11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * ebt_log 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Authors: 51da177e4SLinus Torvalds * Bart De Schuymer <bdschuym@pandora.be> 6d5228a4fSBart De Schuymer * Harald Welte <laforge@netfilter.org> 71da177e4SLinus Torvalds * 81da177e4SLinus Torvalds * April, 2002 91da177e4SLinus Torvalds * 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds 121da177e4SLinus Torvalds #include <linux/netfilter_bridge/ebtables.h> 131da177e4SLinus Torvalds #include <linux/netfilter_bridge/ebt_log.h> 14d5228a4fSBart De Schuymer #include <linux/netfilter.h> 151da177e4SLinus Torvalds #include <linux/module.h> 161da177e4SLinus Torvalds #include <linux/ip.h> 172e4e6a17SHarald Welte #include <linux/in.h> 181da177e4SLinus Torvalds #include <linux/if_arp.h> 191da177e4SLinus Torvalds #include <linux/spinlock.h> 20f01ffbd6SPatrick McHardy #include <net/netfilter/nf_log.h> 2193f65158SKuo-lang Tseng #include <linux/ipv6.h> 2293f65158SKuo-lang Tseng #include <net/ipv6.h> 2393f65158SKuo-lang Tseng #include <linux/in6.h> 241da177e4SLinus Torvalds 251da177e4SLinus Torvalds static DEFINE_SPINLOCK(ebt_log_lock); 261da177e4SLinus Torvalds 271da177e4SLinus Torvalds static int ebt_log_check(const char *tablename, unsigned int hookmask, 281da177e4SLinus Torvalds const struct ebt_entry *e, void *data, unsigned int datalen) 291da177e4SLinus Torvalds { 30abfdf1c4SJan Engelhardt struct ebt_log_info *info = data; 311da177e4SLinus Torvalds 321da177e4SLinus Torvalds if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info))) 331da177e4SLinus Torvalds return -EINVAL; 341da177e4SLinus Torvalds if (info->bitmask & ~EBT_LOG_MASK) 351da177e4SLinus Torvalds return -EINVAL; 361da177e4SLinus Torvalds if (info->loglevel >= 8) 371da177e4SLinus Torvalds return -EINVAL; 381da177e4SLinus Torvalds info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0'; 391da177e4SLinus Torvalds return 0; 401da177e4SLinus Torvalds } 411da177e4SLinus Torvalds 421da177e4SLinus Torvalds struct tcpudphdr 431da177e4SLinus Torvalds { 4447c183faSAl Viro __be16 src; 4547c183faSAl Viro __be16 dst; 461da177e4SLinus Torvalds }; 471da177e4SLinus Torvalds 481da177e4SLinus Torvalds struct arppayload 491da177e4SLinus Torvalds { 501da177e4SLinus Torvalds unsigned char mac_src[ETH_ALEN]; 511da177e4SLinus Torvalds unsigned char ip_src[4]; 521da177e4SLinus Torvalds unsigned char mac_dst[ETH_ALEN]; 531da177e4SLinus Torvalds unsigned char ip_dst[4]; 541da177e4SLinus Torvalds }; 551da177e4SLinus Torvalds 56abfdf1c4SJan Engelhardt static void print_MAC(const unsigned char *p) 571da177e4SLinus Torvalds { 581da177e4SLinus Torvalds int i; 591da177e4SLinus Torvalds 601da177e4SLinus Torvalds for (i = 0; i < ETH_ALEN; i++, p++) 611da177e4SLinus Torvalds printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':'); 621da177e4SLinus Torvalds } 631da177e4SLinus Torvalds 6493f65158SKuo-lang Tseng static void 6593f65158SKuo-lang Tseng print_ports(const struct sk_buff *skb, uint8_t protocol, int offset) 6693f65158SKuo-lang Tseng { 6793f65158SKuo-lang Tseng if (protocol == IPPROTO_TCP || 6893f65158SKuo-lang Tseng protocol == IPPROTO_UDP || 6993f65158SKuo-lang Tseng protocol == IPPROTO_UDPLITE || 7093f65158SKuo-lang Tseng protocol == IPPROTO_SCTP || 7193f65158SKuo-lang Tseng protocol == IPPROTO_DCCP) { 7293f65158SKuo-lang Tseng const struct tcpudphdr *pptr; 7393f65158SKuo-lang Tseng struct tcpudphdr _ports; 7493f65158SKuo-lang Tseng 7593f65158SKuo-lang Tseng pptr = skb_header_pointer(skb, offset, 7693f65158SKuo-lang Tseng sizeof(_ports), &_ports); 7793f65158SKuo-lang Tseng if (pptr == NULL) { 7893f65158SKuo-lang Tseng printk(" INCOMPLETE TCP/UDP header"); 7993f65158SKuo-lang Tseng return; 8093f65158SKuo-lang Tseng } 8193f65158SKuo-lang Tseng printk(" SPT=%u DPT=%u", ntohs(pptr->src), ntohs(pptr->dst)); 8293f65158SKuo-lang Tseng } 8393f65158SKuo-lang Tseng } 8493f65158SKuo-lang Tseng 851da177e4SLinus Torvalds #define myNIPQUAD(a) a[0], a[1], a[2], a[3] 86d5228a4fSBart De Schuymer static void 8776108ceaSJan Engelhardt ebt_log_packet(u_int8_t pf, unsigned int hooknum, 88d5228a4fSBart De Schuymer const struct sk_buff *skb, const struct net_device *in, 89d5228a4fSBart De Schuymer const struct net_device *out, const struct nf_loginfo *loginfo, 90d5228a4fSBart De Schuymer const char *prefix) 911da177e4SLinus Torvalds { 92d5228a4fSBart De Schuymer unsigned int bitmask; 931da177e4SLinus Torvalds 941da177e4SLinus Torvalds spin_lock_bh(&ebt_log_lock); 95d5228a4fSBart De Schuymer printk("<%c>%s IN=%s OUT=%s MAC source = ", '0' + loginfo->u.log.level, 96d5228a4fSBart De Schuymer prefix, in ? in->name : "", out ? out->name : ""); 971da177e4SLinus Torvalds 981da177e4SLinus Torvalds print_MAC(eth_hdr(skb)->h_source); 991da177e4SLinus Torvalds printk("MAC dest = "); 1001da177e4SLinus Torvalds print_MAC(eth_hdr(skb)->h_dest); 1011da177e4SLinus Torvalds 1021da177e4SLinus Torvalds printk("proto = 0x%04x", ntohs(eth_hdr(skb)->h_proto)); 1031da177e4SLinus Torvalds 104d5228a4fSBart De Schuymer if (loginfo->type == NF_LOG_TYPE_LOG) 105d5228a4fSBart De Schuymer bitmask = loginfo->u.log.logflags; 106d5228a4fSBart De Schuymer else 107d5228a4fSBart De Schuymer bitmask = NF_LOG_MASK; 108d5228a4fSBart De Schuymer 109d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto == 1101da177e4SLinus Torvalds htons(ETH_P_IP)){ 111abfdf1c4SJan Engelhardt const struct iphdr *ih; 112abfdf1c4SJan Engelhardt struct iphdr _iph; 1131da177e4SLinus Torvalds 1141da177e4SLinus Torvalds ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 1151da177e4SLinus Torvalds if (ih == NULL) { 1161da177e4SLinus Torvalds printk(" INCOMPLETE IP header"); 1171da177e4SLinus Torvalds goto out; 1181da177e4SLinus Torvalds } 119d5228a4fSBart De Schuymer printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u, IP " 120d5228a4fSBart De Schuymer "tos=0x%02X, IP proto=%d", NIPQUAD(ih->saddr), 121d5228a4fSBart De Schuymer NIPQUAD(ih->daddr), ih->tos, ih->protocol); 12293f65158SKuo-lang Tseng print_ports(skb, ih->protocol, ih->ihl*4); 1231da177e4SLinus Torvalds goto out; 1241da177e4SLinus Torvalds } 12593f65158SKuo-lang Tseng 126f586287eSRandy Dunlap #if defined(CONFIG_BRIDGE_EBT_IP6) || defined(CONFIG_BRIDGE_EBT_IP6_MODULE) 12793f65158SKuo-lang Tseng if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto == 12893f65158SKuo-lang Tseng htons(ETH_P_IPV6)) { 12993f65158SKuo-lang Tseng const struct ipv6hdr *ih; 13093f65158SKuo-lang Tseng struct ipv6hdr _iph; 13193f65158SKuo-lang Tseng uint8_t nexthdr; 13293f65158SKuo-lang Tseng int offset_ph; 13393f65158SKuo-lang Tseng 13493f65158SKuo-lang Tseng ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 13593f65158SKuo-lang Tseng if (ih == NULL) { 13693f65158SKuo-lang Tseng printk(" INCOMPLETE IPv6 header"); 13793f65158SKuo-lang Tseng goto out; 1381da177e4SLinus Torvalds } 13993f65158SKuo-lang Tseng printk(" IPv6 SRC=%x:%x:%x:%x:%x:%x:%x:%x " 14093f65158SKuo-lang Tseng "IPv6 DST=%x:%x:%x:%x:%x:%x:%x:%x, IPv6 " 14193f65158SKuo-lang Tseng "priority=0x%01X, Next Header=%d", NIP6(ih->saddr), 14293f65158SKuo-lang Tseng NIP6(ih->daddr), ih->priority, ih->nexthdr); 14393f65158SKuo-lang Tseng nexthdr = ih->nexthdr; 14493f65158SKuo-lang Tseng offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr); 14593f65158SKuo-lang Tseng if (offset_ph == -1) 14693f65158SKuo-lang Tseng goto out; 14793f65158SKuo-lang Tseng print_ports(skb, nexthdr, offset_ph); 1481da177e4SLinus Torvalds goto out; 1491da177e4SLinus Torvalds } 150f586287eSRandy Dunlap #endif 1511da177e4SLinus Torvalds 152d5228a4fSBart De Schuymer if ((bitmask & EBT_LOG_ARP) && 1531da177e4SLinus Torvalds ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) || 1541da177e4SLinus Torvalds (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) { 155abfdf1c4SJan Engelhardt const struct arphdr *ah; 156abfdf1c4SJan Engelhardt struct arphdr _arph; 1571da177e4SLinus Torvalds 1581da177e4SLinus Torvalds ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); 1591da177e4SLinus Torvalds if (ah == NULL) { 1601da177e4SLinus Torvalds printk(" INCOMPLETE ARP header"); 1611da177e4SLinus Torvalds goto out; 1621da177e4SLinus Torvalds } 1631da177e4SLinus Torvalds printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d", 1641da177e4SLinus Torvalds ntohs(ah->ar_hrd), ntohs(ah->ar_pro), 1651da177e4SLinus Torvalds ntohs(ah->ar_op)); 1661da177e4SLinus Torvalds 1671da177e4SLinus Torvalds /* If it's for Ethernet and the lengths are OK, 1681da177e4SLinus Torvalds * then log the ARP payload */ 1691da177e4SLinus Torvalds if (ah->ar_hrd == htons(1) && 1701da177e4SLinus Torvalds ah->ar_hln == ETH_ALEN && 17147c183faSAl Viro ah->ar_pln == sizeof(__be32)) { 172abfdf1c4SJan Engelhardt const struct arppayload *ap; 173abfdf1c4SJan Engelhardt struct arppayload _arpp; 1741da177e4SLinus Torvalds 17585c1937bSDavid S. Miller ap = skb_header_pointer(skb, sizeof(_arph), 1761da177e4SLinus Torvalds sizeof(_arpp), &_arpp); 1771da177e4SLinus Torvalds if (ap == NULL) { 1781da177e4SLinus Torvalds printk(" INCOMPLETE ARP payload"); 1791da177e4SLinus Torvalds goto out; 1801da177e4SLinus Torvalds } 1811da177e4SLinus Torvalds printk(" ARP MAC SRC="); 1821da177e4SLinus Torvalds print_MAC(ap->mac_src); 1831da177e4SLinus Torvalds printk(" ARP IP SRC=%u.%u.%u.%u", 1841da177e4SLinus Torvalds myNIPQUAD(ap->ip_src)); 1851da177e4SLinus Torvalds printk(" ARP MAC DST="); 1861da177e4SLinus Torvalds print_MAC(ap->mac_dst); 1871da177e4SLinus Torvalds printk(" ARP IP DST=%u.%u.%u.%u", 1881da177e4SLinus Torvalds myNIPQUAD(ap->ip_dst)); 1891da177e4SLinus Torvalds } 1901da177e4SLinus Torvalds } 1911da177e4SLinus Torvalds out: 1921da177e4SLinus Torvalds printk("\n"); 1931da177e4SLinus Torvalds spin_unlock_bh(&ebt_log_lock); 194d5228a4fSBart De Schuymer 195d5228a4fSBart De Schuymer } 196d5228a4fSBart De Schuymer 197d5228a4fSBart De Schuymer static void ebt_log(const struct sk_buff *skb, unsigned int hooknr, 198d5228a4fSBart De Schuymer const struct net_device *in, const struct net_device *out, 199d5228a4fSBart De Schuymer const void *data, unsigned int datalen) 200d5228a4fSBart De Schuymer { 201abfdf1c4SJan Engelhardt const struct ebt_log_info *info = data; 202d5228a4fSBart De Schuymer struct nf_loginfo li; 203d5228a4fSBart De Schuymer 204d5228a4fSBart De Schuymer li.type = NF_LOG_TYPE_LOG; 205d5228a4fSBart De Schuymer li.u.log.level = info->loglevel; 206d5228a4fSBart De Schuymer li.u.log.logflags = info->bitmask; 207d5228a4fSBart De Schuymer 208bafac2a5SPatrick McHardy if (info->bitmask & EBT_LOG_NFLOG) 209ee999d8bSJan Engelhardt nf_log_packet(NFPROTO_BRIDGE, hooknr, skb, in, out, &li, 2105c170a09SPhilip Craig "%s", info->prefix); 211bafac2a5SPatrick McHardy else 212ee999d8bSJan Engelhardt ebt_log_packet(NFPROTO_BRIDGE, hooknr, skb, in, out, &li, 213bafac2a5SPatrick McHardy info->prefix); 2141da177e4SLinus Torvalds } 2151da177e4SLinus Torvalds 2161da177e4SLinus Torvalds static struct ebt_watcher log = 2171da177e4SLinus Torvalds { 2181da177e4SLinus Torvalds .name = EBT_LOG_WATCHER, 2191da177e4SLinus Torvalds .watcher = ebt_log, 2201da177e4SLinus Torvalds .check = ebt_log_check, 2211da177e4SLinus Torvalds .me = THIS_MODULE, 2221da177e4SLinus Torvalds }; 2231da177e4SLinus Torvalds 2247b2f9631SPatrick McHardy static const struct nf_logger ebt_log_logger = { 225d5228a4fSBart De Schuymer .name = "ebt_log", 226d5228a4fSBart De Schuymer .logfn = &ebt_log_packet, 227d5228a4fSBart De Schuymer .me = THIS_MODULE, 228d5228a4fSBart De Schuymer }; 229d5228a4fSBart De Schuymer 23065b4b4e8SAndrew Morton static int __init ebt_log_init(void) 2311da177e4SLinus Torvalds { 232d5228a4fSBart De Schuymer int ret; 233d5228a4fSBart De Schuymer 234d5228a4fSBart De Schuymer ret = ebt_register_watcher(&log); 235d5228a4fSBart De Schuymer if (ret < 0) 236d5228a4fSBart De Schuymer return ret; 237ee999d8bSJan Engelhardt nf_log_register(NFPROTO_BRIDGE, &ebt_log_logger); 2387e2acc7eSPatrick McHardy return 0; 2391da177e4SLinus Torvalds } 2401da177e4SLinus Torvalds 24165b4b4e8SAndrew Morton static void __exit ebt_log_fini(void) 2421da177e4SLinus Torvalds { 243e92ad99cSPatrick McHardy nf_log_unregister(&ebt_log_logger); 2441da177e4SLinus Torvalds ebt_unregister_watcher(&log); 2451da177e4SLinus Torvalds } 2461da177e4SLinus Torvalds 24765b4b4e8SAndrew Morton module_init(ebt_log_init); 24865b4b4e8SAndrew Morton module_exit(ebt_log_fini); 249f776c4cdSJan Engelhardt MODULE_DESCRIPTION("Ebtables: Packet logging to syslog"); 2501da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 251