nzymedefense / nzyme

Network Defense System.
https://www.nzyme.org/
Other
1.41k stars 145 forks source link

db exception "ERROR: invalid byte sequence for encoding "UTF8": 0x00" #669

Open jweglinski opened 2 years ago

jweglinski commented 2 years ago

Hello! I have recently encountered Java exception in application log complaining about data types provided. As I am encountering large number of strange SSID (single or double char, like ']?', '2n', '?_') I think that this time SSID 0x0 was logged. Exception stack below:

12:51:35.978 [sentry-scanner] ERROR horse.wtf.nzyme.dot11.networks.sentry.Sentry - Could not sync sentry SSID. Skipping.
org.jdbi.v3.core.statement.UnableToExecuteStatementException: org.postgresql.util.PSQLException: ERROR: invalid byte sequence for encoding "UTF8": 0x00 [statement:"SELECT COUNT(*) FROM sentry_ssids WHERE ssid = :ssid", arguments:{positional:{}, named:{ssid:^@%}, finder:[]}]
        at org.jdbi.v3.core.statement.SqlStatement.internalExecute(SqlStatement.java:1790) ~[nzyme-1.2.2.jar:?]
        at org.jdbi.v3.core.result.ResultProducers.lambda$getResultSet$2(ResultProducers.java:64) ~[nzyme-1.2.2.jar:?]
        at org.jdbi.v3.core.result.ResultIterable.lambda$of$0(ResultIterable.java:54) ~[nzyme-1.2.2.jar:?]
        at org.jdbi.v3.core.result.ResultIterable.first(ResultIterable.java:188) ~[nzyme-1.2.2.jar:?]
        at horse.wtf.nzyme.dot11.networks.sentry.Sentry.lambda$syncDatabase$1(Sentry.java:75) ~[nzyme-1.2.2.jar:?]
        at org.jdbi.v3.core.Jdbi.withHandle(Jdbi.java:342) ~[nzyme-1.2.2.jar:?]
        at horse.wtf.nzyme.database.Database.withHandle(Database.java:96) ~[nzyme-1.2.2.jar:?]
        at horse.wtf.nzyme.dot11.networks.sentry.Sentry.syncDatabase(Sentry.java:71) ~[nzyme-1.2.2.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) [?:?]
        at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305) [?:?]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305) [?:?]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
        at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: org.postgresql.util.PSQLException: ERROR: invalid byte sequence for encoding "UTF8": 0x00
        at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2553) ~[nzyme-1.2.2.jar:?]
        at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2285) ~[nzyme-1.2.2.jar:?]
        at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:323) ~[nzyme-1.2.2.jar:?]
        at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:481) ~[nzyme-1.2.2.jar:?]
        at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:401) ~[nzyme-1.2.2.jar:?]
        at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:164) ~[nzyme-1.2.2.jar:?]
        at org.postgresql.jdbc.PgPreparedStatement.execute(PgPreparedStatement.java:153) ~[nzyme-1.2.2.jar:?]
        at org.jdbi.v3.core.statement.SqlLoggerUtil.wrap(SqlLoggerUtil.java:31) ~[nzyme-1.2.2.jar:?]
        at org.jdbi.v3.core.statement.SqlStatement.internalExecute(SqlStatement.java:1782) ~[nzyme-1.2.2.jar:?]
        ... 13 more
lennartkoopmann commented 2 years ago

(Formatted for readability. Please always use code blocks for output, configuration or code.)

lennartkoopmann commented 2 years ago

While this should be handled more gracefully by the database handling ode, I think the underlying issue is that you are receiving malformed frames. Can you post your entire nzyme.log file?

jweglinski commented 2 years ago

Yes - I think my installation is suffering from #638 - many log entries with 12:43:59.338 [probe-loop-0] INFO horse.wtf.nzyme.dot11.Dot11TaggedParameters - Malformed 802.11 tagged parameters:

nzyme 1.2.2 on Linux with two wifi nics: Qualcomm Atheros Communications AR9271 802.11n Intel Corporation Centrino Wireless-N 1030

but malformed frames are captured also when only Atheros nic is enabled...