+ if (texttype) {
+ logprintf(ctx, "%s packet ",
+ direction == PKT_INCOMING ? "Incoming" : "Outgoing");
+
+ if (seq)
+ logprintf(ctx, "#0x%lx, ", *seq);
+
+ logprintf(ctx, "type %d / 0x%02x (%s)", type, type, texttype);
+
+ if (downstream_id) {
+ logprintf(ctx, " on behalf of downstream #%u", downstream_id);
+ if (additional_log_text)
+ logprintf(ctx, " (%s)", additional_log_text);
+ }
+
+ logprintf(ctx, "\r\n");
+ } else {
+ /*
+ * Raw data is logged with a timestamp, so that it's possible
+ * to determine whether a mysterious delay occurred at the
+ * client or server end. (Timestamping the raw data avoids
+ * cluttering the normal case of only logging decrypted SSH
+ * messages, and also adds conceptual rigour in the case where
+ * an SSH message arrives in several pieces.)
+ */
+ char buf[256];
+ struct tm tm;
+ tm = ltime();
+ strftime(buf, 24, "%Y-%m-%d %H:%M:%S", &tm);
+ logprintf(ctx, "%s raw data at %s\r\n",
+ direction == PKT_INCOMING ? "Incoming" : "Outgoing",
+ buf);
+ }