Bugzilla Bug 91416

I'm using the pcap plugin of app-admin/ulogd-1.02-r1 on an AMD
Athlon(tm) 64 Processor 3000+ AuthenticAMD running
sys-kernel/gentoo-dev-sources-2.6.10-gentoo-r6 (machine 1).
The produced pcap files are unreadable with tcpdump.
Here is the error message:

# tcpdump -n -r /var/log/ulogd.pcap
reading from file /var/log/ulogd.pcap, link-type RAW (Raw IP)
tcpdump: pcap_loop: bogus savefile header
#

I'm also using app-admin/ulogd-1.02-r1 on an i686 VIA Samuel 2
CentaurHauls running
sys-kernel/gentoo-dev-sources-2.6.9-gentoo-r13 (machine 2).

tcpdump is net-analyzer/tcpdump-3.8.3-r1 and
libpcap is net-libs/libpcap-0.8.3-r1 on machine 1 and 2.

In order to check what is wrong, I captured a single udp packet on
both machines.

The command I used to send the packet is:
nc -u 127.0.0.1 1234 followed by a single return as payload.

The netfilter rule used to match the packet is:
iptables -I INPUT 1 -i lo -p udp --dport 1234 -j ULOG

Here are the results:
Machine 1:

Syslog line:
Mar 1 16:54:49 zorglub IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1 LEN=29 TOS=00 PREC=0x00 TTL=64 ID=62357 CE DF PROTO=UDP
SPT=32810 DPT=1234 LEN=9

Pcap file dump:
0000000 c3d4 a1b2 0002 0004 f1f0 ffff 0000 0000
0000020 0000 0001 0065 0000 9049 4224 0000 0000
0000040 62be 0006 0000 0000 001d 0000 001d 0000
0000060 0045 1d00 95f3 0040 1140 3849 007f 0100
0000100 007f 0100 2a80 d204 0900 dd72 000a
0000115

*** PCAP FILE HEADER *** (see struct pcap_file_header in pcap.h from
libpcap)
c3d4 a1b2 -> magic number
0002 -> major version
0004 -> minor version
f1f0 ffff -> gmt to local correction
0000 0000 -> accuracy of timestamps
0000 0001 -> max length saved portion of each pkt
0065 0000 -> data link type
*** END OF PCAP FILE HEADER ***

*** PCAP PACKET HEADER *** (see struct pcap_pkthdr in pcap.h from
libpcap)
9049 4224 0000 0000 62be 0006 0000 0000 -> timestamp
001d 0000 -> caplen
001d 0000 -> len
*** END OF PCAP PACKET HEADER ***

*** PACKET *** (see http://www.sans.org/resources/tcpip.pdf)
0045 -> TOS/IP version/IHL
1d00 -> LEN=29
95f3 -> ID=62357
0040 -> Flags/Fragment Offset
1140 -> PROTO=17(UDP)/TTL=64
3849 -> Header cksum
007f 0100 -> src ip: 127.0.0.1
007f 0100 -> dst ip: 127.0.0.1
2a80 -> src port: 32810
d204 -> dst port: 1234
0900 -> Length
dd72 -> UDP cksum
000a -> payload
*** END OF PACKET ***

Machine 2:

Syslog line:
Mar 1 16:56:40 crockdur IN=lo OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
DST=127.0.0.1 LEN=29 TOS=00 PREC=0x00 TTL=64 ID=22758 DF PROTO=UDP
SPT=33303 DPT=1234 LEN=9

Pcap file dump:
0000000 c3d4 a1b2 0002 0004 f1f0 ffff 0000 0000
0000020 0000 0001 0065 0000 90b8 4224 3e74 000e
0000040 001d 0000 001d 0000 0045 1d00 e658 0040
0000060 1140 e7e3 007f 0100 007f 0100 1782 d204
0000100 0900 f070 000a
0000105

*** PCAP FILE HEADER *** (see struct pcap_file_header in pcap.h from
libpcap)
c3d4 a1b2 -> magic number
0002 -> major version
0004 -> minor version
f1f0 ffff -> gmt to local correction
0000 0000 -> accuracy of timestamps
0000 0001 -> max length saved portion of each pkt
0065 0000 -> data link type
*** END OF PCAP FILE HEADER ***

*** PCAP PACKET HEADER *** (see struct pcap_pkthdr in pcap.h from
libpcap)
90b8 4224 3e74 000e -> timestamp
001d 0000 -> caplen
001d 0000 -> len
*** END OF PCAP PACKET HEADER ***

*** PACKET *** (see http://www.sans.org/resources/tcpip.pdf)
0045 -> TOS/IP version/IHL
1d00 -> LEN=29
e658 -> ID=22758
0040 -> Flags/Fragment Offset
1140 -> PROTO=17(UDP)/TTL=64
e7e3 -> Header cksum
007f 0100 -> src ip: 127.0.0.1
007f 0100 -> dst ip: 127.0.0.1
1782 -> src port: 33303
d204 -> dst port: 1234
0900 -> Length
f070 -> UDP cksum
000a -> payload
*** END OF PACKET ***

The problem seems to come from the timestamp in the pcap packet header.
It should match the members of a timeval struct from <sys/time.h> (man
gettimeofday):
struct timeval {
time_t tv_sec; /* seconds */
suseconds_t tv_usec; /* microseconds */
};

The size of the timeval struct is different on machine 1 and machine 2:
Machine 1: sizeof(struct timeval) == 16
Machine 2: sizeof(struct timeval) == 8

The problem is that tcpdump uses 8 bytes timeval struct on both
architectures, but ulogd does not.

Is it a gentoo specific problem or should it be reported to ulogd developers ?


Reproducible: Always
Steps to Reproduce:

Created an attachment (id=63824) [details]
patch for systems whose sizeof(struct timeval) != 8

Attached is a patch for ulogd to use libpcap's struct pcap_pkthdr format as
defined in "pcap-int.h".  This fixes the "bogus savefile header" bug on systems
whose sizeof(struct timeval) != 8.  The patch is against ulogd-1.23 but also
patches ulogd-1.02.  A ulogd-1.23 ebuild will follow.  As this isn't
gentoo-specific, I am sending this patch upstream to the ulogd developers.  A
better log_PCAP implementation would use libpcap instead of writing directly to
a file.

Created an attachment (id=63825) [details]
ebuild for new ulogd-1.23 with patch for amd64 bug

ebuild changes since ulogd-1.02-r1:
 * added virtual/libpcap dependency
 * apply patch for "bogus savefile header" bug on systems whose
   sizeof(struct timeval) != 8

The virtual/libpcap dependency may not be necessary, but the log_PCAP logging
target is not created without it, and I am unaware of any libpcap USE flag.

Re-assign.

This bug has been sitting around for age, can someone on the amd64 team confirm
the patch works?

The patch was applied upstream and released in ulogd-1.24.

An updated ebuild would solve this, as the latest ebuild is for ulogd-1.23.

Bumped ebuild (which will be attached shortly) *compiles* fine for me on
amd64.  I don't have a ulogd installation in which to test that it is
generating appropriate files, as this is a test chroot on an otherwise active
box.

While revbumping, I removed the gcc41 patch (as it didn't apply) and changed
the HOMEPAGE, since the old one led to a 404.

Dustin

Gentoo Base System version 1.12.5
Portage 2.1.1-r1 (default-linux/amd64/2006.1, gcc-4.1.1, glibc-2.4-r3,
2.6.15-gentoo-r72006040301 x86_64)
=================================================================
System uname: 2.6.15-gentoo-r72006040301 x86_64 AMD Athlon(tm) 64 Processor
3700+
Last Sync: Mon, 11 Dec 2006 21:50:01 +0000
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: [Not Present]
dev-lang/python:     2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.60
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.14
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O2 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig collision-protect confcache digest distlocks
metadata-transfer multilib-strict sandbox sfperms strict test"
GENTOO_MIRRORS="http://gentoo.chem.wisc.edu/gentoo/"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage"
SYNC="rsync://209.59.138.21/gentoo-portage"
USE="amd64 berkdb bitmap-fonts cli cracklib crypt cups dlloader dri elibc_glibc
fortran gdbm gpm iconv input_devices_evdev input_devices_keyboard
input_devices_mouse ipv6 isdnlog kernel_linux libg++ ncurses nls nptl nptlonly
pam pcre perl ppds pppd python readline reflection session spl ssl tcpd
truetype-fonts type1-fonts udev unicode userland_GNU video_cards_apm
video_cards_ark video_cards_ati video_cards_chips video_cards_cirrus
video_cards_cyrix video_cards_dummy video_cards_fbdev video_cards_glint
video_cards_i128 video_cards_i810 video_cards_mga video_cards_neomagic
video_cards_nv video_cards_rendition video_cards_s3 video_cards_s3virge
video_cards_savage video_cards_siliconmotion video_cards_sis video_cards_sisusb
video_cards_tdfx video_cards_tga video_cards_trident video_cards_tseng
video_cards_v4l video_cards_vesa video_cards_vga video_cards_via
video_cards_vmware video_cards_voodoo xorg zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS,
LINGUAS, MAKEOPTS, PORTAGE_RSYNC_EXTRA_OPTS

Created an attachment (id=105977) [details]
ulogd-1.24.ebuild

revbump with slight modifications

1.24 is in cvs