pflog: print the ruleset if it's present.

Do that regardless of whether the subrule is present.

Picked up from the OpenBSD tcpdump.

diff --git a/CHANGES b/CHANGES
index fe0d98c30359ee3ab382717a0366b4c90ea8cf90..e125e934bbbb52ad3666edd1e6d69cbbbbfa6c59 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -148,7 +148,11 @@ Friday, August 30, 2024 / The Tcpdump Group
       OSPF: Update LS-Ack printing not to run off the end of the packet.
       OSPF6: Fix an undefined behavior.
       pflog: use nd_ types in struct pfloghdr.
+      pflog: print some additional fields from the header (picked up
+        from the FreeBSD tcpdump).
       pflog: handle all types of pflog files (as best as can be done)
+      pflog: print the ruleset if it's present, regardless of whether
+        the subrule is present (picked up from the OpenBSD tcpdump).
       PPP: Check if there is some data to hexdump.
       PPP: Remove an extra colon before LCP Callback Operation.
       Use the buffer stack for de-escaping PPP; fixes CVE-2024-2397;

diff --git a/print-pflog.c b/print-pflog.c
index 51b437eeb23bee0711f2cd51f750f3b080f6455f..e65a1ef9372d4b0c167315a99776c0be93b71240 100644 (file)
--- a/print-pflog.c
+++ b/print-pflog.c
@@ -350,13 +350,17 @@ pflog_print(netdissect_options *ndo, const struct pfloghdr *hdr)
 
        rulenr = GET_BE_U_4(hdr->rulenr);
        subrulenr = GET_BE_U_4(hdr->subrulenr);
-       if (subrulenr == (uint32_t)-1)
-               ND_PRINT("rule %u/", rulenr);
-       else {
-               ND_PRINT("rule %u.", rulenr);
-               nd_printjnp(ndo, (const u_char*)hdr->ruleset, PFLOG_RULESET_NAME_SIZE);
-               ND_PRINT(".%u/", subrulenr);
+       ND_PRINT("rule ");
+       if (rulenr != (uint32_t)-1) {
+               ND_PRINT("%u", rulenr);
+               if (hdr->ruleset[0] != '\0') {
+                       ND_PRINT(".");
+                       nd_printjnp(ndo, (const u_char*)hdr->ruleset, PFLOG_RULESET_NAME_SIZE);
+               }
+               if (subrulenr != (uint32_t)-1)
+                       ND_PRINT(".%u", subrulenr);
        }
+       ND_PRINT("/");
 
        if (length == PFLOG_HEADER_LEN_FREEBSD)
                ND_PRINT("%s", tok2str(pf_reasons_freebsd, "unkn(%u)", GET_U_1(hdr->reason)));