From 904e16a934da969d5f32d35a7c0946a86a96a079 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Tue, 29 Jul 2008 12:11:21 +0200 Subject: MAC2STR: Rename it to HWHDR Use a more appropriate name for this filter. Signed-off-by: Eric Leblond Signed-off-by: Pablo Neira Ayuso --- filter/Makefile.am | 6 +- filter/ulogd_filter_HWHDR.c | 241 ++++++++++++++++++++++++++++++++++++++++++ filter/ulogd_filter_MAC2STR.c | 241 ------------------------------------------ 3 files changed, 244 insertions(+), 244 deletions(-) create mode 100644 filter/ulogd_filter_HWHDR.c delete mode 100644 filter/ulogd_filter_MAC2STR.c (limited to 'filter') diff --git a/filter/Makefile.am b/filter/Makefile.am index cbeb5bc..556705c 100644 --- a/filter/Makefile.am +++ b/filter/Makefile.am @@ -5,7 +5,7 @@ INCLUDES = $(all_includes) -I$(top_srcdir)/include pkglib_LTLIBRARIES = ulogd_filter_IFINDEX.la ulogd_filter_PWSNIFF.la \ ulogd_filter_PRINTPKT.la ulogd_filter_PRINTFLOW.la \ ulogd_filter_IP2STR.la ulogd_filter_IP2BIN.la \ - ulogd_filter_MAC2STR.la ulogd_filter_MARK.la + ulogd_filter_HWHDR.la ulogd_filter_MARK.la ulogd_filter_IFINDEX_la_SOURCES = ulogd_filter_IFINDEX.c ulogd_filter_IFINDEX_la_LDFLAGS = -module -lnfnetlink @@ -19,8 +19,8 @@ ulogd_filter_IP2STR_la_LDFLAGS = -module ulogd_filter_IP2BIN_la_SOURCES = ulogd_filter_IP2BIN.c ulogd_filter_IP2BIN_la_LDFLAGS = -module -ulogd_filter_MAC2STR_la_SOURCES = ulogd_filter_MAC2STR.c -ulogd_filter_MAC2STR_la_LDFLAGS = -module +ulogd_filter_HWHDR_la_SOURCES = ulogd_filter_HWHDR.c +ulogd_filter_HWHDR_la_LDFLAGS = -module ulogd_filter_MARK_la_SOURCES = ulogd_filter_MARK.c ulogd_filter_MARK_la_LDFLAGS = -module diff --git a/filter/ulogd_filter_HWHDR.c b/filter/ulogd_filter_HWHDR.c new file mode 100644 index 0000000..cecd3e2 --- /dev/null +++ b/filter/ulogd_filter_HWHDR.c @@ -0,0 +1,241 @@ +/* ulogd_filter_MAC2STR.c, Version $Revision: 1500 $ + * + * ulogd interpreter plugin for HWMAC + * + * (C) 2008 by Eric Leblond + * + * Based on ulogd_filter_IFINDEX.c Harald Welte + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 + * as published by the Free Software Foundation + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + * + * $Id: ulogd_filter_IFINDEX.c 1500 2005-10-03 16:54:02Z laforge $ + */ + +#include +#include +#include +#include +#include +#include +#include + +enum input_keys { + KEY_RAW_TYPE, + KEY_OOB_PROTOCOL, + KEY_RAW_MAC, + KEY_RAW_MACLEN, + KEY_RAW_MAC_SADDR, + KEY_RAW_MAC_ADDRLEN, +}; + +enum output_keys { + KEY_MAC_TYPE, + KEY_MAC_PROTOCOL, + KEY_MAC_SADDR, + KEY_MAC_DADDR, + KEY_MAC_ADDR, +}; + +static struct ulogd_key mac2str_inp[] = { + [KEY_RAW_TYPE] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.type", + }, + [KEY_OOB_PROTOCOL] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "oob.protocol", + }, + [KEY_RAW_MAC] = { + .type = ULOGD_RET_RAW, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac", + }, + [KEY_RAW_MACLEN] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac_len", + }, + [KEY_RAW_MAC_SADDR] = { + .type = ULOGD_RET_RAW, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac.saddr", + }, + [KEY_RAW_MAC_ADDRLEN] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, + .name = "raw.mac.addrlen", + }, +}; + +static struct ulogd_key mac2str_keys[] = { + [KEY_MAC_TYPE] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "raw.type", + }, + [KEY_MAC_PROTOCOL] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "oob.protocol", + }, + [KEY_MAC_SADDR] = { + .type = ULOGD_RET_STRING, + .flags = ULOGD_RETF_FREE, + .name = "mac.saddr.str", + }, + [KEY_MAC_DADDR] = { + .type = ULOGD_RET_STRING, + .flags = ULOGD_RETF_FREE, + .name = "mac.daddr.str", + }, + [KEY_MAC_ADDR] = { + .type = ULOGD_RET_STRING, + .flags = ULOGD_RETF_FREE, + .name = "mac.str", + }, +}; + +static int parse_mac2str(struct ulogd_key *ret, unsigned char *mac, + int okey, int len) +{ + char *mac_str = calloc(len/sizeof(char)*3, sizeof(char)); + char *buf_cur = mac_str; + int i; + + if (mac_str == NULL) + return ULOGD_IRET_ERR; + + for (i = 0; i < len; i++) + buf_cur += sprintf(buf_cur, "%02x%c", mac[i], + i == len - 1 ? 0 : ':'); + + ret[okey].u.value.ptr = mac_str; + ret[okey].flags |= ULOGD_RETF_VALID; + + return ULOGD_IRET_OK; +} + +static int parse_ethernet(struct ulogd_key *ret, struct ulogd_key *inp) +{ + int fret; + if (!pp_is_valid(inp, KEY_RAW_MAC_SADDR)) { + fret = parse_mac2str(ret, + GET_VALUE(inp, KEY_RAW_MAC).ptr + + ETH_ALEN, + KEY_MAC_SADDR, ETH_ALEN); + if (fret != ULOGD_IRET_OK) + return fret; + } + fret = parse_mac2str(ret, GET_VALUE(inp, KEY_RAW_MAC).ptr, + KEY_MAC_DADDR, ETH_ALEN); + if (fret != ULOGD_IRET_OK) + return fret; + + ret[KEY_MAC_PROTOCOL].u.value.ui16 = + ntohs(*(u_int16_t *) (GET_VALUE(inp, KEY_RAW_MAC).ptr + + 2 * ETH_ALEN)); + ret[KEY_MAC_PROTOCOL].flags |= ULOGD_RETF_VALID; + + return ULOGD_IRET_OK; +} + +static int interp_mac2str(struct ulogd_pluginstance *pi) +{ + struct ulogd_key *ret = pi->output.keys; + struct ulogd_key *inp = pi->input.keys; + u_int16_t type = 0; + + if (pp_is_valid(inp, KEY_OOB_PROTOCOL)) { + ret[KEY_MAC_PROTOCOL].u.value.ui16 = + GET_VALUE(inp, KEY_OOB_PROTOCOL).ui16; + ret[KEY_MAC_PROTOCOL].flags |= ULOGD_RETF_VALID; + } + + if (pp_is_valid(inp, KEY_RAW_MAC_SADDR)) { + int fret; + fret = parse_mac2str(ret, + GET_VALUE(inp, KEY_RAW_MAC_SADDR).ptr, + KEY_MAC_SADDR, + GET_VALUE(inp, KEY_RAW_MAC_ADDRLEN).ui16); + if (fret != ULOGD_IRET_OK) + return fret; + } + + if (!pp_is_valid(inp, KEY_RAW_MAC)) { + if (GET_VALUE(inp, KEY_RAW_MAC_ADDRLEN).ui16 == ETH_ALEN) { + ret[KEY_MAC_TYPE].u.value.ui16 = ARPHRD_ETHER; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } else { + ret[KEY_MAC_TYPE].u.value.ui16 = ARPHRD_VOID; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } + return ULOGD_IRET_OK; + } + + if (pp_is_valid(inp, KEY_RAW_TYPE)) { + /* NFLOG with Linux >= 2.6.27 case */ + ret[KEY_MAC_TYPE].u.value.ui16 = type = + GET_VALUE(inp, KEY_RAW_TYPE).ui16; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } else { + /* ULOG case, treat ethernet encapsulation */ + if (GET_VALUE(inp, KEY_RAW_MACLEN).ui16 == ETH_HLEN) { + ret[KEY_MAC_TYPE].u.value.ui16 = type = ARPHRD_ETHER; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } else { + ret[KEY_MAC_TYPE].u.value.ui16 = type = ARPHRD_VOID; + ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; + } + } + + switch (type) { + case ARPHRD_ETHER: + parse_ethernet(ret, inp); + default: + /* convert raw header to string */ + return parse_mac2str(ret, + GET_VALUE(inp, KEY_RAW_MAC).ptr, + KEY_MAC_ADDR, + GET_VALUE(inp, + KEY_RAW_MACLEN).ui16); + } + return ULOGD_IRET_OK; +} + + + +static struct ulogd_plugin mac2str_pluging = { + .name = "MAC2STR", + .input = { + .keys = mac2str_inp, + .num_keys = ARRAY_SIZE(mac2str_inp), + .type = ULOGD_DTYPE_PACKET, + }, + .output = { + .keys = mac2str_keys, + .num_keys = ARRAY_SIZE(mac2str_keys), + .type = ULOGD_DTYPE_PACKET, + }, + .interp = &interp_mac2str, + .version = ULOGD_VERSION, +}; + +void __attribute__ ((constructor)) init(void); + +void init(void) +{ + ulogd_register_plugin(&mac2str_pluging); +} diff --git a/filter/ulogd_filter_MAC2STR.c b/filter/ulogd_filter_MAC2STR.c deleted file mode 100644 index cecd3e2..0000000 --- a/filter/ulogd_filter_MAC2STR.c +++ /dev/null @@ -1,241 +0,0 @@ -/* ulogd_filter_MAC2STR.c, Version $Revision: 1500 $ - * - * ulogd interpreter plugin for HWMAC - * - * (C) 2008 by Eric Leblond - * - * Based on ulogd_filter_IFINDEX.c Harald Welte - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 - * as published by the Free Software Foundation - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - * - * $Id: ulogd_filter_IFINDEX.c 1500 2005-10-03 16:54:02Z laforge $ - */ - -#include -#include -#include -#include -#include -#include -#include - -enum input_keys { - KEY_RAW_TYPE, - KEY_OOB_PROTOCOL, - KEY_RAW_MAC, - KEY_RAW_MACLEN, - KEY_RAW_MAC_SADDR, - KEY_RAW_MAC_ADDRLEN, -}; - -enum output_keys { - KEY_MAC_TYPE, - KEY_MAC_PROTOCOL, - KEY_MAC_SADDR, - KEY_MAC_DADDR, - KEY_MAC_ADDR, -}; - -static struct ulogd_key mac2str_inp[] = { - [KEY_RAW_TYPE] = { - .type = ULOGD_RET_UINT16, - .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, - .name = "raw.type", - }, - [KEY_OOB_PROTOCOL] = { - .type = ULOGD_RET_UINT16, - .flags = ULOGD_RETF_NONE, - .name = "oob.protocol", - }, - [KEY_RAW_MAC] = { - .type = ULOGD_RET_RAW, - .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, - .name = "raw.mac", - }, - [KEY_RAW_MACLEN] = { - .type = ULOGD_RET_UINT16, - .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, - .name = "raw.mac_len", - }, - [KEY_RAW_MAC_SADDR] = { - .type = ULOGD_RET_RAW, - .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, - .name = "raw.mac.saddr", - }, - [KEY_RAW_MAC_ADDRLEN] = { - .type = ULOGD_RET_UINT16, - .flags = ULOGD_RETF_NONE|ULOGD_KEYF_OPTIONAL, - .name = "raw.mac.addrlen", - }, -}; - -static struct ulogd_key mac2str_keys[] = { - [KEY_MAC_TYPE] = { - .type = ULOGD_RET_UINT16, - .flags = ULOGD_RETF_NONE, - .name = "raw.type", - }, - [KEY_MAC_PROTOCOL] = { - .type = ULOGD_RET_UINT16, - .flags = ULOGD_RETF_NONE, - .name = "oob.protocol", - }, - [KEY_MAC_SADDR] = { - .type = ULOGD_RET_STRING, - .flags = ULOGD_RETF_FREE, - .name = "mac.saddr.str", - }, - [KEY_MAC_DADDR] = { - .type = ULOGD_RET_STRING, - .flags = ULOGD_RETF_FREE, - .name = "mac.daddr.str", - }, - [KEY_MAC_ADDR] = { - .type = ULOGD_RET_STRING, - .flags = ULOGD_RETF_FREE, - .name = "mac.str", - }, -}; - -static int parse_mac2str(struct ulogd_key *ret, unsigned char *mac, - int okey, int len) -{ - char *mac_str = calloc(len/sizeof(char)*3, sizeof(char)); - char *buf_cur = mac_str; - int i; - - if (mac_str == NULL) - return ULOGD_IRET_ERR; - - for (i = 0; i < len; i++) - buf_cur += sprintf(buf_cur, "%02x%c", mac[i], - i == len - 1 ? 