11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * ebt_log 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Authors: 51da177e4SLinus Torvalds * Bart De Schuymer <bdschuym@pandora.be> 6d5228a4fSBart De Schuymer * Harald Welte <laforge@netfilter.org> 71da177e4SLinus Torvalds * 81da177e4SLinus Torvalds * April, 2002 91da177e4SLinus Torvalds * 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds #include <linux/module.h> 121da177e4SLinus Torvalds #include <linux/ip.h> 132e4e6a17SHarald Welte #include <linux/in.h> 141da177e4SLinus Torvalds #include <linux/if_arp.h> 151da177e4SLinus Torvalds #include <linux/spinlock.h> 16f01ffbd6SPatrick McHardy #include <net/netfilter/nf_log.h> 1793f65158SKuo-lang Tseng #include <linux/ipv6.h> 1893f65158SKuo-lang Tseng #include <net/ipv6.h> 1993f65158SKuo-lang Tseng #include <linux/in6.h> 2018219d3fSJan Engelhardt #include <linux/netfilter/x_tables.h> 2118219d3fSJan Engelhardt #include <linux/netfilter_bridge/ebtables.h> 2218219d3fSJan Engelhardt #include <linux/netfilter_bridge/ebt_log.h> 2318219d3fSJan Engelhardt #include <linux/netfilter.h> 241da177e4SLinus Torvalds 251da177e4SLinus Torvalds static DEFINE_SPINLOCK(ebt_log_lock); 261da177e4SLinus Torvalds 27135367b8SJan Engelhardt static int ebt_log_tg_check(const struct xt_tgchk_param *par) 281da177e4SLinus Torvalds { 29af5d6dc2SJan Engelhardt struct ebt_log_info *info = par->targinfo; 301da177e4SLinus Torvalds 311da177e4SLinus Torvalds if (info->bitmask & ~EBT_LOG_MASK) 32d6b00a53SJan Engelhardt return -EINVAL; 331da177e4SLinus Torvalds if (info->loglevel >= 8) 34d6b00a53SJan Engelhardt return -EINVAL; 351da177e4SLinus Torvalds info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0'; 36d6b00a53SJan Engelhardt return 0; 371da177e4SLinus Torvalds } 381da177e4SLinus Torvalds 391da177e4SLinus Torvalds struct tcpudphdr 401da177e4SLinus Torvalds { 4147c183faSAl Viro __be16 src; 4247c183faSAl Viro __be16 dst; 431da177e4SLinus Torvalds }; 441da177e4SLinus Torvalds 451da177e4SLinus Torvalds struct arppayload 461da177e4SLinus Torvalds { 471da177e4SLinus Torvalds unsigned char mac_src[ETH_ALEN]; 481da177e4SLinus Torvalds unsigned char ip_src[4]; 491da177e4SLinus Torvalds unsigned char mac_dst[ETH_ALEN]; 501da177e4SLinus Torvalds unsigned char ip_dst[4]; 511da177e4SLinus Torvalds }; 521da177e4SLinus Torvalds 5393f65158SKuo-lang Tseng static void 5493f65158SKuo-lang Tseng print_ports(const struct sk_buff *skb, uint8_t protocol, int offset) 5593f65158SKuo-lang Tseng { 5693f65158SKuo-lang Tseng if (protocol == IPPROTO_TCP || 5793f65158SKuo-lang Tseng protocol == IPPROTO_UDP || 5893f65158SKuo-lang Tseng protocol == IPPROTO_UDPLITE || 5993f65158SKuo-lang Tseng protocol == IPPROTO_SCTP || 6093f65158SKuo-lang Tseng protocol == IPPROTO_DCCP) { 6193f65158SKuo-lang Tseng const struct tcpudphdr *pptr; 6293f65158SKuo-lang Tseng struct tcpudphdr _ports; 6393f65158SKuo-lang Tseng 6493f65158SKuo-lang Tseng pptr = skb_header_pointer(skb, offset, 6593f65158SKuo-lang Tseng sizeof(_ports), &_ports); 6693f65158SKuo-lang Tseng if (pptr == NULL) { 6793f65158SKuo-lang Tseng printk(" INCOMPLETE TCP/UDP header"); 6893f65158SKuo-lang Tseng return; 6993f65158SKuo-lang Tseng } 7093f65158SKuo-lang Tseng printk(" SPT=%u DPT=%u", ntohs(pptr->src), ntohs(pptr->dst)); 7193f65158SKuo-lang Tseng } 7293f65158SKuo-lang Tseng } 7393f65158SKuo-lang Tseng 74d5228a4fSBart De Schuymer static void 758cdb46daSHans Schillstrom ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum, 76d5228a4fSBart De Schuymer const struct sk_buff *skb, const struct net_device *in, 77d5228a4fSBart De Schuymer const struct net_device *out, const struct nf_loginfo *loginfo, 78d5228a4fSBart De Schuymer const char *prefix) 791da177e4SLinus Torvalds { 80d5228a4fSBart De Schuymer unsigned int bitmask; 817d278924SGao feng 827d278924SGao feng /* FIXME: Disabled from containers until syslog ns is supported */ 837d278924SGao feng if (!net_eq(net, &init_net)) 847d278924SGao feng return; 851da177e4SLinus Torvalds 861da177e4SLinus Torvalds spin_lock_bh(&ebt_log_lock); 8716af511aSJoe Perches printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", 88be39ee11STobias Klauser '0' + loginfo->u.log.level, prefix, 89be39ee11STobias Klauser in ? in->name : "", out ? out->name : "", 90be39ee11STobias Klauser eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, 91be39ee11STobias Klauser ntohs(eth_hdr(skb)->h_proto)); 921da177e4SLinus Torvalds 93d5228a4fSBart De Schuymer if (loginfo->type == NF_LOG_TYPE_LOG) 94d5228a4fSBart De Schuymer bitmask = loginfo->u.log.logflags; 95d5228a4fSBart De Schuymer else 96d5228a4fSBart De Schuymer bitmask = NF_LOG_MASK; 97d5228a4fSBart De Schuymer 98d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto == 991da177e4SLinus Torvalds htons(ETH_P_IP)){ 100abfdf1c4SJan Engelhardt const struct iphdr *ih; 101abfdf1c4SJan Engelhardt struct iphdr _iph; 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 1041da177e4SLinus Torvalds if (ih == NULL) { 1051da177e4SLinus Torvalds printk(" INCOMPLETE IP header"); 1061da177e4SLinus Torvalds goto out; 1071da177e4SLinus Torvalds } 10821454aaaSHarvey Harrison printk(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d", 10921454aaaSHarvey Harrison &ih->saddr, &ih->daddr, ih->tos, ih->protocol); 11093f65158SKuo-lang Tseng print_ports(skb, ih->protocol, ih->ihl*4); 1111da177e4SLinus Torvalds goto out; 1121da177e4SLinus Torvalds } 11393f65158SKuo-lang Tseng 114e6373c4cSIgor Maravić #if IS_ENABLED(CONFIG_BRIDGE_EBT_IP6) 11593f65158SKuo-lang Tseng if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto == 11693f65158SKuo-lang Tseng htons(ETH_P_IPV6)) { 11793f65158SKuo-lang Tseng const struct ipv6hdr *ih; 11893f65158SKuo-lang Tseng struct ipv6hdr _iph; 11993f65158SKuo-lang Tseng uint8_t nexthdr; 12075f2811cSJesse Gross __be16 frag_off; 12193f65158SKuo-lang Tseng int offset_ph; 12293f65158SKuo-lang Tseng 12393f65158SKuo-lang Tseng ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 12493f65158SKuo-lang Tseng if (ih == NULL) { 12593f65158SKuo-lang Tseng printk(" INCOMPLETE IPv6 header"); 12693f65158SKuo-lang Tseng goto out; 1271da177e4SLinus Torvalds } 1285b095d98SHarvey Harrison printk(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d", 129b189db5dSHarvey Harrison &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr); 13093f65158SKuo-lang Tseng nexthdr = ih->nexthdr; 13175f2811cSJesse Gross offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr, &frag_off); 13293f65158SKuo-lang Tseng if (offset_ph == -1) 13393f65158SKuo-lang Tseng goto out; 13493f65158SKuo-lang Tseng print_ports(skb, nexthdr, offset_ph); 1351da177e4SLinus Torvalds goto out; 1361da177e4SLinus Torvalds } 137f586287eSRandy Dunlap #endif 1381da177e4SLinus Torvalds 139d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_ARP) && 1401da177e4SLinus Torvalds ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) || 1411da177e4SLinus Torvalds (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) { 142abfdf1c4SJan Engelhardt const struct arphdr *ah; 143abfdf1c4SJan Engelhardt struct arphdr _arph; 1441da177e4SLinus Torvalds 1451da177e4SLinus Torvalds ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); 1461da177e4SLinus Torvalds if (ah == NULL) { 1471da177e4SLinus Torvalds printk(" INCOMPLETE ARP header"); 1481da177e4SLinus Torvalds goto out; 1491da177e4SLinus Torvalds } 1501da177e4SLinus Torvalds printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d", 1511da177e4SLinus Torvalds ntohs(ah->ar_hrd), ntohs(ah->ar_pro), 1521da177e4SLinus Torvalds ntohs(ah->ar_op)); 1531da177e4SLinus Torvalds 1541da177e4SLinus Torvalds /* If it's for Ethernet and the lengths are OK, 1551da177e4SLinus Torvalds * then log the ARP payload */ 1561da177e4SLinus Torvalds if (ah->ar_hrd == htons(1) && 1571da177e4SLinus Torvalds ah->ar_hln == ETH_ALEN && 15847c183faSAl Viro ah->ar_pln == sizeof(__be32)) { 159abfdf1c4SJan Engelhardt const struct arppayload *ap; 160abfdf1c4SJan Engelhardt struct arppayload _arpp; 1611da177e4SLinus Torvalds 16285c1937bSDavid S. Miller ap = skb_header_pointer(skb, sizeof(_arph), 1631da177e4SLinus Torvalds sizeof(_arpp), &_arpp); 1641da177e4SLinus Torvalds if (ap == NULL) { 1651da177e4SLinus Torvalds printk(" INCOMPLETE ARP payload"); 1661da177e4SLinus Torvalds goto out; 1671da177e4SLinus Torvalds } 168be39ee11STobias Klauser printk(" ARP MAC SRC=%pM ARP IP SRC=%pI4 ARP MAC DST=%pM ARP IP DST=%pI4", 169be39ee11STobias Klauser ap->mac_src, ap->ip_src, ap->mac_dst, ap->ip_dst); 1701da177e4SLinus Torvalds } 1711da177e4SLinus Torvalds } 1721da177e4SLinus Torvalds out: 1731da177e4SLinus Torvalds printk("\n"); 1741da177e4SLinus Torvalds spin_unlock_bh(&ebt_log_lock); 175d5228a4fSBart De Schuymer 176d5228a4fSBart De Schuymer } 177d5228a4fSBart De Schuymer 1782d06d4a5SJan Engelhardt static unsigned int 1794b560b44SJan Engelhardt ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par) 180d5228a4fSBart De Schuymer { 1817eb35586SJan Engelhardt const struct ebt_log_info *info = par->targinfo; 182d5228a4fSBart De Schuymer struct nf_loginfo li; 18330e0c6a6SGao feng struct net *net = dev_net(par->in ? par->in : par->out); 184d5228a4fSBart De Schuymer 185d5228a4fSBart De Schuymer li.type = NF_LOG_TYPE_LOG; 186d5228a4fSBart De Schuymer li.u.log.level = info->loglevel; 187d5228a4fSBart De Schuymer li.u.log.logflags = info->bitmask; 188d5228a4fSBart De Schuymer 189bafac2a5SPatrick McHardy if (info->bitmask & EBT_LOG_NFLOG) 19030e0c6a6SGao feng nf_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, 19130e0c6a6SGao feng par->in, par->out, &li, "%s", info->prefix); 192bafac2a5SPatrick McHardy else 1938cdb46daSHans Schillstrom ebt_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, par->in, 1947eb35586SJan Engelhardt par->out, &li, info->prefix); 1950ac6ab1fSJan Engelhardt return EBT_CONTINUE; 1961da177e4SLinus Torvalds } 1971da177e4SLinus Torvalds 198043ef46cSJan Engelhardt static struct xt_target ebt_log_tg_reg __read_mostly = { 199043ef46cSJan Engelhardt .name = "log", 200001a18d3SJan Engelhardt .revision = 0, 201001a18d3SJan Engelhardt .family = NFPROTO_BRIDGE, 2022d06d4a5SJan Engelhardt .target = ebt_log_tg, 2032d06d4a5SJan Engelhardt .checkentry = ebt_log_tg_check, 204fc0e3df4SFlorian Westphal .targetsize = sizeof(struct ebt_log_info), 2051da177e4SLinus Torvalds .me = THIS_MODULE, 2061da177e4SLinus Torvalds }; 2071da177e4SLinus Torvalds 208704b3ea3SEric Leblond static struct nf_logger ebt_log_logger __read_mostly = { 209d5228a4fSBart De Schuymer .name = "ebt_log", 210d5228a4fSBart De Schuymer .logfn = &ebt_log_packet, 211d5228a4fSBart De Schuymer .me = THIS_MODULE, 212d5228a4fSBart De Schuymer }; 213d5228a4fSBart De Schuymer 2147d278924SGao feng static int __net_init ebt_log_net_init(struct net *net) 2157d278924SGao feng { 2167d278924SGao feng nf_log_set(net, NFPROTO_BRIDGE, &ebt_log_logger); 2177d278924SGao feng return 0; 2187d278924SGao feng } 2197d278924SGao feng 2207d278924SGao feng static void __net_exit ebt_log_net_fini(struct net *net) 2217d278924SGao feng { 2227d278924SGao feng nf_log_unset(net, &ebt_log_logger); 2237d278924SGao feng } 2247d278924SGao feng 2257d278924SGao feng static struct pernet_operations ebt_log_net_ops = { 2267d278924SGao feng .init = ebt_log_net_init, 2277d278924SGao feng .exit = ebt_log_net_fini, 2287d278924SGao feng }; 2297d278924SGao feng 23065b4b4e8SAndrew Morton static int __init ebt_log_init(void) 2311da177e4SLinus Torvalds { 232d5228a4fSBart De Schuymer int ret; 233d5228a4fSBart De Schuymer 2347d278924SGao feng ret = register_pernet_subsys(&ebt_log_net_ops); 2357d278924SGao feng if (ret < 0) 2367d278924SGao feng goto err_pernet; 2377d278924SGao feng 238043ef46cSJan Engelhardt ret = xt_register_target(&ebt_log_tg_reg); 239d5228a4fSBart De Schuymer if (ret < 0) 2407d278924SGao feng goto err_target; 2417d278924SGao feng 242ee999d8bSJan Engelhardt nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger); 2437d278924SGao feng 2447d278924SGao feng return ret; 2457d278924SGao feng 2467d278924SGao feng err_target: 2477d278924SGao feng unregister_pernet_subsys(&ebt_log_net_ops); 2487d278924SGao feng err_pernet: 2497d278924SGao feng return ret; 2501da177e4SLinus Torvalds } 2511da177e4SLinus Torvalds 25265b4b4e8SAndrew Morton static void __exit ebt_log_fini(void) 2531da177e4SLinus Torvalds { 2547d278924SGao feng unregister_pernet_subsys(&ebt_log_net_ops); 255e92ad99cSPatrick McHardy nf_log_unregister(&ebt_log_logger); 256043ef46cSJan Engelhardt xt_unregister_target(&ebt_log_tg_reg); 2571da177e4SLinus Torvalds } 2581da177e4SLinus Torvalds 25965b4b4e8SAndrew Morton module_init(ebt_log_init); 26065b4b4e8SAndrew Morton module_exit(ebt_log_fini); 261f776c4cdSJan Engelhardt MODULE_DESCRIPTION("Ebtables: Packet logging to syslog"); 2621da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 263