[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: bash sockets: printf \x0a does TCP fragmentation

From: Dirk Wetter
Subject: Re: bash sockets: printf \x0a does TCP fragmentation
Date: Thu, 11 Oct 2018 18:53:18 +0200
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1

On 23.09.18 20:29, Bob Proulx wrote:
> Robert Elz wrote:
>   $ { command printf "one\n"; sleep 1; command printf "two\n" ;} | strace -v 
> -o /tmp/dd.strace.out -e write,read dd status=none ibs=1M obs=1M ; head 
> /tmp/*.strace.out
>   one
>   two
>   ...
>   read(0, "one\n", 1048576)               = 4
>   read(0, "two\n", 1048576)               = 4
>   read(0, "", 1048576)                    = 0
>   write(1, "one\ntwo\n", 8)               = 8
>   +++ exited with 0 +++
> And just for completeness I will show the above with both a large
> input buffer and a large output buffer of the same size and show that
> result too.  The required dd option, as you correctly insisted, really
> is obs= in order to set the output block size.  I stand corrected. :-)
> I had missed the documented dd behavior:
>   ‘bs=BYTES’
>      Set both input and output block sizes to BYTES.  This makes ‘dd’
>      read and write BYTES per block, overriding any ‘ibs’ and ‘obs’
>      settings.  In addition, if no data-transforming ‘conv’ option is
>      specified, input is copied to the output as soon as it’s read, even
>      if it is smaller than the block size.
> It is always good to learn something new about fundamental behavior in
> a command one has been using for some decades! :-)

Thanks for the long mails!

This all -- including cat -- sounded reasonable. But it seems using sockets the 
internal printf
as opposed to the one from coreutils is still causing fragmentation other than 
expected with
strace  PoC:

bash 0$ exec 5<>/dev/tcp/
bash 0$ printf
| dd obs=1M ibs=1M >&5
bash 0$

(Excuse the wrapping. The IP is mine from the project. Feel free to use another 
The servername encoded in there is anyway nonsense)

If you use wireshark you see in the ClientHello "TCP segment of a reassembled 
PDU" @ byte
173. That's where the first LF is encountered. The second one doesn't cause an 
fragment here, other people spotted that.

The fragmentation is independent on the dd options used. Also "| cat" does the 
stdbuf is not available on all platforms, especially on those who do not have a 
external printf:

/usr/bin/printf  "\xf5\xee\xbe\xe5" | xxd
00000000: 7866 3578 6565 7862 6578 6535            xf5xeexbexe5

like FreeBSD and OS X. OpenBSD's /usr/bin/printf works surprisingly.

Cheers, Dirk

PS + @Bob: fd 5 is not a tty in the program -- but interactively in this PoC 
you want to make
sure it is not taken yet.

reply via email to

[Prev in Thread] Current Thread [Next in Thread]