2
* Copyright (c) 1998-2004 Hannes Gredler <hannes@tcpdump.org>
5
* Redistribution and use in source and binary forms, with or without
6
* modification, are permitted provided that: (1) source code
7
* distributions retain the above copyright notice and this paragraph
8
* in its entirety, and (2) distributions including binary code include
9
* the above copyright notice and this paragraph in its entirety in
10
* the documentation or other materials provided with the distribution.
11
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND
12
* WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT
13
* LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
14
* FOR A PARTICULAR PURPOSE.
18
static const char rcsid[] _U_ =
19
"@(#) $Header: /tcpdump/master/tcpdump/print-syslog.c,v 1.1 2004/10/29 11:42:53 hannes Exp $";
26
#include <tcpdump-stdinc.h>
31
#include "interface.h"
33
#include "addrtoname.h"
36
* tokenlists and #defines taken from Ethereal - Network traffic analyzer
37
* by Gerald Combs <gerald@ethereal.com>
40
#define SYSLOG_SEVERITY_MASK 0x0007 /* 0000 0000 0000 0111 */
41
#define SYSLOG_FACILITY_MASK 0x03f8 /* 0000 0011 1111 1000 */
42
#define SYSLOG_MAX_DIGITS 3 /* The maximum number if priority digits to read in. */
44
static const struct tok syslog_severity_values[] = {
56
static const struct tok syslog_facility_values[] = {
85
syslog_print(register const u_char *pptr, register u_int len)
87
u_int16_t msg_off = 0;
89
u_int16_t facility,severity;
91
/* extract decimal figures that are
92
* encapsulated within < > tags
93
* based on this decimal figure extract the
94
* severity and facility values
97
if (!TTEST2(*pptr, 1))
100
if (*(pptr+msg_off) == '<') {
103
if (!TTEST2(*(pptr+msg_off), 1))
106
while ( *(pptr+msg_off) >= '0' &&
107
*(pptr+msg_off) <= '9' &&
108
msg_off <= SYSLOG_MAX_DIGITS) {
110
if (!TTEST2(*(pptr+msg_off), 1))
113
pri = pri * 10 + (*(pptr+msg_off) - '0');
116
if (!TTEST2(*(pptr+msg_off), 1))
119
if (*(pptr+msg_off) == '>')
127
facility = (pri & SYSLOG_FACILITY_MASK) >> 3;
128
severity = pri & SYSLOG_SEVERITY_MASK;
133
printf("SYSLOG %s.%s, length: %u",
134
tok2str(syslog_facility_values, "unknown (%u)", facility),
135
tok2str(syslog_severity_values, "unknown (%u)", severity),
140
printf("SYSLOG, length: %u\n\tFacility %s (%u), Severity %s (%u)\n\tMsg: ",
142
tok2str(syslog_facility_values, "unknown (%u)", facility),
144
tok2str(syslog_severity_values, "unknown (%u)", severity),
147
/* print the syslog text in verbose mode */
148
for (; msg_off < len; msg_off++) {
149
if (!TTEST2(*(pptr+msg_off), 1))
151
safeputchar(*(pptr+msg_off));
155
if(!print_unknown_data(pptr,"\n\t",len))