diff options
| author | Jeremy Sowden <jeremy@azazel.net> | 2023-08-21 20:42:30 +0100 |
|---|---|---|
| committer | Florian Westphal <fw@strlen.de> | 2023-09-14 14:22:49 +0200 |
| commit | b5a4bc8ffc6e6a48c43d8f8f28092ea0d2b8f82a (patch) | |
| tree | 03bb185c7549da69f33f05fe6373fae022244900 /filter/raw2packet | |
| parent | 57fed71654ca7e3eb06d87bf1110970262339b5a (diff) | |
raw2packet_BASE: store ARP address values as integers
Keys of type `ULOGD_RET_IPADDR` may be ipv4 or ipv6. ARP protocol
addresses are 32-bits (i.e., ipv4). By using `okey_set_u32` we keep
track of the size and allow downstream plug-ins to handle them
correctly.
Reported-by: Robert O'Brien <robrien@foxtrot-research.com>
Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'filter/raw2packet')
| -rw-r--r-- | filter/raw2packet/ulogd_raw2packet_BASE.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/filter/raw2packet/ulogd_raw2packet_BASE.c b/filter/raw2packet/ulogd_raw2packet_BASE.c index 1442348..09e9313 100644 --- a/filter/raw2packet/ulogd_raw2packet_BASE.c +++ b/filter/raw2packet/ulogd_raw2packet_BASE.c @@ -896,18 +896,23 @@ static int _interp_arp(struct ulogd_pluginstance *pi, uint32_t len) struct ulogd_key *ret = pi->output.keys; const struct ether_arp *arph = ikey_get_ptr(&pi->input.keys[INKEY_RAW_PCKT]); + uint32_t arp_spa, arp_tpa; if (len < sizeof(struct ether_arp)) return ULOGD_IRET_OK; - okey_set_u16(&ret[KEY_ARP_HTYPE], ntohs(arph->arp_hrd)); - okey_set_u16(&ret[KEY_ARP_PTYPE], ntohs(arph->arp_pro)); + okey_set_u16(&ret[KEY_ARP_HTYPE], ntohs(arph->arp_hrd)); + okey_set_u16(&ret[KEY_ARP_PTYPE], ntohs(arph->arp_pro)); okey_set_u16(&ret[KEY_ARP_OPCODE], ntohs(arph->arp_op)); okey_set_ptr(&ret[KEY_ARP_SHA], (void *)&arph->arp_sha); - okey_set_ptr(&ret[KEY_ARP_SPA], (void *)&arph->arp_spa); okey_set_ptr(&ret[KEY_ARP_THA], (void *)&arph->arp_tha); - okey_set_ptr(&ret[KEY_ARP_TPA], (void *)&arph->arp_tpa); + + memcpy(&arp_spa, arph->arp_spa, sizeof(arp_spa)); + memcpy(&arp_tpa, arph->arp_tpa, sizeof(arp_tpa)); + + okey_set_u32(&ret[KEY_ARP_SPA], arp_spa); + okey_set_u32(&ret[KEY_ARP_TPA], arp_tpa); return ULOGD_IRET_OK; } |