Re: Log ARP headers

[Jeremy Sowden <jeremy@azazel.net>]

[-- Attachment #1: Type: text/plain, Size: 1146 bytes --]

On 2025-03-03, at 21:52:07 +0000, Slavko wrote:
> On 3. marca 2025 19:35:33 UTC, Florian Westphal <fw@strlen.de> wrote:
> > This is only required for logging that is triggered internally,
> > e.g. for nf_conntrack.log_Invalid.
>
> Oh, many thanks, that was not clear for me from any related article.
>
> > I think this is missing support in ulogd2.
> >
> > Untested, to give you some starting point:
> > (3 is NFPROTO_ARP).
> >
> > --- a/filter/raw2packet/ulogd_raw2packet_BASE.c
> > +++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
> > @@ -959,6 +959,8 @@ static int _interp_pkt(struct ulogd_pluginstance *pi)
> >                 return _interp_ipv6hdr(pi, len);
> >         case AF_BRIDGE:
> >                 return _interp_bridge(pi, len);
> > +       case 3:
> > +               return _interp_arp(pi, len);
> >         }
> >         return ULOGD_IRET_OK;
> >  }
>
> Unfortunately, i don't speak C ;-)

I do.

> I understand this change, but i cannot see all consequence,
>
> Any chance that it will go to ulogd itself? Or i have to maintain
> this patch locally only? (I mean for future versions)

I'll look at this when I get a moment.

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]