ebt_log.c 5.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * ebt_log
  4. *
  5. * Authors:
  6. * Bart De Schuymer <bdschuym@pandora.be>
  7. * Harald Welte <laforge@netfilter.org>
  8. *
  9. * April, 2002
  10. *
  11. */
  12. #include <linux/module.h>
  13. #include <linux/ip.h>
  14. #include <linux/in.h>
  15. #include <linux/if_arp.h>
  16. #include <linux/spinlock.h>
  17. #include <net/netfilter/nf_log.h>
  18. #include <linux/ipv6.h>
  19. #include <net/ipv6.h>
  20. #include <linux/in6.h>
  21. #include <linux/netfilter/x_tables.h>
  22. #include <linux/netfilter_bridge/ebtables.h>
  23. #include <linux/netfilter_bridge/ebt_log.h>
  24. #include <linux/netfilter.h>
  25. static DEFINE_SPINLOCK(ebt_log_lock);
  26. static int ebt_log_tg_check(const struct xt_tgchk_param *par)
  27. {
  28. struct ebt_log_info *info = par->targinfo;
  29. if (info->bitmask & ~EBT_LOG_MASK)
  30. return -EINVAL;
  31. if (info->loglevel >= 8)
  32. return -EINVAL;
  33. info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
  34. return 0;
  35. }
  36. struct tcpudphdr {
  37. __be16 src;
  38. __be16 dst;
  39. };
  40. struct arppayload {
  41. unsigned char mac_src[ETH_ALEN];
  42. unsigned char ip_src[4];
  43. unsigned char mac_dst[ETH_ALEN];
  44. unsigned char ip_dst[4];
  45. };
  46. static void
  47. print_ports(const struct sk_buff *skb, uint8_t protocol, int offset)
  48. {
  49. if (protocol == IPPROTO_TCP ||
  50. protocol == IPPROTO_UDP ||
  51. protocol == IPPROTO_UDPLITE ||
  52. protocol == IPPROTO_SCTP ||
  53. protocol == IPPROTO_DCCP) {
  54. const struct tcpudphdr *pptr;
  55. struct tcpudphdr _ports;
  56. pptr = skb_header_pointer(skb, offset,
  57. sizeof(_ports), &_ports);
  58. if (pptr == NULL) {
  59. pr_cont(" INCOMPLETE TCP/UDP header");
  60. return;
  61. }
  62. pr_cont(" SPT=%u DPT=%u", ntohs(pptr->src), ntohs(pptr->dst));
  63. }
  64. }
  65. static void
  66. ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum,
  67. const struct sk_buff *skb, const struct net_device *in,
  68. const struct net_device *out, const struct nf_loginfo *loginfo,
  69. const char *prefix)
  70. {
  71. unsigned int bitmask;
  72. /* FIXME: Disabled from containers until syslog ns is supported */
  73. if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns)
  74. return;
  75. spin_lock_bh(&ebt_log_lock);
  76. printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x",
  77. '0' + loginfo->u.log.level, prefix,
  78. in ? in->name : "", out ? out->name : "",
  79. eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
  80. ntohs(eth_hdr(skb)->h_proto));
  81. if (loginfo->type == NF_LOG_TYPE_LOG)
  82. bitmask = loginfo->u.log.logflags;
  83. else
  84. bitmask = NF_LOG_DEFAULT_MASK;
  85. if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto ==
  86. htons(ETH_P_IP)) {
  87. const struct iphdr *ih;
  88. struct iphdr _iph;
  89. ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
  90. if (ih == NULL) {
  91. pr_cont(" INCOMPLETE IP header");
  92. goto out;
  93. }
  94. pr_cont(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d",
  95. &ih->saddr, &ih->daddr, ih->tos, ih->protocol);
  96. print_ports(skb, ih->protocol, ih->ihl*4);
  97. goto out;
  98. }
  99. #if IS_ENABLED(CONFIG_BRIDGE_EBT_IP6)
  100. if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto ==
  101. htons(ETH_P_IPV6)) {
  102. const struct ipv6hdr *ih;
  103. struct ipv6hdr _iph;
  104. uint8_t nexthdr;
  105. __be16 frag_off;
  106. int offset_ph;
  107. ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
  108. if (ih == NULL) {
  109. pr_cont(" INCOMPLETE IPv6 header");
  110. goto out;
  111. }
  112. pr_cont(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d",
  113. &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr);
  114. nexthdr = ih->nexthdr;
  115. offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr, &frag_off);
  116. if (offset_ph == -1)
  117. goto out;
  118. print_ports(skb, nexthdr, offset_ph);
  119. goto out;
  120. }
  121. #endif
  122. if ((bitmask & EBT_LOG_ARP) &&
  123. ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) ||
  124. (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) {
  125. const struct arphdr *ah;
  126. struct arphdr _arph;
  127. ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
  128. if (ah == NULL) {
  129. pr_cont(" INCOMPLETE ARP header");
  130. goto out;
  131. }
  132. pr_cont(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
  133. ntohs(ah->ar_hrd), ntohs(ah->ar_pro),
  134. ntohs(ah->ar_op));
  135. /* If it's for Ethernet and the lengths are OK,
  136. * then log the ARP payload
  137. */
  138. if (ah->ar_hrd == htons(1) &&
  139. ah->ar_hln == ETH_ALEN &&
  140. ah->ar_pln == sizeof(__be32)) {
  141. const struct arppayload *ap;
  142. struct arppayload _arpp;
  143. ap = skb_header_pointer(skb, sizeof(_arph),
  144. sizeof(_arpp), &_arpp);
  145. if (ap == NULL) {
  146. pr_cont(" INCOMPLETE ARP payload");
  147. goto out;
  148. }
  149. pr_cont(" ARP MAC SRC=%pM ARP IP SRC=%pI4 ARP MAC DST=%pM ARP IP DST=%pI4",
  150. ap->mac_src, ap->ip_src,
  151. ap->mac_dst, ap->ip_dst);
  152. }
  153. }
  154. out:
  155. pr_cont("\n");
  156. spin_unlock_bh(&ebt_log_lock);
  157. }
  158. static unsigned int
  159. ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par)
  160. {
  161. const struct ebt_log_info *info = par->targinfo;
  162. struct nf_loginfo li;
  163. struct net *net = xt_net(par);
  164. li.type = NF_LOG_TYPE_LOG;
  165. li.u.log.level = info->loglevel;
  166. li.u.log.logflags = info->bitmask;
  167. /* Remember that we have to use ebt_log_packet() not to break backward
  168. * compatibility. We cannot use the default bridge packet logger via
  169. * nf_log_packet() with NFT_LOG_TYPE_LOG here. --Pablo
  170. */
  171. if (info->bitmask & EBT_LOG_NFLOG)
  172. nf_log_packet(net, NFPROTO_BRIDGE, xt_hooknum(par), skb,
  173. xt_in(par), xt_out(par), &li, "%s",
  174. info->prefix);
  175. else
  176. ebt_log_packet(net, NFPROTO_BRIDGE, xt_hooknum(par), skb,
  177. xt_in(par), xt_out(par), &li, info->prefix);
  178. return EBT_CONTINUE;
  179. }
  180. static struct xt_target ebt_log_tg_reg __read_mostly = {
  181. .name = "log",
  182. .revision = 0,
  183. .family = NFPROTO_BRIDGE,
  184. .target = ebt_log_tg,
  185. .checkentry = ebt_log_tg_check,
  186. .targetsize = sizeof(struct ebt_log_info),
  187. .me = THIS_MODULE,
  188. };
  189. static int __init ebt_log_init(void)
  190. {
  191. return xt_register_target(&ebt_log_tg_reg);
  192. }
  193. static void __exit ebt_log_fini(void)
  194. {
  195. xt_unregister_target(&ebt_log_tg_reg);
  196. }
  197. module_init(ebt_log_init);
  198. module_exit(ebt_log_fini);
  199. MODULE_DESCRIPTION("Ebtables: Packet logging to syslog");
  200. MODULE_LICENSE("GPL");