Example #1
0
int log_payload_get_physindev(struct log_payload *self)
{
    return nflog_get_physindev(self->nfad);
}
Example #2
0
/* Functions */
static int nflog_incoming(struct nflog_g_handle *gh, struct nfgenmsg *nfmsg,
                          struct nflog_data *nfa, void *p)
{
    static char jumbo_container[10000];
    struct timeval tv = {};
    struct pcap_pkthdr hdr;
    char *pkt = NULL;
    ssize_t pkt_len = nflog_get_payload(nfa, &pkt);
    ssize_t mac_len = nflog_get_msg_packet_hwhdrlen(nfa);
    struct pcap_callback_data *cb_data = p;

    /* Check we can handle this packet */
    switch (nfmsg->nfgen_family) {
    case AF_INET:
        break;
#ifdef ENABLE_IPV6
    case AF_INET6:
        break;
#endif
    default:
        return 0;
    }

    if (pkt_len == -1)
        return -1;
    nflog_get_timestamp(nfa, &tv);
    hdr.ts = tv;
    hdr.caplen = MIN(pkt_len, config.snaplen);
    hdr.len = pkt_len;

    cb_data->ifindex_in = nflog_get_physindev(nfa);
    if (cb_data->ifindex_in == 0)
        cb_data->ifindex_in = nflog_get_indev(nfa);

    cb_data->ifindex_out = nflog_get_physoutdev(nfa);
    if (cb_data->ifindex_out == 0)
        cb_data->ifindex_out = nflog_get_outdev(nfa);

#if defined (HAVE_L2)
    if (mac_len) {
        memcpy(jumbo_container, nflog_get_msg_packet_hwhdr(nfa), mac_len);
        memcpy(jumbo_container + mac_len, pkt, hdr.caplen);
        hdr.caplen += mac_len;
        hdr.len += mac_len;
    } else {
        memset(jumbo_container, 0, ETHER_HDRLEN);
        memcpy(jumbo_container+ETHER_HDRLEN, pkt, hdr.caplen);
        hdr.caplen += ETHER_HDRLEN;
        hdr.len += ETHER_HDRLEN;

        switch (nfmsg->nfgen_family) {
        case AF_INET:
            ((struct eth_header *)jumbo_container)->ether_type = ntohs(ETHERTYPE_IP);
            break;
        case AF_INET6:
            ((struct eth_header *)jumbo_container)->ether_type = ntohs(ETHERTYPE_IPV6);
            break;
        }
    }

    pcap_cb((u_char *) cb_data, &hdr, jumbo_container);
#else
    pcap_cb((u_char *) cb_data, &hdr, pkt);
#endif
}