void log_packet(void *handle, int direction, int type,
char *texttype, const void *data, int len,
int n_blanks, const struct logblank_t *blanks,
- const unsigned long *seq)
+ const unsigned long *seq,
+ unsigned downstream_id, const char *additional_log_text)
{
struct LogContext *ctx = (struct LogContext *)handle;
char dumpdata[80], smalldata[5];
/* Packet header. */
if (texttype) {
- if (seq) {
- logprintf(ctx, "%s packet #0x%lx, type %d / 0x%02x (%s)\r\n",
- direction == PKT_INCOMING ? "Incoming" : "Outgoing",
- *seq, type, type, texttype);
- } else {
- logprintf(ctx, "%s packet type %d / 0x%02x (%s)\r\n",
- direction == PKT_INCOMING ? "Incoming" : "Outgoing",
- type, type, texttype);
- }
- } else {
- logprintf(ctx, "%s raw data\r\n",
+ logprintf(ctx, "%s packet ",
direction == PKT_INCOMING ? "Incoming" : "Outgoing");
+
+ if (seq)
+ logprintf(ctx, "#0x%lx, ", *seq);
+
+ logprintf(ctx, "type %d / 0x%02x (%s)", type, type, texttype);
+
+ if (downstream_id) {
+ logprintf(ctx, " on behalf of downstream #%u", downstream_id);
+ if (additional_log_text)
+ logprintf(ctx, " (%s)", additional_log_text);
+ }
+
+ logprintf(ctx, "\r\n");
+ } else {
+ /*
+ * Raw data is logged with a timestamp, so that it's possible
+ * to determine whether a mysterious delay occurred at the
+ * client or server end. (Timestamping the raw data avoids
+ * cluttering the normal case of only logging decrypted SSH
+ * messages, and also adds conceptual rigour in the case where
+ * an SSH message arrives in several pieces.)
+ */
+ char buf[256];
+ struct tm tm;
+ tm = ltime();
+ strftime(buf, 24, "%Y-%m-%d %H:%M:%S", &tm);
+ logprintf(ctx, "%s raw data at %s\r\n",
+ direction == PKT_INCOMING ? "Incoming" : "Outgoing",
+ buf);
}
/*
bufchain_clear(&ctx->queue);
if (ctx->currlogfilename)
filename_free(ctx->currlogfilename);
+ conf_free(ctx->conf);
sfree(ctx);
}