From 904e16a934da969d5f32d35a7c0946a86a96a079 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Tue, 29 Jul 2008 12:11:21 +0200 Subject: MAC2STR: Rename it to HWHDR Use a more appropriate name for this filter. Signed-off-by: Eric Leblond Signed-off-by: Pablo Neira Ayuso --- filter/ulogd_filter_HWHDR.c | 241 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 241 insertions(+) create mode 100644 filter/ulogd_filter_HWHDR.c (limited to 'filter/ulogd_filter_HWHDR.c') diff --git a/filter/ulogd_filter_HWHDR.c b/filter/ulogd_filter_HWHDR.c new file mode 100644 index 0000000..cecd3e2 --- /dev/null +++ b/filter/ulogd_filter_HWHDR.c @@ -0,0 +1,241 @@ +/* ulogd_filter_MAC2STR.c, Version $Revision: 1500 $ + * + * ulogd interpreter plugin for HWMAC + * + * (C) 2008 by Eric Leblond + * + * Based on ulogd_filter_IFINDEX.c Harald Welte + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * $Id: ulogd_filter_IFINDEX.c 1500 2005-10-03 16:54:02Z laforge $ + */ + +#include +#include +#include +#include +#include +#include +#include + +enum input_keys { + KEY_RAW_TYPE, + KEY_OOB_PROTOCOL, + KEY_RAW_MAC, + KEY_RAW_MACLEN, + KEY_RAW_MAC_SADDR, + KEY_RAW_MAC_ADDRLEN, +}; + +enum output_keys { + KEY_MAC_TYPE, + KEY_MAC_PROTOCOL, + KEY_MAC_SADDR, + KEY_MAC_DADDR, + KEY_MAC_ADDR, +}; + +static struct ulogd_key mac2str_inp[] = { + [KEY_RAW_TYPE] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.type", + }, + [KEY_OOB_PROTOCOL] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "oob.protocol", + }, + [KEY_RAW_MAC] = { + .type = ULOGD_RET_RAW, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac", + }, + [KEY_RAW_MACLEN] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac_len", + }, + [KEY_RAW_MAC_SADDR] = { + .type = ULOGD_RET_RAW, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac.saddr", + }, + [KEY_RAW_MAC_ADDRLEN] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac.addrlen", + }, +}; + +static struct ulogd_key mac2str_keys[] = { + [KEY_MAC_TYPE] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "raw.type", + }, + [KEY_MAC_PROTOCOL] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "oob.protocol", + }, + [KEY_MAC_SADDR] = { + .type = ULOGD_RET_STRING, + .flags = ULOGD_RETF_FREE, + .name = "mac.saddr.str", + }, + [KEY_MAC_DADDR] = { + .type = ULOGD_RET_STRING, + .flags = ULOGD_RETF_FREE, + .name = "mac.daddr.str", + }, + [KEY_MAC_ADDR] = { + .type = ULOGD_RET_STRING, + .flags = ULOGD_RETF_FREE, + .name = "mac.str", + }, +}; + +static int parse_mac2str(struct ulogd_key *ret, unsigned char *mac, + int okey, int len) +{ + char *mac_str = calloc(len/sizeof(char)*3, sizeof(char)); + char *buf_cur = mac_str; + int i; + + if (mac_str == NULL) + return ULOGD_IRET_ERR; + + for (i = 0; i < len; i++) + buf_cur += sprintf(buf_cur, "%02x%c", mac[i], + i == len - 1 ? 