Robert O'Brien reported a bug in the output of the source and target IP addresses of ARP packets using the GPRINT output plug-in and proposed a fix for that particular bug: https://lore.kernel.org/netfilter-devel/005601d8f532$49cd7080$dd685180$@foxtrot-research.com/ It transpires that there are a number of incorrect assumptions about the format of IP addresses in the code-base. In a couple of places there are endianness mismatches, but more commonly it is assumed that all IP addresses are IPv4. This series fixes a couple of things I noticed during triage, and then converts all addresses internally to IPv6, using IPv4-in-IPv6 format for IPv4 addresses, converting them back to IPv4 where necessary (e.g., on output). Things to note. 1. Previously IP2HBIN passed IPv6 address through unmodified. Now it ignores them altogether. 2. The GPRINT and OPRINT plug-ins now use `inet_ntop` to format addresses and handle IPv6 address correctly. 3. The SQL output plug-ins, which previously output garbage for IPv6 addresses, now output NULL. Patch 1 fixes a misspelt variable. Patch 2 adds some missing int64_t support. Patch 3 contains the IP address changes. Jeremy Sowden (3): filter: IP2BIN: correct spelling of variable output: add missing support for int64_t values src: keep IPv4 addresses internally in IPv4-in-IPv6 format filter/raw2packet/ulogd_raw2packet_BASE.c | 24 +++++-- filter/ulogd_filter_IP2BIN.c | 39 +++------- filter/ulogd_filter_IP2HBIN.c | 13 ++-- filter/ulogd_filter_IP2STR.c | 5 +- include/ulogd/ulogd.h | 52 ++++++++++++++ input/flow/ulogd_inpflow_NFCT.c | 24 ++++--- output/ipfix/ulogd_output_IPFIX.c | 4 +- output/sqlite3/ulogd_output_SQLITE3.c | 24 +++++-- output/ulogd_output_GPRINT.c | 38 +++++++--- output/ulogd_output_JSON.c | 3 + output/ulogd_output_OPRINT.c | 87 +++++++++++++---------- src/ulogd.c | 3 +- util/db.c | 18 +++-- 13 files changed, 219 insertions(+), 115 deletions(-) -- 2.35.1
