.gitignore

@@ -1,3 +1,2 @@
 SOURCES/tcpdump-4.9.3.tar.gz
-SOURCES/tcpdump-4.9.3.tar.gz.sig
 SOURCES/tcpslice-1.2a3.tar.gz

.tcpdump.metadata

@@ -0,0 +1,2 @@
+59b309f3620ac4b709de2eaf7bf3a83bf04bc048 SOURCES/tcpdump-4.9.3.tar.gz
+98790301cb1bf4399a95153bc62d49b3f5808994 SOURCES/tcpslice-1.2a3.tar.gz

SOURCES/0016-direction-for-any.patch

@@ -1,400 +0,0 @@
-diff --git a/netdissect.h b/netdissect.h
-index 4f3c666a..93fa8be6 100644
---- a/netdissect.h
-+++ b/netdissect.h
-@@ -465,6 +465,7 @@ extern u_int raw_if_print IF_PRINTER_ARGS;
- extern u_int sl_bsdos_if_print IF_PRINTER_ARGS;
- extern u_int sl_if_print IF_PRINTER_ARGS;
- extern u_int sll_if_print IF_PRINTER_ARGS;
-+extern u_int sll2_if_print IF_PRINTER_ARGS;
- extern u_int sunatm_if_print IF_PRINTER_ARGS;
- extern u_int symantec_if_print IF_PRINTER_ARGS;
- extern u_int token_if_print IF_PRINTER_ARGS;
-diff --git a/print-sll.c b/print-sll.c
-index 571b7c5e..5a4e2f68 100644
---- a/print-sll.c
-+++ b/print-sll.c
-@@ -84,6 +84,21 @@ struct sll_header {
- 	uint16_t	sll_protocol;	/* protocol */
- };
- 
-+/*
-+ * A DLT_LINUX_SLL2 fake link-layer header.
-+ */
-+#define SLL2_HDR_LEN	20		/* total header length */
-+
-+struct sll2_header {
-+	uint16_t	sll2_protocol;		/* protocol */
-+	uint16_t	sll2_reserved_mbz;	/* reserved - must be zero */
-+	uint32_t	sll2_if_index;		/* 1-based interface index */
-+	uint16_t	sll2_hatype;		/* link-layer address type */
-+	uint8_t		sll2_pkttype;		/* packet type */
-+	uint8_t		sll2_halen;		/* link-layer address length */
-+	u_char		sll2_addr[SLL_ADDRLEN];	/* link-layer address */
-+};
-+
- /*
-  * The LINUX_SLL_ values for "sll_pkttype"; these correspond to the
-  * PACKET_ values on Linux, but are defined here so that they're
-@@ -308,3 +323,192 @@ recurse:
- 
- 	return (hdrlen);
- }
-+
-+static void
-+sll2_print(netdissect_options *ndo, const struct sll2_header *sllp, u_int length)
-+{
-+	u_short ether_type;
-+
-+	ndo->ndo_protocol = "sll2";
-+       ND_PRINT((ndo,"ifindex %u ", EXTRACT_32BITS(&sllp->sll2_if_index)));
-+
-+	/*
-+	 * XXX - check the link-layer address type value?
-+	 * For now, we just assume 6 means Ethernet.
-+	 * XXX - print others as strings of hex?
-+	 */
-+	if (EXTRACT_8BITS(&sllp->sll2_halen) == 6)
-+		ND_PRINT((ndo, "%s ", etheraddr_string(ndo, sllp->sll2_addr)));
-+
-+	if (!ndo->ndo_qflag) {
-+		ether_type = EXTRACT_16BITS(&sllp->sll2_protocol);
-+
-+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
-+			/*
-+			 * Not an Ethernet type; what type is it?
-+			 */
-+			switch (ether_type) {
-+
-+			case LINUX_SLL_P_802_3:
-+				/*
-+				 * Ethernet_802.3 IPX frame.
-+				 */
-+				ND_PRINT((ndo, "802.3"));
-+				break;
-+
-+			case LINUX_SLL_P_802_2:
-+				/*
-+				 * 802.2.
-+				 */
-+				ND_PRINT((ndo, "802.2"));
-+				break;
-+
-+			default:
-+				/*
-+				 * What is it?
-+				 */
-+				ND_PRINT((ndo, "ethertype Unknown (0x%04x)",
-+				    ether_type));
-+				break;
-+			}
-+		} else {
-+			ND_PRINT((ndo, "ethertype %s (0x%04x)",
-+			    tok2str(ethertype_values, "Unknown", ether_type),
-+			    ether_type));
-+		}
-+		ND_PRINT((ndo, ", length %u: ", length));
-+	}
-+}
-+
-+/*
-+ * This is the top level routine of the printer.  'p' points to the
-+ * Linux "cooked capture" header of the packet, 'h->ts' is the timestamp,
-+ * 'h->len' is the length of the packet off the wire, and 'h->caplen'
-+ * is the number of bytes actually captured.
-+ */
-+u_int
-+sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p)
-+{
-+	u_int caplen = h->caplen;
-+	u_int length = h->len;
-+	const struct sll2_header *sllp;
-+	u_short ether_type;
-+	int llc_hdrlen;
-+	u_int hdrlen;
-+
-+	ndo->ndo_protocol = "sll2";
-+	if (caplen < SLL2_HDR_LEN) {
-+		/*
-+		 * XXX - this "can't happen" because "pcap-linux.c" always
-+		 * adds this many bytes of header to every packet in a
-+		 * cooked socket capture.
-+		 */
-+		ND_PRINT((ndo, " [|%s]", ndo->ndo_protocol));
-+		return (caplen);
-+	}
-+
-+	sllp = (const struct sll2_header *)p;
-+#ifdef HAVE_NET_IF_H
-+	uint32_t if_index = EXTRACT_32BITS(&sllp->sll2_if_index);
-+	if (!if_indextoname(if_index, ifname))
-+		strncpy(ifname, "?", 2);
-+	ND_PRINT((ndo, "%-5s ", ifname));
-+#endif
-+
-+	ND_PRINT((ndo, "%-3s ",
-+		tok2str(sll_pkttype_values, "?", EXTRACT_8BITS(&sllp->sll2_pkttype))));
-+
-+	if (ndo->ndo_eflag)
-+		sll2_print(ndo, sllp, length);
-+
-+	/*
-+	 * Go past the cooked-mode header.
-+	 */
-+	length -= SLL2_HDR_LEN;
-+	caplen -= SLL2_HDR_LEN;
-+	p += SLL2_HDR_LEN;
-+	hdrlen = SLL2_HDR_LEN;
-+
-+	ether_type = EXTRACT_16BITS(&sllp->sll2_protocol);
-+
-+recurse:
-+	/*
-+	 * Is it (gag) an 802.3 encapsulation, or some non-Ethernet
-+	 * packet type?
-+	 */
-+	if (ether_type <= MAX_ETHERNET_LENGTH_VAL) {
-+		/*
-+		 * Yes - what type is it?
-+		 */
-+		switch (ether_type) {
-+
-+		case LINUX_SLL_P_802_3:
-+			/*
-+			 * Ethernet_802.3 IPX frame.
-+			 */
-+			ipx_print(ndo, p, length);
-+			break;
-+
-+		case LINUX_SLL_P_802_2:
-+			/*
-+			 * 802.2.
-+			 * Try to print the LLC-layer header & higher layers.
-+			 */
-+			llc_hdrlen = llc_print(ndo, p, length, caplen, NULL, NULL);
-+			if (llc_hdrlen < 0)
-+				goto unknown;	/* unknown LLC type */
-+			hdrlen += llc_hdrlen;
-+			break;
-+
-+		default:
-+			/*FALLTHROUGH*/
-+
-+		unknown:
-+			/* packet type not known, print raw packet */
-+			if (!ndo->ndo_suppress_default_print)
-+				ND_DEFAULTPRINT(p, caplen);
-+			break;
-+		}
-+	} else if (ether_type == ETHERTYPE_8021Q) {
-+		/*
-+		 * Print VLAN information, and then go back and process
-+		 * the enclosed type field.
-+		 */
-+		if (caplen < 4) {
-+			ND_PRINT((ndo, "[|vlan]"));
-+			return (hdrlen + caplen);
-+		}
-+		if (length < 4) {
-+			ND_PRINT((ndo, "[|vlan]"));
-+			return (hdrlen + length);
-+		}
-+	        if (ndo->ndo_eflag) {
-+			uint16_t tag = EXTRACT_16BITS(p);
-+
-+			ND_PRINT((ndo, "%s, ", ieee8021q_tci_string(tag)));
-+		}
-+
-+		ether_type = EXTRACT_16BITS(p + 2);
-+		if (ether_type <= MAX_ETHERNET_LENGTH_VAL)
-+			ether_type = LINUX_SLL_P_802_2;
-+		if (!ndo->ndo_qflag) {
-+			ND_PRINT((ndo, "ethertype %s, ",
-+			    tok2str(ethertype_values, "Unknown", ether_type)));
-+		}
-+		p += 4;
-+		length -= 4;
-+		caplen -= 4;
-+		hdrlen += 4;
-+		goto recurse;
-+	} else {
-+		if (ethertype_print(ndo, ether_type, p, length, caplen, NULL, NULL) == 0) {
-+			/* ether_type not known, print raw packet */
-+			if (!ndo->ndo_eflag)
-+				sll2_print(ndo, sllp, length + SLL2_HDR_LEN);
-+			if (!ndo->ndo_suppress_default_print)
-+				ND_DEFAULTPRINT(p, caplen);
-+		}
-+	}
-+
-+	return (hdrlen);
-+}
-diff --git a/print.c b/print.c
-index b9c92adc..4cc35bab 100644
---- a/print.c
-+++ b/print.c
-@@ -126,6 +126,9 @@ static const struct printer printers[] = {
- #ifdef DLT_LINUX_SLL
- 	{ sll_if_print,		DLT_LINUX_SLL },
- #endif
-+#ifdef DLT_LINUX_SLL2
-+	{ sll2_if_print,	DLT_LINUX_SLL2 },
-+#endif
- #ifdef DLT_FR
- 	{ fr_if_print,		DLT_FR },
- #endif
-diff --git a/ethertype.h b/ethertype.h
-index f38ec8e4..7719a6f0 100644
---- a/ethertype.h
-+++ b/ethertype.h
-@@ -19,6 +19,13 @@
-  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
-  */
- 
-+/*
-+ * Maximum length of the length field in an Ethernet header; any value
-+ * greater than this is not a length value, so it's either an Ethernet
-+ * type or an invalid value.
-+ */
-+#define        MAX_ETHERNET_LENGTH_VAL 1500
-+
- /*
-  * Ethernet types.
-  *
-diff --git a/config.h.in b/config.h.in
-index 4fcbba77..8ae16730 100644
---- a/config.h.in
-+++ b/config.h.in
