Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to turn on/off fix packet header length #846

Conversation

ChuckCottrill
Copy link

@ChuckCottrill ChuckCottrill commented Jan 31, 2024

Description:
Change tcprewrite to add a option flag fixhdrlen to enable (default disable) modifying packet header length.
Only modify packet header length when flag fixhdrlen is used.

Explanation:
The tcprewrite program modifies packet length in an unexpected and (sometimes) undesireable manner.

Due to the change introduced in ver 4.4.1, packet header length is rewritten in certain cases, due to packet padding.
This behavior is different from 4.4.0 and prior, and needs to be guarded by a flag.

The tcprewrite program modifies packet length in an undesireable manner.
The result is an incorrect checksum, and packets may be discarded by some systems due to the incorrect checksum.

Solution is to add a flag, ``,

Solution is to add an option flag fixhdrlen, to enable change introduced in version 4.4.1

Describe the bug
TCP rewrite produces an incorrect IP and TCP checksum for certain pcap files.
TCP rewrite appears to change packet length incorrectly, and thus produces an invalid checksum;
certain downstream processing may treat said incorrect checksum as a spoofing attempt and discard packet.

Expected behavior:
TCP rewrite should only change packet length when that behavior is specifically desired (command line option?).
TCP rewrite should correctly calculate IP and TCP checksum (incorrect because length incorrect).

Reference:

To Reproduce

Steps to reproduce the behavior:

  1. uncompress packet captures:
mkdir -p pcaps
unzip tcprewrite-pcaps.zip
cp tcprewrite-pcaps/pcap-original-packet-3.pcap pcaps/.
  1. Run tcprewrite version 4.4.0 and observe the output, as follows
# version 4.4.0
VERSION="4.4.0"
# prepare
tcpreplay-4.4.0/src/tcpprep \
    --cidr=0.0.0.0/0 \
    --pcap=pcaps/pcap-original-packet-3.pcap \
    --cachefile=pcaps/pcap.cache
# use tcprewrite to rewrite packet addresses
tcpreplay-4.4.0/src/tcprewrite \
    --cachefile=pcaps/pcap.cache \
    --infile=pcaps/pcap-original-packet-3.pcap \
    --outfile=pcaps/cap-4.4.0-packet-out.pcap \
    --endpoints=10.200.1.1:10.200.1.2
  1. Run tcprewrite version 4.4.1 and observe the output, as follows
# version 4.4.1
# prepare
tcpreplay-4.4.1/src/tcpprep \
    --cidr=0.0.0.0/0 \
    --pcap=pcaps/pcap-original-packet-3.pcap \
    --cachefile=pcaps/pcap.cache
# use tcprewrite to rewrite packet addresses
tcpreplay-4.4.1/src/tcprewrite \
    --cachefile=pcaps/pcap.cache \
    --infile=pcaps/pcap-original-packet-3.pcap \
    --outfile=pcaps/cap-4.4.1-packet-out.pcap \
    --endpoints=10.200.1.1:10.200.1.2
  1. compare files, should be identical
bdiff pcaps/cap-4.4.0-packet-out.pcap pcaps/cap-4.4.1-packet-out.pcap

Packet Captures

Packet Captures to Reproduce:

  • pcap-original-packet-3.pcap
  • pcap-4.4.0-packet-3.pcap
  • pcap-4.4.1-packet-3.pcap

tcprewrite-pcaps.zip

Examine packets

Use Wireshark to examine and compare both packets.

  • Note that the ver 4.4.1 reports incorrect checksum.
  • Note also that packet length was changed, which is different behavior from desired.
  • Perhaps a flag to specify whether length change is needed or desired?

Screenshots
N/A - use Wireshark to view packets

System (please complete the following information):

  • OS: Linux
  • OS version
    • Linux hostname 5.15.0-71-generic #78-Ubuntu SMP datetime x86_64 x86_64 x86_64 GNU/Linux
  • Tcpreplay Version [4.4.1] versus [4.4.0]

Additional context
The erroneous checksum is due to the changed length. The problem results in dropped packet.

@fklassen fklassen changed the base branch from master to Bug_703_844_PR_846_optionally_fix_pkt_hdr_len June 1, 2024 19:53
@fklassen fklassen added this to In progress in 4.5 via automation Jun 1, 2024
@fklassen fklassen self-assigned this Jun 1, 2024
@fklassen fklassen merged commit b4148e7 into appneta:Bug_703_844_PR_846_optionally_fix_pkt_hdr_len Jun 1, 2024
2 of 3 checks passed
4.5 automation moved this from In progress to Done Jun 1, 2024
fklassen added a commit that referenced this pull request Jun 2, 2024
…x_pkt_hdr_len

Bug #703 #844 PR #846: optionally fix packet header length --fixhdrlen
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
4.5
Done
Development

Successfully merging this pull request may close these issues.

None yet

2 participants