Bug 243522

Summary: net/tcpslice needs updating
Product: Ports & Packages Reporter: dgilbert
Component: Individual Port(s)Assignee: Sofian Brabez <sbz>
Status: Closed FIXED    
Severity: Affects Only Me CC: leres
Priority: --- Flags: bugzilla: maintainer-feedback? (sbz)
Version: Latest   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
patch
none
revised patch leres: maintainer-approval?

Description dgilbert 2020-01-22 16:51:57 UTC 
I have tcpslice from ports.  I have two files of 95 megabytes in size created by FreeBSD's own tcpdump.  I try to "tcpslice -w file3.pcap 9h25m 10h10m file1.pcap file2.pcap" ... and tcpslice just says it can't find the final packet.

I git clone from https://github.com/the-tcpdump-group/tcpslice and ./configure + make + make install ... and tcpslice works.
Comment 1 Craig Leres freebsd_committer freebsd_triage 2020-05-15 03:29:17 UTC 
Created attachment 214510 [details]
patch

My cybersecurity guys complained about this issue; here's my fix. The symptom is:

    tcpslice: problems finding end packet of file ...

This is because pcap-int.h is not found while building. This comment from search.c explains the complication:

    /* If we're building without pcap's internal headers, we have to just
     * assume that the public pcap_pkthdr is the same as is written to
     * the file.  This can cause problems on systems with 64-bit longs;
     * the symptom is that tcpslice can't find any packets to read.
     * The solution is to build with the pcap-int.h from the installed
     * version of libpcap.
     */

So adding -I${SRC_BASE}/contrib/libpcap to CPPFLAGS allows usage of pcap-int.h. But a patch to search.c is also needed due to the unfortunately ordering of includes (libpcap has some portability that pcap-int.h invokes that doesn't work if its invoked before string.h is included).

Here's the upstream pull request: https://github.com/the-tcpdump-group/tcpslice/pull/6

Happy to commit with maintainer approval.
Comment 2 Craig Leres freebsd_committer freebsd_triage 2020-05-15 19:36:37 UTC 
Created attachment 214535 [details]
revised patch

My pull request prompted a rewrite of some parts of tcpslice; the new version does not depend on pcap-int.h.

Here's a revised patch to just update to the version committed yesterday.
Comment 3 commit-hook freebsd_committer freebsd_triage 2020-07-22 00:24:29 UTC 
A commit references this bug:

Author: leres
Date: Wed Jul 22 00:23:27 UTC 2020
New revision: 542820
URL: https://svnweb.freebsd.org/changeset/ports/542820

Log:
  net/tcpslice: Update to solve "problems finding end packet of file" error

  tcpslice was a 2014 version that required an internal header file
  (pcap-int.h) to fully support systems with 64-bit longs. After I
  filed an issue with upstream the code was rewritten to eliminate
  this dependency; update to this version.

  PR:		243522
  Approved by:	sbz (maintainer timeout, 9 weeks)

Changes:
  head/net/tcpslice/Makefile
  head/net/tcpslice/distinfo
Comment 4 Sofian Brabez freebsd_committer freebsd_triage 2021-03-29 07:56:19 UTC 
It should have been closed after r542820. Also I landed a update to latest version in r569431. Thanks!