11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * ebt_log 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Authors: 51da177e4SLinus Torvalds * Bart De Schuymer <bdschuym@pandora.be> 6d5228a4fSBart De Schuymer * Harald Welte <laforge@netfilter.org> 71da177e4SLinus Torvalds * 81da177e4SLinus Torvalds * April, 2002 91da177e4SLinus Torvalds * 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds #include <linux/module.h> 121da177e4SLinus Torvalds #include <linux/ip.h> 132e4e6a17SHarald Welte #include <linux/in.h> 141da177e4SLinus Torvalds #include <linux/if_arp.h> 151da177e4SLinus Torvalds #include <linux/spinlock.h> 16f01ffbd6SPatrick McHardy #include <net/netfilter/nf_log.h> 1793f65158SKuo-lang Tseng #include <linux/ipv6.h> 1893f65158SKuo-lang Tseng #include <net/ipv6.h> 1993f65158SKuo-lang Tseng #include <linux/in6.h> 2018219d3fSJan Engelhardt #include <linux/netfilter/x_tables.h> 2118219d3fSJan Engelhardt #include <linux/netfilter_bridge/ebtables.h> 2218219d3fSJan Engelhardt #include <linux/netfilter_bridge/ebt_log.h> 2318219d3fSJan Engelhardt #include <linux/netfilter.h> 241da177e4SLinus Torvalds 251da177e4SLinus Torvalds static DEFINE_SPINLOCK(ebt_log_lock); 261da177e4SLinus Torvalds 27135367b8SJan Engelhardt static int ebt_log_tg_check(const struct xt_tgchk_param *par) 281da177e4SLinus Torvalds { 29af5d6dc2SJan Engelhardt struct ebt_log_info *info = par->targinfo; 301da177e4SLinus Torvalds 311da177e4SLinus Torvalds if (info->bitmask & ~EBT_LOG_MASK) 32d6b00a53SJan Engelhardt return -EINVAL; 331da177e4SLinus Torvalds if (info->loglevel >= 8) 34d6b00a53SJan Engelhardt return -EINVAL; 351da177e4SLinus Torvalds info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0'; 36d6b00a53SJan Engelhardt return 0; 371da177e4SLinus Torvalds } 381da177e4SLinus Torvalds 39abcdd9a6SIan Morris struct tcpudphdr { 4047c183faSAl Viro __be16 src; 4147c183faSAl Viro __be16 dst; 421da177e4SLinus Torvalds }; 431da177e4SLinus Torvalds 44abcdd9a6SIan Morris struct arppayload { 451da177e4SLinus Torvalds unsigned char mac_src[ETH_ALEN]; 461da177e4SLinus Torvalds unsigned char ip_src[4]; 471da177e4SLinus Torvalds unsigned char mac_dst[ETH_ALEN]; 481da177e4SLinus Torvalds unsigned char ip_dst[4]; 491da177e4SLinus Torvalds }; 501da177e4SLinus Torvalds 5193f65158SKuo-lang Tseng static void 5293f65158SKuo-lang Tseng print_ports(const struct sk_buff *skb, uint8_t protocol, int offset) 5393f65158SKuo-lang Tseng { 5493f65158SKuo-lang Tseng if (protocol == IPPROTO_TCP || 5593f65158SKuo-lang Tseng protocol == IPPROTO_UDP || 5693f65158SKuo-lang Tseng protocol == IPPROTO_UDPLITE || 5793f65158SKuo-lang Tseng protocol == IPPROTO_SCTP || 5893f65158SKuo-lang Tseng protocol == IPPROTO_DCCP) { 5993f65158SKuo-lang Tseng const struct tcpudphdr *pptr; 6093f65158SKuo-lang Tseng struct tcpudphdr _ports; 6193f65158SKuo-lang Tseng 6293f65158SKuo-lang Tseng pptr = skb_header_pointer(skb, offset, 6393f65158SKuo-lang Tseng sizeof(_ports), &_ports); 6493f65158SKuo-lang Tseng if (pptr == NULL) { 6513fa745dSJoe Perches pr_cont(" INCOMPLETE TCP/UDP header"); 6693f65158SKuo-lang Tseng return; 6793f65158SKuo-lang Tseng } 6813fa745dSJoe Perches pr_cont(" SPT=%u DPT=%u", ntohs(pptr->src), ntohs(pptr->dst)); 6993f65158SKuo-lang Tseng } 7093f65158SKuo-lang Tseng } 7193f65158SKuo-lang Tseng 72d5228a4fSBart De Schuymer static void 738cdb46daSHans Schillstrom ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum, 74d5228a4fSBart De Schuymer const struct sk_buff *skb, const struct net_device *in, 75d5228a4fSBart De Schuymer const struct net_device *out, const struct nf_loginfo *loginfo, 76d5228a4fSBart De Schuymer const char *prefix) 771da177e4SLinus Torvalds { 78d5228a4fSBart De Schuymer unsigned int bitmask; 797d278924SGao feng 807d278924SGao feng /* FIXME: Disabled from containers until syslog ns is supported */ 812851940fSMichal Kubeček if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns) 827d278924SGao feng return; 831da177e4SLinus Torvalds 841da177e4SLinus Torvalds spin_lock_bh(&ebt_log_lock); 8516af511aSJoe Perches printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", 86be39ee11STobias Klauser '0' + loginfo->u.log.level, prefix, 87be39ee11STobias Klauser in ? in->name : "", out ? out->name : "", 88be39ee11STobias Klauser eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, 89be39ee11STobias Klauser ntohs(eth_hdr(skb)->h_proto)); 901da177e4SLinus Torvalds 91d5228a4fSBart De Schuymer if (loginfo->type == NF_LOG_TYPE_LOG) 92d5228a4fSBart De Schuymer bitmask = loginfo->u.log.logflags; 93d5228a4fSBart De Schuymer else 94ff107d27SLiping Zhang bitmask = NF_LOG_DEFAULT_MASK; 95d5228a4fSBart De Schuymer 96d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto == 971da177e4SLinus Torvalds htons(ETH_P_IP)) { 98abfdf1c4SJan Engelhardt const struct iphdr *ih; 99abfdf1c4SJan Engelhardt struct iphdr _iph; 1001da177e4SLinus Torvalds 1011da177e4SLinus Torvalds ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 1021da177e4SLinus Torvalds if (ih == NULL) { 10313fa745dSJoe Perches pr_cont(" INCOMPLETE IP header"); 1041da177e4SLinus Torvalds goto out; 1051da177e4SLinus Torvalds } 10613fa745dSJoe Perches pr_cont(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d", 10721454aaaSHarvey Harrison &ih->saddr, &ih->daddr, ih->tos, ih->protocol); 10893f65158SKuo-lang Tseng print_ports(skb, ih->protocol, ih->ihl*4); 1091da177e4SLinus Torvalds goto out; 1101da177e4SLinus Torvalds } 11193f65158SKuo-lang Tseng 112e6373c4cSIgor Maravić #if IS_ENABLED(CONFIG_BRIDGE_EBT_IP6) 11393f65158SKuo-lang Tseng if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto == 11493f65158SKuo-lang Tseng htons(ETH_P_IPV6)) { 11593f65158SKuo-lang Tseng const struct ipv6hdr *ih; 11693f65158SKuo-lang Tseng struct ipv6hdr _iph; 11793f65158SKuo-lang Tseng uint8_t nexthdr; 11875f2811cSJesse Gross __be16 frag_off; 11993f65158SKuo-lang Tseng int offset_ph; 12093f65158SKuo-lang Tseng 12193f65158SKuo-lang Tseng ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 12293f65158SKuo-lang Tseng if (ih == NULL) { 12313fa745dSJoe Perches pr_cont(" INCOMPLETE IPv6 header"); 12493f65158SKuo-lang Tseng goto out; 1251da177e4SLinus Torvalds } 12613fa745dSJoe Perches pr_cont(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d", 127b189db5dSHarvey Harrison &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr); 12893f65158SKuo-lang Tseng nexthdr = ih->nexthdr; 12975f2811cSJesse Gross offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr, &frag_off); 13093f65158SKuo-lang Tseng if (offset_ph == -1) 13193f65158SKuo-lang Tseng goto out; 13293f65158SKuo-lang Tseng print_ports(skb, nexthdr, offset_ph); 1331da177e4SLinus Torvalds goto out; 1341da177e4SLinus Torvalds } 135f586287eSRandy Dunlap #endif 1361da177e4SLinus Torvalds 137d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_ARP) && 1381da177e4SLinus Torvalds ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) || 1391da177e4SLinus Torvalds (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) { 140abfdf1c4SJan Engelhardt const struct arphdr *ah; 141abfdf1c4SJan Engelhardt struct arphdr _arph; 1421da177e4SLinus Torvalds 1431da177e4SLinus Torvalds ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); 1441da177e4SLinus Torvalds if (ah == NULL) { 14513fa745dSJoe Perches pr_cont(" INCOMPLETE ARP header"); 1461da177e4SLinus Torvalds goto out; 1471da177e4SLinus Torvalds } 14813fa745dSJoe Perches pr_cont(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d", 1491da177e4SLinus Torvalds ntohs(ah->ar_hrd), ntohs(ah->ar_pro), 1501da177e4SLinus Torvalds ntohs(ah->ar_op)); 1511da177e4SLinus Torvalds 1521da177e4SLinus Torvalds /* If