Re: snort3-261: snort can not stop on QUIT and TERM in NFQ mode.
Meridoff via Snort-devel <[email protected]> Wed, 16 Oct 2019 22:57:46 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CAFfuDwyuXsg5uY3=dwPQEM-S6jTheHB1Tm=xTHsxHjekEaOBfA@mail.gmail.com> |
--===============6725753305485382825==
Content-Type: multipart/alternative; boundary="000000000000719e7705950c8417"
--000000000000719e7705950c8417
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
I've debugged some and found that on QUIT/TERM/INT analyzer can't stop for
some reason: ACStop didint' called though it must be and
analyzer.exit_requested is not settled.
This happenes because of nl_socket_recv() ( called in function
nfq_daq_msg_receive()
), after snort receiving signal TERM/QUIT or INT, always returns EAGAIN or
EWOULDBLOCK and never EINTR, so even when nfqc->interrupted=3Dtrue this
doesn't result to returning status DAQ_RSTAT_INTERRUPTED and always return
status DAQ_RSTAT_TIMEOUT (because i think idx=3D0 always in this function,
but i've not debugged this yet, so recvmsg is may be always BLOCKING).
In any case : in afpacket mode we receive DAQ_RSTAT_IUNTERRUPTED from DAQ,
and in nfq we don't receive this status and that is why snort can't stop in
NFQ mode.
As workaround such code in nfq_daq_msg_receive() can solve problem and
snort can stop but may be it is not good solution:
*ssize_t ret =3D nl_socket_recv(nfqc, desc->nlmsg_buf, nfqc->nlmsg_bufsize,
idx =3D=3D 0);*
*if (ret < 0)*
* {*
* if (errno =3D=3D ENOBUFS)*
* {*
* nfqc->stats.hw_packets_dropped++;*
* continue;*
* } else if (nfqc->interrupted) {
*rstat =3D DAQ_RSTAT_INTERRUPTED; nfqc->interrupted =3D
false; *
* } else if (errno =3D=3D EAGAIN || errno =3D=3D EWOULDBLOCK)*
* *rstat =3D (idx =3D=3D 0) ? DAQ_RSTAT_TIMEOUT :
DAQ_RSTAT_WOULD_BLOCK;*
* else if (errno =3D=3D EINTR)*
* {*
* if (!nfqc->interrupted)*
* continue;*
* } *
=D1=87=D1=82, 10 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 19:44, Meridoff <o=
[email protected]>:
> Hello, i run snort3 build 261 with nfq
>
> Config concerning to daq :
> *ips.mode=3D"tap"*
> *daq =3D { module_dirs =3D { "/usr/lib/daq" } }*
> *daq.inputs =3D {'1'} --my queue ID*
> *daq.modules =3D { { name =3D 'nfq', mode=3D'passive' } }*
>
> When I try to kill snort I see in log:
>
> *Oct 9 11:36:32 xxx snort[25483]:
> --------------------------------------------------*
> *Oct 9 11:36:32 xxx snort[25483]: nfq DAQ configured to passive.*
> *Oct 9 11:36:32 xxx snort[25483]: initializing daemon mode*
> *Oct 9 11:36:32 xxx snort[25483]: child process is 25484*
> *Oct 9 11:36:32 xxx snort[25484]: Commencing packet processing*
> *Oct 9 11:36:32 xxx snort[25484]: ++ [0] 1*
> *Oct 9 11:36:32 xxx snort[25484]: Writing PID "25484" to file
> "/var/run/snort.pid"*
> *Oct 9 11:36:32 xxx snort[25484]: Chroot directory =3D /*
> *Oct 9 11:38:02 xxx snort[25484]: ** caught term signal*
> *Oct 9 11:38:02 xxx snort[25484]: =3D=3D stopping*
> *Oct 9 11:38:31 xxx snort[25484]: ** caught quit signal*
> *Oct 9 11:38:31 xxx snort[25484]: =3D=3D stopping*
>
> And process remains running..
> As I know* --dirty-pig* mode is ON when killing by QUIT, but even this
> can'not help.
>
> I even tried to not configure nfq in iptables . With iptables configured
> for nfq - the same situation..
