kern/123255: mistake in ng_bpf manpage

[Eugenio Maffione]

>Number:         123255
>Category:       kern
>Synopsis:       mistake in ng_bpf manpage
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          doc-bug
>Submitter-Id:   current-users
>Arrival-Date:   Wed Apr 30 11:50:01 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Eugenio Maffione
>Release:        6.2
>Organization:
Telecomitalia
>Environment:
GENERIC!
>Description:
I'm writing to you because I think to have found a little mistake in the ng_bpf man page.

Actually the mistake is in the script proposed in the manpage.

I notice that in some cases the statement 
printf " { code=%d jt=%d jf=%d k=%d }", \$1, \$2, \$3, \$4; 
causes an incorrect programming of the bpf filter.

This happens when the "k" value exceed the MAX_INTEGER value as when, for example, the tcpdump expression refers a network where the the first octect is greater than 128.

In that case the awk generates a negative value for "k" and the bpf matches always (I don't understand why, but it happens).


>How-To-Repeat:
This happens when the "k" value exceed the MAX_INTEGER value as when, for example, the tcpdump expression refers a network where the the first octect is greater than 128. (e.g . PATTERN="udp and dst net 255.255.0.0/16")

>Fix:
I tried to change the printf statement changing the format for using a conversion to unsigned (%u) but  the poor result is to have the absolute value of "k" (so just deleting the minus) [this probably is a problem in awk].

Finallly, I've found that the working one format for the printg in the manpage is " { code=%d jt=%d jf=%d k=%s }" that preserves the right unsigned integer values.

Hopefully  this help some other novice...


>Release-Note:
>Audit-Trail:
>Unformatted: