From 64a0a8b05f1ca855bbf070ffe8b731a84b038457 Mon Sep 17 00:00:00 2001
From: jvazquez-r7 <juan_vazquez@rapid7.com>
Date: Fri, 11 Jul 2014 15:42:59 -0500
Subject: [PATCH] [SeeRM #6355] Fix sniffer extension on 64bits machines

---
 Makefile                       |  1 +
 source/libpcap/pcap-linux.diff | 37 ++++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 source/libpcap/pcap-linux.diff

diff --git a/Makefile b/Makefile
index 7265dff..b5478ad 100644
--- a/Makefile
+++ b/Makefile
@@ -142,6 +142,7 @@ $(build_tmp)/libpcap-1.1.1/libpcap.so.1.1.1:
 	echo '#undef HAVE_ETHER_HOSTTON'  >> $(build_tmp)/libpcap-1.1.1/config.h
 	echo '#define _STDLIB_H this_works_around_malloc_definition_in_grammar_dot_c' >> $(build_tmp)/libpcap-1.1.1/config.h
 	(cd $(build_tmp)/libpcap-1.1.1 && patch --dry-run -p0 < ../../source/libpcap/pcap_nametoaddr_fix.diff && patch -p0 < ../../source/libpcap/pcap_nametoaddr_fix.diff)
+	(cd $(build_tmp)/libpcap-1.1.1 && patch --dry-run -p0 < ../../source/libpcap/pcap-linux.diff && patch -p0 < ../../source/libpcap/pcap-linux.diff)
 	sed -i -e s/pcap-usb-linux.c//g -e s/fad-getad.c/fad-gifc.c/g $(build_tmp)/libpcap-1.1.1/Makefile
 	sed -i -e s^"CC = gcc"^"CC = gcc $(PCAP_CFLAGS)"^g $(build_tmp)/libpcap-1.1.1/Makefile
 	$(MAKE) -C $(build_tmp)/libpcap-1.1.1
diff --git a/source/libpcap/pcap-linux.diff b/source/libpcap/pcap-linux.diff
new file mode 100644
index 0000000..f1c2216
--- /dev/null
+++ b/source/libpcap/pcap-linux.diff
@@ -0,0 +1,37 @@
+--- pcap-linux.c	2010-03-11 17:56:54.000000000 -0800
++++ /opt/libpcap-1.1.1/pcap-linux.c	2014-07-11 13:18:06.133832775 -0700
+@@ -3378,6 +3378,9 @@
+ 		unsigned int tp_snaplen;
+ 		unsigned int tp_sec;
+ 		unsigned int tp_usec;
++		unsigned int ulong_size = 4;
++		unsigned char *raw_data;
++		struct utsname utsbuf;
+ 
+ 		h.raw = pcap_get_ring_frame(handle, TP_STATUS_USER);
+ 		if (!h.raw)
+@@ -3385,11 +3388,19 @@
+ 
+ 		switch (handle->md.tp_version) {
+ 		case TPACKET_V1:
+-			tp_len	   = h.h1->tp_len;
+-			tp_mac	   = h.h1->tp_mac;
+-			tp_snaplen = h.h1->tp_snaplen;
+-			tp_sec	   = h.h1->tp_sec;
+-			tp_usec	   = h.h1->tp_usec;
++			raw_data = (unsigned char *)h.raw;
++			if (uname(&utsbuf) != -1) {
++				if(strstr(utsbuf.machine, "64") == NULL) {
++					ulong_size = 4;
++				} else {
++					ulong_size = 8;
++				}
++			}
++			tp_len	   = (__u32)raw_data[ulong_size];
++			tp_mac	   = (__u16)raw_data[ulong_size + 8];
++			tp_snaplen = (__u32)raw_data[ulong_size + 4];
++			tp_sec	   = (__u32)raw_data[ulong_size + 12];
++			tp_usec	   = (__u32)raw_data[ulong_size + 16];
+ 			break;
+ #ifdef HAVE_TPACKET2
+ 		case TPACKET_V2: