netdev - Re: [tcpdump-workers] PROBLEM: Software injected vlan tagged packets are unable to be identified using recent BPF modifications

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAF4SogagSH_NdT3Shr-_0D9TQNv8QP6viJaY=4PMv5rYMSgX6Q@mail.gmail.com>
Date:	Thu, 10 Jan 2013 15:37:46 -0500
From:	Bill Fenner <fenner@...il.com>
To:	Paul Pearce <pearce@...berkeley.edu>
Cc:	tcpdump-workers <tcpdump-workers@...ts.tcpdump.org>,
	jpirko@...hat.com, netdev@...r.kernel.org,
	Francesco Ruggeri <fruggeri@...stanetworks.com>,
	edumazet <edumazet@...gle.com>,
	David Miller <davem@...emloft.net>
Subject: Re: [tcpdump-workers] PROBLEM: Software injected vlan tagged packets
 are unable to be identified using recent BPF modifications

On Mon, Jan 7, 2013 at 10:04 PM, Paul Pearce <pearce@...berkeley.edu> wrote:
> However, raw vlan tagged packets that are *injected* into the
> interface using libpcap's pcap_inject() (which is just a fancy wrapper
> for the send() syscall) are not identified by filters using the recent
> BPF modifications.
>
> The bug manifests itself if you attempt to use the new BPF
> modifications to filter vlan tagged packets on a live interface. All
> packets from the medium show up, but all injected packets are dropped.

Given that the vlan tag metadata is supplied to userland with
PACKET_AUXDATA, does the symmetrical sendmsg() with PACKET_AUXDATA
work to put the vlan info in the metadata?  I.e., this would require
modifying pcap_inject() to parse the packet and extract the VLAN tag
info into a struct tpacket_auxdata, but obviously you could write a
little test program to test the underlying PF_PACKET socket behavior.

Even if it doesn't currently work, I think this may be a more
acceptable change ("provide a way to set PACKET_AUXDATA using
sendmsg") than having the packet send code munge/parse the vlan tag on
output.

  Bill
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html