0 : ':'); + + ret[okey].u.value.ptr = mac_str; + ret[okey].flags |= ULOGD_RETF_VALID; + + return ULOGD_IRET_OK; +} + +static int parse_ethernet(struct ulogd_key *ret, struct ulogd_key *inp) +{ + int fret; + if (!pp_is_valid(inp, KEY_RAW_MAC_SADDR)) { + fret = parse_mac2str(ret, + GET_VALUE(inp, KEY_RAW_MAC).ptr + + ETH_ALEN, + KEY_MAC_SADDR, ETH_ALEN); + if (fret != ULOGD_IRET_OK) + return fret; + } + fret = parse_mac2str(ret, GET_VALUE(inp, KEY_RAW_MAC).ptr, + KEY_MAC_DADDR, ETH_ALEN); + if (fret != ULOGD_IRET_OK) + return fret; + + ret[KEY_MAC_PROTOCOL].u.value.ui16 = + ntohs(*(u_int16_t *) (GET_VALUE(inp, KEY_RAW_MAC).ptr + + 2 * ETH_ALEN)); + ret[KEY_MAC_PROTOCOL].flags |= ULOGD_RETF_VALID; + + return ULOGD_IRET_OK; +} + +static int interp_mac2str(struct ulogd_pluginstance *pi) +{ + struct ulogd_key *ret = pi->output.keys; + struct ulogd_key *inp = pi->input.keys; + u_int16_t type = 0; + + if (pp_is_valid(inp, KEY_OOB_PROTOCOL)) { + ret[KEY_MAC_PROTOCOL].u.value.ui16 = + GET_VALUE(inp, KEY_OOB_PROTOCOL).ui16; + ret[KEY_MAC_PROTOCOL].flags |= ULOGD_RETF_VALID; + } + + if (pp_is_valid(inp, KEY_RAW_MAC_SADDR)) { + int fret; + fret = parse_mac2str(ret, + GET_VALUE(inp, KEY_RAW_MAC_SADDR).ptr, + KEY_MAC_SADDR, + GET_VALUE(inp, KEY_RAW_MAC_ADDRLEN).ui16); + if (fret != ULOGD_IRET_OK) + return fret; + } + + if (!pp_is_valid(inp, KEY_RAW_MAC)) { + if (GET_VALUE(inp, KEY_RAW_MAC_ADDRLEN).ui16 == ETH_ALEN) { + ret[KEY_MAC_TYPE].u.value.ui16 = ARPHRD_ETHER; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } else { + ret[KEY_MAC_TYPE].u.value.ui16 = ARPHRD_VOID; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } + return ULOGD_IRET_OK; + } + + if (pp_is_valid(inp, KEY_RAW_TYPE)) { + /* NFLOG with Linux >= 2.6.27 case */ + ret[KEY_MAC_TYPE].u.value.ui16 = type = + GET_VALUE(inp, KEY_RAW_TYPE).ui16; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } else { + /* ULOG case, treat ethernet encapsulation */ + if (GET_VALUE(inp, KEY_RAW_MACLEN).ui16 == ETH_HLEN) { + ret[KEY_MAC_TYPE].u.value.ui16 = type = ARPHRD_ETHER; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } else { + ret[KEY_MAC_TYPE].u.value.ui16 = type = ARPHRD_VOID; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } + } + + switch (type) { + case ARPHRD_ETHER: + parse_ethernet(ret, inp); + default: + /* convert raw header to string */ + return parse_mac2str(ret, + GET_VALUE(inp, KEY_RAW_MAC).ptr, + KEY_MAC_ADDR, + GET_VALUE(inp, + KEY_RAW_MACLEN).ui16); + } + return ULOGD_IRET_OK; +} + + + +static struct ulogd_plugin mac2str_pluging = { + .name = "MAC2STR", + .input = { + .keys = mac2str_inp, + .num_keys = ARRAY_SIZE(mac2str_inp), + .type = ULOGD_DTYPE_PACKET, + }, + .output = { + .keys = mac2str_keys, + .num_keys = ARRAY_SIZE(mac2str_keys), + .type = ULOGD_DTYPE_PACKET, + }, + .interp = &interp_mac2str, + .version = ULOGD_VERSION, +}; + +void __attribute__ ((constructor)) init(void); + +void init(void) +{ + ulogd_register_plugin(&mac2str_pluging); +} -- cgit v1.2.3