--- tcpdump-3.8.3.orig/debian/patches/00list
+++ tcpdump-3.8.3/debian/patches/00list
@@ -0,0 +1,6 @@
+10_man_install
+20_man_fixes
+30_openssl_des
+40_ipv6cp
+50_misc_dos
+55_CAN-2005-1267
--- tcpdump-3.8.3.orig/debian/patches/55_CAN-2005-1267.dpatch
+++ tcpdump-3.8.3/debian/patches/55_CAN-2005-1267.dpatch
@@ -0,0 +1,20 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Security fixes for an infinite loop
+
+@DPATCH@
+diff -urNad tcpdump-3.8.3.orig/print-bgp.c tcpdump-3.8.3/print-bgp.c
+--- tcpdump-3.8.3.orig/print-bgp.c
++++ tcpdump-3.8.3/print-bgp.c
+@@ -1649,7 +1649,10 @@ bgp_update_print(const u_char *dat, int 
+ 			char buf[MAXHOSTNAMELEN + 100];
+ 			i = decode_prefix4(p, buf, sizeof(buf));
+ 			if (i == -1)
++			{
+ 				printf("\n\t    (illegal prefix length)");
++				break;
++			}
+ 			else if (i == -2)
+ 				goto trunc;
+ 			else {
--- tcpdump-3.8.3.orig/debian/patches/10_man_install.dpatch
+++ tcpdump-3.8.3/debian/patches/10_man_install.dpatch
@@ -0,0 +1,46 @@
+#! /bin/sh -e
+## 10_man_install.dpatch by Romain Francoise <rfrancoise@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Change man page install paths for Debian.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/Makefile.in tcpdump-3.8.3/Makefile.in
+--- /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/Makefile.in	2004-05-08 09:12:28.000000000 +0200
++++ tcpdump-3.8.3/Makefile.in	2004-05-08 09:13:23.000000000 +0200
+@@ -157,13 +157,13 @@
+ 	[ -d $(DESTDIR)$(sbindir) ] || \
+ 	    (mkdir -p $(DESTDIR)$(sbindir); chmod 755 $(DESTDIR)$(sbindir))
+ 	$(INSTALL_PROGRAM) $(PROG) $(DESTDIR)$(sbindir)/$(PROG)
+-	[ -d $(DESTDIR)$(mandir)/man1 ] || \
+-	    (mkdir -p $(DESTDIR)$(mandir)/man1; chmod 755 $(DESTDIR)$(mandir)/man1)
+-	$(INSTALL_DATA) $(srcdir)/$(PROG).1 $(DESTDIR)$(mandir)/man1/$(PROG).1
++	[ -d $(DESTDIR)$(mandir)/man8 ] || \
++	    (mkdir -p $(DESTDIR)$(mandir)/man8; chmod 755 $(DESTDIR)$(mandir)/man8)
++	$(INSTALL_DATA) $(srcdir)/$(PROG).1 $(DESTDIR)$(mandir)/man8/$(PROG).8
+ 
+ uninstall:
+ 	rm -f $(DESTDIR)$(sbindir)/$(PROG)
+-	rm -f $(DESTDIR)$(mandir)/man1/$(PROG).1
++	rm -f $(DESTDIR)$(mandir)/man8/$(PROG).8
+ 
+ lint: $(GENSRC)
+ 	lint -hbxn $(SRC) | \
--- tcpdump-3.8.3.orig/debian/patches/20_man_fixes.dpatch
+++ tcpdump-3.8.3/debian/patches/20_man_fixes.dpatch
@@ -0,0 +1,67 @@
+#! /bin/sh -e
+## 20_man_fixes.dpatch by Romain Francoise <rfrancoise@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Misc. fixes to the upstream man page.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/tcpdump.1 tcpdump-3.8.3/tcpdump.1
+--- /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/tcpdump.1	2004-05-08 09:12:32.000000000 +0200
++++ tcpdump-3.8.3/tcpdump.1	2004-05-08 09:18:27.000000000 +0200
+@@ -22,7 +22,7 @@
+ .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
+ .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ .\"
+-.TH TCPDUMP 1  "7 January 2004"
++.TH TCPDUMP 8  "8 May 2004"
+ .SH NAME
+ tcpdump \- dump traffic on a network
+ .SH SYNOPSIS
+@@ -672,7 +672,7 @@
+ True if the ethernet destination address is \fIehost\fP.
+ \fIEhost\fP
+ may be either a name from /etc/ethers or a number (see
+-.IR ethers (3N)
++.IR ethers (5)
+ for numeric format).
+ .IP "\fBether src \fIehost\fP
+ True if the ethernet source address is \fIehost\fP.
+@@ -699,7 +699,7 @@
+ True if the IPv4/v6 destination address of the packet has a network
+ number of \fInet\fP.
+ \fINet\fP may be either a name from /etc/networks
+-or a network number (see \fInetworks(4)\fP for details).
++or a network number (see \fInetworks(5)\fP for details).
+ .IP "\fBsrc net \fInet\fR"
+ True if the IPv4/v6 source address of the packet has a network
+ number of \fInet\fP.
+@@ -718,9 +718,9 @@
+ True if the packet is ip/tcp, ip/udp, ip6/tcp or ip6/udp and has a
+ destination port value of \fIport\fP.
+ The \fIport\fP can be a number or a name used in /etc/services (see
+-.IR tcp (4P)
++.IR tcp (7)
+ and
+-.IR udp (4P)).
++.IR udp (7)).