-@@ -78,6 +78,9 @@
- /* Define to 1 if you have the <netinet/if_ether.h> header file. */
- #undef HAVE_NETINET_IF_ETHER_H
- 
-+/* Define to 1 if you have the <net/if.h> header file. */
-+#undef HAVE_NET_IF_H
-+
- /* Define to 1 if you have the <net/if_pflog.h> header file. */
- #undef HAVE_NET_IF_PFLOG_H
- 
-diff --git a/configure b/configure
-index eb33db18..f64c4eea 100755
---- a/configure
-+++ b/configure
-@@ -4037,7 +4037,7 @@ fi
- done
- 
- 
--for ac_header in fcntl.h rpc/rpc.h rpc/rpcent.h
-+for ac_header in fcntl.h rpc/rpc.h rpc/rpcent.h net/if.h
- do :
-   as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
- ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default"
-diff --git a/configure.ac b/configure.ac
-index 32f48b60..46f841c0 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -24,7 +24,7 @@ AC_PROG_CC_C99
- 	fi
- fi
- 
--AC_CHECK_HEADERS(fcntl.h rpc/rpc.h rpc/rpcent.h)
-+AC_CHECK_HEADERS(fcntl.h rpc/rpc.h rpc/rpcent.h net/if.h)
- AC_CHECK_HEADERS(net/pfvar.h, , , [#include <sys/types.h>
- #include <sys/socket.h>
- #include <net/if.h>])
-diff --git a/print-sll.c b/print-sll.c
-index 96031442..e6c7bd4a 100644
---- a/print-sll.c
-+++ b/print-sll.c
-@@ -25,6 +25,10 @@
- #include "config.h"
- #endif
- 
-+#ifdef HAVE_NET_IF_H
-+#include <net/if.h>
-+#endif
-+
- #include <netdissect-stdinc.h>
- 
- #include "netdissect.h"
-@@ -395,6 +399,9 @@ sll2_if_print(netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char
- 	u_short ether_type;
- 	int llc_hdrlen;
- 	u_int hdrlen;
-+#ifdef HAVE_NET_IF_H
-+	char ifname[IF_NAMESIZE];
-+#endif
- 
- 	ndo->ndo_protocol = "sll2";
- 	if (caplen < SLL2_HDR_LEN) {
-diff --git a/tcpdump.c b/tcpdump.c
-index 2bef72c8..0ef21117 100644
---- a/tcpdump.c
-+++ b/tcpdump.c
-@@ -1978,6 +1978,10 @@ main(int argc, char **argv)
- 			    RFileName, dlt_name,
- 			    pcap_datalink_val_to_description(dlt));
- 		}
-+#ifdef DLT_LINUX_SLL2
-+		if (dlt == DLT_LINUX_SLL2)
-+			fprintf(stderr, "Warning: interface names might be incorrect\n");
-+#endif
- 	} else {
- 		/*
- 		 * We're doing a live capture.
-diff --git a/tcpdump.c b/tcpdump.c
-index 376d9a20..06d3d9b9 100644
---- a/tcpdump.c
-+++ b/tcpdump.c
-@@ -155,6 +155,7 @@ static int Iflag;			/* rfmon (monitor) mode */
- static int Jflag;			/* list available time stamp types */
- #endif
- static int jflag = -1;			/* packet time stamp source */
-+static int oflag = 0;
- static int pflag;			/* don't go promiscuous */
- #ifdef HAVE_PCAP_SETDIRECTION
- static int Qflag = -1;			/* restrict captured packet by send/receive direction */
-@@ -515,7 +515,7 @@ show_devices_and_exit (void)
- #define Q_FLAG
- #endif
- 
--#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
-+#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNoOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
- 
- /*
-  * Long options.
-@@ -1340,6 +1341,10 @@ main(int argc, char **argv)
- 			++ndo->ndo_Nflag;
- 			break;
- 
-+		case 'o':
-+			oflag++;
-+			break;
-+
- 		case 'O':
- 			Oflag = 0;
- 			break;
-@@ -1932,6 +1932,14 @@ main(int argc, char **argv)
- 		show_devices_and_exit();
- #endif
- 
-+#if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK)
-+/* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */
-+		if (device != NULL &&
-+		    strncmp (device, "any", strlen("any")) == 0
-+		    && yflag_dlt == -1 && oflag > 0)
-+			yflag_dlt = DLT_LINUX_SLL2;
-+#endif
-+
- 	switch (ndo->ndo_tflag) {
- 
- 	case 0: /* Default */
-@@ -2180,7 +2188,8 @@ main(int argc, char **argv)
- 			}
- #endif
- 			(void)fprintf(stderr, "%s: data link type %s\n",
--				      program_name, yflag_dlt_name);
-+				      program_name,
-+				      pcap_datalink_val_to_name(yflag_dlt));
- 			(void)fflush(stderr);
- 		}
- 		i = pcap_snapshot(pd);

SOURCES/0017-pgm-fix-the-way-we-step-through-the-packet.patch

@@ -1,155 +0,0 @@
-From 1ef47c304f226ca9f8a8d6bff1b43e617eafef19 Mon Sep 17 00:00:00 2001
-From: Guy Harris <gharris@sonic.net>
-Date: Mon, 21 Aug 2023 23:15:14 -0700
-Subject: [PATCH] pgm: fix the way we step through the packet.
-
-Step past the PGM header after we finish processing it and before we
-process the message-type-specific header.
-
-Step past the message-type-specific fixed-length header before we
-process the stuff after that header.
-
-This makes the code a bit clearer (by explicitly advancing bp by the
-size of the stuff we just processed, rather than doing so by trickery
-involving adding 1 to a pointer to a structure), and fixes the
-processing of message types that don't have a message-type-specific
-header (where we weren't stepping past the PGM header).  It also affects
-the way we handle messages of an unknown type.
-
-(cherry picked from commit 9a3eebde95cf1032ac68ae4312e2db14bb1fe58d)
----
- print-pgm.c               | 29 +++++++++++++++--------------
- tests/pgm_opts_asan.out   |  2 +-
- tests/pgm_opts_asan_2.out |  2 +-
- tests/pgm_opts_asan_3.out |  2 +-
- 4 files changed, 18 insertions(+), 17 deletions(-)
-
-diff --git a/print-pgm.c b/print-pgm.c
-index 7672b616..f5ef7702 100644
---- a/print-pgm.c
-+++ b/print-pgm.c
-@@ -218,13 +218,14 @@ pgm_print(netdissect_options *ndo,
- 		     pgm->pgm_gsid[3],
-                      pgm->pgm_gsid[4],
-                      pgm->pgm_gsid[5]));
-+	bp += sizeof(struct pgm_header);
- 	switch (pgm->pgm_type) {
- 	case PGM_SPM: {
- 	    const struct pgm_spm *spm;
- 
--	    spm = (const struct pgm_spm *)(pgm + 1);
-+	    spm = (const struct pgm_spm *)bp;
- 	    ND_TCHECK(*spm);
--	    bp = (const u_char *) (spm + 1);
-+	    bp += sizeof(struct pgm_spm);
- 
- 	    switch (EXTRACT_16BITS(&spm->pgms_nla_afi)) {
- 	    case AFNUM_INET:
-@@ -253,21 +254,21 @@ pgm_print(netdissect_options *ndo,
- 	case PGM_POLL: {
- 	    const struct pgm_poll *poll_msg;
- 
--	    poll_msg = (const struct pgm_poll *)(pgm + 1);
-+	    poll_msg = (const struct pgm_poll *)bp;
- 	    ND_TCHECK(*poll_msg);
- 	    ND_PRINT((ndo, "POLL seq %u round %u",
- 			 EXTRACT_32BITS(&poll_msg->pgmp_seq),
-                          EXTRACT_16BITS(&poll_msg->pgmp_round)));
--	    bp = (const u_char *) (poll_msg + 1);
-+	    bp += sizeof(struct pgm_poll);
- 	    break;
- 	}
- 	case PGM_POLR: {
- 	    const struct pgm_polr *polr;
- 	    uint32_t ivl, rnd, mask;
- 
--	    polr = (const struct pgm_polr *)(pgm + 1);
-+	    polr = (const struct pgm_polr *)bp;
- 	    ND_TCHECK(*polr);
--	    bp = (const u_char *) (polr + 1);
-+	    bp += sizeof(struct pgm_polr);
- 
- 	    switch (EXTRACT_16BITS(&polr->pgmp_nla_afi)) {
- 	    case AFNUM_INET:
-@@ -305,24 +306,24 @@ pgm_print(netdissect_options *ndo,
- 	case PGM_ODATA: {
- 	    const struct pgm_data *odata;
- 
--	    odata = (const struct pgm_data *)(pgm + 1);
-+	    odata = (const struct pgm_data *)bp;
- 	    ND_TCHECK(*odata);
- 	    ND_PRINT((ndo, "ODATA trail %u seq %u",