>
> Is it dungerous to use *always exit_pronto =3D true *in sources? So quick
> exit without cleanup can be done..
>
> exit_pronto settled to false after some part of initialization done. May
> do no set it to false for avalibilty of quick exist ?
>
> Thanks.
>
>
>
>
--000000000000719e7705950c8417
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div dir=3D"ltr">I've debugged some and found that on =
QUIT/TERM/INT analyzer =C2=A0can't stop for some reason: ACStop didint&=
#39; called though it must be and analyzer.exit_requested is not settled.<d=
iv><br></div><div>This happenes because of<span style=3D"color:rgb(111,66,1=
93);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,m=
onospace;font-size:12px;white-space:pre-wrap"> nl_socket_recv() ( called in=
function <span style=3D"color:rgb(111,66,193);font-family:SFMono-Regular,C=
onsolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-sp=
ace:pre-wrap">nfq_daq_msg_receive() </span>), after snort receiving signal =
TERM/QUIT or INT, always returns EAGAIN or EWOULDBLOCK and never EINTR, so=
even when nfqc->interrupted=3Dtrue this doesn't result to returning=
status DAQ_RSTAT_INTERRUPTED and always return status DAQ_RSTAT_TIMEOUT (b=
ecause i think idx=3D0 always in this function, but i've not debugged t=
his yet, so recvmsg is may be always BLOCKING). <br></span></div><div><span=
style=3D"color:rgb(111,66,193);font-family:SFMono-Regular,Consolas,"L=
iberation Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap"><=
br></span></div><div><span style=3D"color:rgb(111,66,193);font-family:SFMon=
o-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12=
px;white-space:pre-wrap">In any case : in afpacket mode we receive DAQ_RSTA=
T_IUNTERRUPTED from DAQ, and in nfq we don't receive this status and th=
at is why snort can't stop in NFQ mode.<br></span></div><br><div><div>A=
s workaround such code=20
<span style=3D"color:rgb(111,66,193);font-family:SFMono-Regular,Consolas,&q=
uot;Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre-wr=
ap">in nfq_daq_msg_receive()</span> can solve problem and snort can stop bu=
t may be it is not good solution:</div><div><br></div>
<i>
</i><i>
</i><table class=3D"gmail-highlight gmail-tab-size gmail-js-file-line=
-container"><tbody><tr><td id=3D"gmail-LC717" class=3D"gmail-blob-code gmai=
l-blob-code-inner gmail-js-file-line"> <i><span class=3D"gmail-pl-c1=
">ssize_t</span> ret =3D <span class=3D"gmail-pl-c1">nl_socket_recv</span>(=
nfqc, desc-><span class=3D"gmail-pl-smi">nlmsg_buf</span>, nfqc-><spa=
n class=3D"gmail-pl-smi">nlmsg_bufsize</span>, idx =3D=3D <span class=3D"gm=
ail-pl-c1">0</span>);</i></td></tr><tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC718" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"> <i><span c=
lass=3D"gmail-pl-k">if</span> (ret < <span class=3D"gmail-pl-c1">0</span=
>)</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC719" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i> {</i></=
td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC720" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 <span class=3D"gmail-pl-k">if</span> (errno =3D=
=3D ENOBUFS)</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC721" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 {</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC722" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
nfqc-><span class=3D"gmail-pl-smi">stats</span>.<span class=3D=
"gmail-pl-smi">hw_packets_dropped</span>++;</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC723" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
<span class=3D"gmail-pl-k">continue</span>;</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC724" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 }=20
=C2=A0=C2=A0=C2=A0 <span class=3D"gmail-pl-k">else if</span> (nfqc-><spa=
n class=3D"gmail-pl-smi">interrupted</span>)<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 {<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0
*rstat =3D DAQ_RSTAT_INTERRUPTED;
<br>
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 nfqc-><span class=
=3D"gmail-pl-smi">interrupted</span> =3D <span class=3D"gmail-pl-c1">false<=
/span>;
<br></i></td></tr><tr></tr></tbody></table><table class=3D"gmail-highlight =
gmail-tab-size gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC7=
25" class=3D"gmail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 } <span class=3D"gmail-pl-k=
