summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* build: bump release version to 2.0.8ulogd-2.0.8Pablo Neira Ayuso2022-11-021-1/+1
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: if `--enable-sqlite3` is `yes`, abort if libsqlite3 is not foundJeremy Sowden2022-01-111-2/+7
| | | | | | | | If SQLITE3 support has been explicitly requested, abort if it is not available. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: if `--enable-pgsql` is `yes`, abort if libpq is not foundJeremy Sowden2022-01-111-0/+6
| | | | | | | | If PostgreSQL support has been explicitly requested, abort if it is not available. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: if `--enable-pcap` is `yes`, abort if libpcap is not foundJeremy Sowden2022-01-111-0/+6
| | | | | | | | If libpcap support has been explicitly requested, abort if it is not available. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: if `--enable-mysql` is `yes`, abort if libmysqlclient is not foundJeremy Sowden2022-01-111-0/+6
| | | | | | | | If MySQL support has been explicitly requested, abort if it is not available. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: if `--enable-dbi` is `yes`, abort if libdbi is not foundJeremy Sowden2022-01-111-2/+7
| | | | | | | | If DBI support has been explicitly requested, abort if it is not available. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkg-config or pg_config for libpqJeremy Sowden2022-01-113-101/+31
| | | | | | | | Recent versions of postgresql support pkg-config. Use pkg-config if available, otherwise fall back to pg_config. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkg-config or pcap-config for libpcapJeremy Sowden2022-01-113-82/+29
| | | | | | | | | Recent versions of libpcap support pkg-config. Older versions provide a pcap-config script. Use pkg-config if available, otherwise fall back to pcap-config. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkg-config or mysql_config for libmysqlclientJeremy Sowden2022-01-113-99/+51
| | | | | | | | | Recent versions of mariadb and mysql support pkg-config. Older versions provide a mysql_config script. Use pkg-config if available, otherwise fall back to mysql_config. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkg-config for libdbiJeremy Sowden2022-01-113-89/+5
| | | | | | | | libdbi introduced pkg-config support in 0.9.0, which was released in 2013. Use it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use `--enable-XYZ` options for output pluginsJeremy Sowden2022-01-111-20/+20
| | | | | | | | | | | | | Currently, we use `AC_ARG_WITH` for output plugins. However, this is not consistent with the input plugins, which use `AC_ARG_ENABLE`, and in some cases (dbi, mysql, pgsql) the macro calls in configure.ac conflict with others in acinclude.m4. Use `AC_ARG_ENABLE` instead and change the name of the option for the JSON plugin from `jansson` to `json`. Fixes: 51ba7aec8951 ("Fix automagic support of dbi, pcap and sqlite3") Fixes: c61c05c2d050 ("configure.ac: Add --without-{mysql,pgsql}") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: SQLITE3: remove unused variableJeremy Sowden2022-01-101-1/+0
| | | | | | | | There's local variable left over from a previous tidy-up. Remove it. Fixes: 67b0be90f16f ("output: SQLITE3: improve mapping of fields to DB columns") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: GPRINT: fix it with NFLOGPablo Neira Ayuso2022-01-092-2/+2
| | | | | | | | | | | Add ULOGD_DTYPE_RAW to GPRINT to make it work, it does not provide much information since raw packets come with only a few fields set on. Therefore, update example ulogd.conf.in file since BASE provides a more complete packet dissection. Fixes: 59a71256945d ("src: add example use of GPRINT to ulogd.conf.in configuration file") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: remove bogus check for host and portPablo Neira Ayuso2022-01-041-5/+0
| | | | | | | struct config_entry already provides storage for the host and port strings, .u.string is never NULL. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: fix possible truncation of socket pathPablo Neira Ayuso2022-01-041-9/+39
| | | | | | Verify that the path is shorter than 108 bytes (maximum unix socket path). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: IPFIX: remove compiler attribute macrosJeremy Sowden2022-01-033-11/+4
| | | | | | | | | | | | The ipfix.h header includes three macros which expand to compiler attributes. Presumably, at some point the definitions were one branch of an if-else preprocessor conditional where the definitions in the other branch expanded to nothing. This is no longer the case. Only one of the macros (`__packed`) is used and the raw attribute is used elsewhere in the code-base. Remove the macros. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: optimize appending of newline to outputJeremy Sowden2022-01-031-2/+2
