The information you are about to copy is INTERNAL!
DO NOT share it with anyone outside Check Point.
Policy Verification takes very long time and eventually times out
| Solution ID |
sk98106 |
| Product |
Security Management, Multi-Domain Management / Provider-1 |
| Version |
R77, R77.10 |
| Platform / Model |
Intel/PC, Smart-1 |
| Date Created |
08-Jan-2014
|
| Last Modified |
19-Dec-2016
|
Symptoms
Policy Verification takes very long time and eventually times out.
Debug of FWM daemon (per sk86186) during policy verification ends with the following:
Verifier warnings: The Converter failed to convert policy. Possibly wrong policy name.
FWM daemon crashes with a core dump file. Core dump files contains the following stack:
#0 0x... in __kernel_vsyscall ()
#1 0x... in raise () from /lib/libc.so.6
#2 0x... in abort () from /lib/libc.so.6
#3 0x... in __libc_message () from /lib/libc.so.6
#4 0x... in free () from /lib/libc.so.6
#5 0x... in ?? () from /usr/lib/libstdc++.so.5
#6 0x... in ?? () from /usr/lib/libstdc++.so.5
#7 0x... in FreeErrorMessages (a_psErrMsg=0x..., a_nSize=...) at VerifyManagerCLI.cpp
#8 0x... in fwm_filtervrfy (...) at fwmrules.c
#9 0x... in fwm_child_cmain (...) at fwmasync.c
#10 0x... in fwm_handle_async (...) at fwmasync.c
#11 0x... in fwm_cpmi_command_handler (...) at fwm_cpmi_server.c
#12 0x... in cpmi_gen_handler (...) at fwm_cpmi_server.c
#13 0x... in cpmi_server_demultiplex_datagram (...) at CpmiOpsecServer.c
Output of valgrind attached to FWM daemon shows:
Invalid free() / delete / delete[] / realloc()
at 0x...: operator delete[](void*) (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
by 0x...: FreeErrorMessages (VerifyManagerCLI.cpp)
by 0x...: fwm_filtervrfy (fwmrules.c)
by 0x...: fwm_child_cmain (fwmasync.c)
by 0x...: fwm_handle_async (fwmasync.c)
by 0x...: fwm_cpmi_command_handler (fwm_cpmi_server.c)
by 0x...: cpmi_gen_handler (fwm_cpmi_server.c)
by 0x...: cpmi_server_demultiplex_datagram (in /opt/CPshrd-R77/lib/libopsec.so)
by 0x...: opsec_demultiplex_datagram (in /opt/CPshrd-R77/lib/libopsec.so)
by 0x...: ??? (in /opt/CPshrd-R77/lib/libopsec.so)
by 0x...: opsec_demultiplex_datagram (in /opt/CPshrd-R77/lib/libopsec.so)
by 0x...: opsec_fwasync_conn_handler (in /opt/CPshrd-R77/lib/libopsec.so)
Solution
|
Note: To view this solution you need to
Sign In
.
|
