Re: [PATCH] ulogd2: Fix length handling in PCAP output

[Pablo Neira Ayuso <pablo@netfilter.org>]

On 05/09/10 18:29, Jan Andres wrote:
> Currently, the PCAP output plugin uses ip.totlen to determine both the
> "len" and "caplen" pcap header fields, as well as the amount of packet
> data written to the file. There are two issues with this:
> 
> - For obvious reasons it doesn't work for IPv6.
> 
> - AFAICT, in case of an incompletely captured packet (--nflog-range)
>   it will attempt to write out the whole packet, not just the part
>   captured.
> 
> This patch changes the behavior to:
> 
> - Use raw.pktlen to set the "caplen" field, and the amount of data
>   written.
> 
> - Determine the "len" (original length) field from ip.totlen or
>   ip6.payload_len if possible, default to the same value as "caplen"
>   otherwise.
> 
> Signed-off-by: Jan Andres <jandres@gmx.net>

Applied, thanks Jan.