| | | | | | | | | | | | We have `buflen` available. We can remove `strncat` and assign the characters directly, without traversing the whole buffer. Fixes a compiler warning: logd_output_JSON.c:407:9: warning: `strncat` specified bound 1 equals source length Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: fix possible leak in error-handling.Jeremy Sowden2022-01-031-7/+6
| | | | | | | | | | | | The `realloc` extending the buffer containing the JSON to allow us to insert a final new-line may fail. Therefore, we need to assign the return-value to a temporary variable or we will not able to free the existing buffer on error. Use the correct type for `buflen`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: increase time-stamp buffer sizeJeremy Sowden2022-01-031-1/+1
| | | | | | | | | | | | | | | The output buffer for date-times is of sufficient size provided that we don't get oversized integer values for any of the fields, which is a reasonable assumption. However, the compiler complains about possible truncation, e.g.: ulogd_output_JSON.c:314:65: warning: `%06u` directive output may be truncated writing between 6 and 10 bytes into a region of size between 0 and 18 ulogd_output_JSON.c:313:25: note: `snprintf` output between 27 and 88 bytes into a destination of size 38 Fix the warnings by increasing the buffer size. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: JSON: fix output of GMT offsetJeremy Sowden2022-01-031-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | The compiler has two sets of complaints. Firstly, `t->tm_gmtoffset` is a `long int`, but it is being passed to `abs`, which leads to warnings such as: ulogd_output_JSON.c:308:34: warning: absolute value function `abs` given an argument of type `long int` but has parameter of type `int` which may cause truncation of value Secondly, it can't verify that the hour value derived from the offset will in fact fit into `%02d`, thus: ulogd_output_JSON.c:306:37: warning: `%02d` directive output may be truncated writing between 2 and 6 bytes into a region of size 5 To remedy these, we now mod the offset by 86,400 and assign it to an `int` before deriving the hour and minute values. We also change the format-specifier for the hour value to `%+03d` which causes a sign to be printed even if the value is positive, thus allowing us not to specify the sign explicitly and to drop the `abs` call for the hour value. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* db: simplify initialization of ring-bufferJeremy Sowden2022-01-031-3/+2
| | | | | | | | | | | | | | | Currently, `strncpy` is used to copy the SQL statement to the ring buffer, passing the length of the source string, which leads gcc to complain: ../../util/db.c:231:25: warning: `strncpy` specified bound depends on the length of the source argument In fact, the ring buffer is sized to be a multiple of the size of the SQL buffer, and the SQL is simply copied multiple times at increasing offsets, so use `strcpy` instead. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* db: improve mapping of input-keys to DB columnsJeremy Sowden2022-01-031-5/+8
| | | | | | | | | | | | | | | | | | | | Currently, we copy the key-name to a buffer, iterate over it to replace the full-stops with underscores, using `strchr` from the start of the buffer on each iteration, then append the buffer to the SQL statement. Apart from the inefficiency, `strncpy` is used to do the copies, which leads gcc to complain: ../../util/db.c:118:25: warning: `strncpy` output may be truncated copying 31 bytes from a string of length 31 Furthermore, the buffer is one character too short and so there is the possibility of overruns. Instead, append the key-name directly to the statement using `sprintf`, and run `strchr` from the last underscore on each iteration. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* db: improve formatting of insert statementJeremy Sowden2022-01-031-10/+9
| | | | | | | | | | | | | | | | `sql_createstmt` contains a variable `stmt_val` which points to the end of the SQL already written, where the next chunk should be appended. Currently, this is assigned after every write: sprintf(stmt_val, ...); stmt_val = mi->stmt + strlen(mi->stmt); However, since `sprintf` returns the number of bytes written, increment `stmt_val` by the return-value of `sprintf` in order to avoid the repeated `strlen` calls. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: SQLITE3: catch errors creating SQL statementJeremy Sowden2022-01-031-7/+13
| | | | | | | | | `sqlite3_createstmt` returns non-zero on error, but the return-value was being ignored. Change the calling code to check the return-value, log an error message and propagate the error. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: SQLITE3: improve mapping of fields to DB columnsPablo Neira Ayuso2022-01-031-16/+8
| | | | | | | | | | | | | | | | | | | | | | Currently, we derive a field-name by replacing all the underscores in a DB column-name with full-stops and use the field-name to find the matching input-key. However, every time we create a new insert SQL statement, we derive the column-names by copying the field-names to a buffer, replacing all the full-stops with underscores, and then appending the buffer containing the column-name to the one containing the statments. Apart from the inefficiency, `strncpy` is used to do the copies, which leads gcc to complain: ulogd_output_SQLITE3.c:234:17: warning: `strncpy` output may be truncated copying 31 bytes from a string of length 31 Instead, leave the underscores in the field-name, but copy it once to a buffer in which the underscores are replaced and use this to find the input-key. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: SQLITE3: improve mapping of DB columns to fieldsJeremy Sowden2022-01-031-13/+13
| | | | | | | | | | | | | | | | | | | | | | Currently, we copy the column-name to a buffer, iterate over it to replace the underscores with full-stops, using `strchr` from the start of the buffer on each iteration, then copy the buffer to the field's `name` member. Apart from the inefficiency, `strncpy` is used to do the copies, which leads gcc to complain: ulogd_output_SQLITE3.c:341:17: warning: `strncpy` output may be truncated copying 31 bytes from a string of length 31 Furthermore, the buffer is not initialized, which means that there is also a possible buffer overrun if the column-name is too long, since `strncpy` will not append a NUL. Instead, copy the column-name directly to the field using `snprintf`, and run `strchr` from the last underscore on each iteration. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: SQLITE3: improve formatting of insert statementJeremy Sowden2022-01-031-10/+6
| | | | | | | | | | | | | | | | | | | | | | `sqlite3_createstmt` contains a variable `stmt_pos` which points to the end of the SQL already written, where the next chunk should be appended. Currently, this is assigned after every write: sprintf(stmt_pos, ...); stmt_pos = priv->stmt + strlen(priv->stmt); However, since `sprintf` returns the number of bytes written, increment `stmt_pos` by the return-value of `sprintf` in order to avoid the repeated `strlen` calls. Pablo mangled this original patch to add this chunk at the end of this patch (originally submitted as a conversion to use strcpy). + for (i = 0; i < cols - 1; i++) + stmt_pos += sprintf(stmt_pos, "?,"); Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: bump libnetfilter_log dependencyJeremy Sowden2021-12-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Recent changes to add conntrack info to the NFLOG output plug-in rely on symbols only present in the headers provided by libnetfilter-log v1.0.2: CC ulogd_inppkt_NFLOG.lo ulogd_inppkt_NFLOG.c: In function 'build_ct': ulogd_inppkt_NFLOG.c:346:34: error: 'NFULA_CT' undeclared (first use in this function); did you mean 'NFULA_GID'? if (mnl_attr_get_type(attr) == NFULA_CT) { ^~~~~~~~ NFULA_GID ulogd_inppkt_NFLOG.c:346:34: note: each undeclared identifier is reported only once for each function it appears in ulogd_inppkt_NFLOG.c: In function 'start': ulogd_inppkt_NFLOG.c:669:12: error: 'NFULNL_CFG_F_CONNTRACK' undeclared (first use in this function); did you mean 'NFULNL_CFG_F_SEQ'? flags |= NFULNL_CFG_F_CONNTRACK; ^~~~~~~~~~~~~~~~~~~~~~ NFULNL_CFG_F_SEQ Bump the pkg-config version accordingly. Fixes: f6a615587a10 ("NFLOG: attach struct nf_conntrack") Fixes: e513a04cd925 ("NFLOG: add NFULNL_CFG_F_CONNTRACK flag") Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: SQLITE3: fix memory-leak in error-handlingJeremy Sowden2021-12-061-1/+5
| | | | | | | | | When mapping DB column names to input-keys, if we cannot find a key to match a column, the newly allocated `struct field` is leaked. Free it, and log an error message. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: SQLITE3: fix possible buffer overrunsJeremy Sowden2021-12-061-3/+3
| | | | | | | | | There is a an off-by-one error in the size of some of the buffers used to hold key-names. The maximum length of a name is `ULOGD_MAX_KEYLEN`, and so declare the buffers with size `ULOGD_MAX_KEYLEN + 1`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: PGSQL: fix non-`connstring` configuration of DB connectionJeremy Sowden2021-12-061-27/+17
