Unexpected version display from static binary

[sarnold]

Static binary workflow from git checkouts of libpcap-1.10.5 and tcpdump-4.99.5 in github container muslcc/x86_64:x86_64-linux-musl using "local libpcap" where both git checkouts are side-by-side:

$ tree -d -L1 libpcap/ tcpdump/
libpcap/
├── ChmodBPF
├── cmake
├── doc
├── missing
├── pcap
├── rpcapd
├── testprogs
└── tests
tcpdump/
├── cmake
├── doc
├── missing
└── tests

Where config.h for each contains:

#define PACKAGE_NAME "pcap"
#define PACKAGE_STRING "pcap 1.10.5"
#define PACKAGE_TARNAME "pcap"
#define PACKAGE_VERSION "1.10.5"

and

#define PACKAGE_NAME "tcpdump"
#define PACKAGE_STRING "tcpdump 4.99.5"
#define PACKAGE_TARNAME "tcpdump"
#define PACKAGE_VERSION "4.99.5"

Running the resultant binary has unexpected output:

$ ./tcpdump --version
tcpdump version 1.10.5
libpcap version unknown
64-bit build, 64-bit time_t

Built using the scripts and workflows on the tcpdump-499 branch here: https://github.com/VCTLabs/static-toolbox (the latest release page has the tcpdump artifacts.

Some Alpine container build tool versions:

(4/89) Installing autoconf (2.71-r0)
(5/89) Installing automake (1.16.3-r0)
(6/89) Installing bison (3.7.6-r0)
(17/89) Installing libgcc (10.3.1_git20210424-r2)
(19/89) Installing libstdc++ (10.3.1_git20210424-r2)
(21/89) Installing cmake (3.20.6-r0)
(37/89) Installing gmp (6.2.1-r1)
(38/89) Installing libgmpxx (6.2.1-r1)
(41/89) Installing linux-headers (5.10.41-r0)
(57/89) Installing make (4.3-r0)
(58/89) Installing patch (2.7.6-r7)
(68/89) Installing libcap-ng (0.8.2-r0)

I also get the same version result building manually on a current Gentoo desktop.

If building from master, I get a a different unexpected result:

$ ./tcpdump --version
tcpdump version 1.11.0-PRE-GIT
libpcap version 1.11.0-PRE-GIT (with TPACKET_V3)
64-bit build, 64-bit time_t

• This is not a security issue.

[guyharris]

Somehow, the configure scripts failed to find pcap_lib_version() in libpcap when it configured tcpdump.

Please attach a text file showing the full output from the build process; that should show the output of the configure scripts.

[guyharris]

If building from master, I get a a different unexpected result:

$ ./tcpdump --version
tcpdump version 1.11.0-PRE-GIT
libpcap version 1.11.0-PRE-GIT (with TPACKET_V3)
64-bit build, 64-bit time_t

If you're building from the libpcap and tcpdump main branches, what is unexpected about that result? Were you expecting it to show libraries other than libpcap?

[guyharris]

Built using the scripts and workflows on the tcpdump-499 branch here: https://github.com/VCTLabs/static-toolbox

In particular, the main build script can be found at https://github.com/VCTLabs/static-toolbox/blob/master/build/targets/build_tcpdump.sh

[guyharris]

Built using the scripts and workflows on the tcpdump-499 branch here: https://github.com/VCTLabs/static-toolbox (the latest release page has the tcpdump artifacts.

The latest release page appears to be https://github.com/VCTLabs/static-toolbox/releases, but the only artifacts appear to be source code and executable images, not any logs of the build. Is there a location at which the build process logs can be found?

[fxlb]

Some logs in "Actions":
https://github.com/VCTLabs/static-toolbox/actions/runs/14184542330/job/39737399649

[fxlb]

gcc -static -fPIC -I/build/libpcap -L/build/libpcap ... is incorrect.
It should have -I. first to include the tcpdump config.h, not the libpcap one.

[infrastation]

Yes, that explains tcpdump version 1.11.0-PRE-GIT etc. The build script needs more attention, in particular, CXXFLAGS is a no-op in this context and ./configure in both projects may not need as many (or even any) arguments to do the right job.

[sarnold]

If building from master, I get a a different unexpected result:

$ ./tcpdump --version
tcpdump version 1.11.0-PRE-GIT
libpcap version 1.11.0-PRE-GIT (with TPACKET_V3)
64-bit build, 64-bit time_t

If you're building from the libpcap and tcpdump main branches, what is unexpected about that result? Were you expecting it to show libraries other than libpcap?

No, but that looks like the libpcap version in both places. And thanks for pointing me in the right direction! Also, I should probably switch to cmake in that fork...

[sarnold]

yep, that was indeed the missing bit:

$ ./tcpdump --version
tcpdump version 4.99.5
libpcap version 1.10.5 (with TPACKET_V3)
64-bit build, 64-bit time_t

[guyharris]

We might want to have tcpdump.c check to make sure that config.h didn't define anything that would indicate that it's libpcap's config.h and, if so, #error with an indication that the compiler's been told to search the libpcap source directory before the build directory, and that this will not work.

[fxlb]

Or a test with AC_COMPILE_IFELSE in autoconf.ac, if possible?

[sarnold]

Also some of the branches have configure and some don't (not sure why) so i added the ./autogen.sh bits to the build script.