[Bro] Assertion failure, Tag.cc

Michael Fry michael.fry at morphick.com
Tue Apr 5 08:00:55 PDT 2016


Thanks for the response. We do have a custom script running that chooses
files to extract based on mime type. Here is the stack trace that I'm
seeing. It's always the same.

Regards

#0  0x00007ffb28a680d5 in raise () from /lib/x86_64-linux-gnu/libc.so.6

#1  0x00007ffb28a6b83b in abort () from /lib/x86_64-linux-gnu/libc.so.6

#2  0x00007ffb28a60d9e in ?? () from /lib/x86_64-linux-gnu/libc.so.6

#3  0x00007ffb28a60e42 in __assert_fail () from
/lib/x86_64-linux-gnu/libc.so.6

#4  0x0000000000852850 in Tag::AsEnumVal (this=0x7fff27c7a8e0,
etype=0x246a700) at /home/mfry/dev/bro24/bro-2.4.1/src/Tag.cc:72

#5  0x0000000000b51b7b in file_analysis::Tag::AsEnumVal
(this=0x7fff27c7a8e0) at
/home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/Tag.cc:23

#6  0x0000000000b4d95b in file_analysis::AnalyzerSet::GetKey
(this=0xb74e850, t=..., args=0xff59ca0) at
/home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/AnalyzerSet.cc:155

#7  0x0000000000b4d7c7 in file_analysis::AnalyzerSet::QueueRemove
(this=0xb74e850, tag=..., args=0xff59ca0) at
/home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/AnalyzerSet.cc:140

#8  0x0000000000b4b3c9 in file_analysis::File::DeliverStream
(this=0xb74e820,

    data=0xc02f4f0
"\217\020\272\214\355\361\301\272p\200\371\355\f\301\305\066\247Bj\216\027v\217^\303\t\221.6Fgrv\250\347Clcc\264\212\224\210\230!\336;\271Y\336!\355ɩ\210\332$]\b\217l\372[\240\362O\261K'\234b\v\376",
len=1460)

    at /home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/File.cc:405

#9  0x0000000000b4c995 in file_analysis::FileReassembler::BlockInserted
(this=0x10a0e400, start_block=0x11637850) at
/home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/FileReassembler.cc:66

#10 0x0000000000b4cabd in file_analysis::FileReassembler::Undelivered
(this=0x10a0e400, up_to_seq=70713344) at
/home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/FileReassembler.cc:96

#11 0x0000000000806342 in Reassembler::TrimToSeq (this=0x10a0e400,
seq=70713344) at /home/mfry/dev/bro24/bro-2.4.1/src/Reassem.cc:101

#12 0x0000000000b4c879 in file_analysis::FileReassembler::Flush
(this=0x10a0e400) at
/home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/FileReassembler.cc:33

#13 0x0000000000b4b533 in file_analysis::File::DeliverChunk
(this=0xb74e820, data=0xf0b2870
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
len=1460, offset=1147283)

    at /home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/File.cc:421

#14 0x0000000000b4b9dc in file_analysis::File::DataIn (this=0xb74e820,
data=0xf0b2870
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
len=1460, offset=1147283)

    at /home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/File.cc:481

#15 0x0000000000b45722 in file_analysis::Manager::DataIn (this=0x246a440,
data=0xf0b2870
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
len=1460, offset=1147283, tag=...,

    conn=0x10fb36f0, is_orig=false, precomputed_id=...) at
/home/mfry/dev/bro24/bro-2.4.1/src/file_analysis/Manager.cc:121

#16 0x00000000009bea07 in analyzer::http::HTTP_Entity::SubmitData
(this=0xa3eb330, len=1460, buf=0xf0b2870
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y")

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:322

#17 0x0000000000a2140b in analyzer::mime::MIME_Entity::FlushData
(this=0xa3eb330) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/mime/MIME.cc:1217

#18 0x0000000000a20a97 in analyzer::mime::MIME_Entity::DecodeDataLine
(this=0xa3eb330, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",

    trailing_CRLF=0) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/mime/MIME.cc:1013

#19 0x0000000000a1fe3c in analyzer::mime::MIME_Entity::NewDataLine
(this=0xa3eb330, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/mime/MIME.cc:698

#20 0x0000000000a1fbd3 in analyzer::mime::MIME_Entity::Deliver
(this=0xa3eb330, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/mime/MIME.cc:617

#21 0x00000000009be2cb in analyzer::http::HTTP_Entity::DeliverBodyClear
(this=0xa3eb330, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",

    trailing_CRLF=0) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:217

#22 0x00000000009be218 in analyzer::http::HTTP_Entity::DeliverBody
(this=0xa3eb330, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:205

#23 0x00000000009be086 in analyzer::http::HTTP_Entity::Deliver
(this=0xa3eb330, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:159

#24 0x0000000000a1fe1a in analyzer::mime::MIME_Entity::NewDataLine
(this=0x12b37890, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/mime/MIME.cc:693