+ If a name is used, both the port
+ number and protocol are checked.
+ If a number or ambiguous name is used,
--- tcpdump-3.8.3.orig/debian/patches/30_openssl_des.dpatch
+++ tcpdump-3.8.3/debian/patches/30_openssl_des.dpatch
@@ -0,0 +1,57 @@
+#! /bin/sh -e
+## 30_openssl_des.dpatch by Romain Francoise <rfrancoise@debian.org> 
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Change "des_cbc_encrypt" check to "DES_cbc_encrypt" since it
+## DP: got renamed in OpenSSL 0.9.7.  Super-ugly change to configure,
+## DP: but it's simpler this way (changing configure.in too while we're
+## DP: at it).
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/configure tcpdump-3.8.3/configure
+--- /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/configure	2004-03-28 23:06:09.000000000 +0200
++++ tcpdump-3.8.3/configure	2004-05-14 21:58:56.000000000 +0200
+@@ -9760,11 +9760,11 @@
+ #endif
+ /* We use char because int might match the return type of a gcc2
+    builtin and then its argument prototype would still apply.  */
+-char des_cbc_encrypt ();
++char DES_cbc_encrypt ();
+ int
+ main ()
+ {
+-des_cbc_encrypt ();
++DES_cbc_encrypt ();
+   ;
+   return 0;
+ }
+diff -urNad /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/configure.in tcpdump-3.8.3/configure.in
+--- /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/configure.in	2004-03-28 23:04:48.000000000 +0200
++++ tcpdump-3.8.3/configure.in	2004-05-14 21:58:11.000000000 +0200
+@@ -732,7 +732,7 @@
+ 	if test -f $ac_cv_ssleay_path/lib/librsaref.a; then
+ 		LIBS="$LIBS -lrsaref"
+ 	fi
+-	AC_CHECK_LIB(crypto, des_cbc_encrypt)
++	AC_CHECK_LIB(crypto, DES_cbc_encrypt)
+ 
+ 	CPPFLAGS="$CPPFLAGS $V_INCLS"
+ 	AC_CHECK_HEADERS(openssl/evp.h)
--- tcpdump-3.8.3.orig/debian/patches/40_ipv6cp.dpatch
+++ tcpdump-3.8.3/debian/patches/40_ipv6cp.dpatch
@@ -0,0 +1,45 @@
+#! /bin/sh -e
+## 40_ipv6cp.dpatch by Romain Francoise <rfrancoise@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Do not try to grok IPV6CP packets, the dissector doesn't 
+## DP: support it.
+
+if [ $# -lt 1 ]; then
+    echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+    exit 1
+fi
+
+[ -f debian/patches/00patch-opts ] && . debian/patches/00patch-opts
+patch_opts="${patch_opts:--f --no-backup-if-mismatch} ${2:+-d $2}"
+
+case "$1" in
+    -patch) patch -p1 ${patch_opts} < $0;;
+    -unpatch) patch -R -p1 ${patch_opts} < $0;;
+    *)
+        echo "`basename $0`: script expects -patch|-unpatch as argument" >&2
+        exit 1;;
+esac
+
+exit 0
+
+@DPATCH@
+diff -urNad /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/print-ppp.c tcpdump-3.8.3/print-ppp.c
+--- /home/romain/Work/Debian/tcpdump/tcpdump-3.8.3/print-ppp.c	2004-04-17 00:25:32.000000000 +0200
++++ tcpdump-3.8.3/print-ppp.c	2004-06-19 14:54:40.000000000 +0200
+@@ -1056,7 +1056,6 @@
+ 	case PPP_IPCP:
+ 	case PPP_OSICP:
+ 	case PPP_MPLSCP:
+-	case PPP_IPV6CP:
+ 	case PPP_CCP:
+ 	case PPP_BACP:
+ 		handle_ctrl_proto(proto, p, length);
+@@ -1077,6 +1076,7 @@
+ #ifdef INET6
+ 	case ETHERTYPE_IPV6:	/*XXX*/
+ 	case PPP_IPV6:
++	case PPP_IPV6CP:
+ 		ip6_print(p, length);
+ 		break;
+ #endif
--- tcpdump-3.8.3.orig/debian/patches/50_misc_dos.dpatch
+++ tcpdump-3.8.3/debian/patches/50_misc_dos.dpatch
@@ -0,0 +1,138 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 50_misc_dos.dpatch by Romain Francoise <rfrancoise@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Security fixes from upstream CVS.
+
+@DPATCH@
+diff -urNad tcpdump-3.8.3/print-bgp.c /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-bgp.c
+--- tcpdump-3.8.3/print-bgp.c	2004-03-24 01:04:04.000000000 +0100
++++ /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-bgp.c	2005-04-27 21:07:21.000000000 +0200
+@@ -36,7 +36,7 @@
+ 
+ #ifndef lint
+ static const char rcsid[] _U_ =
+-     "@(#) $Header: /tcpdump/master/tcpdump/print-bgp.c,v 1.72.2.4 2004/03/24 00:04:04 guy Exp $";
++     "@(#) $Header: /tcpdump/master/tcpdump/print-bgp.c,v 1.72.2.5 2005/04/27 18:42:28 hannes Exp $";
+ #endif
+ 
+ #include <tcpdump-stdinc.h>
+@@ -1216,6 +1216,8 @@
+                             tptr = pptr + len;
+                             break;
+ 			}
++                        if (advance < 0) /* infinite loop protection */
++                            break;
+ 			tptr += advance;
+ 		}
+ 		break;
+diff -urNad tcpdump-3.8.3/print-isoclns.c /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-isoclns.c
+--- tcpdump-3.8.3/print-isoclns.c	2004-03-24 02:45:26.000000000 +0100
++++ /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-isoclns.c	2005-04-27 21:07:21.000000000 +0200
+@@ -26,7 +26,7 @@
+ 
+ #ifndef lint
+ static const char rcsid[] _U_ =
+-    "@(#) $Header: /tcpdump/master/tcpdump/print-isoclns.c,v 1.106.2.5 2004/03/24 01:45:26 guy Exp $ (LBL)";
++    "@(#) $Header: /tcpdump/master/tcpdump/print-isoclns.c,v 1.106.2.8 2005/04/25 10:44:24 hannes Exp $ (LBL)";
+ #endif
+ 
+ #ifdef HAVE_CONFIG_H
+@@ -1250,11 +1250,11 @@
+ 	    break;
+ 	case L1_CSNP:
+ 	case L2_CSNP:
+-	    printf(", src-id %s", isis_print_id(header_csnp->source_id,SYSTEM_ID_LEN));
++	    printf(", src-id %s", isis_print_id(header_csnp->source_id,NODE_ID_LEN));
+ 	    break;
+ 	case L1_PSNP:
+ 	case L2_PSNP:
+-	    printf(", src-id %s", isis_print_id(header_psnp->source_id,SYSTEM_ID_LEN));
++	    printf(", src-id %s", isis_print_id(header_psnp->source_id,NODE_ID_LEN));
+ 	    break;
+ 
+ 	}
+@@ -1506,6 +1506,9 @@
+                tlv_type,
+                tlv_len);
+ 
++        if (tlv_len == 0) /* something is malformed */
++            break;
++
+         /* now check if we have a decoder otherwise do a hexdump at the end*/
+ 	switch (tlv_type) {
+ 	case TLV_AREA_ADDR:
+@@ -1536,7 +1539,7 @@
+ 	    break;
+ 
+         case TLV_ISNEIGH_VARLEN:
+-            if (!TTEST2(*tptr, 1))
++            if (!TTEST2(*tptr, 1) || tmp < 3) /* min. TLV length */
+ 		goto trunctlv;
+ 	    lan_alen = *tptr++; /* LAN adress length */
+             tmp --;
+diff -urNad tcpdump-3.8.3/print-ldp.c /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-ldp.c
+--- tcpdump-3.8.3/print-ldp.c	2003-11-16 09:51:31.000000000 +0100
++++ /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-ldp.c	2005-04-27 21:07:21.000000000 +0200
+@@ -15,7 +15,7 @@
+ 
+ #ifndef lint
+ static const char rcsid[] _U_ =
+-    "@(#) $Header: /tcpdump/master/tcpdump/print-ldp.c,v 1.4.2.2 2003/11/16 08:51:31 guy Exp $";
++    "@(#) $Header: /tcpdump/master/tcpdump/print-ldp.c,v 1.4.2.3 2005/04/27 18:42:29 hannes Exp $";
+ #endif
+ 
+ #ifdef HAVE_CONFIG_H
+@@ -326,6 +326,9 @@
+                EXTRACT_32BITS(&ldp_msg_header->id),
+                LDP_MASK_U_BIT(EXTRACT_16BITS(&ldp_msg_header->type)) ? "continue processing" : "ignore");
+ 
++        if (msg_len == 0) /* infinite loop protection */
++            break;
++
+         msg_tptr=tptr+sizeof(struct ldp_msg_header);
+         msg_tlen=msg_len-sizeof(struct ldp_msg_header)+4; /* Type & Length fields not included */
+ 
+diff -urNad tcpdump-3.8.3/print-rsvp.c /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-rsvp.c
+--- tcpdump-3.8.3/print-rsvp.c	2004-03-24 05:01:08.000000000 +0100
++++ /tmp/dpep.vFpHHq/tcpdump-3.8.3/print-rsvp.c	2005-04-27 21:07:21.000000000 +0200
+@@ -15,7 +15,7 @@
+ 
+ #ifndef lint
+ static const char rcsid[] _U_ =
+-    "@(#) $Header: /tcpdump/master/tcpdump/print-rsvp.c,v 1.24.2.3 2004/03/24 04:01:08 guy Exp $";
++    "@(#) $Header: /tcpdump/master/tcpdump/print-rsvp.c,v 1.24.2.5 2005/04/26 14:00:03 hannes Exp $";
+ #endif
+ 
+ #ifdef HAVE_CONFIG_H
+@@ -875,10 +875,17 @@
+             switch(rsvp_obj_ctype) {
+             case RSVP_CTYPE_IPV4:
+                 while(obj_tlen >= 4 ) {
+-                    printf("\n\t    Subobject Type: %s",
++                    printf("\n\t    Subobject Type: %s, length %u",
+                            tok2str(rsvp_obj_xro_values,
+                                    "Unknown %u",
+-                                   RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)));                
++                                   RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)),
++                           *(obj_tptr+1));                
++
++                    if (*(obj_tptr+1) == 0) { /* prevent infinite loops */
++                        printf("\n\t      ERROR: zero length ERO subtype");
++                        break;
++                    }
++
+                     switch(RSVP_OBJ_XRO_MASK_SUBOBJ(*obj_tptr)) {
+                     case RSVP_OBJ_XRO_IPV4:
+                         printf(", %s, %s/%u, Flags: [%s]",
+@@ -921,8 +928,8 @@
+                 if (obj_tlen < 8)
+                     return;
+                 printf("\n\t    Restart  Time: %ums, Recovery Time: %ums",
+-                       EXTRACT_16BITS(obj_tptr),
+-                       EXTRACT_16BITS(obj_tptr+4));
++                       EXTRACT_32BITS(obj_tptr),
++                       EXTRACT_32BITS(obj_tptr+4));
+                 obj_tlen-=8;
+                 obj_tptr+=8;
+                 break;
--- tcpdump-3.8.3.orig/debian/compat
+++ tcpdump-3.8.3/debian/compat
@@ -0,0 +1 @@
+4
--- tcpdump-3.8.3.orig/debian/control
+++ tcpdump-3.8.3/debian/control
@@ -0,0 +1,23 @@
+Source: tcpdump
+Section: net
+Priority: optional
+Maintainer: Romain Francoise <rfrancoise@debian.org>
+Uploaders: Torsten Landschoff <torsten@debian.org>
+Build-Depends: debhelper (>= 4), libpcap0.8-dev, dpatch, libssl-dev
+Standards-Version: 3.6.1.0
+
+Package: tcpdump
+Architecture: any
+Depends: ${shlibs:Depends}
+Description: A powerful tool for network monitoring and data acquisition
+ This program allows you to dump the traffic on a network. tcpdump 
+ is able to examine IPv4, ICMPv4, IPv6, ICMPv6, UDP, TCP, SNMP, AFS
+ BGP, RIP, PIM, DVMRP, IGMP, SMB, OSPF, NFS and many other packet
+ types.
+ .
+ It can be used to print out the headers of packets on a network 
+ interface, filter packets that match a certain expression. You can 
+ use this tool to track down network problems, to detect "ping attacks" 
+ or to monitor network activities. 
+ .
+ Further information is available at <URL: http://www.tcpdump.org/>
--- tcpdump-3.8.3.orig/debian/changelog
+++ tcpdump-3.8.3/debian/changelog
@@ -0,0 +1,299 @@
+tcpdump (3.8.3-5sarge1) stable-security; urgency=high
+
+  * Non-maintainer upload by the Security Team
+  * Applied Gentoo patch to fix infinite loop in BGP dissector
+    [debian/patches/55_CAN-2005-1267.dpatch, print-bgp.c]
+
+ -- Martin Schulze <joey@infodrom.org>  Sat,  1 Oct 2005 20:28:51 +0200
+
+tcpdump (3.8.3-5) unstable; urgency=low
+
+  * debian/copyright: Clarify license conditions, some files in the
+    distribution are still under the 4-clause BSD license (closes: #283008).
+  * debian/changelog: Revise 3.8.3-4 entry to add CAN numbers (which have
+    been assigned in the meantime).
+
+ -- Romain Francoise <rfrancoise@debian.org>  Sun,  1 May 2005 17:23:45 +0200
+
+tcpdump (3.8.3-4) unstable; urgency=high
+
+  * Urgency set to high due to security fixes.
+  * debian/patches/50_misc_dos.dpatch: Security fixes stolen from the 3.8
+    branch fix infinite loops in the BGP, ISIS, LDP and RSVP dissectors
+    [CAN-2005-1278, CAN-2005-1279, CAN-2005-1280] (closes: #306529).
+  * debian/patches/00list: Add 50_misc_dos.
+
+ -- Romain Francoise <rfrancoise@debian.org>  Wed, 27 Apr 2005 21:05:37 +0200
+
+tcpdump (3.8.3-3) unstable; urgency=low
+
+  * debian/patches/40_ipv6cp.dpatch: New patch, do not try to print IPV6CP
+    ppp packets, the dissector doesn't support it (closes: #255179).
+  * debian/patches/00list: Add 40_ipv6cp.
+
+ -- Romain Francoise <rfrancoise@debian.org>  Sat, 19 Jun 2004 15:01:27 +0200
+
+tcpdump (3.8.3-2) unstable; urgency=low
+
+  * debian/rules: Enable crypto support (closes: #82581, #93428).
+  * debian/control:
+    + Build-Depend on libssl-dev.
+    + Put back URL markers in description.
+    + Switch Maintainer and Uploaders fields to match reality.
+  * debian/patches/30_openssl_des.dpatch: Patch to make upstream's
+    configure script check for DES_cbc_encrypt instead of des_cbc_encrypt,
+    (the function got renamed in OpenSSL 0.9.7), which saves us the hassle
+    of re-running autoconf.  Temporary hack since upstream has fixed this
+    in CVS already.
+  * debian/patches/00list: Add 30_openssl_des.
+
+ -- Romain Francoise <rfrancoise@debian.org>  Fri, 14 May 2004 22:14:08 +0200
+
+tcpdump (3.8.3-1) unstable; urgency=low
+
+  * New upstream release.
+  * debian/rules:
+    + Add -D_FILE_OFFSET_BITS=64 to default CFLAGS to match libpcap 
+      (closes: #154762).
+    + Use dpatch for patch management.
+    + Clean up CFLAGS handling.
+    + Support DEB_BUILD_OPTIONS.
+  * debian/control: 
+    + Build-Depend on libpcap0.8-dev, dpatch.
+    + Add versioned Build-Depends on debhelper.
+    + Remove Emacs-style URL markers from description.
+  * debian/compat: New file.
+  * debian/copyright: Update.
+  * debian/tcpdump.docs: Do not install upstream INSTALL file.
+  * debian/patches: New directory.
+  * debian/patches/10_man_install.dpatch: Patch split off the Debian diff
+    to change man install paths in upstream Makefile.in.
+  * debian/patches/20_man_fixes.dpatch: Patch split off the Debian diff to
+    fix some inconsistencies in the upstream man page.
+  * debian/patches/00list: New file (patch list).
+
+ -- Romain Francoise <rfrancoise@debian.org>  Tue, 11 May 2004 14:02:09 +0200
+
+tcpdump (3.7.2-4) unstable; urgency=high
+
+  * Urgency high due to security fixes.
+  * Backport changes from upstream CVS to fix ISAKMP payload handling
+    denial-of-service vulnerabilities (CAN-2004-0183, CAN-2004-0184).
+    Detailed changes (with corresponding upstream revisions):
+    + Add length checks in isakmp_id_print() (print-isakmp.c, rev. 1.47)
+    + Add data checks all over the place, change rawprint() prototype and
+      add corresponding return value checks (print-isakmp.c, rev. 1.46)
+    + Add missing ntohs() and change length initialization in
+      isakmp_id_print(), not porting prototype changes (print-isakmp.c,
+      rev. 1.45)
+  
+ -- Romain Francoise <rfrancoise@debian.org>  Tue,  6 Apr 2004 19:39:24 +0200
+
+tcpdump (3.7.2-3) unstable; urgency=low
+
+  * Backport changes from upstream CVS to fix several vulnerabilities in
+    ISAKMP, L2TP and Radius parsing (closes: #227844, #227845, #227846).
+
+ -- Romain Francoise <rfrancoise@debian.org>  Sat, 17 Jan 2004 14:12:30 +0100
+
+tcpdump (3.7.2-2) unstable; urgency=low
+
+  * Acknowledge NMU by Romain (closes: #208543).
+  * Apply man page fixes by Romain:
+    + networks(4) changed to networks(5) (closes: #194180).
+    + ethers(3N) changed to ethers(5) (closes: #197888).
+  * debian/control: Added Romain Francoise as co maintainer. Thanks for 
+    your help, Romain!
+
+ -- Torsten Landschoff <torsten@debian.org>  Sun, 19 Oct 2003 04:12:31 +0200
+
+tcpdump (3.7.2-1.1) unstable; urgency=low
+
+  * NMU
+  * Reverse order of #include directives in print-sctp.c so that
+    IPPROTO_SCTP is defined (closes: #208543).
+
+ -- Romain Francoise <rfrancoise@debian.org>  Sun, 12 Oct 2003 17:06:01 +0200
+
+tcpdump (3.7.2-1) unstable; urgency=low
+
+  * New upstream release (closes: #195816).
+
+ -- Torsten Landschoff <torsten@debian.org>  Sun,  8 Jun 2003 00:14:44 +0200
+
+tcpdump (3.7.1-1.2) unstable; urgency=high
+
+  * Non-maintainer upload
+  * Apply security fixes from 3.7.2
+    - Fixed infinite loop when parsing malformed isakmp packets.
+      (CAN-2003-0108)
+    - Fixed infinite loop when parsing malformed BGP packets.
+    - Fixed buffer overflow with certain malformed NFS packets.
+
+ -- Matt Zimmerman <mdz@debian.org>  Thu, 27 Feb 2003 11:00:32 -0500
+
+tcpdump (3.7.1-1.1) unstable; urgency=low
+
+  * NMU
+  * Simple rebuild to deal with libpcap0->libpcap0.7 transition.
+    Sourceful NMU so that every arch rebuilds it.
+ 
+ -- LaMont Jones <lamont@debian.org>  Wed, 14 Aug 2002 21:25:45 -0600
+
+tcpdump (3.7.1-1) unstable; urgency=low
+
+  * New upstream release (closes: #138052).
+
+ -- Torsten Landschoff <torsten@debian.org>  Sat,  3 Aug 2002 23:54:04 +0200
+
+tcpdump (3.6.2-2) unstable; urgency=HIGH
+
+  * print-rx.c: Take the version from current CVS fixing the remote 
+    buffer overflow reported in FreeBSD Security Advisory SA-01:48
+    yesterday. Thanks to Matt Zimmerman for forwarding the report, 
+    I might have missed it.
+  * debian/control: Clean the Build-Depends from build-essential 
+    packages.
+
+ -- Torsten Landschoff <torsten@debian.org>  Thu, 19 Jul 2001 15:03:48 +0200
+
+tcpdump (3.6.2-1) unstable; urgency=low
+
+  * New upstream release.
+
+ -- Torsten Landschoff <torsten@debian.org>  Tue,  6 Mar 2001 04:18:16 +0100
+
+tcpdump (3.6.1-2) unstable; urgency=low
+
+  * debian/rules: Force support for IPv6 (closes: #82665).
+  * print-icmp6.c: Removed duplicate definition also in icmp6.h to 
+    get the package to compile with IPv6.
+  * Rebuild should fix the missing libpcap0-dependency (closes: #82666).
+    Additional info: The missing dependency was because the configure 
+    script found my libpcap sources in the parent directory. Black magic
+    always works against you :(
+
+ -- Torsten Landschoff <torsten@debian.org>  Thu, 18 Jan 2001 00:44:01 +0100
+
+tcpdump (3.6.1-1) unstable; urgency=high
+
+  * Taking back the package. Kudos to Anand for his help.
+  * New upstream release. This release fixes a security hole in print-rx.c.
+  * debian/rules: Disable crypto support (closes: #81969).
+  * Removed empty README.Debian (closes: #81966).
+
+ -- Torsten Landschoff <torsten@debian.org>  Tue, 16 Jan 2001 16:04:03 +0100
+
+tcpdump (3.5.2-3) unstable; urgency=low
+
+  * Fixup dependancy stuff. Sheesh. (Closes: #78063, #78081, #78082)
+
+ -- Anand Kumria <wildfire@progsoc.org>  Tue, 28 Nov 2000 02:16:01 +1100
+
+tcpdump (3.5.2-2) unstable; urgency=low
+
+  * Update both config.guess and config.sub (Closes: #36692, #53145)
+  * Opps, make the .diff available. 
+  * We require a particular libpcap version to work (Closes: #77877)
+
+ -- Anand Kumria <wildfire@progsoc.org>  Mon, 27 Nov 2000 01:13:55 +1100
+
+tcpdump (3.5.2-1) unstable; urgency=low
+
+  * New Maintainer
+  * New upstream release (Closes: #75889)
+  * Upstream added hex dump (-x) and ascii dump (-X) Closes: #23514, #29418)
+  * Acknowledge and incorporate security fixes (Closes: #63708, #77489)
+  * Appletalk / Ethertalk patches are in (Closes: #67642)
+
+ -- Anand Kumria <wildfire@progsoc.org>  Wed, 22 Nov 2000 13:19:33 +1100
+
+tcpdump (3.4a6-4.1) frozen unstable; urgency=high
+
+  * Non-maintainer upload by security team
+  * Apply patch from tcpdump-workers mailinglist to fix DNS DoS attack
+    against tcpdump. Based on patch from Guy Harris <gharris@flashcom.net> as
+    found on http://www.tcpdump.org/lists/workers/1999/msg00607.html
+  * Fix Build-Depends entry in debian/control
+
+ -- Wichert Akkerman <wakkerma@debian.org>  Sun,  7 May 2000 15:17:33 +0200
+
+tcpdump (3.4a6-4) unstable; urgency=low
+
+  * New maintainer.
+  * tcpdump.c (main): Reestablish priviliges before closing the device
+    (closes: #19959).
+  * It seems the problem with ppp came from the kernel - I can dump 
+    packages on ppp0 just fine... (closes: #25757)
+  * print-tcp.c (tcp_print): Applied patch from David S. Miller submitted 
+    by Andrea Arcangeli to fix tcpdump sack TCP option interpretation 
+    (closes: #28530).
+  * print-bootp.c (rfc1048_print): Interpret timezone offset as signed
+    (closes: #40376). Fixed byte order problem in printing internet 
+    addresses (closes: #40375). Thanks to Roderick Schertler for the patch.
+  * Several files: Applied SMB patch from samba.org (closes: #27653).
+  * print-ip.c (ip_print): Check for ip headers with less than 5 longs. 
+    Patch taken from RedHat's source package.
+  * Redid debian/rules using debhelper.
+  * Makefile.in: Install the manpage into man8 instead of man1. 
+  * tcpdump.1: Moved to section 8 (admin commands).
+  * print-smb.c (print_smb): Disabled anything but printing the command 
+    info by default. Otherwise we would get flooded with smb information.
+    You can get all info using -vvv. Two -v's will give you the SMB headers.
+  * tcpdump.1: Documented the behaviour described above.
+
+ -- Torsten Landschoff <torsten@debian.org>  Mon, 22 Nov 1999 01:31:44 +0100
+
+tcpdump (3.4a6-3) frozen unstable; urgency=low
+
+  * fixed permissions
+
+ -- Peter Tobias <tobias@et-inf.fho-emden.de>  Mon, 30 Mar 1998 02:28:39 +0200
+
+
+tcpdump (3.4a6-2) frozen unstable; urgency=low
+
+  * rebuild with latest debmake, fixes #19415
+    (should also fix the lintian warnings)
+  * updated standards-version
+
+ -- Peter Tobias <tobias@et-inf.fho-emden.de>  Mon, 30 Mar 1998 00:28:39 +0200
+
+
+tcpdump (3.4a6-1) unstable; urgency=low
+
+  * updated to latest upstream version, fixes: Bug#17163
+  * install changelog.Debian compressed, fixes: Bug#15417
+
+ -- Peter Tobias <tobias@et-inf.fho-emden.de>  Sun,  1 Feb 1998 00:08:31 +0100
+
+
+tcpdump (3.4a4-1) unstable; urgency=low
+
+  * updated to latest upstream version
+  * libc6 version
+
+ -- Peter Tobias <tobias@et-inf.fho-emden.de>  Wed, 17 Sep 1997 23:22:54 +0200
+
+
+tcpdump (3.3.1a2-1) frozen stable unstable; urgency=medium
+
+  * updated to latest upstream version (works with new libpcap now)
+
+ -- Peter Tobias <tobias@et-inf.fho-emden.de>  Sat, 24 May 1997 00:49:17 +0200
+
+
+tcpdump (3.3-2) unstable; urgency=low
+
+  * fixed SLIP support
+
+ -- Peter Tobias <tobias@et-inf.fho-emden.de>  Sun, 16 Feb 1997 21:06:51 +0100
+
+
+tcpdump (3.3-1) unstable; urgency=low
+
+  * updated to latest upstream version
+
+ -- Peter Tobias <tobias@et-inf.fho-emden.de>  Thu, 16 Jan 1997 01:34:00 +0100
+
+
--- tcpdump-3.8.3.orig/debian/rules
+++ tcpdump-3.8.3/debian/rules
@@ -0,0 +1,70 @@
+#!/usr/bin/make -f
+
+include /usr/share/dpatch/dpatch.make
+
+export DH_VERBOSE=1
+
+dstdir := $(shell pwd)/debian/tcpdump
+
+export CFLAGS=-D_FILE_OFFSET_BITS=64
+
+ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
+        CFLAGS += -O0
+endif
+
+build: patch build-stamp
+build-stamp:
+	dh_testdir
+
+	./configure --prefix=/usr --mandir=\$${prefix}/share/man 	\
+		--infodir=\$${prefix}/share/info --enable-ipv6
+	$(MAKE)
+
+	touch build-stamp
+
+clean: clean-patched unpatch
+clean-patched:
+	dh_testdir
+	dh_testroot
+	rm -f build-stamp
+
+	-$(MAKE) distclean
+
+	dh_clean
+
+install: build
+	dh_testdir
+	dh_testroot
+	dh_clean -k
+	dh_installdirs
+
+	$(MAKE) install prefix=$(dstdir)/usr
+
+
+# Build architecture-independent files here.
+binary-indep: build install
+# We have nothing to do by default.
+
+# Build architecture-dependent files here.
+binary-arch: build install
+#	dh_testversion
+	dh_testdir
+	dh_testroot
+	dh_installdocs
+	dh_installexamples
+	dh_installinfo
+	dh_installchangelogs CHANGES
+	dh_link
+	dh_strip
+	dh_compress
+	dh_fixperms
+#	dh_makeshlibs
+	dh_installdeb
+#	dh_perl
+	dh_shlibdeps
+	dh_gencontrol
+	dh_md5sums
+	dh_builddeb
+
+binary: binary-indep binary-arch
+.PHONY: build clean binary-indep binary-arch binary install
--- tcpdump-3.8.3.orig/debian/tcpdump.dirs
+++ tcpdump-3.8.3/debian/tcpdump.dirs
@@ -0,0 +1 @@
+usr/sbin
--- tcpdump-3.8.3.orig/debian/tcpdump.docs
+++ tcpdump-3.8.3/debian/tcpdump.docs
@@ -0,0 +1 @@
+README
--- tcpdump-3.8.3.orig/debian/tcpdump.examples
+++ tcpdump-3.8.3/debian/tcpdump.examples
@@ -0,0 +1,4 @@
+atime.awk
+packetdat.awk
+send-ack.awk
+stime.awk
--- tcpdump-3.8.3.orig/debian/copyright
+++ tcpdump-3.8.3/debian/copyright
@@ -0,0 +1,151 @@
+This package was debianized by Anand Kumria <wildfire@progsoc.org> on
+Wed, 22 Nov 2000 13:19:33 +1100.
+It is now maintained by:
+ + Torsten Landschoff <torsten@debian.org>
+ + Romain Francoise <rfrancoise@debian.org>
+
+It was downloaded from http://tcpdump.org/release/tcpdump-3.8.3.tar.gz
+
+Upstream Authors: tcpdump-workers@tcpdump.org
+
+Licensed under the 3-clause BSD license:
+
+  Redistribution and use in source and binary forms, with or without
+  modification, are permitted provided that the following conditions
+  are met:
+
+    1. Redistributions of source code must retain the above copyright
+       notice, this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in
+       the documentation and/or other materials provided with the
+       distribution.
+    3. The names of the authors may not be used to endorse or promote
+       products derived from this software without specific prior
+       written permission.
+
+  THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+  IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+  WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+
+Some files in this package are licensed under the 4-clause BSD license,
+the copyright on most of them belongs to The Regents of the University
+of California.  Since the license was retroactively changed in 1999 to
+remove the advertising clause, they are effectively under the 3-clause
+license even if the text of the license in the files hasn't been
+updated.  See the following document for more details:
+
+   <URL: ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.License.Change>
+
+Other files under the 4-clause BSD license and whose copyright doesn't
+belong to the The Regents of the University of California are listed
+below:
+- aodv.h, Copyright (c) 2003 Bruce M. Simpson
+- atmuni31.h, Copyright (c) 1997 Yen Yen Lim and North Dakota State University
+- ieee802_11.h, Copyright (c) 2001 Fortress Technologies and Charlie Lenahan
+- print-802_11.c, Copyright (c) 2001 Fortress Technologies and Charlie Lenahan
+- print-aodv.c, Copyright (c) 2003 Bruce M. Simpson
+- print-ascii.c, Copyright (c) 1997, 1998 The NetBSD Foundation, Inc.
+- print-cnfp.c, Copyright (c) 1998 Michael Shalayeff
+- print-gre.c, Copyright (c) 2002 Jason L. Wright
+- print-mobile.c, Copyright (c) 1998 The NetBSD Foundation, Inc.
+- print-sunatm.c, Copyright (c) 1997 Yen Yen Lim and North Dakota State
+  		  University
+- print-telnet.c, Copyright (c) 1997, 1998 The NetBSD Foundation, Inc.
+- print-timed.c, Copyright (c) 2000 Ben Smithurst
+- missing/inet_aton.c, Copyright (c) 1995, 1996, 1997 Kungliga Tekniska
+  		       Högskolan (Royal Institute of Technology, Stockholm,
+		       Sweden).
+- missing/inet_ntop.c, Copyright (c) 1995, 1996, 1997 Kungliga Tekniska
+  		       Högskolan (Royal Institute of Technology, Stockholm,
+		       Sweden).
+- missing/inet_pton.c, Copyright (c) 1995, 1996, 1997 Kungliga Tekniska
+  		       Högskolan (Royal Institute of Technology, Stockholm,
+		       Sweden).
+
+Current upstream maintainers:
+	Bill Fenner			<fenner@research.att.com>
+	Fulvio Risso			<risso@polito.it>
+	Guy Harris	 		<guy@alum.mit.edu>
+	Hannes Gredler			<hannes@juniper.net>
+	Jun-ichiro itojun Hagino	<itojun@iijlab.net>
+	Michael Richardson	 	<mcr@sandelman.ottawa.on.ca>
+
+Additional people who have contributed patches:
+
+	Alan Bawden			<Alan@LCS.MIT.EDU>
+	Alexey Kuznetsov		<kuznet@ms2.inr.ac.ru>
+	Albert Chin			<china@thewrittenword.com>
+	Andrew Brown			<atatat@atatdot.net>
+	Antti Kantee			<pooka@netbsd.org>
+	Arkadiusz Miskiewicz		<misiek@pld.org.pl>
+	Armando L. Caro Jr.		<acaro@mail.eecis.udel.edu>
+	Assar Westerlund	 	<assar@sics.se>
+	Brian Ginsbach			<ginsbach@cray.com>
+	Charles M. Hannum		<mycroft@netbsd.org>
+	Chris G. Demetriou		<cgd@netbsd.org>
+	Chris Pepper			<pepper@mail.reppep.com>
+	Darren Reed			<darrenr@reed.wattle.id.au>
+	David Kaelbling			<drk@sgi.com>
+	David Young			<dyoung@ojctech.com>
+	Don Ebright			<Don.Ebright@compuware.com>
+	Eric Anderson			<anderse@hpl.hp.com>
+	Franz Schaefer			<schaefer@mond.at>
+	Gianluca Varenni		<varenni@netgroup-serv.polito.it>
+	Gisle Vanem			<giva@bgnett.no>
+	Graeme Hewson			<ghewson@cix.compulink.co.uk>
+	Greg Stark			<gsstark@mit.edu>
+	Greg Troxel			<gdt@ir.bbn.com>
+	Guillaume Pelat			<endymion_@users.sourceforge.net>
+	Hyung Sik Yoon			<hsyn@kr.ibm.com>
+	Igor Khristophorov		<igor@atdot.org>
+	Jan-Philip Velders		<jpv@veldersjes.net>
+	Jason R. Thorpe			<thorpej@netbsd.org>
+	Javier Achirica			<achirica@ttd.net>
+	Jean Tourrilhes			<jt@hpl.hp.com>
+	Jefferson Ogata			<jogata@nodc.noaa.gov>
+	Jesper Peterson			<jesper@endace.com>
+	John Bankier			<jbankier@rainfinity.com>
+	Jon Lindgren			<jonl@yubyub.net>
+	Juergen Schoenwaelder		<schoenw@ibr.cs.tu-bs.de>
+	Kazushi Sugyo			<sugyo@pb.jp.nec.com>
+	Klaus Klein			<kleink@netbsd.org>
+	Koryn Grant			<koryn@endace.com>
+	Krzysztof Halasa		<khc@pm.waw.pl>
+	Lorenzo Cavallaro		<sullivan@sikurezza.org>
+	Loris Degioanni			<loris@netgroup-serv.polito.it>
+	Love Hörnquist-Åstrand		<lha@stacken.kth.se>
+	Maciej W. Rozycki		<macro@ds2.pg.gda.pl>
+	Marcus Felipe Pereira		<marcus@task.com.br>
+	Martin Husemann			<martin@netbsd.org>
+	Mike Wiacek			<mike@iroot.net>
+	Monroe Williams			<monroe@pobox.com>
+	Octavian Cerna			<tavy@ylabs.com>
+	Olaf Kirch			<okir@caldera.de>
+	Onno van der Linden		<onno@simplex.nl>
+	Paul Mundt			<lethal@linux-sh.org>
+	Pavel Kankovsky			<kan@dcit.cz>
+	Peter Fales			<peter@fales-lorenz.net>
+	Peter Jeremy			<peter.jeremy@alcatel.com.au>
+	Phil Wood			<cpw@lanl.gov>
+	Rafal Maszkowski		<rzm@icm.edu.pl>
+	Rick Jones			<raj@cup.hp.com>
+	Scott Barron			<sb125499@ohiou.edu>
+	Scott Gifford			<sgifford@tir.com>
+	Sebastian Krahmer		<krahmer@cs.uni-potsdam.de>
+	Shaun Clowes			<delius@progsoc.uts.edu.au>
+	Solomon Peachy			<pizza@shaftnet.org>
+	Stefan Hudson			<hudson@mbay.net>
+	Takashi Yamamoto		<yamt@mwd.biglobe.ne.jp>
+	Tony Li				<tli@procket.com>
+	Torsten Landschoff	 	<torsten@debian.org>
+	Uns Lider			<unslider@miranda.org>
+	Uwe Girlich			<Uwe.Girlich@philosys.de>
+	Xianjie Zhang			<xzhang@cup.hp.com>
+	Yen Yen Lim
+	Yoann Vandoorselaere		<yoann@prelude-ids.org>
+
+The original LBL crew:
+	Steve McCanne
+	Craig Leres
+	Van Jacobson
