From owner-freebsd-bugs@FreeBSD.ORG Fri Mar 23 01:10:04 2007 Return-Path: X-Original-To: freebsd-bugs@hub.freebsd.org Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id EA5B416A406 for ; Fri, 23 Mar 2007 01:10:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [69.147.83.40]) by mx1.freebsd.org (Postfix) with ESMTP id CADA913C4C6 for ; Fri, 23 Mar 2007 01:10:04 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id l2N1A4Ym031118 for ; Fri, 23 Mar 2007 01:10:04 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id l2N1A4lY031117; Fri, 23 Mar 2007 01:10:04 GMT (envelope-from gnats) Resent-Date: Fri, 23 Mar 2007 01:10:04 GMT Resent-Message-Id: <200703230110.l2N1A4lY031117@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Charles Sprickman Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id B2E0D16A400 for ; Fri, 23 Mar 2007 01:09:47 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [69.147.83.33]) by mx1.freebsd.org (Postfix) with ESMTP id A18BF13C480 for ; Fri, 23 Mar 2007 01:09:47 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l2N19lmS012568 for ; Fri, 23 Mar 2007 01:09:47 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.13.1/8.13.1/Submit) id l2N14jmT011312; Fri, 23 Mar 2007 01:04:45 GMT (envelope-from nobody) Message-Id: <200703230104.l2N14jmT011312@www.freebsd.org> Date: Fri, 23 Mar 2007 01:04:45 GMT From: Charles Sprickman To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.0 Cc: Subject: bin/110689: tcpdump ipv4 snaplen too short for pflog X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Mar 2007 01:10:05 -0000 >Number: 110689 >Category: bin >Synopsis: tcpdump ipv4 snaplen too short for pflog >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: change-request >Submitter-Id: current-users >Arrival-Date: Fri Mar 23 01:10:04 GMT 2007 >Closed-Date: >Last-Modified: >Originator: Charles Sprickman >Release: 6.2-Release >Organization: spork, LLC >Environment: [root@slimjim /usr/src/usr.sbin/tcpdump]# uname -a FreeBSD slimjim.bway.net 6.2-RELEASE-p1 FreeBSD 6.2-RELEASE-p1 #4: Thu Feb 15 17:53:43 EST 2007 spork@slimjim.bway.net:/usr/obj/usr/src/sys/ENO i386 >Description: There is a ifdef in the tcpdump sources (I believe just in /usr/src/contrib/tcpdump/interface.h) that sets the default snaplen for tcpdump. Running tcpdump without a special snaplen against pflog will drop some data (the last octet of the second ip). This breaks things like spamlogd (/usr/ports/mail/spamd). The issue is also raised here in the NetBSD bug db: http://www.netbsd.org/cgi-bin/query-pr-single.pl?number=34733 Same issue... >How-To-Repeat: Build a recent spamlogd on FreeBSD, try to run it. You'll see that the traffic it snarfs from pflog is missing the last octet, which makes it unhappy: Mar 22 03:03:31 slimjim spamlogd[700]: outbound 216.220.96 Mar 22 03:03:31 slimjim spamlogd[700]: invalid ip address 216.220.96 >Fix: I rebuilt tcpdump after setting the snaplen to 96 in both cases. Some would argue that the ifdef is not even really necessary and a snaplen big enough to deal with all our "new" interfaces (pflog, carp, etc.) should be the new default. This snippet starts at line 87. /* * The default snapshot length. This value allows most printers to print * useful information while keeping the amount of unwanted data down. */ #ifndef INET6 #define DEFAULT_SNAPLEN 96 /* ether + IPv4 + TCP + 14 */ #else #define DEFAULT_SNAPLEN 96 /* ether + IPv6 + TCP + 22 */ #endif /* ^^ I upped this */ >Release-Note: >Audit-Trail: >Unformatted: