Bug 506076

Summary:	net-analyzer/dsniff-2.4_beta1-r6 - sometimes urlsnarf exits early and fails to read from stdin
Product:	Gentoo Linux	Reporter:	Yun Zheng Hu <hu>
Component:	Current packages	Assignee:	Gentoo Netmon project <netmon>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hu
Priority:	Normal	Keywords:	PATCH
Version:	unspecified
Hardware:	All
OS:	All
See Also:	http://bugs.debian.org/742786
Whiteboard:
Package list:		Runtime testing required:	---
Attachments:	Better timestamp patch.

Description Yun Zheng Hu 2014-03-28 13:58:33 UTC

After upgrading to -r6 which includes Debian's new patchset, urlsnarf can exit early and also it's not possible to read from /dev/stdin anymore.

The patch that caused is: 23_urlsnarf_timestamp.patch

Which can actually be fixed in a better way. See patch on this page and also description of the same problem:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742786



Reproducible: Sometimes

Steps to Reproduce:
1. run urlsnarf on an interface (preferably a high load interface).
2. urlsnarf exits because pcap_next_ex() in the main loop returns 0 (timeout).
3. run again with older dsniff/urlsnarf.. it keeps working, no early exit.
Actual Results:  
urlsnarf exits the main pcap loop.

Expected Results:  
urlsnarf keeps working, not exiting the main loop.

Also, since this patch it is not possible to read pcap data from stdin anymore:

$ sudo tcpdump -i eth0 -s0 -w - -c 100 | urlsnarf -n -p /dev/stdin
Password:
urlsnarf: using /dev/stdin [tcp port 80 or port 8080 or port 3128]
pcap_open_offline(/dev/stdin): unknown file format

Comment 1 Yun Zheng Hu 2014-03-28 14:00:13 UTC

Created attachment 373742 [details, diff]
Better timestamp patch.

A better patch to fix the timestamp issue in urlsnarf. This replaces on of Debian's patches.

This will also make sure that reading from /dev/stdin als pcap file keep working.

Comment 2 Jeroen Roovers (RETIRED) gentoo-dev

2014-03-28 14:04:29 UTC

Since -r6 we're using Debian's patch set, so we might wait for them to update that.

Comment 3 Jeroen Roovers (RETIRED) gentoo-dev

2015-02-07 10:32:56 UTC

(In reply to Jeroen Roovers from comment #2)
> Since -r6 we're using Debian's patch set, so we might wait for them to
> update that.

Well, that didn't happen.

I replaced patch 23 in Gentoo revision -r8.