Re: Log ARP headers

On 3. marca 2025 19:35:33 UTC, Florian Westphal <[email protected]> wrote:

>This is only required for logging that is triggered
>internally, e.g. for nf_conntrack.log_Invalid.

Oh, many thanks, that was not clear for me from any
related article.

>I think this is missing support in ulogd2.
>
>Untested, to give you some starting point:
>(3 is NFPROTO_ARP).
>
>--- a/filter/raw2packet/ulogd_raw2packet_BASE.c
>+++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
>@@ -959,6 +959,8 @@ static int _interp_pkt(struct ulogd_pluginstance *pi)
>                return _interp_ipv6hdr(pi, len);
>        case AF_BRIDGE:
>                return _interp_bridge(pi, len);
>+       case 3:
>+               return _interp_arp(pi, len);
>        }
>        return ULOGD_IRET_OK;
> }

Unfortunately, i don't speak C ;-) I understand this change,
but i cannot see all consequence,

Any chance that it will go to ulogd itself? Or i have to maintain
this patch locally only? (I mean for future versions)

regards


-- 
Slavko
https://www.slavino.sk/