X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/57cb8fa2c85cec4b7ac80577bc093c0003e11e3b..a63600a1fc28dbc7ae7ce9f996829c49a25fb33c:/print-nflog.c

diff --git a/print-nflog.c b/print-nflog.c
index 849b54d1..bbe4ccfc 100644
--- a/print-nflog.c
+++ b/print-nflog.c
@@ -55,12 +55,16 @@ typedef struct nflog_hdr {
 	nd_uint16_t	nflog_rid;		/* resource ID */
 } nflog_hdr_t;
 
+#define NFLOG_HDR_LEN sizeof(nflog_hdr_t)
+
 typedef struct nflog_tlv {
 	nd_uint16_t	tlv_length;		/* tlv length */
 	nd_uint16_t	tlv_type;		/* tlv type */
 	/* value follows this */
 } nflog_tlv_t;
 
+#define NFLOG_TLV_LEN sizeof(nflog_tlv_t)
+
 typedef struct nflog_packet_hdr {
 	nd_uint16_t	hw_protocol;	/* hw protocol */
 	nd_uint8_t	hook;		/* netfilter hook */
@@ -99,11 +103,19 @@ typedef struct nflog_timestamp {
 #define NFULA_HWHEADER			16	/* skbuff's MAC-layer header */
 #define NFULA_HWLEN			17	/* length of skbuff's MAC-layer header */
 
+/*
+ * Define two constants specifically for the two AF code points from the
+ * LINKTYPE_NFLOG specification above and use these constants instead of
+ * AF_INET and AF_INET6.  This is the only way to dissect the "wire" encoding
+ * correctly because some BSD systems define AF_INET6 differently from Linux
+ * (see af.h) and Haiku defines both AF_INET and AF_INET6 differently from
+ * Linux.
+ */
+#define NFLOG_AF_INET   2
+#define NFLOG_AF_INET6 10
 static const struct tok nflog_values[] = {
-	{ AF_INET,		"IPv4" },
-#ifdef AF_INET6
-	{ AF_INET6,		"IPv6" },
-#endif /*AF_INET6*/
+	{ NFLOG_AF_INET,	"IPv4" },
+	{ NFLOG_AF_INET6,	"IPv6" },
 	{ 0,			NULL }
 };
 
@@ -111,81 +123,85 @@ static void
 nflog_hdr_print(netdissect_options *ndo, const nflog_hdr_t *hdr, u_int length)
 {
 	ND_PRINT("version %u, resource ID %u",
-	    EXTRACT_U_1(hdr->nflog_version), EXTRACT_BE_U_2(hdr->nflog_rid));
+	    GET_U_1(hdr->nflog_version), GET_BE_U_2(hdr->nflog_rid));
 
 	if (!ndo->ndo_qflag) {
 		ND_PRINT(", family %s (%u)",
 			 tok2str(nflog_values, "Unknown",
-				 EXTRACT_U_1(hdr->nflog_family)),
-			 EXTRACT_U_1(hdr->nflog_family));
+				 GET_U_1(hdr->nflog_family)),
+			 GET_U_1(hdr->nflog_family));
 		} else {
 		ND_PRINT(", %s",
 			 tok2str(nflog_values,
 				 "Unknown NFLOG (0x%02x)",
-			 EXTRACT_U_1(hdr->nflog_family)));
+			 GET_U_1(hdr->nflog_family)));
 		}
 
 	ND_PRINT(", length %u: ", length);
 }
 
-u_int
+void
 nflog_if_print(netdissect_options *ndo,
-			   const struct pcap_pkthdr *h, const u_char *p)
+	       const struct pcap_pkthdr *h, const u_char *p)
 {
 	const nflog_hdr_t *hdr = (const nflog_hdr_t *)p;
 	uint16_t size;
-	uint16_t h_size = sizeof(nflog_hdr_t);
+	uint16_t h_size = NFLOG_HDR_LEN;
 	u_int caplen = h->caplen;
 	u_int length = h->len;
 
-	ndo->ndo_protocol = "nflog_if";
-	if (caplen < sizeof(nflog_hdr_t) || length < sizeof(nflog_hdr_t))
-		goto trunc;
+	ndo->ndo_protocol = "nflog";
+	if (caplen < NFLOG_HDR_LEN) {
+		nd_print_trunc(ndo);
+		ndo->ndo_ll_hdr_len += caplen;
+		return;
+	}
+	ndo->ndo_ll_hdr_len += NFLOG_HDR_LEN;
 
