ports/89672: tcpflow port not working with local interface, patch provided

[don_oles at able.com.ua]

>Number:         89672
>Category:       ports
>Synopsis:       tcpflow port not working with local interface, patch provided
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Nov 28 14:10:05 GMT 2005
>Closed-Date:
>Last-Modified:
>Originator:     Oles Hnatkevych
>Release:        FreeBSD 4.11-STABLE i386
>Organization:
>Environment:
System: FreeBSD pajaro.kiev.ua.alfa 4.11-STABLE FreeBSD 4.11-STABLE #17: Thu Jun 30 17:56:26 EEST 2005 root at pajaro.kiev.ua.alfa:/usr/src/sys/compile/PAJARO i386


>Description:
	The tcpflow-0.21 port (the latest) does not work with packets going through local interface, it treats them as invalid packets.
>How-To-Repeat:
	Just do it. tcpflow -c -i lo0 won't show anything.
>Fix:
	The file datalink patch below. The patch code is derived from tcpdump sources coming with the system.
	(I'm afraid the removing < > comments also will patch the patch code below, the SWAPLONG definition)


--------------------- cut ------------------------------------------------
--- datalink.c.orig     Mon May  9 12:00:38 2005
+++ datalink.c  Mon May  9 12:23:47 2005
@@ -42,6 +42,13 @@

 #include "tcpflow.h"

+/*
+ * Byte-swap a 32-bit number.
+ * ("htonl()" or "ntohl()" won't work - we want to byte-swap even on
+ * big-endian platforms.)
+ */
+#define SWAPLONG(y) \
+((((y)&0xff)<<24) | (((y)&0xff00)<<8) | (((y)&0xff0000)>>8) | (((y)>>24)&0xff))


 /* The DLT_NULL packet header is 4 bytes long. It contains a network
@@ -71,7 +78,8 @@
 #ifndef DLT_NULL_BROKEN
   /* make sure this is AF_INET */
   memcpy((char *)&family, (char *)p, sizeof(family));
-  family = ntohl(family);
+  // family = ntohl(family);
+  if ((family & 0xFFFF0000) != 0) family = SWAPLONG(family);
   if (family != AF_INET) {
     DEBUG(6) ("warning: received non-AF_INET null frame (type %d)", family);
     return;
--------------------- cut ------------------------------------------------
>Release-Note:
>Audit-Trail:
>Unformatted: