Skip to content

[Bug] tcprewrite adding vlan tag with missing options results in broken output #990

@Big4SMK

Description

@Big4SMK

TLDR; TCPEDIT_ERRORs are ignored by tcprewrite when rewriting packets, allowing users to create faulty pcaps without warning/error.

When using tcprewrite to add a vlan tag to untagged packets, and you omit either the --enet-vlan-cfi, or the --enet-vlan-pri option, the resulting pcap is truncated by 4 bytes (size of vlan header).
The underlying problem is that the en10mb plugin doesn't require the two options during initialization, but does require them during dlt_en10mb_encode when encountering previously untagged packets (see lines 691-706 in en10mb.c). The plugin correctly returns a TCPEDIT_ERROR instead of pktlen.
tcpedit_packet turns the TCPEDIT_ERROR into a TCPEDIT_SOFT_ERROR (lines 104-107 in tcpedit.c), which tcprewrite happily ignores (lines 317-323 in tcprewrite.c). Unfortunately, the vlan header has already been added to the packet in memory, but since the packet length is not updated, the resulting pcap only captures the original length of data, effectively truncating the last 4 bytes because of the vlan tag insertion.

To Reproduce

  1. Grab a pcap with an untagged pcap
  2. Run tcprewrite -i <infile> -o <outfile> --enet-vlan=add --enet-vlan-tag=100
  3. No warnings or errors are communicated
  4. The resulting pcap has a vlan tag inserted but is missing the last 4 bytes

First detected on 4.5.2.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions