v4.6.2

Tcpreplay 4.6.2 is a bugfix release. It fixes six more issues found by the OSS-Fuzz fuzzing added in 4.6.1 — all in fragroute — along with a --pps regression that made -T select replay at full speed, and build fixes for musl, uClibc, cross compiling and macOS.

Highlights

• Six OSS-Fuzz findings fixed, all in the fragroute module chain: two NULL dereferences, a wild read, a negative memmove() size, a leak, and double frees of a module's random-number handle. No new security advisories this cycle
• --pps works with -T select again — a timespec-to-timeval conversion in select_sleep() was backwards, so the sleep was always zero and rate-limited replays ran at top speed. Present since 4.5.0
• fragroute ip_opt and tcp_opt now actually add options — the packet buffer left no room for libdnet to grow the packet, so both silently did nothing
• Builds on musl and uClibc, and --with-tcpdump / -DWITH_TCPDUMP now work when cross compiling

Continuous fuzzing: six issues found and fixed

Found by the OSS-Fuzz pipeline introduced in 4.6.1 (fuzz_fragroute). Two of them (545925319, 545818605) are follow-ups to 4.6.1 fixes for the same issue ids.

Finding	Crash type	Fix
ip_opt_apply() after a rebuilt packet no longer parses (576377476)	Null dereference	pkt_decorate() leaves pkt_ip NULL when the rebuilt IP header no longer fits (e.g. stacked ip_opt rules), and ip_checksum() dereferenced it
ip_tos_apply() on a packet that didn't fully parse (545925319)	Wild read	pkt_decorate() returns early with pkt_ip_data NULL on an overlong IP length or a fragment; the checksum length pkt_ip_data - pkt_eth_data was then a huge bogus value
mod_close() leaked every rule (545818605)	Direct memory leak	4.6.1 wired up mod_close(), which unlinked each rule but never freed the struct rule from mod_open()
tcp_opt on a non-TCP or malformed packet (547161248)	Negative-size-param	libdnet's ip_add_option() reads th_off from whatever follows the IP header, so a UDP packet or random payload made its shift length negative. tcp_opt now checks for a valid TCP header first
ip_frag and tcp_seg double free (547186627, 547151403)	Heap double free	Both keep their rand_t in a static struct and freed it in open() and close() without clearing the pointer. The open() close was added in 4.6.1 (the leak fix), so this regressed in 4.6.1 only

Other fixes

• fragroute: ip_opt and tcp_opt never added an option — pkt_buf_size was the packet's length rather than the allocation's, leaving no room for ip_add_option(). It now reserves room for IP and TCP options (#1163)
• fragroute: a failed ip_opt/tcp_opt truncated the packet by one byte — the ssize_t error return was kept in a size_t and added to the packet end (#1159, #1162)
• fragroute: tcp_opt wscale wrote an option length of 4 instead of 3 (#1164)
• fragroute: tcp_chaff paws wrote its option past the end of the duplicate's buffer, a heap overflow on IPv4 and IPv6 (#1165)
• fragroute: ip_chaff opt leaked the duplicate packet on IPv6, and tcp_chaff paws computed a negative length when th_off was below 5 (#1165, #1166)
• fragroute: ip_chaff <ttl> set the IPv6 hop limit on the original packet instead of the duplicate (#1166)
• build: look for fts_read() in libfts on musl and uClibc (#1153)
• build: --with-tcpdump / -DWITH_TCPDUMP are trusted when cross compiling; --without-tcpdump and -DWITH_TCPDUMP=no/OFF skip the host lookup (#1152, #1167, #1168, #1169)
• build: fix txring.h on musl, where <linux/if_ether.h> clashed with <netinet/if_ether.h> (#1154)
• build: fix clang warnings on macOS — -Waddress-of-packed-member in the checksum helpers, RAND_MAX float conversion, and a libopts false positive (#1155)
• community: CONTRIBUTING.md, CODE_OF_CONDUCT.md, issue forms and a PR template; LICENSE moved to the repo root (#1145, #1146, #1147, #1149)

Credits

Thanks to @gbritoda for reporting the --pps regression, to @GabrielGanne for the fix, and to @yegorich for the musl, uClibc and cross-compile build fixes. The fragroute fixes came from the OSS-Fuzz pipeline.

What's Changed

• Release 4.6.1 by @fklassen in #1142
• community: add CONTRIBUTING/CODE_OF_CONDUCT, convert issue templates to forms by @fklassen in #1145
• build: move LICENSE to repo root, strip custom preamble by @fklassen in #1146
• community: fix and update PULL_REQUEST_TEMPLATE.md by @fklassen in #1147
• skills: add delete-merged-branch, release-checklist, security-advisory-triage by @fklassen in #1148
• community: fix issue-template label case mismatch by @fklassen in #1149
• fix --pps option regression by @GabrielGanne in #1151
• cmake: fix tcpdump detection when cross compiling by @yegorich in #1152
• build: look for fts_read() in libfts by @yegorich in #1153
• build: fix clang warnings on macOS by @tcpreplay-dev in #1155
• fragroute: fix NULL deref in ip_opt when packet no longer parses by @tcpreplay-dev in #1156
• fragroute: fix wild read in ip_tos when packet no longer parses by @tcpreplay-dev in #1157
• fragroute: free rules in mod_close by @tcpreplay-dev in #1158
• fragroute: only add TCP options to packets with a valid TCP header by @tcpreplay-dev in #1159
• fragroute: fix double free of ip_frag's rand_t by @tcpreplay-dev in #1160
• fragroute: hold ip_add_option() result in an ssize_t in ip_opt by @tcpreplay-dev in #1162
• fragroute: fix tcp_chaff paws buffer overflow and ip_chaff packet leak by @tcpreplay-dev in #1165
• fragroute: set ip_chaff ttl on the duplicate and reject tcp_chaff paws th_off < 5 by @tcpreplay-dev in #1166
• fragroute: record the real packet buffer size so options have room to be added by @tcpreplay-dev in #1163
• fragroute: fix tcp_opt wscale option length by @tcpreplay-dev in #1164
• fragroute: fix double free of tcp_seg's rand_t by @tcpreplay-dev in #1161
• txring.h: fix build with musl by @yegorich in #1154
• docs: document -DWITH_TCPDUMP=no in the CMake option mapping by @tcpreplay-dev in #1167
• configure: trust --with-tcpdump when cross compiling by @tcpreplay-dev in #1168
• cmake: treat WITH_TCPDUMP=OFF/0/FALSE like no by @tcpreplay-dev in #1169
• 4.6.2: add CHANGELOG entry, bump version by @tcpreplay-dev in #1170
• 4.6.2 by @fklassen in #1171

New Contributors

• @yegorich made their first contribution in #1152

Verifying the download

The .tar.gz/.tar.xz tarballs are accompanied by detached PGP signatures (.asc), signed with the tcpreplay release key (tcpreplay@appneta.com, fingerprint 84E4FA215C934A7D97DC76D5E9E2149793BDE17E):

gpg --verify tcpreplay-4.6.2.tar.xz.asc tcpreplay-4.6.2.tar.xz

Full Changelog: v4.6.1...v4.6.2