Re: Log ARP headers

Jeremy Sowden <[email protected]> Mon, 3 Mar 2025 22:00:55 +0000

Newsgroups	gmane.comp.security.firewalls.netfilter.general
Message-ID	<[email protected]>

On 2025-03-03, at 21:52:07 +0000, Slavko wrote:
> On 3. marca 2025 19:35:33 UTC, Florian Westphal <[email protected]> wrote:
> > This is only required for logging that is triggered internally,
> > e.g. for nf_conntrack.log_Invalid.
>
> Oh, many thanks, that was not clear for me from any related article.
>
> > I think this is missing support in ulogd2.
> >
> > Untested, to give you some starting point:
> > (3 is NFPROTO_ARP).
> >
> > --- a/filter/raw2packet/ulogd_raw2packet_BASE.c
> > +++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
> > @@ -959,6 +959,8 @@ static int _interp_pkt(struct ulogd_pluginstance *pi)
> >                 return _interp_ipv6hdr(pi, len);
> >         case AF_BRIDGE:
> >                 return _interp_bridge(pi, len);
> > +       case 3:
> > +               return _interp_arp(pi, len);
> >         }
> >         return ULOGD_IRET_OK;
> >  }
>
> Unfortunately, i don't speak C ;-)

I do.

> I understand this change, but i cannot see all consequence,
>
> Any chance that it will go to ulogd itself? Or i have to maintain
> this patch locally only? (I mean for future versions)

I'll look at this when I get a moment.

J.

signature.asc (application/pgp-signature, 931 B)