#25 0x0000000000a1fbd3 in analyzer::mime::MIME_Entity::Deliver
(this=0x12b37890, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/mime/MIME.cc:617

#26 0x00000000009be2cb in analyzer::http::HTTP_Entity::DeliverBodyClear
(this=0x12b37890, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",

    trailing_CRLF=0) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:217

#27 0x00000000009be218 in analyzer::http::HTTP_Entity::DeliverBody
(this=0x12b37890, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:205

#28 0x00000000009bddfe in analyzer::http::HTTP_Entity::Deliver
(this=0x12b37890, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:107

#29 0x00000000009c43ea in analyzer::mime::MIME_Message::Deliver
(this=0xbbf60b0, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
trailing_CRLF=0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/mime/MIME.h:207

#30 0x00000000009c10e0 in analyzer::http::HTTP_Analyzer::DeliverStream
(this=0xaba9ed0, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",

    is_orig=false) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/http/HTTP.cc:908

#31 0x0000000000b74c0b in analyzer::SupportAnalyzer::ForwardStream
(this=0x96e9790, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
is_orig=false)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/Analyzer.cc:835

#32 0x0000000000adcd94 in analyzer::tcp::ContentLine_Analyzer::DoDeliver
(this=0x96e9790, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y")

    at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/ContentLine.cc:168

#33 0x0000000000adcb44 in
analyzer::tcp::ContentLine_Analyzer::DeliverStream (this=0x96e9790,
len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",

    is_orig=false) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/ContentLine.cc:108

#34 0x0000000000b72383 in analyzer::Analyzer::NextStream (this=0x96e9790,
len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
is_orig=false)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/Analyzer.cc:245

#35 0x0000000000b7235e in analyzer::Analyzer::NextStream (this=0xaba9ed0,
len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
is_orig=false)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/Analyzer.cc:239

#36 0x0000000000b72784 in analyzer::Analyzer::ForwardStream
(this=0x77aa210, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y",
is_orig=false)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/Analyzer.cc:331

#37 0x0000000000adb93f in analyzer::tcp::TCP_Reassembler::Deliver
(this=0xd8f75b0, seq=6422408, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y")

    at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/TCP_Reassembler.cc:457

#38 0x0000000000adc279 in analyzer::tcp::TCP_Reassembler::DeliverBlock
(this=0xd8f75b0, seq=6422408, len=1460, data=0xc15aab0
"\030\\\240\357\224\017\001<\207\n8\212\322W\273\023\034C<}@\210\242\031\245\206f'\212\367\254\211\213\227c\303\326k\341\305,\333\034\226\355y")

    at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/TCP_Reassembler.cc:647

#39 0x0000000000adb599 in analyzer::tcp::TCP_Reassembler::BlockInserted
(this=0xd8f75b0, start_block=0x117aba30) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/TCP_Reassembler.cc:393

#40 0x0000000000806256 in Reassembler::NewBlock (this=0xd8f75b0,
t=1459362263.205771, seq=6422408, len=1460, data=0x7ffb2bd72536 <Address
0x7ffb2bd72536 out of bounds>) at
/home/mfry/dev/bro24/bro-2.4.1/src/Reassem.cc:73

#41 0x0000000000adba48 in analyzer::tcp::TCP_Reassembler::DataSent
(this=0xd8f75b0, t=1459362263.205771, seq=6422408, len=1460,
data=0x7ffb2bd72536 <Address 0x7ffb2bd72536 out of bounds>, replaying=true)

    at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/TCP_Reassembler.cc:492

#42 0x0000000000ad9eb1 in analyzer::tcp::TCP_Endpoint::DataSent
(this=0xbd1a7f0, t=1459362263.205771, seq=6422408, len=1460, caplen=1460,
data=0x7ffb2bd72536 <Address 0x7ffb2bd72536 out of bounds>,
ip=0x7fff27c7bd60, tp=0x7ffb2bd72522)

    at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/TCP_Endpoint.cc:205

#43 0x0000000000ad4eac in analyzer::tcp::TCP_Analyzer::DeliverData
(this=0x77aa210, t=1459362263.205771, data=0x7ffb2bd72536 <Address
0x7ffb2bd72536 out of bounds>, len=1460, caplen=1460, ip=0x7fff27c7bd60,
tp=0x7ffb2bd72522, endpoint=0xbd1a7f0, rel_data_seq=6422408,

    is_orig=0, flags=...) at
/home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/TCP.cc:982

#44 0x0000000000ad5f82 in analyzer::tcp::TCP_Analyzer::DeliverPacket
(this=0x77aa210, len=1460, data=0x7ffb2bd72536 <Address 0x7ffb2bd72536 out
of bounds>, is_orig=false, seq=18446744073709551615, ip=0x7fff27c7bd60,
caplen=1460)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/protocol/tcp/TCP.cc:1382

