4.5.0 beta1

.github/workflows/github-actions-ci.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Create configure script
         run: ./autogen.sh
       - name: configure
-        run: ./configure --with-testnic=eth0 --disable-local-libopts
+        run: ./configure --with-testnic=eth0 --disable-local-libopts --enable-asan
       - name: make
         run: make
       - name: make dist

docs/CHANGELOG

@@ -1,5 +1,7 @@
-06/02/2024 Version 4.5.0-beta1
-    - fix nansecond timestamp regression bug (#863)
+06/08/2024 Version 4.5.0-beta1
+    - memory leak in tcpprep when using include/exclude (#869)
+    - memory leak in tcpprep when using RegEx (#867)
+    - fix nanosecond timestamp regression bug (#863)
     - autotools - AC_HELP_STRING is obsolete in 2.70 (#856)
     - configure.ac: do not run conftest in case of cross compilation (#849)
     - Haiku support (#847)
@@ -8,20 +10,26 @@
     - add check for IPv6 extension header length (#827 #842)
     - GitHub template for pull requests (#839)
     - handle IPv6 fragment extension header (#832 #837)
+    - Linux tap interfaces fail intermittently (#828)
     - Infinite loop in tcprewrite at get.c (#827 #842)
-    - add check for empty CIDR (#824 #843)
+    - SLL incorrect size and protocol when converted to Ethernet (#826)
+    - CVE-2023-43279 add check for empty CIDR (#824 #843)
     - AF_XDF socket extension (#822 #823)
     - configure.ac: unify search dirs for pcap and add lib32 (#819)
-    - double free in tcpedit_dlt_cleanup in tcprewrite (#813 #855)
+    - tcpreplay-edit recomputes IPv4 checksums unnecessarily (#815 #846)
+    - CVE-2023-4256 double free in tcprewrite DLT_JUNIPER_ETHER (#813 #851)
     - dlt_jnpr_ether_cleanup: check config before cleanup (#812 #851)
-    - nanosecond timestamps (#796)
+    - SEGV on invalid Juniper Ethernet header length (#811)
+    - nanosecond timestamps support (#796)
+    - Linux cooked packet fatal error (#792)
     - low PPS values run at full speed after several days (#779)
     - create DLT_LINUX_SLL2 plugin (#727)
 
 06/04/2023 Version 4.4.4
     - overflow check fix for parse_mpls (#795)
     - tcpreplay-edit: prevent L2 flooding of ipv6 unicast packets (#793)
-    - CVE-2023-27786 bugs caused by strtok_r (#782 #784 #785 #786 #787 #788)
+    - CVE-2023-27784 CVE-2023-27785 CVE-2023-27786 CVE-2023-27787 CVE-2023-27788 CVE-2023-27789
+      bugs caused by strtok_r (#782 #784 #785 #786 #787 #788)
     - CVE-2023-27783 reachable assert in tcpedit_dlt_cleanup (#780)
     - add CI and C/C++ Linter and CodeQL (#773)
     - reachable assert in fast_edit_packet (#772)
@@ -53,15 +61,16 @@
     - build failures Debian/kfreebsd (#706)
     - bus error when building on armhf (#705)
     - typo fixes (#704)
-    - heap buffer overflow in tcpreplay (#703)
-    - double free in Juniper DLT (#702)
+    - CVE-2022-27418 heap buffer overflow in tcpreplay (#703)
+    - CVE-2022-27416 double free in Juniper DLT (#702)
 
