u_int nflog_if_print(struct netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p) { const nflog_hdr_t *hdr = (const nflog_hdr_t *)p; const nflog_tlv_t *tlv; u_int16_t size; u_int16_t h_size = sizeof(nflog_hdr_t); u_int caplen = h->caplen; u_int length = h->len; if (caplen < (int) sizeof(nflog_hdr_t) || length < (int) sizeof(nflog_hdr_t)) { ND_PRINT((ndo, "[|nflog]")); return h_size; } if (!(hdr->nflog_version) == 0) { ND_PRINT((ndo, "version %u (unknown)", hdr->nflog_version)); return h_size; } if (ndo->ndo_eflag) nflog_hdr_print(ndo, hdr, length); length -= sizeof(nflog_hdr_t); caplen -= sizeof(nflog_hdr_t); p += sizeof(nflog_hdr_t); do { tlv = (const nflog_tlv_t *) p; size = tlv->tlv_length; if (size % 4 != 0) size += 4 - size % 4; h_size = h_size + size; /* wrong size of the packet */ if (size > length || size == 0) return h_size; p += size; length = length - size; caplen = caplen - size; } while (tlv->tlv_type != NFULA_PAYLOAD); /* dont skip payload just tlv length and type */ p = p - size + 4; length += size - 4; caplen += size - 4; h_size -= length; switch (hdr->nflog_family) { case AF_INET: ip_print(ndo, p, length); break; #ifdef INET6 case AF_INET6: ip6_print(ndo, p, length); break; #endif /*INET6*/ default: if (!ndo->ndo_eflag) nflog_hdr_print(ndo, hdr, length + sizeof(nflog_hdr_t)); if (!ndo->ndo_suppress_default_print) ndo->ndo_default_print(ndo, p, caplen); break; } return h_size; }
u_int nflog_if_print(struct netdissect_options *ndo, const struct pcap_pkthdr *h, const u_char *p) { const nflog_hdr_t *hdr = (const nflog_hdr_t *)p; const nflog_tlv_t *tlv; u_int16_t size; u_int16_t h_size = sizeof(nflog_hdr_t); u_int caplen = h->caplen; u_int length = h->len; if (caplen < (int) sizeof(nflog_hdr_t) || length < (int) sizeof(nflog_hdr_t)) { ND_PRINT((ndo, "[|nflog]")); return h_size; } if (!(hdr->nflog_version) == 0) { ND_PRINT((ndo, "version %u (unknown)", hdr->nflog_version)); return h_size; } if (ndo->ndo_eflag) nflog_hdr_print(ndo, hdr, length); p += sizeof(nflog_hdr_t); length -= sizeof(nflog_hdr_t); caplen -= sizeof(nflog_hdr_t); while (length > 0) { /* We have some data. Do we have enough for the TLV header? */ if (caplen < sizeof(nflog_tlv_t) || length < sizeof(nflog_tlv_t)) { /* No. */ ND_PRINT((ndo, "[|nflog]")); return h_size; } tlv = (const nflog_tlv_t *) p; size = tlv->tlv_length; if (size % 4 != 0) size += 4 - size % 4; /* Is the TLV's length less than the minimum? */ if (size < sizeof(nflog_tlv_t)) { /* Yes. Give up now. */ ND_PRINT((ndo, "[|nflog]")); return h_size; } /* Do we have enough data for the full TLV? */ if (caplen < size || length < size) { /* No. */ ND_PRINT((ndo, "[|nflog]")); return h_size; } if (tlv->tlv_type == NFULA_PAYLOAD) { /* * This TLV's data is the packet payload. * Skip past the TLV header, and break out * of the loop so we print the packet data. */ p += sizeof(nflog_tlv_t); h_size += sizeof(nflog_tlv_t); length -= sizeof(nflog_tlv_t); caplen -= sizeof(nflog_tlv_t); break; } p += size; h_size += size; length -= size; caplen -= size; } switch (hdr->nflog_family) { case AF_INET: ip_print(ndo, p, length); break; #ifdef INET6 case AF_INET6: ip6_print(ndo, p, length); break; #endif /*INET6*/ default: if (!ndo->ndo_eflag) nflog_hdr_print(ndo, hdr, length + sizeof(nflog_hdr_t)); if (!ndo->ndo_suppress_default_print) ND_DEFAULTPRINT(p, caplen); break; } return h_size; }
static void nflog_print(struct netdissect_options *ndo, const u_char *p, u_int length, u_int caplen) { const nflog_hdr_t *hdr; const nflog_tlv_t *tlv; u_int16_t size; if (caplen < (int) sizeof(nflog_hdr_t)) { ND_PRINT((ndo, "[|nflog]")); return; } if (ndo->ndo_eflag) nflog_hdr_print(ndo, p, length); length -= sizeof(nflog_hdr_t); caplen -= sizeof(nflog_hdr_t); hdr = (const nflog_hdr_t *)p; p += sizeof(nflog_hdr_t); do { tlv = (const nflog_tlv_t *) p; size = tlv->tlv_length; /* wrong size of the packet */ if (size > length ) return; /* wrong tlv type */ if (tlv->tlv_type > NFULA_MAX) return; if (size % 4 != 0) size += 4 - size % 4; p += size; length = length - size; caplen = caplen - size; } while (tlv->tlv_type != NFULA_PAYLOAD); /* dont skip payload just tlv length and type */ p = p - size + 4; length += size - 4; caplen += size - 4; switch (hdr->nflog_family) { case AF_INET: ip_print(ndo, p, length); break; #ifdef INET6 case AF_INET6: ip6_print(ndo, p, length); break; #endif /*INET6*/ default: if (!ndo->ndo_eflag) nflog_hdr_print(ndo, (u_char *)hdr, length + sizeof(nflog_hdr_t)); if (!ndo->ndo_suppress_default_print) ndo->ndo_default_print(ndo, p, caplen); break; } }