#45 0x0000000000b7229e in analyzer::Analyzer::NextPacket (this=0x77aa210,
len=1480, data=0x7ffb2bd72522 <Address 0x7ffb2bd72522 out of bounds>,
is_orig=false, seq=18446744073709551615, ip=0x7fff27c7bd60, caplen=1480)

    at /home/mfry/dev/bro24/bro-2.4.1/src/analyzer/Analyzer.cc:222

#46 0x000000000076c0c9 in Connection::NextPacket (this=0x10fb36f0,
t=1459362263.205771, is_orig=0, ip=0x7fff27c7bd60, len=1480, caplen=1480,
data=@0x7fff27c7b9a0: 0x7ffb2bd72522 <Address 0x7ffb2bd72522 out of
bounds>, record_packet=@0x7fff27c7ba10: 1,

    record_content=@0x7fff27c7ba14: 1, hdr=0x48d3bb8, pkt=0x7ffb2bd72500
<Address 0x7ffb2bd72500 out of bounds>, hdr_size=14) at
/home/mfry/dev/bro24/bro-2.4.1/src/Conn.cc:260

#47 0x0000000000837be5 in NetSessions::DoNextPacket (this=0x5f2db20,
t=1459362263.205771, hdr=0x48d3bb8, ip_hdr=0x7fff27c7bd60,
pkt=0x7ffb2bd72500 <Address 0x7ffb2bd72500 out of bounds>, hdr_size=14,
encapsulation=0x0)

    at /home/mfry/dev/bro24/bro-2.4.1/src/Sessions.cc:760

#48 0x00000000008361e9 in NetSessions::NextPacket (this=0x5f2db20,
t=1459362263.205771, hdr=0x48d3bb8, pkt=0x7ffb2bd72500 <Address
0x7ffb2bd72500 out of bounds>, hdr_size=14) at
/home/mfry/dev/bro24/bro-2.4.1/src/Sessions.cc:231

#49 0x0000000000835ff7 in NetSessions::DispatchPacket (this=0x5f2db20,
t=1459362263.205771, hdr=0x48d3bb8, pkt=0x7ffb2bd72500 <Address
0x7ffb2bd72500 out of bounds>, hdr_size=14, src_ps=0x48d3a70) at
/home/mfry/dev/bro24/bro-2.4.1/src/Sessions.cc:187

#50 0x00000000007f2082 in net_packet_dispatch (t=1459362263.205771,
hdr=0x48d3bb8, pkt=0x7ffb2bd72500 <Address 0x7ffb2bd72500 out of bounds>,
hdr_size=14, src_ps=0x48d3a70) at
/home/mfry/dev/bro24/bro-2.4.1/src/Net.cc:281

#51 0x0000000000b33fc2 in iosource::PktSrc::Process (this=0x48d3a70) at
/home/mfry/dev/bro24/bro-2.4.1/src/iosource/PktSrc.cc:456

#52 0x00000000007f2290 in net_run () at
/home/mfry/dev/bro24/bro-2.4.1/src/Net.cc:329

#53 0x000000000074815e in main (argc=18, argv=0x7fff27c7c628) at
/home/mfry/dev/bro24/bro-2.4.1/src/main.cc:1190

On Tue, Apr 5, 2016 at 10:37 AM Azoff, Justin S <jazoff at illinois.edu> wrote:

> I've not seen that before.  Are you running any custom local scripts?
>
> Do you still have the core file that it dumped?  There's a good chance gdb
> can be used to figure out what script triggered that assertion.
>
> https://www.bro.org/support/reporting-problems.html outlines the process
> on how to use gdb against a bro core file.
> --
> - Justin Azoff
>
> > On Apr 5, 2016, at 10:04 AM, Michael Fry <michael.fry at morphick.com>
> wrote:
> >
> > Hi All,
> >
> > Has anyone encountered the assertion failure below with Bro 2.4.1? This
> is happening with live traffic at least a couple times a day since
> upgrading from Bro 2.3.2. I didn't see anything the bug tracker, so thought
> I'd float it here first.
> >
> > listening on zc:99 at 1, capture length 8192 bytes
> >
> > 1459786307.312525 processing suspended
> > 1459786307.312525 processing continued
> > 1459802619.911190 Failed to open GeoIP City database:
> /usr/share/GeoIP/GeoIPCity.dat
> > 1459802619.911190 Fell back to GeoIP Country database
> > 1459802619.911190 Failed to open GeoIP Cityv6 database:
> /usr/share/GeoIP/GeoIPCityv6.dat
> > bro: /home/mfry/dev/bro24/bro-2.4.1/src/Tag.cc:72: EnumVal*
> Tag::AsEnumVal(EnumType*) const: Assertion `type == 0 && subtype == 0'
> failed.
> > /opt/bro/share/broctl/scripts/run-bro: line 100: 11312 Aborted
>        (core dumped) nohup ${pin_command} $pin_cpu "$mybro" "$@"
> >
> > Regards,
> > Michael
> >
> > _______________________________________________
> > Bro mailing list
> > bro at bro-ids.org
> > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20160405/ab5f2e21/attachment-0001.html 


More information about the Bro mailing list