Re: Unable send data on BEEP Channel after sending some frames and RST problems

Rajesh Madabhushi <[email protected]> writes:

> Hi All,
> 
> Our product sends IDMEF(Alert/Heartbeat) messages to Intrusion
> Detection Manger (IDM) through IDXP. In order to test our software, I
> prepared small IDM by using Road Runner IDXP ,Road Runner BEEP and
> LibIDMEF of Silicon Defense to parse IDMEF messages. The Idea is,
> parses IDMEF messages received and sends back the replies(OK/Error
> message) once Session and Channels are established. Creating two
> channels one for 'Alert's and second for 'Heartbeats'
> To achieve this, I modified my_consumer() function of
> 'rridxp-0.2/tests/rridxp-server.c' to parses IDMEF messages received
> and replies TRUE/FALSE. Also changed in frame_available() of
> 'rridxp.c' to send back the replies.
> Is it correct way to do this ?

No, you should newer need to change anything in rridxp.c. you should
send the replies directly from the my_consumer function.

> It is working fine with single IDMEF message. But after sending
> replies to certain number of IDMEF Messages in loop, it stop sending
> any replies to IDMEF messages sent, even after successful parsing of
> the message. Using 'rr_channel_send_message()' to send back replies.
> 
> The last two BEEP Frame received from IDM is:
> 
> RPY 39 129 . 4153 32
> Content-Type: Text/xml
> <ok />END
> RPY 39 130 * 4185 7
> ContentEND
> 
> After this no replies
> Could any body tell me reason for this behavior? Am I doing any thing wrong ?
> If anybody wants, I can send net.log' for BEEP traffic generated at
> IDM. Also the modified RR IDXP files.
> 

I need to be able to reproduce this on my own computer to be able to
debug the problem. The traffic log is not enough.

> I also receiving TCP RST from IDM, Reason for RST is Frame Syntax
> Error or Sequence number mismatch in the BEEP frames. But I am sending
> BEEP sequence numbers in correct order and BEEP Frame Payload contents
> in correct size. But not getting this type of error for 'Heartbeat'
> Keep Alive messages that sends periodically to IDM. The problem is
> with 'Alert' messages only sending every message in multiple BEEP
> Frames. However behavior is fine with sending of single messages
> instead in loop. Sorry for re-sending of old problem, same(RST
> problem) was reported earlier and also got reply from Jonas, but I
> couldn't make out from this, sending again to link with current
> problem.
> 

this might be because libidmef isn't thread safe. But as I said above, I need
both the client and the server source code or even better a minimal test-case
that shows the same problem to have any chance to find it.

/ Jonas
-- 
Jonas Borgström                  [email protected]
CodeFactory AB                   http://www.codefactory.se/
Office: +46 (0)90 71 86 10       Cell: +46 (0)70 248 89 58