libpcap on linux issue

[Darren Reed <avalon () coombs anu edu au>]

I'm using libpcap-2002.12.08 on a RedHat 8.0 box and have come across an
issue that I think is quite serious.

In fad-getad.c we have the following section of definitions for SA_LEN:

#ifndef SA_LEN
#ifdef HAVE_SOCKADDR_SA_LEN
#define SA_LEN(addr)    (addr ? (addr)->sa_len : 0)
#else /* HAVE_SOCKADDR_SA_LEN */
#ifdef HAVE_SOCKADDR_STORAGE
#define SA_LEN(addr)    (sizeof (struct sockaddr_storage))
#else /* HAVE_SOCKADDR_STORAGE */
#define SA_LEN(addr)    (sizeof (struct sockaddr))
#endif /* HAVE_SOCKADDR_STORAGE */
#endif /* HAVE_SOCKADDR_SA_LEN */
#endif /* SA_LEN */

Now on this particular linux system, none of the header files in the
/usr/include directory tree define SA_LEN so this comment:
 *
 * GNU libc uses neither scheme, but has an "SA_LEN()" macro that
 * determines the size based on the address family.
 */
fails to hold any water.  This is libc-2.2.93.

The above manifests itself in a nasty situation when you try to use
one of the pcap functions that works with sockaddr's.  eg:

  Electric Fence 2.2.0 Copyright (C) 1987-1999 Bruce Perens <bruce () perens com>

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 8192 (LWP 14955)]
0x4207c46c in memcpy () from /lib/i686/libc.so.6
(gdb) where
#0  0x4207c46c in memcpy () from /lib/i686/libc.so.6
#1  0x080a8c58 in dup_sockaddr (sa=0xbfffe544, sa_length=1076129776) at inet.c:102
#2  0x080a901b in add_addr_to_iflist (alldevs=0xbfffe544, name=0x40246ff0 "eth0", flags=4163, addr=0x40246fc0, 
addr_size=128, netmask=0x40246fd0, netmask_size=128,
    broadaddr=0x40246fe0, broadaddr_size=128, dstaddr=0x0, dstaddr_size=0, errbuf=0xbfffe9f0 "") at inet.c:339
#3  0x080a8740 in pcap_findalldevs (alldevsp=0xbfffe5e4, errbuf=0xbfffe9f0 "") at fad-getad.c:163

One solution to this is changing the #define from being
"sizeof(struct sockaddr_storage)" to be something else - like this:
#define SA_LEN(x)       sizeof(*x)

For now, my application is IPv4 only, so I'll just change it to be
'sizeof(struct sockaddr_in)', but this is clearly just a hack.

Darren
(sorry for the 80-column unfriendly output)
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe