Fix tcpdump(8) on carp(4) interface:

- Use our loop DLT type, not OpenBSD. [1]
- The fields that are converted to network byte order are not 32-bit
  fields but 16-bit fields, so htons should be used in htonl. [1]
- Secondly, ip_input changes ip->ip_len into its value without
  the ip-header length. So, restore the length to make bpf happy. [1]
- Use bpf_mtap2(), use temporary af1, since bpf_mtap2 doesn't
  understand uint8_t af identifier.

Submitted by:	Frank Volf [1]

sys/netinet/ip_carp.c

@@ -357,7 +357,7 @@ carp_clone_create(struct if_clone *ifc, int unit)
 	ifp->if_hdrlen = 0;
 	if_attach(ifp);
 	LIST_INSERT_HEAD(&carpif_list, sc, sc_next);
-	bpfattach(&sc->sc_if, DLT_LOOP, sizeof(u_int32_t));
+	bpfattach(&sc->sc_if, DLT_NULL, sizeof(u_int32_t));
 	return (0);
 }
 
@@ -595,24 +595,13 @@ carp_input_c(struct mbuf *m, struct carp_header *ch, sa_family_t af)
 	sc->sc_if.if_ibytes += m->m_pkthdr.len;
 
 	if (sc->sc_if.if_bpf) {
-		/*
-		 * We need to prepend the address family as
-		 * a four byte field.  Cons up a dummy header
-		 * to pacify bpf.  This is safe because bpf
-		 * will only read from the mbuf (i.e., it won't
-		 * try to free it or keep a pointer to it).
-		 */
-		struct mbuf m0;
 		struct ip *ip = mtod(m, struct ip *);
-		u_int32_t maf = htonl(af);
+		uint32_t af1 = af;
 
-		m0.m_next = m;
-		m0.m_len = sizeof(maf);
-		m0.m_data = (char *)&maf;
 		/* BPF wants net byte order */
-		ip->ip_len = htonl(ip->ip_len);
-		ip->ip_off = htonl(ip->ip_off);
-		BPF_MTAP(&sc->sc_if, &m0);
+		ip->ip_len = htons(ip->ip_len + (ip->ip_hl << 2));
+		ip->ip_off = htons(ip->ip_off);
+		bpf_mtap2(sc->sc_if.if_bpf, &af1, sizeof(af1), m);
 	}
 
 	/* verify the CARP version. */