- 			 EXTRACT_32BITS(&odata->pgmd_trailseq),
- 			 EXTRACT_32BITS(&odata->pgmd_seq)));
--	    bp = (const u_char *) (odata + 1);
-+	    bp += sizeof(struct pgm_data);
- 	    break;
- 	}
- 
- 	case PGM_RDATA: {
- 	    const struct pgm_data *rdata;
- 
--	    rdata = (const struct pgm_data *)(pgm + 1);
-+	    rdata = (const struct pgm_data *)bp;
- 	    ND_TCHECK(*rdata);
- 	    ND_PRINT((ndo, "RDATA trail %u seq %u",
- 			 EXTRACT_32BITS(&rdata->pgmd_trailseq),
- 			 EXTRACT_32BITS(&rdata->pgmd_seq)));
--	    bp = (const u_char *) (rdata + 1);
-+	    bp += sizeof(struct pgm_data);
- 	    break;
- 	}
- 
-@@ -332,9 +333,9 @@ pgm_print(netdissect_options *ndo,
- 	    const struct pgm_nak *nak;
- 	    char source_buf[INET6_ADDRSTRLEN], group_buf[INET6_ADDRSTRLEN];
- 
--	    nak = (const struct pgm_nak *)(pgm + 1);
-+	    nak = (const struct pgm_nak *)bp;
- 	    ND_TCHECK(*nak);
--	    bp = (const u_char *) (nak + 1);
-+	    bp += sizeof(struct pgm_nak);
- 
- 	    /*
- 	     * Skip past the source, saving info along the way
-@@ -402,11 +403,11 @@ pgm_print(netdissect_options *ndo,
- 	case PGM_ACK: {
- 	    const struct pgm_ack *ack;
- 
--	    ack = (const struct pgm_ack *)(pgm + 1);
-+	    ack = (const struct pgm_ack *)bp;
- 	    ND_TCHECK(*ack);
- 	    ND_PRINT((ndo, "ACK seq %u",
- 			 EXTRACT_32BITS(&ack->pgma_rx_max_seq)));
--	    bp = (const u_char *) (ack + 1);
-+	    bp += sizeof(struct pgm_ack);
- 	    break;
- 	}
- 
-diff --git a/tests/pgm_opts_asan.out b/tests/pgm_opts_asan.out
-index cc0607a4..b75868ac 100644
---- a/tests/pgm_opts_asan.out
-+++ b/tests/pgm_opts_asan.out
-@@ -1,2 +1,2 @@
- IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->9eb9)!)
--    128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13]  OPT_06 [26]  PATH_NLA [4] [|OPT]
-+    128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f[Bad OPT_LENGTH option, length 0 != 4]
-diff --git a/tests/pgm_opts_asan_2.out b/tests/pgm_opts_asan_2.out
-index 7e948d41..21cd69a7 100644
---- a/tests/pgm_opts_asan_2.out
-+++ b/tests/pgm_opts_asan_2.out
-@@ -1,2 +1,2 @@
- IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->96b9)!)
--    128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13]  OPT_06 [26] [Bad OPT_PGMCC_DATA option, length 4 < 12]
-+    128.121.89.107 > 89.89.16.63: 128.121.89.107.4 > 89.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f[Bad OPT_LENGTH option, length 0 != 4]
-diff --git a/tests/pgm_opts_asan_3.out b/tests/pgm_opts_asan_3.out
-index 8a6bffd3..f3da1d38 100644
---- a/tests/pgm_opts_asan_3.out
-+++ b/tests/pgm_opts_asan_3.out
-@@ -1,2 +1,2 @@
- IP (tos 0x41,ECT(1), id 0, offset 0, flags [none], proto PGM (113), length 32639, options (unknown 89 [bad length 232]), bad cksum 5959 (->f814)!)
--    128.121.89.16 > 0.89.16.63: 128.121.89.16.4 > 0.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f OPTS LEN 225 OPT_1F [13]  OPT_06 [26] [Bad OPT_REDIRECT option, length 4 < 8]
-+    128.121.89.16 > 0.89.16.63: 128.121.89.16.4 > 0.89.16.63.225: PGM, length 0 0x3414eb1f0022 UNKNOWN type 0x1f[Bad OPT_LENGTH option, length 0 != 4]
--- 
-2.41.0
-

