Hi Blažej,
On Wed, Aug 18, 2021 at 12:06:40PM +0200, Blažej Krajňák wrote:
> st 18. 8. 2021 o 9:23 Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> napísal(a):
> > You need this kernel patch to add this information to nfnetlink_queue,
> > compile-tested only.
>
> Hey Pablo,
> patch is working like a charm. Thank you! Now I see timestamps and
> packets/bytes counters in JSON output correctly.
> At the end I will post customized input plugin for everyone.
>
> The last thing I want to ask is what's correct way to get
>
> attrs[NFULA_CT]
>
> from
>
> struct nfulnl_msg_packet_hdr *ph = nflog_get_msg_packet_hdr(ldata);
>
>
> Now I use the following code which is working but throwing random
> errors "something went wrong (Numerical result out of range)" I'm
> mixing struct nfulnl_msg_packet_hdr with const struct nlmsghdr *nlh
That might be a bug in nflog_nlmsg_parse(): maybe
nflog_parse_attr_cb() is finding a mismatch in the datatype of the
attribute payload.
Could you have a look at what attribute is hitting this error?
> struct nfulnl_msg_packet_hdr *ph = nflog_get_msg_packet_hdr(ldata);
> struct nlattr *attrs[NFULA_MAX + 1] = { NULL };
> int retb;
>
> retb = nflog_nlmsg_parse(ph, attrs);
> if (retb != MNL_CB_OK) {
> printf("something went wrong");
> printf(" (%s)\n", strerror(errno));
> return retb;
> }