0 : ':'); - - ret[okey].u.value.ptr = mac_str; - ret[okey].flags |= ULOGD_RETF_VALID; - - return ULOGD_IRET_OK; -} - -static int parse_ethernet(struct ulogd_key *ret, struct ulogd_key *inp) -{ - int fret; - if (!pp_is_valid(inp, KEY_RAW_MAC_SADDR)) { - fret = parse_mac2str(ret, - GET_VALUE(inp, KEY_RAW_MAC).ptr - + ETH_ALEN, - KEY_MAC_SADDR, ETH_ALEN); - if (fret != ULOGD_IRET_OK) - return fret; - } - fret = parse_mac2str(ret, GET_VALUE(inp, KEY_RAW_MAC).ptr, - KEY_MAC_DADDR, ETH_ALEN); - if (fret != ULOGD_IRET_OK) - return fret; - - ret[KEY_MAC_PROTOCOL].u.value.ui16 = - ntohs(*(u_int16_t *) (GET_VALUE(inp, KEY_RAW_MAC).ptr - + 2 * ETH_ALEN)); - ret[KEY_MAC_PROTOCOL].flags |= ULOGD_RETF_VALID; - - return ULOGD_IRET_OK; -} - -static int interp_mac2str(struct ulogd_pluginstance *pi) -{ - struct ulogd_key *ret = pi->output.keys; - struct ulogd_key *inp = pi->input.keys; - u_int16_t type = 0; - - if (pp_is_valid(inp, KEY_OOB_PROTOCOL)) { - ret[KEY_MAC_PROTOCOL].u.value.ui16 = - GET_VALUE(inp, KEY_OOB_PROTOCOL).ui16; - ret[KEY_MAC_PROTOCOL].flags |= ULOGD_RETF_VALID; - } - - if (pp_is_valid(inp, KEY_RAW_MAC_SADDR)) { - int fret; - fret = parse_mac2str(ret, - GET_VALUE(inp, KEY_RAW_MAC_SADDR).ptr, - KEY_MAC_SADDR, - GET_VALUE(inp, KEY_RAW_MAC_ADDRLEN).ui16); - if (fret != ULOGD_IRET_OK) - return fret; - } - - if (!pp_is_valid(inp, KEY_RAW_MAC)) { - if (GET_VALUE(inp, KEY_RAW_MAC_ADDRLEN).ui16 == ETH_ALEN) { - ret[KEY_MAC_TYPE].u.value.ui16 = ARPHRD_ETHER; - ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; - } else { - ret[KEY_MAC_TYPE].u.value.ui16 = ARPHRD_VOID; - ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; - } - return ULOGD_IRET_OK; - } - - if (pp_is_valid(inp, KEY_RAW_TYPE)) { - /* NFLOG with Linux >= 2.6.27 case */ - ret[KEY_MAC_TYPE].u.value.ui16 = type = - GET_VALUE(inp, KEY_RAW_TYPE).ui16; - ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; - } else { - /* ULOG case, treat ethernet encapsulation */ - if (GET_VALUE(inp, KEY_RAW_MACLEN).ui16 == ETH_HLEN) { - ret[KEY_MAC_TYPE].u.value.ui16 = type = ARPHRD_ETHER; - ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; - } else { - ret[KEY_MAC_TYPE].u.value.ui16 = type = ARPHRD_VOID; - ret[KEY_MAC_TYPE].flags |= ULOGD_RETF_VALID; - } - } - - switch (type) { - case ARPHRD_ETHER: - parse_ethernet(ret, inp); - default: - /* convert raw header to string */ - return parse_mac2str(ret, - GET_VALUE(inp, KEY_RAW_MAC).ptr, - KEY_MAC_ADDR, - GET_VALUE(inp, - KEY_RAW_MACLEN).ui16); - } - return ULOGD_IRET_OK; -} - - - -static struct ulogd_plugin mac2str_pluging = { - .name = "MAC2STR", - .input = { - .keys = mac2str_inp, - .num_keys = ARRAY_SIZE(mac2str_inp), - .type = ULOGD_DTYPE_PACKET, - }, - .output = { - .keys = mac2str_keys, - .num_keys = ARRAY_SIZE(mac2str_keys), - .type = ULOGD_DTYPE_PACKET, - }, - .interp = &interp_mac2str, - .version = ULOGD_VERSION, -}; - -void __attribute__ ((constructor)) init(void); - -void init(void) -{ - ulogd_register_plugin(&mac2str_pluging); -} -- cgit v1.2.3