summaryrefslogtreecommitdiffstats
path: root/filter/raw2packet/ulogd_raw2packet_BASE.c
Commit message (Collapse)AuthorAgeFilesLines
* raw2packet_BASE: store ARP address values as integersJeremy Sowden2023-09-141-4/+9
| | | | | | | | | | | Keys of type `ULOGD_RET_IPADDR` may be ipv4 or ipv6. ARP protocol addresses are 32-bits (i.e., ipv4). By using `okey_set_u32` we keep track of the size and allow downstream plug-ins to handle them correctly. Reported-by: Robert O'Brien <robrien@foxtrot-research.com> Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* printpkt, raw2packet_BASE: keep gateway address in NBOJeremy Sowden2023-09-141-1/+1
| | | | | | | | | Everywhere else ipv4 addresses are left in NBO until output. The only exception is the IP2HBIN filter, which is explicitly intended to convert from NBO to HBO. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* raw2packet: fix comma instead of semicolonTimon Ulrich2020-10-301-1/+1
| | | | | Signed-off-by: Timon Ulrich <t.ulrich@anapur.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: fix crash when ipv4 packet is truncatedLiping Zhang2016-10-171-1/+2
| | | | | | | | | | | If ipv4 packet is truncated, we should not try to dereference the iph pointer. Otherwise, if the user add such iptables rules "-j NFLOG --nflog-size 0", we will dereference the NULL pointer and crash may happen. Reported-by: Chris Caputo <ccaputo@alt.net> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use stdint types everywhereFelix Janda2015-06-261-17/+18
| | | | Signed-off-by: Felix Janda <felix.janda@posteo.de>
* Define _GNU_SOURCE to get members of tcphdrFelix Janda2015-06-231-0/+1
| | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de>
* store Common Information Model name in ulogd keyEric Leblond2014-01-281-2/+8
| | | | | | | | | | | | | | | | | | | This patch adds storage for CIM field name in ulogd key. This will be used by JSON output to interoperate with logging collector such as logstash or splunk. Common Information Model is an open standard that defines how managed elements in an IT environment are represented as a common set of objects and relationships between them: http://www.dmtf.org/standards/cim This seems to be mainly XML based but there is a JSON version of some aspects of the model. One of the main documentation on CIM in JSON format seems to be: http://docs.splunk.com/Documentation/PCI/2.0/DataSource/CommonInformationModelFieldReference Using the correct CIM field name allow events coming from ulogd to be correlated with events coming from other sources.
* base: fix warning on pointer handlingEric Leblond2013-01-181-4/+4
|
* Get rid of SVN tag in comment.Eric Leblond2013-01-181-3/+1
| | | | This patch also update some copyright and licence declaration.
* Add additional ip6 header fields to database scriptsBob Hockney2012-12-191-1/+1
| | | | | Rename internal keyname ip6.payload_len to remove "_" to facilitate this.
* Fix parsing of ipv6 flowlabel and tc fieldsBob Hockney2012-12-191-2/+2
| | | | Mask should be applied after ntohl conversion.
* src: fix version that -V displaysPablo Neira Ayuso2012-08-031-1/+1
| | | | | | | It was wrong, use VERSION constant which uses the version information available in configure.ac. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Return true/false instead of ULOGD_IRET_OK/STOPThomas Jacob2008-12-091-2/+2
| | | | | Signed-off-by: Thomas Jacob <jacob@internet24.de> Signed-off-by: Eric Leblond <eric@inl.fr>
* Add SCTP support to BASE plugin.Eric Leblond2008-12-091-0/+53
| | | | | | THis patch adds basic support for SCTP in the BASE plugin. Signed-off-by: Eric Leblond <eric@inl.fr>
* add ukey_* function for key assignationPablo Neira Ayuso2008-12-091-140/+77
| | | | | | | | | This patch cleans up the current key assignation by introducing a set of functions ukey_* to set the key value as Eric Leblond and we discussed during the latest Netfilter Workshop. This patch is based on an idea from Holger Eitzenberger. Signed-off-by: Eric Leblond <eric@inl.fr>
* cleanup: fix compilation warning related to signed and unsigned comparisonsEric Leblond2008-07-311-1/+1
| | | | | | This patch fixes the warning related to signed and unsigned comparaison. Signed-off-by: Eric Leblond <eric@inl.fr>
* cleanup: fix gcc warningsEric Leblond2008-07-291-3/+0
| | | | | | | | | This patch fixes some gcc warnings: * Unused variables * Functions with wrong return (or without return) Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use ULOGD_IRET_* as return for all interpretersEric Leblond2008-06-121-25/+25
| | | | | | | | This patch modifies plugins to use the already defined but not used define. This also fixes some weird behaviours in error treatment (like not stopping after OOM). Signed-off-by: Eric Leblond <eric@inl.fr>
* Source and destination addresses were put in ptr field of the target structureEric Leblond2008-06-021-2/+4
| | | | | instead of being put in the new type ui128. The result was an improper value of the IPv6 source add destination addresses.
