From 2d4c60fed7c0179450d07523ac023fcec391e634 Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Tue, 29 Jul 2008 11:49:24 +0200 Subject: NFLOG: get full link layer header (requires >= 2.6.27) This patch modifies the key structure of NFLOG. It solves the conflict between ULOG and NFLOG by ensuring that keys have the same meaning: * raw.mac is the full hardware header * raw.mac.saddr is the source hardware address Following Patrick suggestion, it adds a new key "raw.type" which is used to store the type of hardware. Signed-off-by: Eric Leblond Signed-off-by: Pablo Neira Ayuso --- input/packet/ulogd_inppkt_NFLOG.c | 36 +++++++++++++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 3 deletions(-) (limited to 'input/packet') diff --git a/input/packet/ulogd_inppkt_NFLOG.c b/input/packet/ulogd_inppkt_NFLOG.c index cb58661..4853c77 100644 --- a/input/packet/ulogd_inppkt_NFLOG.c +++ b/input/packet/ulogd_inppkt_NFLOG.c @@ -133,6 +133,9 @@ enum nflog_keys { NFLOG_KEY_OOB_UID, NFLOG_KEY_OOB_GID, NFLOG_KEY_RAW_LABEL, + NFLOG_KEY_RAW_TYPE, + NFLOG_KEY_RAW_MAC_SADDR, + NFLOG_KEY_RAW_MAC_ADDRLEN, }; static struct ulogd_key output_keys[] = { @@ -140,6 +143,11 @@ static struct ulogd_key output_keys[] = { .type = ULOGD_RET_RAW, .flags = ULOGD_RETF_NONE, .name = "raw.mac", + }, + [NFLOG_KEY_RAW_MAC_SADDR] = { + .type = ULOGD_RET_RAW, + .flags = ULOGD_RETF_NONE, + .name = "raw.mac.saddr", .ipfix = { .vendor = IPFIX_VENDOR_IETF, .field_id = IPFIX_sourceMacAddress, @@ -240,6 +248,12 @@ static struct ulogd_key output_keys[] = { .flags = ULOGD_RETF_NONE, .name = "raw.mac_len", }, + [NFLOG_KEY_RAW_MAC_ADDRLEN] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "raw.mac.addrlen", + }, + [NFLOG_KEY_OOB_SEQ_LOCAL] = { .type = ULOGD_RET_UINT32, .flags = ULOGD_RETF_NONE, @@ -283,6 +297,11 @@ static struct ulogd_key output_keys[] = { .flags = ULOGD_RETF_NONE, .name = "raw.label", }, + [NFLOG_KEY_RAW_TYPE] = { + .type = ULOGD_RET_UINT16, + .flags = ULOGD_RETF_NONE, + .name = "raw.type", + }, }; @@ -318,11 +337,22 @@ interp_packet(struct ulogd_pluginstance *upi, struct nflog_data *ldata) ret[NFLOG_KEY_OOB_PROTOCOL].flags |= ULOGD_RETF_VALID; } - if (hw) { - ret[NFLOG_KEY_RAW_MAC].u.value.ptr = hw->hw_addr; + if (nflog_get_msg_packet_hwhdrlen(ldata)) { + ret[NFLOG_KEY_RAW_MAC].u.value.ptr = nflog_get_msg_packet_hwhdr(ldata); ret[NFLOG_KEY_RAW_MAC].flags |= ULOGD_RETF_VALID; - ret[NFLOG_KEY_RAW_MAC_LEN].u.value.ui16 = ntohs(hw->hw_addrlen); + ret[NFLOG_KEY_RAW_MAC_LEN].u.value.ui16 = + nflog_get_msg_packet_hwhdrlen(ldata); ret[NFLOG_KEY_RAW_MAC_LEN].flags |= ULOGD_RETF_VALID; + ret[NFLOG_KEY_RAW_TYPE].u.value.ui16 = + nflog_get_hwtype(ldata); + ret[NFLOG_KEY_RAW_TYPE].flags |= ULOGD_RETF_VALID; + } + + if (hw) { + ret[NFLOG_KEY_RAW_MAC_SADDR].u.value.ptr = hw->hw_addr; + ret[NFLOG_KEY_RAW_MAC_SADDR].flags |= ULOGD_RETF_VALID; + ret[NFLOG_KEY_RAW_MAC_ADDRLEN].u.value.ui16 = ntohs(hw->hw_addrlen); + ret[NFLOG_KEY_RAW_MAC_ADDRLEN].flags |= ULOGD_RETF_VALID; } if (payload_len >= 0) { -- cgit v1.2.3