ND_PRINT(", length %u: ", length);
}
-static char *hook_names[] = { "PRE","IN","FWD","OUT","POST" };
-
-static const char *hook2txt(int hook) {
- if(hook >= sizeof(hook_names)/sizeof(hook_names[0])) return "UNK";
- return hook_names[hook];
-}
-
u_int
nflog_if_print(netdissect_options *ndo,
const struct pcap_pkthdr *h, const u_char *p)
{
const nflog_hdr_t *hdr = (const nflog_hdr_t *)p;
uint16_t size;
- uint16_t hw_hdrlen = 0;
- uint16_t hw_addrlen = 0;
uint16_t h_size = sizeof(nflog_hdr_t);
u_int caplen = h->caplen;
u_int length = h->len;
caplen -= sizeof(nflog_tlv_t);
break;
}
- {
- const u_char *adata = p+sizeof(nflog_tlv_t);
- switch(tlv->tlv_type) {
- case NFULA_TIMESTAMP:
- case NFULA_HWTYPE:
- break;
- case NFULA_PACKET_HDR:
- if(ndo->ndo_vflag)
- ND_PRINT((ndo, "HOOK:%s ",
- hook2txt(((nflog_packet_hdr_t *)adata)->hook)));
- break;
- case NFULA_MARK:
- ND_PRINT((ndo, "MARK:0x%x ",
- htonl(*(u_int32_t *)adata)));
- break;
- case NFULA_UID:
- if(ndo->ndo_vflag)
- ND_PRINT((ndo, "UID:%u ",
- htonl(*(u_int32_t *)adata)));
- break;
- case NFULA_GID:
- if(ndo->ndo_vflag)
- ND_PRINT((ndo, "GID:%u ",
- htonl(*(u_int32_t *)adata)));
- break;
- case NFULA_PREFIX:
- if(p[sizeof(nflog_tlv_t)])
- ND_PRINT((ndo, "Prefix:%.*s ",
- size-sizeof(nflog_tlv_t), adata));
- break;
- case NFULA_IFINDEX_INDEV:
- if(ndo->ndo_vflag > 1)
- ND_PRINT((ndo, "iif:%u ",
- htonl(*(u_int32_t *)adata)));
- break;
- case NFULA_IFINDEX_OUTDEV:
- if(ndo->ndo_vflag > 1)
- ND_PRINT((ndo, "oif:%u ",
- htonl(*(u_int32_t *)adata)));
- break;
- case NFULA_IFINDEX_PHYSINDEV:
- if(ndo->ndo_vflag > 1)
- ND_PRINT((ndo, "phyiif:%u ",
- htonl(*(u_int32_t *)adata)));
- break;
- case NFULA_IFINDEX_PHYSOUTDEV:
- if(ndo->ndo_vflag > 1)
- ND_PRINT((ndo, "phyoif:%u ",
- htonl(*(u_int32_t *)adata)));
- break;
- case NFULA_HWADDR:
- hw_addrlen = htons(((nflog_hwaddr_t *)adata)->hw_addrlen);
- break;
- case NFULA_HWLEN:
- hw_hdrlen = htons((*(u_int16_t *)adata));
- break;
- case NFULA_HWHEADER:
- if (!hw_hdrlen || ndo->ndo_vflag < 2) break;
- {
- char attr_buf[128];
- int n,l;
- memset(attr_buf,0,sizeof(attr_buf));
- for(n=0,l=0; n < hw_hdrlen && l < sizeof(attr_buf)-3; n++) {
- if(hw_addrlen &&
- (n == hw_addrlen || n == hw_addrlen*2))
- attr_buf[l++] = ':';
- l += snprintf(&attr_buf[l],3,"%02x",adata[n]);
- }
- ND_PRINT((ndo, "HWHDR=%s ",attr_buf));
- }
- break;
- default:
- if (ndo->ndo_vflag < 3) break;
- ND_PRINT((ndo, "ATTR%d/%d ",tlv->tlv_type,size));
- }
- }
p += size;
h_size += size;
+++ /dev/null
-HOOK:OUT Prefix:out-icmp oif:10 MARK:0x2 UID:0 GID:100 IP (tos 0x0, ttl 64, id 24087, offset 0, flags [DF], proto ICMP (1), length 84)
- 10.52.210.96 > 10.52.210.1: ICMP echo request, id 2995, seq 1, length 64
-HOOK:IN Prefix:in-icmp iif:10 MARK:0x1 HWHDR=e89a8fa8a7bc:6805ca0251b2:0800 IP (tos 0x0, ttl 64, id 39507, offset 0, flags [none], proto ICMP (1), length 84)
- 10.52.210.1 > 10.52.210.96: ICMP echo reply, id 2995, seq 1, length 64
-HOOK:OUT Prefix:out-dns oif:6 MARK:0x4 UID:1000 GID:100 IP (tos 0x0, ttl 64, id 9134, offset 0, flags [none], proto UDP (17), length 51)
- 10.0.0.64.49997 > 10.0.0.1.53: [udp sum ok] 2830+ A? ya.ru. (23)
-HOOK:IN Prefix:in-dns iif:6 MARK:0x3 HWHDR=e89a8fa8a7bc:6805ca0251b3:0800 IP (tos 0x0, ttl 64, id 8040, offset 0, flags [none], proto UDP (17), length 250)
- 10.0.0.1.53 > 10.0.0.64.49997: [udp sum ok] 2830 q: A? ya.ru. 3/2/4 YA.ru. [1m54s] A 93.158.134.3, YA.ru. [1m54s] A 213.180.204.3, YA.ru. [1m54s] A 213.180.193.3 ns: YA.ru. [1h4m20s] NS ns1.yandex.RU., YA.ru. [1h4m20s] NS ns2.yandex.RU. ar: ns1.YANDEX.ru. [15h47m28s] A 213.180.193.1, ns2.YANDEX.ru. [4h34m25s] A 93.158.134.1, ns1.YANDEX.ru. [1d23h35m14s] AAAA 2a02:6b8::1, ns2.YANDEX.ru. [1d23h35m14s] AAAA 2a02:6b8:0:1::1 (222)