Suricata + nDPI: segmentation fault with SNMP traffic

[AgishevArtyom]

I am using Suricata + nDPI build (Suricata version 8.0.0-dev, nDPI -4.12)
Two Ubuntu 22.04.5 LTS virtual machines are used.
Ubuntu-1 - running Suricata + nDPI.
Ubuntu-2 - using snmpd utility to get a list of all available OIDs and their values ​​from Ubuntu-1.
Command: snmpwalk -v 2c -c mycommunity

When running the command, a Segmentation fault error appears.
When adding
return;
to line 60 of the ./nDPI-4.12/src/lib/protocols/snmp_protocol.c file and reconfiguring, the error does not appear.

Thanks in advance for your help.

[koltiradw]

Can you attach the pcap file?

[IvanNardi]

Can you attach the pcap file?

@AgishevArtyom
+1; being able to reproduce the issue with ndpiReader and a trace would be extremely useful.

BTW, with "Suricata + nDPI build" you mean you are testing something like OISF/suricata#12560?
Anyway: who crashes? Suricata? Could you report a list a gdb trace (with symbols)?

[AgishevArtyom]

Can you attach the pcap file?

dump_snmp_segm_fault.zip

BTW, with "Suricata + nDPI build" you mean you are testing something like OISF/suricata#12560?

Yes, that's absolutely right.

Anyway: who crashes? Suricata? Could you report a list a gdb trace (with symbols)?

Yes, suricata crashes. Could you please explain in more detail about gdb trace?

Thanks in advance for your help.

[IvanNardi]

The pcap seems fine from a nDPI standpoint.
I f I should guess, I think the issue is somewhere in Suricata, or in the integration between Suricata and nDPI.
No sure how to help in this scenario, sorry
Could you try at least to:

• attach the exact instructions to compile everything and to reproduce the crash? [the goal is to easily allow someone to reproduce your issue]
• independently from the previous point, report the output after you compile nDPI with --enable-debug-build --with-sanitizer flags? The crash should reports a lot more information in this case

EDIT: on the second point, I mean recompile with those flags the nDPI used by Suricata, and report the Suricata's output

[AgishevArtyom]

@IvanNardi Hello, Ivan.

nDPI-4.12 compilation parameters (https://github.com/ntop/nDPI/tree/4.12)

1. ./autogen.sh
2. ./configure
3. make
4. make install

Suricata compilation parameters (https://github.com/jasonish/suricata/tree/ish/ndpi/plugin/v10)

1. ./autogen.sh
2. ./configure --prefix=/usr/local --enable-ndpi --with-ndpi=/usr/local/nDPI/nDPI-4.12
3. make
4. make install

To reproduce the error, you need to generate any SNMP traffic. For example, you can download the snmpd utility.
Add the line to the /etc/snmp/snmpd.conf file
"rocommunity mycommunity <IP of the host with Suricata+nDPI>"
Then, on another machine, use the command
snmpwalk -v 2c -c mycommunity <IP-address_of_target_VM>
(Suricata must be running on the target machine)

After running the command, the Segmentation fault error immediately appears.

[AgishevArtyom]

@IvanNardi
I configured the nDPI plugin with --enable-debug-build --with-sanitizer and got the following result:

[IvanNardi]

@IvanNardi I configured the nDPI plugin with --enable-debug-build --with-sanitizer and got the following result:

ok, for some reasons, nDPI + asan doesn't work out of the box with Suricata :(

[IvanNardi]

@IvanNardi Hello, Ivan.

nDPI-4.12 compilation parameters (https://github.com/ntop/nDPI/tree/4.12)

1. ./autogen.sh

2. ./configure

3. make

4. make install

Suricata compilation parameters (https://github.com/jasonish/suricata/tree/ish/ndpi/plugin/v10)

1. ./autogen.sh

2. ./configure --prefix=/usr/local --enable-ndpi --with-ndpi=/usr/local/nDPI/nDPI-4.12

3. make

4. make install

To reproduce the error, you need to generate any SNMP traffic. For example, you can download the snmpd utility. Add the line to the /etc/snmp/snmpd.conf file "rocommunity mycommunity <IP of the host with Suricata+nDPI>" Then, on another machine, use the command snmpwalk -v 2c -c mycommunity <IP-address_of_target_VM> (Suricata must be running on the target machine)

After running the command, the Segmentation fault error immediately appears.

@lucaderi, @cardigliano any ideas?

[lucaderi]

@AgishevArtyom Can you provide a stack trace of the crash in Suricata?

[koltiradw]

@IvanNardi I configured the nDPI plugin with --enable-debug-build --with-sanitizer and got the following result:

You should also build suricata with ASAN.
CFLAGS="-fsanitize=address -fno-omit-frame-pointer -g"
LDFLAGS="-fsanitize=address"

[vel21ripn]

@koltiradw The "-fsanitize=address" option requires the LLVM runtime library. You will need to either build nDPI without this option, or build suricata with this option.

[koltiradw]

@koltiradw The "-fsanitize=address" option requires the LLVM runtime library. You will need to either build nDPI without this option, or build suricata with this option.

I agree. Or also compile with gcc, but also have asan runtime. Anyway, the easiest way is to compile both suricata and ndpi with debug flags and run coredump