v4.6.1

Tcpreplay 4.6.1 is a security and hardening release. Its centerpiece is a new continuous fuzzing pipeline — three libFuzzer targets covering the pcap parser, the fragroute rules engine, and the tcpprep --services parser, submitted to OSS-Fuzz — which found and fixed nine defects in its first days running, on top of three new GHSA security advisories reported directly and a round of UBSan/ASan hardening across the packet parsers.

Highlights

• Continuous fuzzing via OSS-Fuzz — three new libFuzzer targets (fuzz_pcap, fuzz_fragroute, fuzz_services) run continuously against every commit; this release fixes all nine issues they found in their first run, from a heap-buffer-overflow write to a resource-exhaustion hang
• 3 new security advisories fixed, two of them CVSS 7.0+ (High)
• UBSan now runs alongside ASan in CI, catching a class of misaligned-access bugs that ASan alone doesn't — the fix also made wire-format header structs packed, removing systemic misaligned access across the packet parsers
• --xdp-batch-size removed — measurement on 100GigE found no benefit from raising it above the default of 1, now that AF_XDP sends pipeline across the whole umem (from 4.6.0)

Security

Three new advisories, all reported by tao pan (@pant0m):

Advisory	CVSS	Severity	Component
GHSA-4hqm-8v2c-9pwj	7.1	High	Three heap out-of-bounds reads in tcpliveplay's pcap parsing — one can leak adjacent heap memory onto the live network
GHSA-pmmx-m8p5-969j	7.0	High	Inverted bounds check in the dlt_radiotap plugin — an 8-year-old >=/<= typo that made an oversized memcpy() run exactly when it was guaranteed to overflow. Not reachable through the bundled CLIs, which clamp caplen; only third-party code linking libtcpedit directly on unclamped input is affected
GHSA-p3f2-88rg-9mch	6.1	Medium	Heap out-of-bounds read in tcpprep cache-file parsing — the file's packets_per_byte field was never cross-checked against the hardcoded indexing stride every reader actually uses

Continuous fuzzing: nine issues found and fixed

This cycle added test/fuzz/ — three libFuzzer targets built against ASan/UBSan and submitted to OSS-Fuzz (#1092, #1101, #1103). Every issue below was found by that pipeline before it ever reached a user, and none had a public GitHub issue filed for it (#1118) — they're listed here for the first time now that fixes are shipped.

Finding	Crash type	Fix
ip_chaff_apply() heap-buffer-overflow write	2-byte OOB write	A buffer-capacity calculation assumed the IP header started 2 bytes earlier than it actually does (missing a PKT_BUF_ALIGN offset), overstating room by exactly 2 bytes — libdnet wrote an inserted IP option 2 bytes past the heap allocation
ip_chaff_apply() pointer corruption → OOB read	Out-of-bounds read	The option-insert path used libdnet's return value unconditionally, including on failure, silently shifting a packet pointer out of bounds on every failed call; a rules file stacking several ip_chaff opt directives could walk it far enough to underflow a length calculation downstream
mod_apply() exponential packet growth	Timeout (>60s)	Duplicating rules (ip_chaff, tcp_chaff) double the packet queue on every application; stacking ~30 of them in a rules file turns one packet into gigabytes of output. Now bounded at a hard packet-count cap between rule applications
mod_close() never called	Direct memory leak	A fully-implemented cleanup function that freed the whole parsed rule chain was never wired up — leaked on every fragroute_close() call, not just in fuzzing
rand_t leak in ip_frag/tcp_seg	Direct memory leak	Both modules store their RNG handle in a file-scope static rather than per-rule heap state; a repeated directive overwrote the handle without closing the previous one
pktq_shuffle() on an empty queue	Unexpected exit	An empty-queue edge case was misdiagnosed as an allocation failure and called exit()
get_l2len_protocol() on an unsupported DLT	Unexpected exit	The one error path in the function that called exit() instead of returning an error code, like every other branch
raw_ip_opt_parse() too-few-tokens	Null dereference	A tcp_opt raw rule with one fewer token than ip_opt raw needs slipped past a caller-side length check and read past the token array
delay_apply() on an empty queue	Null dereference	Same empty-queue class as pktq_shuffle() above, in a different module

Other fixes

• UBSan hardening: fixed misaligned MPLS label parsing and a negative left shift in fragroute's ip_ttl; wire-format header structs are now packed, fixing systemic misaligned access flagged once UBSan ran in CI (#1100, #1104)
• fragroute: fixed a use-after-free in pkt_close() on repeated context setup (#1102)
• txring: fixed TX_RING failing outright on interfaces with an MTU of ~1365 or less, e.g. 1280, the IPv6 minimum (#1090)
• common: fixed an out-of-bounds write from an undersized struct bpf_program stub on HAVE_LIBBPF builds, hit by tcpprep/tcpbridge's -f option (#1121)
• fragroute: fixed an uninitialized-stack read in mod_open()'s debug logging — an intermittent crash under --dbug (#1124)
• tcpedit: fixed 17 -Waddress-of-packed-member warnings left by the packed-struct fix above (#1122)
• test: added a dependency-free unit test suite under test/unit, run by make check and ctest (#1079)
• build: minor compilation fixes and warning cleanups found while building with meson warning_level=3 (#1116, contributed by @GabrielGanne)

Credits

Thanks to tao pan (@pant0m) for the three security reports behind this release, and to @GabrielGanne for compilation cleanups. The remaining nine fixes came from the new OSS-Fuzz pipeline this release also introduces.

What's Changed

• xdp: remove --xdp-batch-size — measurement on 100GigE found no benefit from raising it above the default of 1 (#1128)
• tcpedit: fix 17 -Waddress-of-packed-member warnings left by the packed-struct fix (#1122, #1127)
• common: fix out-of-bounds write from an undersized struct bpf_program stub on HAVE_LIBBPF builds (#1121, #1125)
• fragroute: fix uninitialized-stack read in mod_open()'s debug logging under --dbug (#1124)
• fix: flow_decode() over-required bytes for a minimal ICMP/ICMPv6 header (#1119, #1120)
• fix(fuzz): don't auto-file public GitHub issues from OSS-Fuzz findings (#1092, #1118)
• fix(fuzz): build a minimal libpcap for OSS-Fuzz targets instead of linking the system one (#1092, #1117)
• ci: run UBSan alongside ASan; mark wire-format header structs packed (#1101, #1104, #1105, #1112)
• test: add libFuzzer targets for the pcap, fragroute rules, and tcpprep --services parsers; submit to OSS-Fuzz (#1092, #1103, #1113, #1114, #1115)
• txring: fix TX_RING failing outright on interfaces with an MTU of ~1365 or less (#1090, #1107, #1109, #1111)
• test: add a dependency-free unit test suite under test/unit, run by make check/ctest (#1079, #1091, #1099, #1106)
• fragroute: fix a use-after-free in pkt_close() on repeated context setup (#1102)
• build: minor compilation fixes and warning cleanups found building with meson warning_level=3 (#1116)
• Security: fix inverted bounds check in dlt_radiotap_get_80211() — GHSA-pmmx-m8p5-969j (#1141)
• Security: fix three heap OOB reads in tcpliveplay's pcap parsing — GHSA-4hqm-8v2c-9pwj (#1140)
• Security: reject cache files whose packets_per_byte doesn't match the hardcoded indexing stride — GHSA-p3f2-88rg-9mch (#1139)
• fragroute: bound mod_apply() against exponential packet-count growth (OSS-Fuzz 546146015, #1138)
• fragroute: fix a rand_t leak in ip_frag_open()/tcp_seg_open() on a repeated directive (OSS-Fuzz 545925322, #1137)
• fragroute: wire up mod_close(), implemented but never called (OSS-Fuzz 545818605, #1136)
• fragroute: fix a null-deref in delay_apply() on an empty packet queue (OSS-Fuzz 545965632, #1135)
• fragroute: fix a null-deref in raw_ip_opt_parse() on a tcp_opt raw rule with too few tokens (OSS-Fuzz 545904184, #1134)
• fragroute: fix pointer corruption in ip_chaff_apply() on a failed option insert (OSS-Fuzz 545925319, #1133)
• fragroute: fix a heap-buffer-overflow in ip_chaff_apply()'s option insertion (OSS-Fuzz 545965630, #1132)
• common: fix an Unexpected-exit in get_l2len_protocol() on an unsupported DLT type (OSS-Fuzz 545718476, #1131)
• fragroute: fix an Unexpected-exit in pktq_shuffle() on an empty packet queue (OSS-Fuzz 545904182, #1130)

Verifying the download

The .tar.gz/.tar.xz tarballs are accompanied by detached PGP signatures (.asc), signed with the tcpreplay release key (tcpreplay@appneta.com, fingerprint 84E4FA215C934A7D97DC76D5E9E2149793BDE17E):

gpg --verify tcpreplay-4.6.1.tar.xz.asc tcpreplay-4.6.1.tar.xz

Full Changelog: v4.6.0...v4.6.1