb7ed923e in start_inet_connection (cnx=0x81438f0,
reqperms=PRELUDE_CONNECTION_PERMISSION_IDMEF_WRITE, profile=0x807db48)
    at prelude-connection.c:353
#9  0xb7ed93e7 in prelude_connection_connect (conn=0x81438f0,
profile=0x807db48,
    permission=PRELUDE_CONNECTION_PERMISSION_IDMEF_WRITE) at
prelude-connection.c:418
#10 0xb7edb9ad in prelude_connection_pool_init (pool=0x8140538) at
prelude-connection-pool.c:978
#11 0xb7ed5bbf in prelude_client_start (client=0x807efb8) at
prelude-client.c:1312
#12 0x08050420 in lml_options_init (ropt=0x807bb30, argc=1,
argv=0xbffff4d4) at lml-options.c:709
#13 0x0804d9bd in main (argc=1, argv=0xbffff4d4) at prelude-lml.c:326
(gdb)

>   
>>   segfault at 11 ip b7de20f4 sp bf990ed0 error 4 in
>>
>>   libgnutls.so.26.4.5[b7d90000+ac000]
>>     
>
> So the may may come from libgnutls, if you have a gnutls with debug
> symbols with suse (gnutls-debug?), that would be great.
>
>   
I'll check if gnutls-debug is part of the SuSE RPM.
>>  I am evaluating various HIDS as part of a project here at UBC.
>>     
>
> Lucky you, UBC is such a cool place!
>
>   
>>  I have installed Prelude on a workstation running SuSE Linux 11.1.
>>     
>
> Which seems to have a problem with its gnutls version. Maybe upgrading
> the package or compiling from sources.
>   
The package is the most recent one available from SuSE.  I'll wait on
compiling from sources until I hear back from you about the backtrace.
>   
>>  I have installed Prelude-Manager, Prelude-Correlator, Prelude-LML,
>>
>>  Prelude-Prewikka, libprelude, libpreludeDB and the various
>>
>>  prerequistes (as documented in the wiki) without any problems.
>>     
>
> Great feedback! thanks.
>
>
> Sebastien.
>   

Trevor

-- 
Trevor McLeod
Systems Analyst
UBC, Department of Computer Science
X463-2366 Main Mall
Vancouver, B.C. Canada V6T 1Z4

Phone: +1 604 822-8285

_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user