TLDR; TCPEDIT_ERRORs are ignored by tcprewrite when rewriting packets, allowing users to create faulty pcaps without warning/error.
When using tcprewrite to add a vlan tag to untagged packets, and you omit either the --enet-vlan-cfi, or the --enet-vlan-pri option, the resulting pcap is truncated by 4 bytes (size of vlan header).
The underlying problem is that the en10mb plugin doesn't require the two options during initialization, but does require them during dlt_en10mb_encode when encountering previously untagged packets (see lines 691-706 in en10mb.c). The plugin correctly returns a TCPEDIT_ERROR instead of pktlen.
tcpedit_packet turns the TCPEDIT_ERROR into a TCPEDIT_SOFT_ERROR (lines 104-107 in tcpedit.c), which tcprewrite happily ignores (lines 317-323 in tcprewrite.c). Unfortunately, the vlan header has already been added to the packet in memory, but since the packet length is not updated, the resulting pcap only captures the original length of data, effectively truncating the last 4 bytes because of the vlan tag insertion.
To Reproduce
- Grab a pcap with an untagged pcap
- Run
tcprewrite -i <infile> -o <outfile> --enet-vlan=add --enet-vlan-tag=100
- No warnings or errors are communicated
- The resulting pcap has a vlan tag inserted but is missing the last 4 bytes
First detected on 4.5.2.
TLDR; TCPEDIT_ERRORs are ignored by tcprewrite when rewriting packets, allowing users to create faulty pcaps without warning/error.
When using tcprewrite to add a vlan tag to untagged packets, and you omit either the
--enet-vlan-cfi, or the--enet-vlan-prioption, the resulting pcap is truncated by 4 bytes (size of vlan header).The underlying problem is that the
en10mbplugin doesn't require the two options during initialization, but does require them duringdlt_en10mb_encodewhen encountering previously untagged packets (see lines 691-706 inen10mb.c). The plugin correctly returns aTCPEDIT_ERRORinstead ofpktlen.tcpedit_packetturns theTCPEDIT_ERRORinto aTCPEDIT_SOFT_ERROR(lines 104-107 intcpedit.c), whichtcprewritehappily ignores (lines 317-323 intcprewrite.c). Unfortunately, the vlan header has already been added to the packet in memory, but since the packet length is not updated, the resulting pcap only captures the original length of data, effectively truncating the last 4 bytes because of the vlan tag insertion.To Reproduce
tcprewrite -i <infile> -o <outfile> --enet-vlan=add --enet-vlan-tag=100First detected on 4.5.2.