1 /* 2 * ebt_log 3 * 4 * Authors: 5 * Bart De Schuymer <bdschuym@pandora.be> 6 * Harald Welte <laforge@netfilter.org> 7 * 8 * April, 2002 9 * 10 */ 11 #include <linux/module.h> 12 #include <linux/ip.h> 13 #include <linux/in.h> 14 #include <linux/if_arp.h> 15 #include <linux/spinlock.h> 16 #include <net/netfilter/nf_log.h> 17 #include <linux/ipv6.h> 18 #include <net/ipv6.h> 19 #include <linux/in6.h> 20 #include <linux/netfilter/x_tables.h> 21 #include <linux/netfilter_bridge/ebtables.h> 22 #include <linux/netfilter_bridge/ebt_log.h> 23 #include <linux/netfilter.h> 24 25 static DEFINE_SPINLOCK(ebt_log_lock); 26 27 static int ebt_log_tg_check(const struct xt_tgchk_param *par) 28 { 29 struct ebt_log_info *info = par->targinfo; 30 31 if (info->bitmask & ~EBT_LOG_MASK) 32 return -EINVAL; 33 if (info->loglevel >= 8) 34 return -EINVAL; 35 info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0'; 36 return 0; 37 } 38 39 struct tcpudphdr 40 { 41 __be16 src; 42 __be16 dst; 43 }; 44 45 struct arppayload 46 { 47 unsigned char mac_src[ETH_ALEN]; 48 unsigned char ip_src[4]; 49 unsigned char mac_dst[ETH_ALEN]; 50 unsigned char ip_dst[4]; 51 }; 52 53 static void 54 print_ports(const struct sk_buff *skb, uint8_t protocol, int offset) 55 { 56 if (protocol == IPPROTO_TCP || 57 protocol == IPPROTO_UDP || 58 protocol == IPPROTO_UDPLITE || 59 protocol == IPPROTO_SCTP || 60 protocol == IPPROTO_DCCP) { 61 const struct tcpudphdr *pptr; 62 struct tcpudphdr _ports; 63 64 pptr = skb_header_pointer(skb, offset, 65 sizeof(_ports), &_ports); 66 if (pptr == NULL) { 67 printk(" INCOMPLETE TCP/UDP header"); 68 return; 69 } 70 printk(" SPT=%u DPT=%u", ntohs(pptr->src), ntohs(pptr->dst)); 71 } 72 } 73 74 static void 75 ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum, 76 const struct sk_buff *skb, const struct net_device *in, 77 const struct net_device *out, const struct nf_loginfo *loginfo, 78 const char *prefix) 79 { 80 unsigned int bitmask; 81 82 /* FIXME: Disabled from containers until syslog ns is supported */ 83 if (!net_eq(net, &init_net)) 84 return; 85 86 spin_lock_bh(&ebt_log_lock); 87 printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", 88 '0' + loginfo->u.log.level, prefix, 89 in ? in->name : "", out ? out->name : "", 90 eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, 91 ntohs(eth_hdr(skb)->h_proto)); 92 93 if (loginfo->type == NF_LOG_TYPE_LOG) 94 bitmask = loginfo->u.log.logflags; 95 else 96 bitmask = NF_LOG_MASK; 97 98 if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto == 99 htons(ETH_P_IP)) { 100 const struct iphdr *ih; 101 struct iphdr _iph; 102 103 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 104 if (ih == NULL) { 105 printk(" INCOMPLETE IP header"); 106 goto out; 107 } 108 printk(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d", 109 &ih->saddr, &ih->daddr, ih->tos, ih->protocol); 110 print_ports(skb, ih->protocol, ih->ihl*4); 111 goto out; 112 } 113 114 #if IS_ENABLED(CONFIG_BRIDGE_EBT_IP6) 115 if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto == 116 htons(ETH_P_IPV6)) { 117 const struct ipv6hdr *ih; 118 struct ipv6hdr _iph; 119 uint8_t nexthdr; 120 __be16 frag_off; 121 int offset_ph; 122 123 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 124 if (ih == NULL) { 125 printk(" INCOMPLETE IPv6 header"); 126 goto out; 127 } 128 printk(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d", 129 &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr); 130 nexthdr = ih->nexthdr; 131 offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr, &frag_off); 132 if (offset_ph == -1) 133 goto out; 134 print_ports(skb, nexthdr, offset_ph); 135 goto out; 136 } 137 #endif 138 139 if ((bitmask & EBT_LOG_ARP) && 140 ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) || 141 (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) { 142 const struct arphdr *ah; 143 struct arphdr _arph; 144 145 ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); 146 if (ah == NULL) { 147 printk(" INCOMPLETE ARP header"); 148 goto out; 149 } 150 printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d", 151 ntohs(ah->ar_hrd), ntohs(ah->ar_pro), 152 ntohs(ah->ar_op)); 153 154 /* If it's for Ethernet and the lengths are OK, 155 * then log the ARP payload */ 156 if (ah->ar_hrd == htons(1) && 157 ah->ar_hln == ETH_ALEN && 158 ah->ar_pln == sizeof(__be32)) { 159 const struct arppayload *ap; 160 struct arppayload _arpp; 161 162 ap = skb_header_pointer(skb, sizeof(_arph), 163 sizeof(_arpp), &_arpp); 164 if (ap == NULL) { 165 printk(" INCOMPLETE ARP payload"); 166 goto out; 167 } 168 printk(" ARP MAC SRC=%pM ARP IP SRC=%pI4 ARP MAC DST=%pM ARP IP DST=%pI4", 169 ap->mac_src, ap->ip_src, ap->mac_dst, ap->ip_dst); 170 } 171 } 172 out: 173 printk("\n"); 174 spin_unlock_bh(&ebt_log_lock); 175 176 } 177 178 static unsigned int 179 ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par) 180 { 181 const struct ebt_log_info *info = par->targinfo; 182 struct nf_loginfo li; 183 struct net *net = par->net; 184 185 li.type = NF_LOG_TYPE_LOG; 186 li.u.log.level = info->loglevel; 187 li.u.log.logflags = info->bitmask; 188 189 /* Remember that we have to use ebt_log_packet() not to break backward 190 * compatibility. We cannot use the default bridge packet logger via 191 * nf_log_packet() with NFT_LOG_TYPE_LOG here. --Pablo 192 */ 193 if (info->bitmask & EBT_LOG_NFLOG) 194 nf_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, 195 par->in, par->out, &li, "%s", info->prefix); 196 else 197 ebt_log_packet(net, NFPROTO_BRIDGE, par->hooknum, skb, par->in, 198 par->out, &li, info->prefix); 199 return EBT_CONTINUE; 200 } 201 202 static struct xt_target ebt_log_tg_reg __read_mostly = { 203 .name = "log", 204 .revision = 0, 205 .family = NFPROTO_BRIDGE, 206 .target = ebt_log_tg, 207 .checkentry = ebt_log_tg_check, 208 .targetsize = sizeof(struct ebt_log_info), 209 .me = THIS_MODULE, 210 }; 211 212 static int __init ebt_log_init(void) 213 { 214 return xt_register_target(&ebt_log_tg_reg); 215 } 216 217 static void __exit ebt_log_fini(void) 218 { 219 xt_unregister_target(&ebt_log_tg_reg); 220 } 221 222 module_init(ebt_log_init); 223 module_exit(ebt_log_fini); 224 MODULE_DESCRIPTION("Ebtables: Packet logging to syslog"); 225 MODULE_LICENSE("GPL"); 226