 	ND_TCHECK_SIZE(hdr);
-	if (EXTRACT_U_1(hdr->nflog_version) != 0) {
-		ND_PRINT("version %u (unknown)", EXTRACT_U_1(hdr->nflog_version));
-		return h_size;
+	if (GET_U_1(hdr->nflog_version) != 0) {
+		ND_PRINT("version %u (unknown)", GET_U_1(hdr->nflog_version));
+		return;
 	}
 
 	if (ndo->ndo_eflag)
 		nflog_hdr_print(ndo, hdr, length);
 
-	p += sizeof(nflog_hdr_t);
-	length -= sizeof(nflog_hdr_t);
-	caplen -= sizeof(nflog_hdr_t);
+	p += NFLOG_HDR_LEN;
+	length -= NFLOG_HDR_LEN;
+	caplen -= NFLOG_HDR_LEN;
 
 	while (length > 0) {
 		const nflog_tlv_t *tlv;
 
 		/* We have some data.  Do we have enough for the TLV header? */
-		if (caplen < sizeof(nflog_tlv_t) || length < sizeof(nflog_tlv_t))
+		if (caplen < NFLOG_TLV_LEN)
 			goto trunc;	/* No. */
 
 		tlv = (const nflog_tlv_t *) p;
 		ND_TCHECK_SIZE(tlv);
-		size = EXTRACT_HE_U_2(tlv->tlv_length);
+		size = GET_HE_U_2(tlv->tlv_length);
 		if (size % 4 != 0)
 			size += 4 - size % 4;
 
 		/* Is the TLV's length less than the minimum? */
-		if (size < sizeof(nflog_tlv_t))
+		if (size < NFLOG_TLV_LEN)
 			goto trunc;	/* Yes. Give up now. */
 
 		/* Do we have enough data for the full TLV? */
-		if (caplen < size || length < size)
+		if (caplen < size)
 			goto trunc;	/* No. */
 
-		if (EXTRACT_HE_U_2(tlv->tlv_type) == NFULA_PAYLOAD) {
+		if (GET_HE_U_2(tlv->tlv_type) == NFULA_PAYLOAD) {
 			/*
 			 * This TLV's data is the packet payload.
 			 * Skip past the TLV header, and break out
 			 * of the loop so we print the packet data.
 			 */
-			p += sizeof(nflog_tlv_t);
-			h_size += sizeof(nflog_tlv_t);
-			length -= sizeof(nflog_tlv_t);
-			caplen -= sizeof(nflog_tlv_t);
+			p += NFLOG_TLV_LEN;
+			h_size += NFLOG_TLV_LEN;
+			length -= NFLOG_TLV_LEN;
+			caplen -= NFLOG_TLV_LEN;
 			break;
 		}
 
@@ -195,32 +211,31 @@ nflog_if_print(netdissect_options *ndo,
 		caplen -= size;
 	}
 
-	switch (EXTRACT_U_1(hdr->nflog_family)) {
+	switch (GET_U_1(hdr->nflog_family)) {
 
-	case AF_INET:
+	case NFLOG_AF_INET:
 		ip_print(ndo, p, length);
 		break;
 
-#ifdef AF_INET6
-	case AF_INET6:
+	case NFLOG_AF_INET6:
 		ip6_print(ndo, p, length);
 		break;
-#endif /* AF_INET6 */
 
 	default:
 		if (!ndo->ndo_eflag)
 			nflog_hdr_print(ndo, hdr,
-				length + sizeof(nflog_hdr_t));
+					length + NFLOG_HDR_LEN);
 
 		if (!ndo->ndo_suppress_default_print)
 			ND_DEFAULTPRINT(p, caplen);
 		break;
 	}
 
-	return h_size;
+	ndo->ndo_ll_hdr_len += h_size - NFLOG_HDR_LEN;
+	return;
 trunc:
 	nd_print_trunc(ndo);
-	return h_size;
+	ndo->ndo_ll_hdr_len += h_size - NFLOG_HDR_LEN;
 }
 
 #endif /* DLT_NFLOG */