NFLOG: get full link layer header (requires >= 2.6.27)

This patch modifies the key structure of NFLOG. It solves the conflict
between ULOG and NFLOG by ensuring that keys have the same meaning:
 * raw.mac is the full hardware header
 * raw.mac.saddr is the source hardware address
Following Patrick suggestion, it adds a new key "raw.type" which is
used to store the type of hardware.

Signed-off-by: Eric Leblond <eric@inl.fr>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/configure.in b/configure.in
index 8e0f6a3cfa62a0848df51d1f4d0227db97eb88a2..96cc2d0fb605a7616ffa20c9617a39f637b47450 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -35,7 +35,7 @@ CFLAGS="$CFLAGS -Wall -Wextra"
 dnl Check for the right nfnetlink version
 LIBNFNETLINK_REQUIRED=0.0.39
 LIBNETFILTER_CONNTRACK_REQUIRED=0.0.95
-LIBNETFILTER_LOG_REQUIRED=0.0.14
+LIBNETFILTER_LOG_REQUIRED=0.0.15
 
 PKG_CHECK_MODULES(LIBNFNETLINK, libnfnetlink >= $LIBNFNETLINK_REQUIRED,, AC_MSG_ERROR(Cannot find libnfnetlink >= $LIBNFNETLINK_REQUIRED))
 

diff --git a/input/packet/ulogd_inppkt_NFLOG.c b/input/packet/ulogd_inppkt_NFLOG.c
index cb58661275c059a9b90e0de96d7fc820b4afc94c..4853c77577f5ce829ee58e2f38615c40d9f66f0e 100644 (file)
--- a/input/packet/ulogd_inppkt_NFLOG.c
+++ b/input/packet/ulogd_inppkt_NFLOG.c
@@ -133,6 +133,9 @@ enum nflog_keys {
        NFLOG_KEY_OOB_UID,
        NFLOG_KEY_OOB_GID,
        NFLOG_KEY_RAW_LABEL,
+       NFLOG_KEY_RAW_TYPE,
+       NFLOG_KEY_RAW_MAC_SADDR,
+       NFLOG_KEY_RAW_MAC_ADDRLEN,
 };
 
 static struct ulogd_key output_keys[] = {
@@ -140,6 +143,11 @@ static struct ulogd_key output_keys[] = {
                .type = ULOGD_RET_RAW,
                .flags = ULOGD_RETF_NONE,
                .name = "raw.mac",
+       },
+       [NFLOG_KEY_RAW_MAC_SADDR] = {
+               .type = ULOGD_RET_RAW,
+               .flags = ULOGD_RETF_NONE,
+               .name = "raw.mac.saddr",
                .ipfix = {
                        .vendor = IPFIX_VENDOR_IETF,
                        .field_id = IPFIX_sourceMacAddress,
@@ -240,6 +248,12 @@ static struct ulogd_key output_keys[] = {
                .flags = ULOGD_RETF_NONE,
                .name = "raw.mac_len",
        },
+       [NFLOG_KEY_RAW_MAC_ADDRLEN] = {
+               .type = ULOGD_RET_UINT16,
+               .flags = ULOGD_RETF_NONE,
+               .name = "raw.mac.addrlen",
+       },
+
        [NFLOG_KEY_OOB_SEQ_LOCAL] = {
                .type = ULOGD_RET_UINT32,
                .flags = ULOGD_RETF_NONE,
@@ -283,6 +297,11 @@ static struct ulogd_key output_keys[] = {
                .flags = ULOGD_RETF_NONE,
                .name = "raw.label",
        },
+       [NFLOG_KEY_RAW_TYPE] = {
+               .type = ULOGD_RET_UINT16,
+               .flags = ULOGD_RETF_NONE,
+               .name = "raw.type",
+       },
 
 };
 
@@ -318,11 +337,22 @@ interp_packet(struct ulogd_pluginstance *upi, struct nflog_data *ldata)
                ret[NFLOG_KEY_OOB_PROTOCOL].flags |= ULOGD_RETF_VALID;
        }
 
-       if (hw) {
-               ret[NFLOG_KEY_RAW_MAC].u.value.ptr = hw->hw_addr;
+       if (nflog_get_msg_packet_hwhdrlen(ldata)) {
+               ret[NFLOG_KEY_RAW_MAC].u.value.ptr = nflog_get_msg_packet_hwhdr(ldata);
                ret[NFLOG_KEY_RAW_MAC].flags |= ULOGD_RETF_VALID;
-               ret[NFLOG_KEY_RAW_MAC_LEN].u.value.ui16 = ntohs(hw->hw_addrlen);
+               ret[NFLOG_KEY_RAW_MAC_LEN].u.value.ui16 =
+                       nflog_get_msg_packet_hwhdrlen(ldata);
                ret[NFLOG_KEY_RAW_MAC_LEN].flags |= ULOGD_RETF_VALID;
+               ret[NFLOG_KEY_RAW_TYPE].u.value.ui16 =
+                       nflog_get_hwtype(ldata);
+               ret[NFLOG_KEY_RAW_TYPE].flags |= ULOGD_RETF_VALID;
+       }
+
+       if (hw) {
+               ret[NFLOG_KEY_RAW_MAC_SADDR].u.value.ptr = hw->hw_addr;
+               ret[NFLOG_KEY_RAW_MAC_SADDR].flags |= ULOGD_RETF_VALID;
+               ret[NFLOG_KEY_RAW_MAC_ADDRLEN].u.value.ui16 = ntohs(hw->hw_addrlen);
+               ret[NFLOG_KEY_RAW_MAC_ADDRLEN].flags |= ULOGD_RETF_VALID;
        }
 
        if (payload_len >= 0) {