ports/62274: patch: p0f - fix layer header

[Radim Kolar]

>Number:         62274
>Category:       ports
>Synopsis:       patch: p0f - fix layer header
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Feb 02 09:40:04 PST 2004
>Closed-Date:
>Last-Modified:
>Originator:     Radim Kolar
>Release:        FreeBSD 5.2-RELEASE i386
>Organization:
Sanatana Dharma
>Environment:
System: FreeBSD asura.bsd 5.2-RELEASE FreeBSD 5.2-RELEASE #1: Wed Jan 28 18:18:58 CET 2004 root at asura.bsd:/usr/src/sys/i386/compile/GENERIC i386

	
>Description:
p0f 2.0.3 has wrong size of BPF_NUL link layer, it should be 4 bytes,
not 0.
	
>How-To-Repeat:
p0f -i lo0
do not works without patch
	
>Fix:

--- p0f.c.orig	Mon Oct 13 20:57:21 2003
+++ p0f.c	Mon Feb  2 13:20:05 2004
@@ -161,7 +161,8 @@
 
   switch(type) {
 
-    case DLT_NULL:
+    case DLT_NULL: header_len=4; break;
+
     case DLT_SLIP:
     case DLT_RAW:  break;
 
@@ -1199,11 +1200,15 @@
   /* Whoops, IP header ends past end_ptr */
   if ((_u8*)(iph + 1) > end_ptr) return;
 
-  if ( ((iph->ihl & 0x40) != 0x40) || iph->proto != IPPROTO_TCP) {
-    debug("[!] WARNING: Non-IP packet received. Bad header_len!\n");
+  if ( iph->proto != IPPROTO_TCP) {
+    debug("[!] WARNING: Non-IP packet received.\n");
     return;
   }
 
+  if ( ((iph->ihl & 0x40) != 0x40) ) {
+    debug("[!] WARNING: Bad header_len!\n");
+    return;
+  }
   /* If the declared length is shorter than the snapshot (etherleak
      or such), truncate this bad boy. */
 
--- mtu.h.orig	Fri Oct 10 22:56:39 2003
+++ mtu.h	Mon Feb  2 13:30:57 2004
@@ -58,6 +58,7 @@
   {  4352, "FDDI" },
   {  4500, "token ring (2)" },
   {  9180, "FORE ATM" },
+  { 16384, "loopback" },
   { 16436, "sometimes loopback" },
   { 18000, "token ring x4" },
 };
>Release-Note:
>Audit-Trail:
>Unformatted: