1 /* 2 * ebt_log 3 * 4 * Authors: 5 * Bart De Schuymer <bdschuym@pandora.be> 6 * Harald Welte <laforge@netfilter.org> 7 * 8 * April, 2002 9 * 10 */ 11 #include <linux/module.h> 12 #include <linux/ip.h> 13 #include <linux/in.h> 14 #include <linux/if_arp.h> 15 #include <linux/spinlock.h> 16 #include <net/netfilter/nf_log.h> 17 #include <linux/ipv6.h> 18 #include <net/ipv6.h> 19 #include <linux/in6.h> 20 #include <linux/netfilter/x_tables.h> 21 #include <linux/netfilter_bridge/ebtables.h> 22 #include <linux/netfilter_bridge/ebt_log.h> 23 #include <linux/netfilter.h> 24 25 static DEFINE_SPINLOCK(ebt_log_lock); 26 27 static int ebt_log_tg_check(const struct xt_tgchk_param *par) 28 { 29 struct ebt_log_info *info = par->targinfo; 30 31 if (info->bitmask & ~EBT_LOG_MASK) 32 return -EINVAL; 33 if (info->loglevel >= 8) 34 return -EINVAL; 35 info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0'; 36 return 0; 37 } 38 39 struct tcpudphdr { 40 __be16 src; 41 __be16 dst; 42 }; 43 44 struct arppayload { 45 unsigned char mac_src[ETH_ALEN]; 46 unsigned char ip_src[4]; 47 unsigned char mac_dst[ETH_ALEN]; 48 unsigned char ip_dst[4]; 49 }; 50 51 static void 52 print_ports(const struct sk_buff *skb, uint8_t protocol, int offset) 53 { 54 if (protocol == IPPROTO_TCP || 55 protocol == IPPROTO_UDP || 56 protocol == IPPROTO_UDPLITE || 57 protocol == IPPROTO_SCTP || 58 protocol == IPPROTO_DCCP) { 59 const struct tcpudphdr *pptr; 60 struct tcpudphdr _ports; 61 62 pptr = skb_header_pointer(skb, offset, 63 sizeof(_ports), &_ports); 64 if (pptr == NULL) { 65 pr_cont(" INCOMPLETE TCP/UDP header"); 66 return; 67 } 68 pr_cont(" SPT=%u DPT=%u", ntohs(pptr->src), ntohs(pptr->dst)); 69 } 70 } 71 72 static void 73 ebt_log_packet(struct net *net, u_int8_t pf, unsigned int hooknum, 74 const struct sk_buff *skb, const struct net_device *in, 75 const struct net_device *out, const struct nf_loginfo *loginfo, 76 const char *prefix) 77 { 78 unsigned int bitmask; 79 80 /* FIXME: Disabled from containers until syslog ns is supported */ 81 if (!net_eq(net, &init_net) && !sysctl_nf_log_all_netns) 82 return; 83 84 spin_lock_bh(&ebt_log_lock); 85 printk(KERN_SOH "%c%s IN=%s OUT=%s MAC source = %pM MAC dest = %pM proto = 0x%04x", 86 '0' + loginfo->u.log.level, prefix, 87 in ? in->name : "", out ? out->name : "", 88 eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, 89 ntohs(eth_hdr(skb)->h_proto)); 90 91 if (loginfo->type == NF_LOG_TYPE_LOG) 92 bitmask = loginfo->u.log.logflags; 93 else 94 bitmask = NF_LOG_DEFAULT_MASK; 95 96 if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto == 97 htons(ETH_P_IP)) { 98 const struct iphdr *ih; 99 struct iphdr _iph; 100 101 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 102 if (ih == NULL) { 103 pr_cont(" INCOMPLETE IP header"); 104 goto out; 105 } 106 pr_cont(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d", 107 &ih->saddr, &ih->daddr, ih->tos, ih->protocol); 108 print_ports(skb, ih->protocol, ih->ihl*4); 109 goto out; 110 } 111 112 #if IS_ENABLED(CONFIG_BRIDGE_EBT_IP6) 113 if ((bitmask & EBT_LOG_IP6) && eth_hdr(skb)->h_proto == 114 htons(ETH_P_IPV6)) { 115 const struct ipv6hdr *ih; 116 struct ipv6hdr _iph; 117 uint8_t nexthdr; 118 __be16 frag_off; 119 int offset_ph; 120 121 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 122 if (ih == NULL) { 123 pr_cont(" INCOMPLETE IPv6 header"); 124 goto out; 125 } 126 pr_cont(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d", 127 &ih->saddr, &ih->daddr, ih->priority, ih->nexthdr); 128 nexthdr = ih->nexthdr; 129 offset_ph = ipv6_skip_exthdr(skb, sizeof(_iph), &nexthdr, &frag_off); 130 if (offset_ph == -1) 131 goto out; 132 print_ports(skb, nexthdr, offset_ph); 133 goto out; 134 } 135 #endif 136 137 if ((bitmask & EBT_LOG_ARP) && 138 ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) || 139 (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) { 140 const struct arphdr *ah; 141 struct arphdr _arph; 142 143 ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); 144 if (ah == NULL) { 145 pr_cont(" INCOMPLETE ARP header"); 146 goto out; 147 } 148 pr_cont(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d", 149 ntohs(ah->ar_hrd), ntohs(ah->ar_pro), 150 ntohs(ah->ar_op)); 151 152 /* If it's for Ethernet and the lengths are OK, 153 * then log the ARP payload 154 */ 155 if (ah->ar_hrd == htons(1) && 156 ah->ar_hln == ETH_ALEN && 157 ah->ar_pln == sizeof(__be32)) { 158 const struct arppayload *ap; 159 struct arppayload _arpp; 160 161 ap = skb_header_pointer(skb, sizeof(_arph), 162 sizeof(_arpp), &_arpp); 163 if (ap == NULL) { 164 pr_cont(" INCOMPLETE ARP payload"); 165 goto out; 166 } 167 pr_cont(" ARP MAC SRC=%pM ARP IP SRC=%pI4 ARP MAC DST=%pM ARP IP DST=%pI4", 168 ap->mac_src, ap->ip_src, 169 ap->mac_dst, ap->ip_dst); 170 } 171 } 172 out: 173 pr_cont("\n"); 174 spin_unlock_bh(&ebt_log_lock); 175 } 176 177 static unsigned int 178 ebt_log_tg(struct sk_buff *skb, const struct xt_action_param *par) 179 { 180 const struct ebt_log_info *info = par->targinfo; 181 struct nf_loginfo li; 182 struct net *net = xt_net(par); 183 184 li.type = NF_LOG_TYPE_LOG; 185 li.u.log.level = info->loglevel; 186 li.u.log.logflags = info->bitmask; 187 188 /* Remember that we have to use ebt_log_packet() not to break backward 189 * compatibility. We cannot use the default bridge packet logger via 190 * nf_log_packet() with NFT_LOG_TYPE_LOG here. --Pablo 191 */ 192 if (info->bitmask & EBT_LOG_NFLOG) 193 nf_log_packet(net, NFPROTO_BRIDGE, xt_hooknum(par), skb, 194 xt_in(par), xt_out(par), &li, "%s", 195 info->prefix); 196 else 197 ebt_log_packet(net, NFPROTO_BRIDGE, xt_hooknum(par), skb, 198 xt_in(par), xt_out(par), &li, info->prefix); 199 return EBT_CONTINUE; 200 } 201 202 static struct xt_target ebt_log_tg_reg __read_mostly = { 203 .name = "log", 204 .revision = 0, 205 .family = NFPROTO_BRIDGE, 206 .target = ebt_log_tg, 207 .checkentry = ebt_log_tg_check, 208 .targetsize = sizeof(struct ebt_log_info), 209 .me = THIS_MODULE, 210 }; 211 212 static int __init ebt_log_init(void) 213 { 214 return xt_register_target(&ebt_log_tg_reg); 215 } 216 217 static void __exit ebt_log_fini(void) 218 { 219 xt_unregister_target(&ebt_log_tg_reg); 220 } 221 222 module_init(ebt_log_init); 223 module_exit(ebt_log_fini); 224 MODULE_DESCRIPTION("Ebtables: Packet logging to syslog"); 225 MODULE_LICENSE("GPL"); 226