">else</span> <span class=3D"gmail-pl-k">if</span> (errno =3D=3D EAGAIN || =
errno =3D=3D EWOULDBLOCK)</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC726" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 *rstat =3D =
(idx =3D=3D <span class=3D"gmail-pl-c1">0</span>) ? DAQ_RSTAT_TIMEOUT : DAQ=
_RSTAT_WOULD_BLOCK;</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC727" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 <span class=3D"gmail-pl-k">else</span> <span cl=
ass=3D"gmail-pl-k">if</span> (errno =3D=3D EINTR)</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC728" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 {</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC729" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 <span class=3D"gmail-pl-k">if</span> (!nfqc-><span class=3D=
"gmail-pl-smi">interrupted</span>)</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC730" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><i>=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 <span c=
lass=3D"gmail-pl-k">continue</span>;</i></td>
</tr>
<tr>
</tr></tbody></table><table class=3D"gmail-highlight gmail-tab-size=
gmail-js-file-line-container"><tbody><tr><td id=3D"gmail-LC731" class=3D"g=
mail-blob-code gmail-blob-code-inner gmail-js-file-line"><br></td></tr><tr>=
</tr></tbody></table><i>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
}
</i><div><br></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D=
"gmail_attr">=D1=87=D1=82, 10 =D0=BE=D0=BA=D1=82. 2019 =D0=B3. =D0=B2 19:44=
, Meridoff <<a href=3D"mailto:[email protected]" target=3D"_blank">oagvo=
[email protected]</a>>:<br></div><blockquote class=3D"gmail_quote" style=3D"m=
argin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left=
:1ex"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><=
div dir=3D"ltr"><div dir=3D"ltr">Hello, i run snort3 build 261 with nfq</di=
v><div dir=3D"ltr"><br><div>Config concerning to daq :</div><div><div><i>ip=
s.mode=3D"tap"</i></div><div><i>daq =3D { module_dirs =3D { "=
;/usr/lib/daq" } }</i></div><div><i>daq.inputs =3D {'1'} =C2=
=A0 --my queue ID</i></div><div><i>daq.modules =3D { { name =3D 'nfq=
9;, mode=3D'passive' } }</i></div></div><div><br></div><div>When I =
try to kill snort I see in log:</div><div><br></div><div><div><i>Oct =C2=A0=
9 11:36:32 xxx snort[25483]: ----------------------------------------------=
----</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[25483]: nfq DAQ config=
ured to passive.</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[25483]: in=
itializing daemon mode</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[2548=
3]: child process is 25484</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[=
25484]: Commencing packet processing</i></div><div><i>Oct =C2=A09 11:36:32 =
xxx snort[25484]: ++ [0] 1</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[=
25484]: Writing PID "25484" to file "/var/run/snort.pid"=
;</i></div><div><i>Oct =C2=A09 11:36:32 xxx snort[25484]: Chroot directory =
=3D /</i></div></div><div><div><i>Oct =C2=A09 11:38:02 xxx snort[25484]: **=
caught term signal</i></div><div><i>Oct =C2=A09 11:38:02 xxx snort[25484]:=
=3D=3D stopping</i></div><div><i>Oct =C2=A09 11:38:31 xxx snort[25484]: **=
caught quit signal</i></div><div><i>Oct =C2=A09 11:38:31 xxx snort[25484]:=
=3D=3D stopping</i></div><div><br></div><div>And process remains running..=
=C2=A0</div><div>As I know<b> --dirty-pig</b> mode is ON when killing by QU=
IT, but even this can'not help.</div><div><br></div><div>I even tried t=
o not configure nfq in iptables . With iptables configured for nfq - the sa=
me situation..</div><div><br></div><div>Is it dungerous to use <b>always ex=
it_pronto =3D true </b>in sources? So quick exit without cleanup can be don=
e..</div><div><br></div><div>exit_pronto settled to false after some part o=
f initialization done. May do no set it to false for avalibilty of quick ex=
ist ?<br></div><div><br></div><div>Thanks.</div><div><br></div></div><div><=
br></div><div><br></div></div></div></div></div></div></div>
</blockquote></div></div></div></div>
--000000000000719e7705950c8417--
--===============6725753305485382825==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel
Please visit http://blog.snort.org for the latest news about Snort!
--===============6725753305485382825==--