| | | | | | | | | | | | | In `open_db_pgsql`, we test whether various config-settings are defined by comparing their string values to `NULL`. However, the `u.string` member of `struct config_entry` is an array, not a pointer, so it is never `NULL`. Instead, check whether the string is empty. Use a pointer to the end of the `connstr` buffer and `sprintf`, rather than repeated `strcat`s. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: PGSQL: improve mapping of DB columns to input-keysJeremy Sowden2021-12-061-7/+7
| | | | | | | | | | | | | | | | | | | | | | Currently, we copy the column-name to a buffer, iterate over it to replace the underscores with full-stops, using `strchr` from the start of the buffer on each iteration, then copy the buffer to the input-key's `name` member. Apart from the inefficiency, `strncpy` is used to do the copies, which leads gcc to complain: ulogd_output_PGSQL.c:204:17: warning: `strncpy` output may be truncated copying 31 bytes from a string of length 31 Furthermore, the buffer is not initialized, which means that there is also a possible buffer overrun if the column-name is too long, since `strncpy` will not append a NUL. Instead, copy the column-name directly to the input-key using `snprintf`, and run `strchr` from the last underscore on each iteration. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: MYSQL: improve mapping of DB columns to input-keysJeremy Sowden2021-12-061-7/+7
| | | | | | | | | | | | | | | | | | | | | | Currently, we copy the column-name to a buffer, iterate over it to replace the underscores with full-stops, using `strchr` from the start of the buffer on each iteration, then copy the buffer to the input-key's `name` member. Apart from the inefficiency, `strncpy` is used to do the copies, which leads gcc to complain: ulogd_output_MYSQL.c:149:17: warning: `strncpy` output may be truncated copying 31 bytes from a string of length 31 Furthermore, the buffer is not initialized, which means that there is also a possible buffer overrun if the column-name is too long, since `strncpy` will not append a NUL. Instead, copy the column-name directly to the input-key using `snprintf`, and run `strchr` from the last underscore on each iteration. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: DBI: fix configuration of DB connectionJeremy Sowden2021-12-061-7/+7
| | | | | | | | | | In `open_db_dbi`, we test whether various config-settings are defined by comparing their string values to `NULL`. However, the `u.string` member of `struct config_entry` is an array, not a pointer, so it is never `NULL`. Instead, check whether the string is empty. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: DBI: fix NUL-termination of escaped SQL stringJeremy Sowden2021-12-061-4/+6
| | | | | | | | | | | | On error, `dbi_conn_quote_string_copy` returns zero. In this case, we need to set `*dst` to NUL. Handle a return-value of `2` as normal below. `1` is never returned. Replace `strncpy` with `memcpy`: using `strncpy` is nearly always a mistake, and we don't need its special behaviour here. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: DBI: improve mapping of DB columns to input-keysJeremy Sowden2021-11-301-21/+13
| | | | | | | | | | | | | | | | | | | | | | | | Currently, we copy the column-name to a buffer, iterate over it to replace the underscores with full-stops, using `strchr` from the start of the buffer on each iteration, iterate over it a second time to lower-case all letters, and finally copy the buffer to the input-key's `name` member. In addition to being inefficient, `strncpy` is used to do the copies, which leads gcc to complain: ulogd_output_DBI.c:160:17: warning: `strncpy` output may be truncated copying 31 bytes from a string of length 31 Furthermore, the buffer is not initialized, which means that there is also a possible buffer overrun if the column-name is too long, since `strncpy` will not append a NUL. Instead, copy the column-name directly to the input-key using `snprintf`, and then iterate over it once to replace underscores and lower-case letters. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: DBI: fix deprecation warningsJeremy Sowden2021-11-301-7/+11
| | | | | | | | | | | | | The DBI output plugin uses some libdbi functions which have been deprecated in favour of re-entrant equivalents. Switch to the re-entrant functions. Remove superfluous `init` declaration. Add destructor to clean up DBI instance on exit. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: UNIXSOCK: prevent unaligned pointer accessJeremy Sowden2021-11-301-9/+9
