ironbee dies if there is a body in response to HEAD request about ironbee HOT 5 CLOSED

Eldar,

On Wed, Dec 12, 2012 at 3:53 PM, Eldar Zaitov [email protected]:

2012-12-13T01:52:17.9648+0400 INFO - ( htp_response.c:729 ) [16723] LibHTP
Invalid response line
ibcli1: data.c:601: ib_data_get_ex: Assertion `dpi != ((void *)0)' failed.

Program received signal SIGABRT, Aborted.

I seem to be unable to reproduce this. Can you send me the configuration,
request and response files that you're using, as well as the exact command
line and any other information that might be helpful in reproducing the
crash?

Thanks

-Nick

from ironbee.

$ cat ironbee.conf

LogLevel 9 # can be any

SensorId AAAABBBB-1111-2222-3333-FFFF00000023
SensorName blabla
SensorHostname blablabla.com

LoadModule "ibmod_htp.so"
LoadModule "ibmod_pcre.so"
LoadModule "ibmod_ac.so"
LoadModule "ibmod_rules.so"

Set parser "htp"

AuditEngine RelevantOnly
AuditLogIndex None
AuditLogBaseDir /tmp
AuditLogSubDirFormat "%Y%m%d-%H%M"
AuditLogDirMode 0755
AuditLogParts minimal request requestBody -response -responseBody

RequestBuffering Off

<Site site1>
    SiteId AAAABBBB-1111-2222-4444-000000000001
    Hostname *

    RuleEnable "all"

    <Location />
        LogLevel 9
        AuditLogParts +debug
    </Location>
</Site>

$ gdb ibcli
(gdb) r --request-file 1 --response-file 2 --config ironbee.conf

Now you have all the required info.

from ironbee.

On Sat, Dec 15, 2012 at 9:10 AM, Eldar Zaitov [email protected]:

Now you have all the required info.

$ gdb ibcli
(gdb) r --request-file 1 --response-file 2 --config ironbee.conf

You didn't attach the request and response files.

-Nick

from ironbee.

both are in the first message (hexdumps).

from ironbee.

Eldar,

I've pushed a fix for this to the 0.6.x branch.

Thanks for reporting.

-Nick

from ironbee.