[Bro] bro segfaults on startup

[David Vasil]

Robin Sommer wrote:
> Ah, 64 bit and resolver-problems, that rings a bell: I've seen
> core-dumps on a 64bit SUSE Linux which were caused by linking in the
> 32bit version of the resolver-library. However, I recall that there
> was a corresponding warning during compiling/linking (which was easy
> to miss though). David, do you see anything like this?

Yes, during the compile of bro the following message is seen:

g++  -g -O2   -o bro  dce_rpc_pac.o ncp_pac.o smb_pac.o main.o 
net_util.o util.o parse.o scan.o re-parse.o re-scan.o rule-parse.o 
rule-scan.o Active.o Anon.o Attr.o BackDoor.o Base64.o BPF_Program.o 
BroString.o CCL.o ChunkedIO.o CompHash.o Conn.o ConnCompressor.o 
DCE_RPC.o DFA.o DNS.o DNS_Mgr.o DbgBreakpoint.o DbgHelp.o DbgWatch.o 
Debug.o DebugCmds.o DebugLogger.o Desc.o Dict.o Discard.o EquivClass.o 
Event.o EventHandler.o EventRegistry.o Expr.o FTP.o File.o Finger.o 
Frag.o Frame.o Func.o Gnutella.o HTTP.o Hash.o ICMP.o ID.o Ident.o 
IntSet.o InterConn.o IOSource.o IRC.o List.o Logger.o Login.o MIME.o 
NCP.o NFA.o NFS.o NTP.o NVT.o Net.o NetVar.o NetbiosSSN.o Obj.o 
OSFinger.o PacketFilter.o PacketSort.o PersistenceSerializer.o PktSrc.o 
PolicyFile.o POP3.o Portmap.o PrefixTable.o PriorityQueue.o Queue.o RE.o 
RPC.o Reassem.o RemoteSerializer.o Rlogin.o RSH.o Rule.o RuleAction.o 
RuleCondition.o RuleMatcher.o ScriptAnaly.o SMB.o SmithWaterman.o SMTP.o 
SSH.o Scope.o SerializationFormat.o SerialObj.o Serializer.o Sessions.o 
StateAccess.o Stats.o SteppingStone.o Stmt.o TCP.o TCP_Contents.o 
TCP_Endpoint.o TCP_Rewriter.o Telnet.o Timer.o Traverse.o TwoWise.o 
Type.o UDP.o Val.o Var.o XDR.o bsd-getopt-long.o cq.o md5.o patricia.o 
setsignal.o version.o strsep.o nb_dns.o X509.o SSLCiphers.o 
SSLInterpreter.o SSLProxy.o SSLv2.o SSLv3.o SSLv3Automaton.o  -Llibedit 
-ledit  -L../aux/libpcap-0.7.2 -lpcap -lresolv -lz /usr/lib/libresolv.a 
-lssl -lcrypto /usr/lib/libresolv.a -ltermcap -lm
/usr/bin/ld: warning: i386 architecture of input file 
`/usr/lib/libresolv.a(ns_parse.o)' is incompatible with i386:x86-64 output

I assume that is the error we are looking for.  Unfortunately, it seems 
that removing the references to /usr/lib/libresolv.a in each of the 
Makefiles causes ns_initparse to go undefined and make fails:

gcc -DHAVE_CONFIG_H -I. -I. -I../..     -g -O2 -I/include -c `test -f 
nb_dns.c || echo './'`nb_dns.c
gcc  -g -O2 -I/include   -o hf  hf.o setsignal.o version.o nb_dns.o 
-L../../aux/libpcap-0.7.2 -lpcap -lresolv -lz  -lssl -lcrypto -ltermcap
nb_dns.o(.text+0x671): In function `nb_dns_activity':
/raid/work/bro-1.0/aux/hf/nb_dns.c:476: undefined reference to 
`__ns_initparse'
nb_dns.o(.text+0x7ae):/raid/work/bro-1.0/aux/hf/nb_dns.c:519: undefined 
reference to `_ns_flagdata'
nb_dns.o(.text+0x7ca):/raid/work/bro-1.0/aux/hf/nb_dns.c:519: undefined 
reference to `_ns_flagdata'
nb_dns.o(.text+0x93c):/raid/work/bro-1.0/aux/hf/nb_dns.c:561: undefined 
reference to `__ns_parserr'
collect2: ld returned 1 exit status
make[4]: *** [hf] Error 1
make[4]: Leaving directory `/raid/work/bro-1.0/aux/hf'
make[3]: *** [all-recursive] Error 1
make[3]: Leaving directory `/raid/work/bro-1.0/aux'
make[2]: *** [all] Error 2
make[2]: Leaving directory `/raid/work/bro-1.0/aux'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/raid/work/bro-1.0'
make: *** [all] Error 2

I'll look into it more, figured you might like an update though.

-- 
| David Vasil <dmvasil at ornl.gov>
| Oak Ridge National Laboratory NCCS Division
| High Performance Computing Systems Administrator
| Bldg: 5600-A115  Phone: (865)241-5562