| | | | | | | | | | | | | `struct ulogd_unixsock_packet_t` is packed, so taking the address of its `struct iphdr payload` member may yield an unaligned pointer value. We only actually dereference the pointer to get the IP version, so replace the pointer with a version variable and elsewhere use `pkt.payload` directly. Remove a couple of stray semicolons. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: UNIXSOCK: fix possible truncation of socket pathJeremy Sowden2021-11-301-5/+10
| | | | | | | | Verify that the socket path is short enough, and replace `strncpy` with `strcpy`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: UNIXSOCK: remove stat of socket-pathJeremy Sowden2021-11-301-14/+5
| | | | | | | | | | | When creating the UNIX socket, there is a TOCTOU race between the stat(2) and bind(2) calls, and if the path is already bound, the bind(2) call will fail in any case. Remove the stat(2) call. Tidy up a couple of error message. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: PWSNIFF: replace malloc+strncpy with strndupJeremy Sowden2021-11-301-9/+9
| | | | | | | | | | | | There are a couple of instances of allocating memory with `malloc`, followed by copying a string to it with `strncpy` and adding an explicit assignment of `\0` to terminate the string. Replace them with `strndup`. Add an enum to name indices of output keys. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Replace malloc+memset with callocJeremy Sowden2021-11-305-20/+5
| | | | | | | | There are a number of places where we `malloc` some memory and then `memset` it to zero. Use `calloc` instead. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: HWHDR: remove zero-initialization of MAC typeJeremy Sowden2021-11-301-1/+1
| | | | | | | | | We don't need to initialize `type`, and even if we did the right value would be `ARPHDR_VOID`, not `0`, which is a valid MAC type (`ARPHDR_NETROM`). Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: HWHDR: re-order KEY_RAW_MAC checksJeremy Sowden2021-11-301-18/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, in `interp_mac2str` we have: if (/* KEY_RAW_MAC is valid */) { /* * set mac type */ } if (/* mac type is ethernet */) // parse ethernet if (/* KEY_RAW_MAC is not valid */) // return early. The MAC type will not be set to ethernet unless KEY_RAW_MAC is valid, so we can move the last check up and drop the first one: if (/* KEY_RAW_MAC is not valid */) // return early. /* * set mac type */ if (/* mac type is ethernet */) // parse ethernet Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: HWHDR: simplify flow-controlJeremy Sowden2021-11-301-13/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `interp_mac2str` function concludes with a `switch` followed by a `return` statement. The `switch` has one case falling through to a default: switch (expr) { case X: // ... X code ... default: // ... default code ... } This is equivalent to the simpler and more readily comprehensible: if (expr == X) { // ... X code ... } // ... default code ... Replace the former with the latter. Doing so makes it obvious that the following `return` statement is never reached. Remove it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* db: add missing `break` to switch caseJeremy Sowden2021-11-301-0/+1
| | | | | | | | | | When formatting DB queries, if we get a input key of type `RAW`, we log a message indicating that `RAW` is unsupported, then fall through to the default case, which logs another message that the key type is unknown. Add the missing `break` statement to prevent the fall-through. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* jhash: add "fall through" comments to switch casesJeremy Sowden2021-11-301-12/+12
| | | | | | | | | gcc warns about undocumented fall-throughs in switches. In this case, the fall-throughs are intended, so add commnts to indicate this to the compiler. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* XML: show both nflog packet and conntrackKen-ichirou MATSUZAWA2021-11-231-11/+22
| | | | | | | | This patch enables to show "ct" as well as "raw" if output type is ULOGD_DTYPE_RAW and "ct" input exists. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: attach struct nf_conntrackKen-ichirou MATSUZAWA2021-11-232-6/+68
| | | | | | | | put nf_conntrack in ct outputkey when "attach_conntrack" is specified. But there is no way to show both nflog "raw" and "ct" now. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: add NFULNL_CFG_F_CONNTRACK flagKen-ichirou MATSUZAWA2021-11-231-1/+10
| | | | | | | acquiring conntrack information by specifying "attack_conntrack=1" Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>