Changeset a6badc2

Timestamp:

04/28/05 15:58:51 (17 years ago)

Author:

Perry Lorier <perry@…>

Branches:

4.0.1-hotfixes, cachetimestamps, develop, dpdk-ndag, etsilive, getfragoff, help, libtrace4, master, ndag_format, pfring, rc-4.0.1, rc-4.0.2, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance, ringtimestampfixes

Children:

b13027e

Parents:

58e9e02

Message:

Added PFLOG (obsd/fbsd) support for phil murray

Location:

lib

Files:

• libtrace.h (modified) (1 diff)
• trace.c (modified) (5 diffs)

lib/libtrace.h

@@ -380 +380 @@
        TRACE_TYPE_80211,
        TRACE_TYPE_NONE,
-       TRACE_TYPE_LINUX_SLL
+       TRACE_TYPE_LINUX_SLL,
+       TRACE_TYPE_PFLOG
      } libtrace_linktype_t;
 

lib/trace.c

@@ -205 +205 @@
         char addr[8];                   /* link-layer address */
         uint16_t protocol;              /* protocol */
+};
+
+#ifndef PF_RULESET_NAME_SIZE
+#define PF_RULESET_NAME_SIZE 16
+#endif
+
+struct trace_pflog_header_t {
+        uint8_t    length;
+        sa_family_t   af;
+        uint8_t    action;
+        uint8_t    reason;
+        char       ifname[IFNAMSIZ];
+        char       ruleset[PF_RULESET_NAME_SIZE];
+        uint32_t   rulenr;
+        uint32_t   subrulenr;
+        uint8_t    dir;
+        uint8_t    pad[3];
 };
 
@@ -988 +1005 @@
                         }
                         break;
+                case TRACE_TYPE_PFLOG:
+                        {
+                                struct trace_pflog_header_t *pflog;
+                                pflog = trace_get_link(packet);
+                                if (!pflog) {
+                                        ipptr = NULL;
+                                        break;
+                                }
+                                if (pflog->af != AF_INET) {
+                                        ipptr = NULL;
+                                } else {
+                                        ipptr = ((void*)pflog)+sizeof(*pflog);
+                                }
+                        }
+                        break;
                 case TRACE_TYPE_ATM:
                         {
@@ -1416 +1448 @@
                                         return TRACE_TYPE_LINUX_SLL;
 #endif
+#ifdef DLT_PFLOG
+                                case DLT_PFLOG:
+                                        return TRACE_TYPE_PFLOG;
+#endif
                         }
                         break;
@@ -1648 +1684 @@
                                 break;
 #endif
+#ifdef DLT_PFLOG
+                        case TRACE_TYPE_PFLOG:
+                                pcap = pcap_open_dead(DLT_PFLOG, 1500);
+                                break;
+#endif
                         default:
                                 printf("only works for ETH and LINUX_SLL (ppp) at the moment\n");
@@ -1725 +1766 @@
                         switch (trace_get_link_type(packet)) {
                                 case TRACE_TYPE_LINUX_SLL:
-                                        {
-                                                struct trace_sll_header_t *sll;
-                                                sll = trace_get_link(packet);
-                                                if (!sll) {
-                                                        return -1;
-                                                }
-                                                /* 0 == LINUX_SLL_HOST */
-                                                /* the Waikato Capture point defines "packets
-                                                 * originating locally" (ie, outbound), with a
-                                                 * direction of 0, and "packets destined locally"
-                                                 * (ie, inbound), with a direction of 1.
-                                                 * This is kind-of-opposite to LINUX_SLL.
-                                                 * We return consistent values here, however
-                                                 *
-                                                 * Note that in recent versions of pcap, you can
-                                                 * use "inbound" and "outbound" on ppp in linux
-                                                 */
-                                                if (ntohs(sll->pkttype==0)) {
-
-                                                        direction = 1;
-                                                }
-                                                else {
-                                                        direction = 0;
-                                                }
-                                                break;
+                                {
+                                        struct trace_sll_header_t *sll;
+                                        sll = trace_get_link(packet);
+                                        if (!sll) {
+                                                return -1;
                                         }
+                                        /* 0 == LINUX_SLL_HOST */
+                                        /* the Waikato Capture point defines "packets
+                                         * originating locally" (ie, outbound), with a
+                                         * direction of 0, and "packets destined locally"
+                                         * (ie, inbound), with a direction of 1.
+                                         * This is kind-of-opposite to LINUX_SLL.
+                                         * We return consistent values here, however
+                                         *
+                                         * Note that in recent versions of pcap, you can
+                                         * use "inbound" and "outbound" on ppp in linux
+                                         */
+                                        if (ntohs(sll->pkttype==0)) {
+
+                                                direction = 1;
+                                        }
+                                        else {
+                                                direction = 0;
+                                        }
+                                        break;
+                                }
+                                case TRACE_TYPE_PFLOG:
+                                {
+                                        struct trace_pflog_header_t *pflog;
+                                        pflog = trace_get_link(packet);
+                                        if (!pflog) {
+                                                return -1;
+                                        }
+                                        /* enum    { PF_IN=0, PF_OUT=1 }; */
+                                        if (ntohs(pflog->dir==0)) {
+
+                                                direction = 1;
+                                        }
+                                        else {
+                                                direction = 0;
+                                        }
+                                        break;
+                                }
                                 default:
                                         /* pass */