SOURCES/0018-pgm-don-t-advance-bp-by-the-option-haeder-length-twi.patch

@@ -1,48 +0,0 @@
-From 5109a65f791280b3549377851e4bdd77f802c207 Mon Sep 17 00:00:00 2001
-From: Guy Harris <gharris@sonic.net>
-Date: Tue, 22 Aug 2023 12:23:20 -0700
-Subject: [PATCH] pgm: don't advance bp by the option haeder length twice.
-
-At those points, we've already advanced it by the option header length,
-and opt_len includes that length, so advance bp by opt_len minus the
-option header length.
-
-(cherry picked from commit 09b0447fad52298440e05e7368f9d24492d0b0fe)
----
- print-pgm.c | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/print-pgm.c b/print-pgm.c
-index 8340f2c3..7672b616 100644
---- a/print-pgm.c
-+++ b/print-pgm.c
-@@ -668,7 +668,7 @@ pgm_print(netdissect_options *ndo,
- 
- 		case PGM_OPT_PATH_NLA:
- 		    ND_PRINT((ndo, " PATH_NLA [%d]", opt_len));
--		    bp += opt_len;
-+		    bp += opt_len - 2;
- 		    opts_len -= opt_len;
- 		    break;
- 
-@@ -710,7 +710,7 @@ pgm_print(netdissect_options *ndo,
- 
- 		case PGM_OPT_CR:
- 		    ND_PRINT((ndo, " CR"));
--		    bp += opt_len;
-+		    bp += opt_len - 2;
- 		    opts_len -= opt_len;
- 		    break;
- 
-@@ -814,7 +814,7 @@ pgm_print(netdissect_options *ndo,
- 
- 		default:
- 		    ND_PRINT((ndo, " OPT_%02X [%d] ", opt_type, opt_len));
--		    bp += opt_len;
-+		    bp += opt_len - 2;
- 		    opts_len -= opt_len;
- 		    break;
- 		}
--- 
-2.41.0
-

