tcpreplay su interaction

loqs · 2018-05-14 23:52:46

Investigating https://bugs.archlinux.org/task/58595 I ran tcpreplay. After running tcpreplay sudo / su authentication fails which seems a strange interaction

$ sudo pacman -Rcns tcpreplay 
checking dependencies...

Packages (3) autogen-5.18.12-2  libdnet-1.12-10  tcpreplay-4.2.6-1

Total Removed Size:  2.32 MiB

:: Do you want to remove these packages? [Y/n] y
:: Running pre-transaction hooks...
(1/1) Removing old entries from the info directory file...
:: Processing package changes...
(1/3) removing tcpreplay                           [######################] 100%
(2/3) removing libdnet                             [######################] 100%
(3/3) removing autogen                             [######################] 100%
:: Running post-transaction hooks...
(1/1) Arming ConditionNeedsUpdate...
$ sudo pacman -S tcpreplay
resolving dependencies...
looking for conflicting packages...

Packages (3) autogen-5.18.12-2  libdnet-1.12-10  tcpreplay-4.2.6-1

Total Installed Size:  2.32 MiB

:: Proceed with installation? [Y/n] y
(3/3) checking keys in keyring                     [######################] 100%
(3/3) checking package integrity                   [######################] 100%
(3/3) loading package files                        [######################] 100%
(3/3) checking for file conflicts                  [######################] 100%
(3/3) checking available disk space                [######################] 100%
:: Processing package changes...
(1/3) installing libdnet                           [######################] 100%
Optional dependencies for libdnet
    python2 [installed]
(2/3) installing autogen                           [######################] 100%
(3/3) installing tcpreplay                         [######################] 100%
Optional dependencies for tcpreplay
    tcpdump: decoding of packets support [installed]
:: Running post-transaction hooks...
(1/2) Arming ConditionNeedsUpdate...
(2/2) Updating the info directory file...
$ sudo pacman -Rcns tcpreplay 
checking dependencies...

Packages (3) autogen-5.18.12-2  libdnet-1.12-10  tcpreplay-4.2.6-1

Total Removed Size:  2.32 MiB

:: Do you want to remove these packages? [Y/n] ^C
Interrupt signal received

$ tcpreplay
tcpreplay error:  The intf1 option is required
tcpreplay (tcpreplay) - Replay network traffic stored in pcap files
Usage:  tcpreplay [ -<flag> [<val>] | --<name>[{=| }<val>] ]... <pcap_file(s)>

   -q, --quiet                Quiet mode
   -T, --timer=str            Select packet timing mode: select, ioport, gtod, nano
       --maxsleep=num         Sleep for no more then X milliseconds between packets
   -v, --verbose              Print decoded packets via tcpdump to STDOUT
   -A, --decode=str           Arguments passed to tcpdump decoder
   -K, --preload-pcap         Preloads packets into RAM before sending
   -c, --cachefile=str        Split traffic via a tcpprep cache file
   -2, --dualfile             Replay two files at a time from a network tap
   -i, --intf1=str            Client to server/RX/primary traffic output interface
   -I, --intf2=str            Server to client/TX/secondary traffic output interface
   -l, --loop=num             Loop through the capture file X times
       --loopdelay-ms=num     Delay between loops in milliseconds
       --pktlen               Override the snaplen and use the actual packet len
   -L, --limit=num            Limit the number of packets to send
       --duration=num         Limit the number of seconds to send
   -x, --multiplier=str       Modify replay speed to a given multiple
   -p, --pps=str              Replay packets at a given packets/sec
   -M, --mbps=str             Replay packets at a given Mbps
   -t, --topspeed             Replay packets as fast as possible
   -o, --oneatatime           Replay one packet at a time for each user input
       --pps-multi=num        Number of packets to send for each time interval
       --unique-ip            Modify IP addresses each loop iteration to generate unique flows
       --unique-ip-loops=str  Number of times to loop before assigning new unique ip
       --no-flow-stats        Suppress printing and tracking flow count, rates and expirations
       --flow-expiry=num      Number of inactive seconds before a flow is considered expired
   -P, --pid                  Print the PID of tcpreplay at startup
       --stats=num            Print statistics every X seconds, or every loop if '0'
   -V, --version              Print version information
   -h, --less-help            Display less usage information and exit
   -H, --help                 display extended usage information and exit
   -!, --more-help            extended usage information passed thru pager
       --save-opts[=arg]      save the option state to a config file
       --load-opts=str        load options from a config file

Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
tcpreplay is a tool for replaying network traffic from files saved with
tcpdump or other tools which write pcap(3) files.

Please send bug reports to:  <tcpreplay-users@lists.sourceforge.net>
$ sudo pacman -Rcns tcpreplay 
checking dependencies...

Packages (3) autogen-5.18.12-2  libdnet-1.12-10  tcpreplay-4.2.6-1

Total Removed Size:  2.32 MiB

$ su -
Password: 
su: Authentication token manipulation error

I did not abort the last pacman invocation it terminated itself.

SealsRock12 · 2018-05-14 23:58:42

What is your question?

loqs · 2018-05-14 23:59:43

Why does running tcpreplay have any interaction with subsequent use of sudo / su?
Edit:
shell in use in bash, normal user allowed to use sudo with user password works as expected before execution of tcpreplay.
Issue is limited to the shell/terminal tcpreplay has been executed in.
Edit2:

write(2, "Password: ", 10)              = 10
read(0, 0x7ffe72926450, 511)            = ? ERESTARTSYS (To be restarted if SA_RESTART is set)

from strace of su - (working shell)

write(2, "Password: ", 10)              = 10
read(0, 0x7ffc10e5d1d0, 511)            = -1 EAGAIN (Resource temporarily unavailable)

from strace of su - (none working shell)

Last edited by loqs (2018-05-15 01:10:00)

seth · 2018-05-15 05:52:01

"Stupidity" - It probably sets stdin to nonblockign and forgets to clean up. So the problem isn't so much the priv leverage, but the password reading.
https://stackoverflow.com/questions/165 … gain-error

I'm not at hand sure whether there're any built-in ways to alter the mode.

loqs · 2018-05-15 07:47:26

This appears to be the cause https://github.com/appneta/tcpreplay/bl … api.c#L115
Edit:
minimal reproducer

#include <fcntl.h>
#include <unistd.h>

int main()
{
  fcntl(STDERR_FILENO, F_SETFL, O_NONBLOCK);
}

Last edited by loqs (2018-05-15 17:04:46)

Arch Linux

#1 2018-05-14 23:52:46

tcpreplay su interaction

#2 2018-05-14 23:58:42

Re: tcpreplay su interaction

#3 2018-05-14 23:59:43

Re: tcpreplay su interaction

#4 2018-05-15 05:52:01

Re: tcpreplay su interaction

#5 2018-05-15 07:47:26

Re: tcpreplay su interaction

Board footer