freebsd-src icon indicating copy to clipboard operation
freebsd-src copied to clipboard

MFC libpcap and tcpdup updates and fixes to stable/13

Open Jehops opened this issue 11 months ago • 0 comments

In stable/13, libpcap is at version 1.9.1 and tcpdump is at 4.9.3. These versions were released over five years ago, and multiple CVEs have been identified in them. See https://www.tcpdump.org/public-cve-list.txt for a list of those CVEs.

Testing Performed for this MFC:

  1. Build and run verification:
  • Built a full stable/13 system with these changes in a bhyve.
  • Looked at simple pf logs passed to tcpdump.
  • Confirmed the correct uid (1001) was printed in logs.
# tcpdump -n -e -ttt -i pflog0

tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on pflog0, link-type PFLOG (OpenBSD pflog file), snapshot length 262144 bytes
 00:00:00.000000 rule 0/0(match) [uid 0]: pass out on vtnet0: 192.168.2.116.37028 > 192.168.2.1.53: 42411+ A? google.com. (28)
 00:00:00.003401 rule 0/0(match) [uid 0]: pass out on vtnet0: 192.168.2.116.15400 > 192.168.2.1.53: 36559+ AAAA? google.com. (28)
 00:00:00.008184 rule 0/0(match) [uid 1001]: pass out on vtnet0: 192.168.2.116.44179 > 192.168.2.1.53: 44280+ A? google.com. (28)
00:00:00.002640 rule 0/0(match) [uid 0]: pass out on vtnet0: 192.168.2.116 > 142.251.35.174: ICMP echo request, id 24069, seq 0, length 64
  1. Kyua Test:
root@freebsd134:/usr/tests/sys/netpfil/pf # kyua test ridentifier
ridentifier:basic  ->  passed  [5.398s]

Results file id is usr_tests_sys_netpfil_pf.20250124-094308-809318
Results saved to /root/.kyua/store/results.usr_tests_sys_netpfil_pf.20250124-094308-809318.db

1/1 passed (0 failed)

Jehops avatar Jan 24 '25 14:01 Jehops