11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * ebt_log 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Authors: 51da177e4SLinus Torvalds * Bart De Schuymer <bdschuym@pandora.be> 6d5228a4fSBart De Schuymer * Harald Welte <laforge@netfilter.org> 71da177e4SLinus Torvalds * 81da177e4SLinus Torvalds * April, 2002 91da177e4SLinus Torvalds * 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds #include <linux/module.h> 121da177e4SLinus Torvalds #include <linux/ip.h> 132e4e6a17SHarald Welte #include <linux/in.h> 141da177e4SLinus Torvalds #include <linux/if_arp.h> 151da177e4SLinus Torvalds #include <linux/spinlock.h> 16f01ffbd6SPatrick McHardy #include <net/netfilter/nf_log.h> 1793f65158SKuo-lang Tseng #include <linux/ipv6.h> 1893f65158SKuo-lang Tseng #include <net/ipv6.h> 1993f65158SKuo-lang Tseng #include <linux/in6.h> 2018219d3fSJan Engelhardt #include <linux/netfilter/x_tables.h> 2118219d3fSJan Engelhardt #include <linux/netfilter_bridge/ebtables.h> 2218219d3fSJan Engelhardt #include <linux/netfilter_bridge/ebt_log.h> 2318219d3fSJan Engelhardt #include <linux/netfilter.h> 241da177e4SLinus Torvalds 251da177e4SLinus Torvalds static DEFINE_SPINLOCK(ebt_log_lock); 261da177e4SLinus Torvalds 27af5d6dc2SJan Engelhardt static bool ebt_log_tg_check(const struct xt_tgchk_param *par) 281da177e4SLinus Torvalds { 29af5d6dc2SJan Engelhardt struct ebt_log_info *info = par->targinfo; 301da177e4SLinus Torvalds 311da177e4SLinus Torvalds if (info->bitmask & ~EBT_LOG_MASK) 3219eda879SJan Engelhardt return false; 331da177e4SLinus Torvalds if (info->loglevel >= 8) 3419eda879SJan Engelhardt return false; 351da177e4SLinus Torvalds info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0'; 3619eda879SJan Engelhardt return true; 371da177e4SLinus Torvalds } 381da177e4SLinus Torvalds 391da177e4SLinus Torvalds struct tcpudphdr 401da177e4SLinus Torvalds { 4147c183faSAl Viro __be16 src; 4247c183faSAl Viro __be16 dst; 431da177e4SLinus Torvalds }; 441da177e4SLinus Torvalds 451da177e4SLinus Torvalds struct arppayload 461da177e4SLinus Torvalds { 471da177e4SLinus Torvalds unsigned char mac_src[ETH_ALEN]; 481da177e4SLinus Torvalds unsigned char ip_src[4]; 491da177e4SLinus Torvalds unsigned char mac_dst[ETH_ALEN]; 501da177e4SLinus Torvalds unsigned char ip_dst[4]; 511da177e4SLinus Torvalds }; 521da177e4SLinus Torvalds 53abfdf1c4SJan Engelhardt static void print_MAC(const unsigned char *p) 541da177e4SLinus Torvalds { 551da177e4SLinus Torvalds int i; 561da177e4SLinus Torvalds 571da177e4SLinus Torvalds for (i = 0; i < ETH_ALEN; i++, p++) 581da177e4SLinus Torvalds printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':'); 591da177e4SLinus Torvalds } 601da177e4SLinus Torvalds 6193f65158SKuo-lang Tseng static void 6293f65158SKuo-lang Tseng print_ports(const struct sk_buff *skb, uint8_t protocol, int offset) 6393f65158SKuo-lang Tseng { 6493f65158SKuo-lang Tseng if (protocol == IPPROTO_TCP || 6593f65158SKuo-lang Tseng protocol == IPPROTO_UDP || 6693f65158SKuo-lang Tseng protocol == IPPROTO_UDPLITE || 6793f65158SKuo-lang Tseng protocol == IPPROTO_SCTP || 6893f65158SKuo-lang Tseng protocol == IPPROTO_DCCP) { 6993f65158SKuo-lang Tseng const struct tcpudphdr *pptr; 7093f65158SKuo-lang Tseng struct tcpudphdr _ports; 7193f65158SKuo-lang Tseng 7293f65158SKuo-lang Tseng pptr = skb_header_pointer(skb, offset, 7393f65158SKuo-lang Tseng sizeof(_ports), &_ports); 7493f65158SKuo-lang Tseng if (pptr == NULL) { 7593f65158SKuo-lang Tseng printk(" INCOMPLETE TCP/UDP header"); 7693f65158SKuo-lang Tseng return; 7793f65158SKuo-lang Tseng } 7893f65158SKuo-lang Tseng printk(" SPT=%u DPT=%u", ntohs(pptr->src), ntohs(pptr->dst)); 7993f65158SKuo-lang Tseng } 8093f65158SKuo-lang Tseng } 8193f65158SKuo-lang Tseng 82d5228a4fSBart De Schuymer static void 8376108ceaSJan Engelhardt ebt_log_packet(u_int8_t pf, unsigned int hooknum, 84d5228a4fSBart De Schuymer const struct sk_buff *skb, const struct net_device *in, 85d5228a4fSBart De Schuymer const struct net_device *out, const struct nf_loginfo *loginfo, 86d5228a4fSBart De Schuymer const char *prefix) 871da177e4SLinus Torvalds { 88d5228a4fSBart De Schuymer unsigned int bitmask; 891da177e4SLinus Torvalds 901da177e4SLinus Torvalds spin_lock_bh(&ebt_log_lock); 91d5228a4fSBart De Schuymer printk("<%c>%s IN=%s OUT=%s MAC source = ", '0' + loginfo->u.log.level, 92d5228a4fSBart De Schuymer prefix, in ? in->name : "", out ? out->name : ""); 931da177e4SLinus Torvalds 941da177e4SLinus Torvalds print_MAC(eth_hdr(skb)->h_source); 951da177e4SLinus Torvalds printk("MAC dest = "); 961da177e4SLinus Torvalds print_MAC(eth_hdr(skb)->h_dest); 971da177e4SLinus Torvalds 981da177e4SLinus Torvalds printk("proto = 0x%04x", ntohs(eth_hdr(skb)->h_proto)); 991da177e4SLinus Torvalds 100d5228a4fSBart De Schuymer if (loginfo->type == NF_LOG_TYPE_LOG) 101d5228a4fSBart De Schuymer bitmask = loginfo->u.log.logflags; 102d5228a4fSBart De Schuymer else 103d5228a4fSBart De Schuymer bitmask = NF_LOG_MASK; 104d5228a4fSBart De Schuymer 105d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto == 1061da177e4SLinus Torvalds htons(ETH_P_IP)){ 107abfdf1c4SJan Engelhardt const struct iphdr *ih; 108abfdf1c4SJan Engelhardt struct iphdr _iph; 1091da177e4SLinus Torvalds 1101da177e4SLinus Torvalds ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 1111da177e4SLinus Torvalds if (ih == NULL) { 1121da177e4SLinus Torvalds printk(" INCOMPLETE IP header"); 1131da177e4SLinus Torvalds goto out; 1141da177e4SLinus Torvalds } 11521454aaaSHarvey Harrison printk(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d", 11621454aaaSHarvey Harrison &ih->saddr, &ih->daddr, ih->tos, ih->protocol); 11793f65158SKuo-lang Tseng print_ports(skb, ih->protocol, ih->ihl*4); 1181da177e4SLinus Torvalds goto out; 1191da177e4SLinus Torvalds } 12093f65158SKuo-lang Tseng 121f586287eSRandy Dunlap #if defined(CONFIG_BRIDGE_EBT_IP6) || defined(CONFIG_BRIDGE_EBT_IP6_MODULE) 12293f65158SKuo-lang Tseng if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto == 12393f65158SKuo-lang Tseng htons(ETH_P_IPV6)) { 12493f65158SKuo-lang Tseng const struct ipv6hdr *ih; 12593f65158SKuo-lang Tseng struct ipv6hdr _iph; 12693f65158SKuo-lang Tseng uint8_t nexthdr; 12793f65158SKuo-lang Tseng int offset_ph; 12893f65158SKuo-lang Tseng 12993f65158SKuo-lang Tseng ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 13093f65158SKuo-lang Tseng if (ih == NULL) { 13193f65158SKuo-lang Tseng printk(" INCOMPLETE IPv6 header"); 13293f65158SKuo-lang Tseng goto out; 1331da177e4SLinus Torvalds } 1345b095d98SHarvey Harrison printk(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d", 135b189db5dSHarvey Harrison &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr); 13693f65158SKuo-lang Tseng nexthdr = ih->nexthdr; 13793f65158SKuo-lang Tseng offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr); 13893f65158SKuo-lang Tseng if (offset_ph == -1) 13993f65158SKuo-lang Tseng goto out; 14093f65158SKuo-lang Tseng print_ports(skb, nexthdr, offset_ph); 1411da177e4SLinus Torvalds goto out; 1421da177e4SLinus Torvalds } 143f586287eSRandy Dunlap #endif 1441da177e4SLinus Torvalds 145d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_ARP) && 1461da177e4SLinus Torvalds ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) || 1471da177e4SLinus Torvalds (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) { 148abfdf1c4SJan Engelhardt const struct arphdr *ah; 149abfdf1c4SJan Engelhardt struct arphdr _arph; 1501da177e4SLinus Torvalds 1511da177e4SLinus Torvalds ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); 1521da177e4SLinus Torvalds if (ah == NULL) { 1531da177e4SLinus Torvalds printk(" INCOMPLETE ARP header"); 1541da177e4SLinus Torvalds goto out; 1551da177e4SLinus Torvalds } 1561da177e4SLinus Torvalds printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d", 1571da177e4SLinus Torvalds ntohs(ah->ar_hrd), ntohs(ah->ar_pro), 1581da177e4SLinus Torvalds ntohs(ah->ar_op)); 1591da177e4SLinus Torvalds 1601da177e4SLinus Torvalds /* If it's for Ethernet and the lengths are OK, 1611da177e4SLinus Torvalds * then log the ARP payload */ 1621da177e4SLinus Torvalds if (ah->ar_hrd == htons(1) && 1631da177e4SLinus Torvalds ah->ar_hln == ETH_ALEN && 16447c183faSAl Viro ah->ar_pln == sizeof(__be32)) { 165abfdf1c4SJan Engelhardt const struct arppayload *ap; 166abfdf1c4SJan Engelhardt struct arppayload _arpp; 1671da177e4SLinus Torvalds 16885c1937bSDavid S. Miller ap = skb_header_pointer(skb, sizeof(_arph), 1691da177e4SLinus Torvalds sizeof(_arpp), &_arpp); 1701da177e4SLinus Torvalds if (ap == NULL) { 1711da177e4SLinus Torvalds printk(" INCOMPLETE ARP payload"); 1721da177e4SLinus Torvalds goto out; 1731da177e4SLinus Torvalds } 1741da177e4SLinus Torvalds printk(" ARP MAC SRC="); 1751da177e4SLinus Torvalds print_MAC(ap->mac_src); 17621454aaaSHarvey Harrison printk(" ARP IP SRC=%pI4", ap->ip_src); 1771da177e4SLinus Torvalds printk(" ARP MAC DST="); 1781da177e4SLinus Torvalds print_MAC(ap->mac_dst); 17921454aaaSHarvey Harrison printk(" ARP IP DST=%pI4", ap->ip_dst); 1801da177e4SLinus Torvalds } 1811da177e4SLinus Torvalds } 1821da177e4SLinus Torvalds out: 1831da177e4SLinus Torvalds printk("\n"); 1841da177e4SLinus Torvalds spin_unlock_bh(&ebt_log_lock); 185d5228a4fSBart De Schuymer 186d5228a4fSBart De Schuymer } 187d5228a4fSBart De Schuymer 1882d06d4a5SJan Engelhardt static unsigned int 1897eb35586SJan Engelhardt ebt_log_tg(struct sk_buff *skb, const struct xt_target_param *par) 190d5228a4fSBart De Schuymer { 1917eb35586SJan Engelhardt const struct ebt_log_info *info = par->targinfo; 192d5228a4fSBart De Schuymer struct nf_loginfo li; 193d5228a4fSBart De Schuymer 194d5228a4fSBart De Schuymer li.type = NF_LOG_TYPE_LOG; 195d5228a4fSBart De Schuymer li.u.log.level = info->loglevel; 196d5228a4fSBart De Schuymer li.u.log.logflags = info->bitmask; 197d5228a4fSBart De Schuymer 198bafac2a5SPatrick McHardy if (info->bitmask & EBT_LOG_NFLOG) 1997eb35586SJan Engelhardt nf_log_packet(NFPROTO_BRIDGE, par->hooknum, skb, par->in, 2007eb35586SJan Engelhardt par->out, &li, "%s", info->prefix); 201bafac2a5SPatrick McHardy else 2027eb35586SJan Engelhardt ebt_log_packet(NFPROTO_BRIDGE, par->hooknum, skb, par->in, 2037eb35586SJan Engelhardt par->out, &li, info->prefix); 2040ac6ab1fSJan Engelhardt return EBT_CONTINUE; 2051da177e4SLinus Torvalds } 2061da177e4SLinus Torvalds 207043ef46cSJan Engelhardt static struct xt_target ebt_log_tg_reg __read_mostly = { 208043ef46cSJan Engelhardt .name = "log", 209001a18d3SJan Engelhardt .revision = 0, 210001a18d3SJan Engelhardt .family = NFPROTO_BRIDGE, 2112d06d4a5SJan Engelhardt .target = ebt_log_tg, 2122d06d4a5SJan Engelhardt .checkentry = ebt_log_tg_check, 21318219d3fSJan Engelhardt .targetsize = XT_ALIGN(sizeof(struct ebt_log_info)), 2141da177e4SLinus Torvalds .me = THIS_MODULE, 2151da177e4SLinus Torvalds }; 2161da177e4SLinus Torvalds 217704b3ea3SEric Leblond static struct nf_logger ebt_log_logger __read_mostly = { 218d5228a4fSBart De Schuymer .name = "ebt_log", 219d5228a4fSBart De Schuymer .logfn = &ebt_log_packet, 220d5228a4fSBart De Schuymer .me = THIS_MODULE, 221d5228a4fSBart De Schuymer }; 222d5228a4fSBart De Schuymer 22365b4b4e8SAndrew Morton static int __init ebt_log_init(void) 2241da177e4SLinus Torvalds { 225d5228a4fSBart De Schuymer int ret; 226d5228a4fSBart De Schuymer 227043ef46cSJan Engelhardt ret = xt_register_target(&ebt_log_tg_reg); 228d5228a4fSBart De Schuymer if (ret < 0) 229d5228a4fSBart De Schuymer return ret; 230ee999d8bSJan Engelhardt nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger); 2317e2acc7eSPatrick McHardy return 0; 2321da177e4SLinus Torvalds } 2331da177e4SLinus Torvalds 23465b4b4e8SAndrew Morton static void __exit ebt_log_fini(void) 2351da177e4SLinus Torvalds { 236e92ad99cSPatrick McHardy nf_log_unregister(&ebt_log_logger); 237043ef46cSJan Engelhardt xt_unregister_target(&ebt_log_tg_reg); 2381da177e4SLinus Torvalds } 2391da177e4SLinus Torvalds 24065b4b4e8SAndrew Morton module_init(ebt_log_init); 24165b4b4e8SAndrew Morton module_exit(ebt_log_fini); 242f776c4cdSJan Engelhardt MODULE_DESCRIPTION("Ebtables: Packet logging to syslog"); 2431da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 244