NFLOG: remove header dependency, add a test case

This change removes detection of linux/netfilter/nfnetlink_log.h, which
was only used to provide two constants. The constants are now defined in
print-nflog.c, making it possible to compile (and test) the NFLOG
decoder on all systems, not only Linux.

There is now a test case for the decoder, it was produced on a Linux
host with:

iptables -A INPUT -p udp --source 74.82.42.42 -j NFLOG --nflog-group 20
dig @74.82.42.42 ...

diff --git a/configure.in b/configure.in
index 2d22d1c9e9933ee434917463a79ebd032fd4fcfc..4c8059b88578aef6e42c62aa9f829a90aa3b4639 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -33,7 +33,7 @@ if test "$ac_cv___attribute__" = "yes"; then
                AC_C___ATTRIBUTE___FORMAT_FUNCTION_POINTER
        fi
 fi
-AC_CHECK_HEADERS(fcntl.h rpc/rpc.h rpc/rpcent.h netdnet/dnetdb.h linux/netfilter/nfnetlink_log.h)
+AC_CHECK_HEADERS(fcntl.h rpc/rpc.h rpc/rpcent.h netdnet/dnetdb.h)
 AC_CHECK_HEADERS(net/pfvar.h, , , [#include <sys/types.h>
 #include <sys/socket.h>
 #include <net/if.h>])

diff --git a/netdissect.h b/netdissect.h
index 29c2e6f50d3c15b5e0b0cd47ef917bd92fd1eb97..4fd47264cb9ccf3e0de8775df3bc0778282ceb4a 100644 (file)
--- a/netdissect.h
+++ b/netdissect.h
@@ -482,11 +482,7 @@ extern void pptp_print(netdissect_options *,const u_char *, u_int);
 
 extern u_int ipnet_if_print(netdissect_options *,const struct pcap_pkthdr *, const u_char *);
 extern u_int ppi_if_print(netdissect_options *,const struct pcap_pkthdr *, const u_char *);
-
-#ifdef HAVE_LINUX_NETFILTER_NFNETLINK_LOG_H
 extern u_int nflog_if_print(netdissect_options *,const struct pcap_pkthdr *, const u_char *);
-#endif
-
 extern u_int ieee802_15_4_if_print(netdissect_options *,const struct pcap_pkthdr *, const u_char *);
 
 #ifdef INET6

diff --git a/print-nflog.c b/print-nflog.c
index fdd21e69d9f52be99896f64fdc5c073560768d73..238226e13a384ed1130becbe6bfcb771a2275bca 100644 (file)
--- a/print-nflog.c
+++ b/print-nflog.c
@@ -37,12 +37,13 @@
 #include "netdissect.h"
 #include "interface.h"
 
-#ifdef HAVE_LINUX_NETFILTER_NFNETLINK_LOG_H
-#include <linux/netfilter/nfnetlink_log.h>
 #include "nflog.h"
 
 #ifdef DLT_NFLOG
 
+#define NFULA_PAYLOAD 9
+#define NFULA_MAX 17
+
 const struct tok nflog_values[] = {
        { AF_INET,              "IPv4" },
        { AF_INET6,             "IPv6" },
@@ -150,5 +151,4 @@ nflog_if_print(struct netdissect_options *ndo,
        return (sizeof(nflog_hdr_t));
 }
 
-#endif /* HAVE_LINUX_NETFILTER_NFNETLINK_LOG_H */
 #endif /* DLT_NFLOG */

diff --git a/tcpdump.c b/tcpdump.c
index c4b287c699056c6d92f32553aa8d6c25b6d7ea6f..6a9c26a87d3c62a7d670afd0ed7d781221cdfcbe 100644 (file)
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -332,9 +332,7 @@ static struct ndo_printer ndo_printers[] = {
        { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
 #endif
 #ifdef DLT_NFLOG
-#ifdef HAVE_LINUX_NETFILTER_NFNETLINK_LOG_H
        { nflog_if_print,       DLT_NFLOG},
-#endif
 #endif
        { NULL,                 0 },
 };

diff --git a/tests/TESTLIST b/tests/TESTLIST
index 271d7b1c85cde21689e3524186d6b097ba19b916..c2688aebffeb839bbb42bf0650be71895d6ddc6a 100644 (file)
--- a/tests/TESTLIST
+++ b/tests/TESTLIST
@@ -134,3 +134,6 @@ of10_pf5240-vv      of10_pf5240.pcap        of10_pf5240-vv.out      -t -vv
 
 # GeoNetworking and CALM FAST tests
 geonet-calm-fast       geonet_and_calm_fast.pcap       geonet_and_calm_fast.out        -t -vv -n
+
+# NFLOG test case
+nflog-e                nflog.pcap              nflog-e.out             -t -e

diff --git a/tests/nflog-e.out b/tests/nflog-e.out
new file mode 100644 (file)
index 0000000..636d38e
--- /dev/null
+++ b/tests/nflog-e.out
@@ -0,0 +1,4 @@
+version 0, resource ID 20, family IPv4 (2), length 180: 74.82.42.42.53 > 10.0.0.20.42585: 17265 1/0/0 A 93.184.216.119 (45)
+version 0, resource ID 20, family IPv4 (2), length 192: 74.82.42.42.53 > 10.0.0.20.45190: 52954 1/0/0 AAAA 2606:2800:220:6d:26bf:1447:1097:aa7 (57)
+version 0, resource ID 20, family IPv4 (2), length 184: 74.82.42.42.53 > 10.0.0.20.44031: 8279 1/0/0 A 93.184.216.119 (49)
+version 0, resource ID 20, family IPv4 (2), length 196: 74.82.42.42.53 > 10.0.0.20.48736: 2122 1/0/0 AAAA 2606:2800:220:6d:26bf:1447:1097:aa7 (61)

diff --git a/tests/nflog.pcap b/tests/nflog.pcap
new file mode 100644 (file)
index 0000000..9151d6a
Binary files /dev/null and b/tests/nflog.pcap differ