[Bug 2076398] Re: Tcpdump utility captures incorrect packets on VLAN interface when using SLL2

[Andreas Hasenack]

Hello Chengen, or anyone else affected,

Accepted libpcap into jammy-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/libpcap/1.10.1-4ubuntu1.22.04.1 in
a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
jammy to verification-done-jammy. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-jammy. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: libpcap (Ubuntu Jammy)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-jammy

** Changed in: libpcap (Ubuntu Focal)
       Status: In Progress => Fix Committed

** Tags added: verification-needed-focal

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2076398

Title:
  Tcpdump utility captures incorrect packets on VLAN interface when
  using SLL2

Status in libpcap package in Ubuntu:
  Fix Released
Status in libpcap source package in Focal:
  Fix Committed
Status in libpcap source package in Jammy:
  Fix Committed

Bug description:
  [Impact]
  When using the `tcpdump -i any` command with SLL2, bogus packets may be captured.
  This issue arises due to differing offsets used for inserting VLAN tags across various data link types.

  [Fix]
  An upstream commit has been made to address and fix this issue.
  commit 4bfca3682e5aeabe05b4406daf00c9abcc36c571
  Author:     Guy Harris <gharris at sonic.net>
  Date: Sat Apr 9 16:55:20 2022 -0700

      linux: set handlep->vlan_offset if the linktype is changed.

      The change to the linktype might change the offset at which to insert
      VLAN tags (or change it to -1, meaning "don't insert VLAN tags").

      This should fix issue #1105.

  [Test Plan]
  1. Set up a VLAN interface:
  # ip link add link eth0 eth0.24 type vlan id 24
  # ifconfig eth0.24 1.0.24.1/24
  2. Generate traffic for packet sniffing:
  # ping -n 1.0.24.3 > /dev/null 2>&1 &
  3. Use tcpdump to capture packets and verify that the error does not occur.
  # tcpdump -nn -i any -Q out not tcp and not udp
  tcpdump: data link type LINUX_SLL2
  tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
  listening on any, link-type LINUX_SLL2 (Linux cooked v2), snapshot length 262144 bytes
  06:43:28.360947 eth0.24 Out ARP, Request who-has 1.0.24.3 tell 1.0.24.1, length 28
  06:43:28.360949 eth0  Out ARP, Unknown Hardware (12318) (len 0), Unknown Protocol (0x0000) (len 1), length 32

  [Where problems could occur]
  The patch introduced a step to set the VLAN offset when configuring the data link type.
  This change primarily affects the handling of SLL2 and should not impact other data link types.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libpcap/+bug/2076398/+subscriptions