Hello, On Wednesday, 2008 July 9 at 13:10:34 +0200, Patrick McHardy wrote: > Pablo Neira Ayuso wrote: >> Patrick McHardy wrote: >>> Pablo Neira Ayuso wrote: >>>> + ret[ULOG_KEY_OOB_PROTOCOL].u.value.ui16 = 0; >>>> + ret[ULOG_KEY_OOB_PROTOCOL].flags |= ULOGD_RETF_VALID; >>>> + return ULOGD_IRET_OK; >>> This appears to be breaking logging for anything but ethernet >>> packets. We can't do that, especially since ulogd1 has long >>> been in maintenance-only mode. >> >> Hm, this patch applies to ulogd2, probably you got confused with the >> subject? > > Indeed, I mixed that up. > >> But indeed, I agree with you. Eric, I think that it's better to drop any >> effort in trying to add layer 2 support for ulogd2 if the user use ULOG >> as input logger. If users want new features, eg. the layer 2 information >> in their log messages, they should upgrade to NFLOG. > > Agreed, I really don't see how this can be done without breaking > things. The necessary information is not present in the ULOG > messages. I think the proposed patch is a best effort work. It should be enough for most users as ethernet headers are the more common. But I agree, we can't have a full working solution with ULOG. I will try to find some time to rework my NFLOG patch to see if it is possible to cleanly send the source and destination hardware address to userspace via NFLOG. IMHO, this patch is not harmfull and will help some people. It may worth to be push in the git tree. BR, -- Eric Leblond
Attachment:
signature.asc
Description: Digital signature
