tcpdump broken wrt CsCov & CsVal parsing?

tcpdump broken wrt CsCov & CsVal parsing?

[Arnaldo Carvalho de Melo]

Trying to rebuild a proper test setup, so far using just loopback for
simple tests I noticed this problem:

11:57:47.463084 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 5, cksum 0xf52a (correct), dataack (ack\x115231163474841)
11:57:47.463095 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 5, cksum 0x92f7 (correct), ack (ack\x115230668497611)
11:57:47.463219 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 10, cksum 0xe8d8 (correct), dataack (ack\x115231163474842)
11:57:47.463231 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 10, cksum 0xa7e9 (correct), ack (ack\x115230668497612)
11:57:47.463344 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 15, cksum 0xda86 (correct), dataack (ack\x115231163474843)
11:57:47.463355 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 15, cksum 0x166c (correct), ack (ack\x115230668497613)
11:57:47.463466 IP localhost.40343 > localhost.5001: CCVal 0, CsCov 4, cksum 0xcf34 (correct), dataack (ack\x115231163474844)
11:57:47.463477 IP localhost.5001 > localhost.40343: CCVal 0, CsCov 4, cksum 0x4f19 (correct), ack (ack\x115230668497614)

Who was the last person to touch the DCCP support code in tcpdump? Care
to take a look?

- Arnaldo

Re: tcpdump broken wrt CsCov & CsVal parsing?

[Ian McDonald]

On 9/23/07, Arnaldo Carvalho de Melo <acme@ghostprotocols.net> wrote:
> Trying to rebuild a proper test setup, so far using just loopback for
> simple tests I noticed this problem:
>
> Who was the last person to touch the DCCP support code in tcpdump? Care
> to take a look?
>
> - Arnaldo

I'm pretty sure that would be me :-(

I'll take a look but it won't be very soon.

-- 
Web1: http://wand.net.nz/~iam4/
Web2: http://www.jandi.co.nz
Blog: http://iansblog.jandi.co.nz

Re: tcpdump broken wrt CsCov & CsVal parsing?

[Gerrit Renker]

|  On 9/23/07, Arnaldo Carvalho de Melo <acme@ghostprotocols.net> wrote:
|  > Trying to rebuild a proper test setup, so far using just loopback for
|  > simple tests I noticed this problem:
|  >
|  > Who was the last person to touch the DCCP support code in tcpdump? Care
|  > to take a look?
|  >
|  > - Arnaldo
|  
|  I'm pretty sure that would be me :-(
|  
|  I'll take a look but it won't be very soon.
|  
... and me too :) I know this problem - CsCov and CCVal were swapped in the
header file. As far as I recall the maintainer had checked an update in last
year.

You didn't say which version of tcpdump you were using, I checked locally:
 * tcpdump 3.9.5 as Debian package with libpcap 0.9.5 has this swap-problem 
 * tcpdump 3.9.5 built from tcpdump source, with libpcap 0.9.4 works correct

Can you try tcpdump from source please and check if the problem persists?

Re: tcpdump broken wrt CsCov & CsVal parsing?

[Arnaldo Carvalho de Melo]

Em Tue, Sep 25, 2007 at 09:08:29AM +0100, Gerrit Renker escreveu:
> |  On 9/23/07, Arnaldo Carvalho de Melo <acme@ghostprotocols.net> wrote:
> |  > Trying to rebuild a proper test setup, so far using just loopback for
> |  > simple tests I noticed this problem:
> |  >
> |  > Who was the last person to touch the DCCP support code in tcpdump? Care
> |  > to take a look?
> |  >
> |  > - Arnaldo
> |  
> |  I'm pretty sure that would be me :-(
> |  
> |  I'll take a look but it won't be very soon.
> |  
> ... and me too :) I know this problem - CsCov and CCVal were swapped in the
> header file. As far as I recall the maintainer had checked an update in last
> year.
> 
> You didn't say which version of tcpdump you were using, I checked locally:
>  * tcpdump 3.9.5 as Debian package with libpcap 0.9.5 has this swap-problem 
>  * tcpdump 3.9.5 built from tcpdump source, with libpcap 0.9.4 works correct
> 
> Can you try tcpdump from source please and check if the problem persists?

Excellent data point, I should know better and try with upstream before
complaining. Ah, and also provide the tcpdump version:

[root@tonchinha ~]# rpm -q tcpdump
tcpdump-3.9.7-3.fc8

I'll check upstream now.

- Arnaldo

Re: tcpdump broken wrt CsCov & CsVal parsing?

[Gerrit Renker]

|  I checked locally:
|  >  * tcpdump 3.9.5 as Debian package with libpcap 0.9.5 has this swap-problem 
|  >  * tcpdump 3.9.5 built from tcpdump source, with libpcap 0.9.4 works correct
|  > 
|  > Can you try tcpdump from source please and check if the problem persists?
|  
|  Excellent data point, I should know better and try with upstream before
|  complaining. Ah, and also provide the tcpdump version:
|  
|  [root@tonchinha ~]# rpm -q tcpdump
|  tcpdump-3.9.7-3.fc8
Have you looked at the source rpm's? I found the old patch, if the following hunk
applies then quite likely they have forgotten to patch the header file, and the
problem could be solved then (CCval and Cscov were swapped):

--- a/dccp.h
+++ b/dccp.h
@@ -36,8 +36,8 @@ struct dccp_hdr {
 	}		dccph_xtrs;
 };
 
-#define DCCPH_CCVAL(dh)	(((dh)->dccph_ccval_cscov) & 0x0F)
-#define DCCPH_CSCOV(dh)	(((dh)->dccph_ccval_cscov >> 4) & 0x0F)
+#define DCCPH_CCVAL(dh)	(((dh)->dccph_ccval_cscov >> 4) & 0xF)
+#define DCCPH_CSCOV(dh)	(((dh)->dccph_ccval_cscov) & 0xF)
 
 #define DCCPH_X(dh)	((dh)->dccph_xtrs.dccph_xtr & 1)
 #define DCCPH_TYPE(dh)	(((dh)->dccph_xtrs.dccph_xtr >> 1) & 0xF)