SOURCES/0019-CVE-2021-41043.patch

@@ -1,48 +0,0 @@
-From 030859fce9c77417de657b9bb29c0f78c2d68f4a Mon Sep 17 00:00:00 2001
-From: Denis Ovsienko <denis@ovsienko.info>
-Date: Thu, 30 Dec 2021 17:52:52 +0000
-Subject: [PATCH] CVE-2021-41043: Fix a use-after-free in extract_slice().
-
-This issue was discovered by Mohammad Hosein Askari (@C0NSTANTINE110),
-see GitHub issue #11.
-
-In extract_slice() pcap_dump_open() takes a pcap_t argument to tell
-which DLT to use for the output file.  This used to be the pcap_t of the
-first input file, as main() requires at least one input file.  However,
-the loop before pcap_dump_open() closes all, including the first, input
-files that don't meet a test condition.  This way, when the first file
-didn't meet the condition, the call to pcap_dump_open() would end up as
-a use-after-free.  Make the pcap_dump_open() call before the loop, when
-the first array element is always valid, and fix this problem.
----
-diff --git a/tcpslice-1.2a3/tcpslice.c b/tcpslice-1.2a3/tcpslice.c
-index 6d08473..7c0f4a0 100644
---- a/tcpslice-1.2a3/tcpslice.c
-+++ b/tcpslice-1.2a3/tcpslice.c
-@@ -841,6 +841,13 @@ extract_slice(struct state *states, const int numfiles, const char *write_file_n
- 	TV_SUB(start_time, base_time, &relative_start);
- 	TV_SUB(stop_time, base_time, &relative_stop);
- 
-+	/* Always write the output file, use the first input file's DLT. */
-+	dumper = pcap_dump_open(states[0].p, write_file_name);
-+	if (!dumper) {
-+		error("error creating output file '%s': %s",
-+		      write_file_name, pcap_geterr(states[0].p));
-+	}
-+
- 	for (i = 0; i < numfiles; ++i) {
- 		s = &states[i];
- 
-@@ -879,12 +886,6 @@ extract_slice(struct state *states, const int numfiles, const char *write_file_n
- 		get_next_packet(s);
- 	}
- 
--	dumper = pcap_dump_open(states->p, write_file_name);
--	if (! dumper) {
--		error( "error creating output file %s: ",
--			write_file_name, pcap_geterr( states->p ) );
--	}
--
- 
- 	/*
- 	 * Now, loop thru all the packets in all the files,

SPECS/tcpdump.spec

@@ -2,7 +2,7 @@ Summary: A network traffic monitoring tool
 Name: tcpdump
 Epoch: 14
 Version: 4.9.3
-Release: 5%{?dist}
+Release: 2%{?dist}
 License: BSD with advertising
 URL: http://www.tcpdump.org
 Group: Applications/Internet
@@ -25,10 +25,6 @@ Patch0012:      0012-Add-printing-support-for-vsockmon-devices.patch
 Patch0013:      0013-tcpslice-stdlib.patch
 Patch0014:      0014-enhance-mptcp.patch
 Patch0015:      0015-CVE-2020-8037.patch
-Patch0016:      0016-direction-for-any.patch
-Patch0017:      0017-pgm-fix-the-way-we-step-through-the-packet.patch
-Patch0018:      0018-pgm-don-t-advance-bp-by-the-option-haeder-length-twi.patch
-Patch0019:      0019-CVE-2021-41043.patch
 
 %define tcpslice_dir tcpslice-1.2a3
 
@@ -94,15 +90,6 @@ exit 0
 %{_mandir}/man8/tcpdump.8*
 
 %changelog
-* Fri Jan 05 2024 Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-5
-- Resolves: RHEL-7858 - tcpslice: use-after-free in extract_slice()
-
-* Wed Nov 01 2023 Pavol Žáčik <pzacik@redhat.com> - 14:4.9.3-4
-- Resolves: RHEL-10708 - Fix PGM option printing
-
-* Mon Jan 10 2022 Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-3
-- Resolves: #2005451 - tcpdump support for direction and interface needed in RHEL8
-
 * Thu May 13 2021 Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
 - Resolves: #1860216 - tcpdump can not parse mptcp options
 - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory