tcpdump/0004-tcpslice-update-tcpslice-patch-to-1.2a3.patch

From 954c235f6db6f601d732b6fce48d2e8183c05d49 Mon Sep 17 00:00:00 2001
From: rpm-build <rpm-build>
Date: Mon, 20 Oct 2014 14:43:04 +0200
Subject: [PATCH 4/8] tcpslice: update tcpslice patch to 1.2a3

---
 tcpslice-1.2a3/search.c   | 22 +++++++++++++++-------
 tcpslice-1.2a3/tcpslice.h | 20 ++++++++++++++++++++
 2 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/tcpslice-1.2a3/search.c b/tcpslice-1.2a3/search.c
index 1e2d051..23aa105 100644
--- a/tcpslice-1.2a3/search.c
+++ b/tcpslice-1.2a3/search.c
@@ -53,7 +53,7 @@ static const char rcsid[] =
 /* Size of a packet header in bytes; easier than typing the sizeof() all
  * the time ...
  */
-#define PACKET_HDR_LEN (sizeof( struct pcap_pkthdr ))
+#define PACKET_HDR_LEN (sizeof( struct pcap_sf_pkthdr ))
 
 extern int snaplen;
 
@@ -111,16 +111,24 @@ reasonable_header( struct pcap_pkthdr *hdr, time_t first_time, time_t last_time
 static void
 extract_header( pcap_t *p, u_char *buf, struct pcap_pkthdr *hdr )
 	{
-	memcpy((char *) hdr, (char *) buf, sizeof(struct pcap_pkthdr));
+	struct pcap_sf_pkthdr hdri;
+
+	memcpy((char *) &hdri, (char *) buf, sizeof(struct pcap_sf_pkthdr));
 
 	if ( pcap_is_swapped( p ) )
 		{
-		hdr->ts.tv_sec = SWAPLONG(hdr->ts.tv_sec);
-		hdr->ts.tv_usec = SWAPLONG(hdr->ts.tv_usec);
-		hdr->len = SWAPLONG(hdr->len);
-		hdr->caplen = SWAPLONG(hdr->caplen);
+		hdr->ts.tv_sec = SWAPLONG(hdri.ts.tv_sec);
+		hdr->ts.tv_usec = SWAPLONG(hdri.ts.tv_usec);
+		hdr->len = SWAPLONG(hdri.len);
+		hdr->caplen = SWAPLONG(hdri.caplen);
+		}
+	else
+		{
+		hdr->ts.tv_sec = hdri.ts.tv_sec;
+		hdr->ts.tv_usec = hdri.ts.tv_usec;
+		hdr->len = hdri.len;
+		hdr->caplen = hdri.caplen;
 		}
-
 	/*
 	 * From bpf/libpcap/savefile.c:
 	 *
diff --git a/tcpslice-1.2a3/tcpslice.h b/tcpslice-1.2a3/tcpslice.h
index de4a01c..9dcd1a1 100644
--- a/tcpslice-1.2a3/tcpslice.h
+++ b/tcpslice-1.2a3/tcpslice.h
@@ -20,6 +20,26 @@
  */
 
 
+#include <time.h>
+/* #include <net/bpf.h> */
+
+/*
+ * This is a timeval as stored in disk in a dumpfile.
+ * It has to use the same types everywhere, independent of the actual
+ * `struct timeval'
+ */
+
+struct pcap_timeval {
+    bpf_int32 tv_sec;           /* seconds */
+    bpf_int32 tv_usec;          /* microseconds */
+};
+
+struct pcap_sf_pkthdr {
+    struct pcap_timeval ts;     /* time stamp */
+    bpf_u_int32 caplen;         /* length of portion present */
+    bpf_u_int32 len;            /* length this packet (off wire) */
+};
+
 time_t	gwtm2secs( struct tm *tm );
 
 int	sf_find_end( struct pcap *p, struct timeval *first_timestamp,
-- 
2.9.3