* Adds AF_BRIDGE and ARP header interpreter to BASE plugin/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-2/+130
| | | | | | This patch adds an AF_BRIDGE interpreter to ulogd_raw2packet_BASE plugin, which allows to log packets coming from ebtables. It also adds an ARP header decoder. Signed-off-by: Peter Warasin <peter@endian.com>
* revert r7369 until clarified/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-141-125/+2
|
* Adds AF_BRIDGE and ARP header interpreter to BASE plugin/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-141-2/+125
| | | | | | | | | This patch adds an AF_BRIDGE interpreter to ulogd_raw2packet_BASE plugin, which allows to log packets coming from ebtables. It also adds an ARP header decoder. Signed-off-by: Peter Warasin <peter@endian.com>
* Adds input key enumeration in order to address the fields/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-141-4/+12
| | | | | | | with symbols instead of numbers. Shortens the lines by the use of GET_VALUE() Signed-off-by: Peter Warasin <peter@endian.com>
* revert r7348/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-101-23/+9
|
* From: Eric Leblond <eric@inl.fr>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-091-9/+23
| | | | | | | | | | | | When using NFLOG or ULOG, obb.family (protocol IPv4 or IPv6) has to be setup manually in ulogd.conf configuration file. This is used by the BASE filter to properly parse the packet. This patch suppress oob.family as output keys of NFLOG and ULOG and let the BASE filter determine the family of the packet by itself (by parsing the raw header). A good side effect is to be able to log in IPv6 and IPv4 in the same group. Before that, two loggers have to be setup separatly.
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-0/+4
| | | | | With this patch, BASE filter module is able fill oob_family when parsing IPv6 address.
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-24/+4
| | | | | - This patch suppress key relative to IPv6 address because IPv4 and IPv6 can be stored in the same key. - Add missing IP2STR line to ulogd.conf.in
* Add IPv6 support, fix a few incorrect key assignments and make sure this doesn't/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org2007-03-061-189/+514
| | | | | repeat by using symbolic names to make sure the assignment matches the array index.
* make 'num_keys' an attribute of pluginstance instead of pluginlaforge2005-11-201-11/+16
|
* introduce version field for plugins, refuse loading plugins with different ↵laforge2005-11-051-0/+1
| | | | version
* add more ipfix related information to raw2packet_BASElaforge2005-11-041-8/+77
|
* all protocols now merged into one pluginlaforge2005-10-031-146/+180
|
* revive BASE pluginlaforge2005-10-031-20/+13
|
* make BASE plugin compile (not fully ported yet)laforge2005-04-171-54/+69
|
* current working state (doesn't compile yet)laforge2005-04-171-3/+4
|
* commit my latest changes from Ottawa (July 2004)laforge2004-08-221-9/+32
|
* sume of the BASE stuff (the part dealing with OOB) doesn't belong in a ↵laforge2004-07-241-129/+0
| | | | generic packet interpreter but is rather specific to the ULOG input plugin.
* merge ulogd-1 fix for TOS byte (Rich Bartell)laforge2004-07-231-1/+1
|
* - add ipfix field typeslaforge2004-07-231-66/+182
| | | | - add new "raw.pktcount" field
* further tree reorganizationlaforge2004-07-231-0/+441