 01/31/2022 Version 4.4.0
     - remove obsolete FORCE_ALIGN support to fix macOS 11 compile (#695)
     - add a security policy document (#689)
+    - CVE-2021-45386 CVE-2021-45387 two reachable assertions in add_tree_ipv4() and add_tree_ipv6() (#687 #678)
     - ability to specify directory of pcap files (#682)
     - incorrect PPS rate for long-running sessions (#679)
-    - option --skipbroadcast not working (#677)
+    - option --skipbroadcast not working (#677 #678)
     - revert #630 to fix --multiplier issues (#674)
     - gcc 9.3 compiler warnings (#670)
     - installed netmap not automatically detected (#669)
@@ -100,15 +109,15 @@
     - CVE-2018-20553 Correct L2 header length calculations so that IP header offset is correct (#584)
     - Correct L2 header length to correct IP header offset (#583)
     - Fix warnings from gcc version 10 (#580)
-    - Heap Buffer Overflow in randomize_iparp (#579)
+    -  CVE-2020-23273 Heap Buffer Overflow in randomize_iparp (#579)
     - Use after free in get_ipv6_next (#578)
     - CVE-2020-12740 Heap Buffer Overflow in git_ipv6_next (#576)
     - Call pcap_freecode() on pcap_compile() (#572)
     - Increase max snaplen to 262144 (#571)
     - Fix divide by zero in fuzzing (#570)
     - Unique IP repeats at very high iteration counts (#566)
     - Fails to compile on FreeBSD amd64 13.0 (#558)
-    - Heap Buffer Overflow in do_checksum (#556) (#577)
+    - CVE-2020-18976 Heap Buffer Overflow in do_checksum (#556) (#577)
     - Attempt to correct corrupt pcap files, if possible (#557)
     - Fix GCC v10 warnings (#555)
     - Remove some duplicated SOURCES entries (#551)

src/common/sendpacket.c

@@ -524,10 +524,6 @@ sendpacket_open(const char *device,
                 sendpacket_type_t sendpacket_type _U_,
                 void *arg _U_)
 {
-#ifdef HAVE_TUNTAP
-    char sys_dev_dir[128];
-    bool device_exists;
-#endif
     sendpacket_t *sp;
     struct stat sdata;
 
@@ -536,11 +532,6 @@ sendpacket_open(const char *device,
 
     errbuf[0] = '\0';
 
-#ifdef HAVE_TUNTAP
-    snprintf(sys_dev_dir, sizeof(sys_dev_dir), "/sys/class/net/%s/", device);
-    device_exists = access(sys_dev_dir, R_OK) == 0;
-#endif
-
     /* khial is universal */
     if (stat(device, &sdata) == 0) {
         if (((sdata.st_mode & S_IFMT) == S_IFCHR)) {
@@ -563,7 +554,7 @@ sendpacket_open(const char *device,
             }
         }
 #ifdef HAVE_TUNTAP
-    } else if (strncmp(device, "tap", 3) == 0 && !device_exists) {
+    } else if (strncmp(device, "tap", 3) == 0) {
         sp = sendpacket_open_tuntap(device, errbuf);
 #endif
     } else {
@@ -895,9 +886,12 @@ sendpacket_open_tuntap(const char *device, char *errbuf)
     strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name) - 1);
 
     if (ioctl(tapfd, TUNSETIFF, (void *)&ifr) < 0) {
-        snprintf(errbuf, SENDPACKET_ERRBUF_SIZE, "Unable to create tuntap interface: %s", device);
-        close(tapfd);
-        return NULL;
+        // ignore EBUSY - it just means that the tunnel has already been opened
+        if (errno != EBUSY) {
+            snprintf(errbuf, SENDPACKET_ERRBUF_SIZE, "Unable to create tuntap interface: %s errno=%d", device, errno);
+            close(tapfd);
+            return NULL;
+        }
     }
 #elif defined(HAVE_FREEBSD)
     if (*device == '/') {

src/tcpedit/plugins/dlt_en10mb/en10mb.c

@@ -464,7 +464,7 @@
  * Returns: TCPEDIT_ERROR | TCPEDIT_OK | TCPEDIT_WARN
  */
 int
 dlt_en10mb_encode(tcpeditdlt_t *ctx, u_char *packet, int pktlen, tcpr_dir_t dir)
 {
     struct tcpr_802_1q_hdr *vlan_hdr;
     struct tcpr_ethernet_hdr *eth;
@@ -519,9 +519,9 @@
     }
 
     /* newl2len for some other DLT -> ethernet */
-    else if (config->vlan == TCPEDIT_VLAN_ADD) {
-        /* if add a vlan then 18, */
-        newl2len = TCPR_802_1Q_H;
+    else {
+        newl2len = config->vlan == TCPEDIT_VLAN_ADD ? TCPR_802_1Q_H : TCPR_802_3_H;
+        oldl2len = ctx->l2len;
     }
 
     if ((uint32_t)pktlen < newl2len || pktlen + newl2len - ctx->l2len > MAXPACKET) {
@@ -555,7 +555,6 @@
 
     /* update the total packet length */
     pktlen += (int)(newl2len - oldl2len);
-    ctx->l2len += (int)(newl2len - oldl2len);
 
     /* set the src & dst address as the first 12 bytes */
     eth = (struct tcpr_ethernet_hdr *)(packet + ctx->l2offset);
@@ -665,6 +664,11 @@
         }
     }
 
+    if (newl2len == TCPR_802_3_H) {
+        /* all we need for 802.3 is the proto */
+        eth->ether_type = ctx->proto;
+    }
+
     if (config->vlan == TCPEDIT_VLAN_ADD || (config->vlan == TCPEDIT_VLAN_OFF && extra->vlan)) {
         vlan_hdr = (struct tcpr_802_1q_hdr *)(packet + extra->vlan_offset);
         if (config->vlan == TCPEDIT_VLAN_ADD) {
@@ -812,7 +816,7 @@
     if (l2len == -1 || pktlen < l2len)
         return NULL;
 
-    assert(ctx->decoded_extra_size == sizeof(*extra));
+    assert(ctx->decoded_extra_size >= sizeof(*extra));
     extra = (en10mb_extra_t *)ctx->decoded_extra;
     eth = (struct tcpr_ethernet_hdr *)(packet + ctx->l2offset);
     assert(eth);

src/tcpedit/plugins/dlt_jnpr_ether/jnpr_ether.c

@@ -64,9 +64,7 @@ dlt_jnpr_ether_register(tcpeditdlt_t *ctx)
     plugin = tcpedit_dlt_newplugin();
 
     plugin->provides += PLUGIN_MASK_PROTO + PLUGIN_MASK_SRCADDR + PLUGIN_MASK_DSTADDR;
-    plugin->
-        requires
-    = 0;
+    plugin->requires = 0;
 
     /* what is our DLT value? */
     plugin->dlt = dlt_value;
@@ -304,6 +302,13 @@ dlt_jnpr_ether_proto(tcpeditdlt_t *ctx, const u_char *packet, int pktlen)
     memcpy(&jnpr_hdr_len, &packet[JUNIPER_ETHER_EXTLEN_OFFSET], 2);
 
     jnpr_hdr_len = ntohs(jnpr_hdr_len) + JUNIPER_ETHER_HEADER_LEN;
+    if (jnpr_hdr_len > pktlen) {
+        tcpedit_seterr(ctx->tcpedit,
+                       "Juniper header length %d invalid: it is greater than packet length %d",
+                       jnpr_hdr_len, pktlen);
+        return TCPEDIT_ERROR;
+    }
+
     ethernet = packet + jnpr_hdr_len;
 
     /* let the en10mb plugin do the rest of the work */

src/tcpedit/plugins/dlt_plugins.c

@@ -96,12 +96,6 @@ const char *tcpeditdlt_bit_info[] = {"Missing required Layer 3 protocol.",
  * Public functions
  ********************************************************************/
 
-/*
- * Ensure init/cleanup are called only once
- * Assume a single tcpedit struct and return the previously allocated context.
- */
-static int tcpedit_dlt_is_initialized = 0;
-
 /**
  * initialize our plugin library.  Pass the DLT of the source pcap handle.
  * Actions:
@@ -123,9 +117,6 @@ tcpedit_dlt_init(tcpedit_t *tcpedit, const int srcdlt)
     assert(tcpedit);
     assert(srcdlt >= 0);
 
-    if (tcpedit_dlt_is_initialized++ > 0)
-        return tcpedit->dlt_ctx;
-
     ctx = (tcpeditdlt_t *)safe_malloc(sizeof(tcpeditdlt_t));
 
     /* do we need a side buffer for L3 data? */
@@ -454,9 +445,6 @@ tcpedit_dlt_cleanup(tcpeditdlt_t *ctx)
 {
     tcpeditdlt_plugin_t *plugin;
 
-    if (--tcpedit_dlt_is_initialized <= 0)
-        return;
-
     assert(ctx);
 
     plugin = ctx->plugins;

src/tcpprep_api.c

@@ -91,6 +91,14 @@
         cidr = cidr_nxt;
     }
 
+    if (options->xX.list)
+        free_list(options->xX.list);
+
+    if (options->xX.cidr)
+        safe_free(options->xX.cidr);
+
+    regfree(&options->preg);
+
     safe_free(options);
 
     safe_free(ctx->outfile);