it's for Ethernet and the lengths are OK, 1537f495ad9SIan Morris * then log the ARP payload 1547f495ad9SIan Morris */ 1551da177e4SLinus Torvalds if (ah->ar_hrd == htons(1) && 1561da177e4SLinus Torvalds ah->ar_hln == ETH_ALEN && 15747c183faSAl Viro ah->ar_pln == sizeof(__be32)) { 158abfdf1c4SJan Engelhardt const struct arppayload *ap; 159abfdf1c4SJan Engelhardt struct arppayload _arpp; 1601da177e4SLinus Torvalds 16185c1937bSDavid S. Miller ap = skb_header_pointer(skb, sizeof(_arph), 1621da177e4SLinus Torvalds sizeof(_arpp), &_arpp); 1631da177e4SLinus Torvalds if (ap == NULL) { 16413fa745dSJoe Perches pr_cont(" INCOMPLETE ARP payload"); 1651da177e4SLinus Torvalds goto out; 1661da177e4SLinus Torvalds } 16713fa745dSJoe Perches pr_cont(" ARP MAC SRC=%pM ARP IP SRC=%pI4 ARP MAC DST=%pM ARP IP DST=%pI4", 16813fa745dSJoe Perches ap->mac_src, ap->ip_src, 16913fa745dSJoe Perches ap->mac_dst, ap->ip_dst); 1701da177e4SLinus Torvalds } 1711da177e4SLinus Torvalds } 1721da177e4SLinus Torvalds out: 17313fa745dSJoe Perches pr_cont("\n"); 1741da177e4SLinus Torvalds spin_unlock_bh(&ebt_log_lock); 175d5228a4fSBart De Schuymer } 176d5228a4fSBart De Schuymer 1772d06d4a5SJan Engelhardt static unsigned int 1784b560b44SJan Engelhardt ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par) 179d5228a4fSBart De Schuymer { 1807eb35586SJan Engelhardt const struct ebt_log_info *info = par->targinfo; 181d5228a4fSBart De Schuymer struct nf_loginfo li; 182613dbd95SPablo Neira Ayuso struct net *net = xt_net(par); 183d5228a4fSBart De Schuymer 184d5228a4fSBart De Schuymer li.type = NF_LOG_TYPE_LOG; 185d5228a4fSBart De Schuymer li.u.log.level = info->loglevel; 186d5228a4fSBart De Schuymer li.u.log.logflags = info->bitmask; 187d5228a4fSBart De Schuymer 188960649d1SPablo Neira Ayuso /* Remember that we have to use ebt_log_packet() not to break backward 189960649d1SPablo Neira Ayuso * compatibility. We cannot use the default bridge packet logger via 190960649d1SPablo Neira Ayuso * nf_log_packet() with NFT_LOG_TYPE_LOG here. --Pablo 191960649d1SPablo Neira Ayuso */ 192bafac2a5SPatrick McHardy if (info->bitmask & EBT_LOG_NFLOG) 193613dbd95SPablo Neira Ayuso nf_log_packet(net, NFPROTO_BRIDGE, xt_hooknum(par), skb, 194613dbd95SPablo Neira Ayuso xt_in(par), xt_out(par), &li, "%s", 195613dbd95SPablo Neira Ayuso info->prefix); 196bafac2a5SPatrick McHardy else 197613dbd95SPablo Neira Ayuso ebt_log_packet(net, NFPROTO_BRIDGE, xt_hooknum(par), skb, 198613dbd95SPablo Neira Ayuso xt_in(par), xt_out(par), &li, info->prefix); 1990ac6ab1fSJan Engelhardt return EBT_CONTINUE; 2001da177e4SLinus Torvalds } 2011da177e4SLinus Torvalds 202043ef46cSJan Engelhardt static struct xt_target ebt_log_tg_reg __read_mostly = { 203043ef46cSJan Engelhardt .name = "log", 204001a18d3SJan Engelhardt .revision = 0, 205001a18d3SJan Engelhardt .family = NFPROTO_BRIDGE, 2062d06d4a5SJan Engelhardt .target = ebt_log_tg, 2072d06d4a5SJan Engelhardt .checkentry = ebt_log_tg_check, 208fc0e3df4SFlorian Westphal .targetsize = sizeof(struct ebt_log_info), 2091da177e4SLinus Torvalds .me = THIS_MODULE, 2101da177e4SLinus Torvalds }; 2111da177e4SLinus Torvalds 21265b4b4e8SAndrew Morton static int __init ebt_log_init(void) 2131da177e4SLinus Torvalds { 214960649d1SPablo Neira Ayuso return xt_register_target(&ebt_log_tg_reg); 2151da177e4SLinus Torvalds } 2161da177e4SLinus Torvalds 21765b4b4e8SAndrew Morton static void __exit ebt_log_fini(void) 2181da177e4SLinus Torvalds { 219043ef46cSJan Engelhardt xt_unregister_target(&ebt_log_tg_reg); 2201da177e4SLinus Torvalds } 2211da177e4SLinus Torvalds 22265b4b4e8SAndrew Morton module_init(ebt_log_init); 22365b4b4e8SAndrew Morton module_exit(ebt_log_fini); 224f776c4cdSJan Engelhardt MODULE_DESCRIPTION("Ebtables: Packet logging to syslog"); 2251da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 226