1 /* 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 3 * Copyright (c) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Development of this code funded by Astaro AG (http://www.astaro.com/) 10 */ 11 12 #include <linux/kernel.h> 13 #include <linux/init.h> 14 #include <linux/module.h> 15 #include <linux/netlink.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nf_tables.h> 18 #include <net/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_log.h> 20 #include <linux/netdevice.h> 21 22 static const char *nft_log_null_prefix = ""; 23 24 struct nft_log { 25 struct nf_loginfo loginfo; 26 char *prefix; 27 }; 28 29 static void nft_log_eval(const struct nft_expr *expr, 30 struct nft_regs *regs, 31 const struct nft_pktinfo *pkt) 32 { 33 const struct nft_log *priv = nft_expr_priv(expr); 34 35 nf_log_packet(pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in, 36 pkt->out, &priv->loginfo, "%s", priv->prefix); 37 } 38 39 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = { 40 [NFTA_LOG_GROUP] = { .type = NLA_U16 }, 41 [NFTA_LOG_PREFIX] = { .type = NLA_STRING }, 42 [NFTA_LOG_SNAPLEN] = { .type = NLA_U32 }, 43 [NFTA_LOG_QTHRESHOLD] = { .type = NLA_U16 }, 44 [NFTA_LOG_LEVEL] = { .type = NLA_U32 }, 45 [NFTA_LOG_FLAGS] = { .type = NLA_U32 }, 46 }; 47 48 static int nft_log_init(const struct nft_ctx *ctx, 49 const struct nft_expr *expr, 50 const struct nlattr * const tb[]) 51 { 52 struct nft_log *priv = nft_expr_priv(expr); 53 struct nf_loginfo *li = &priv->loginfo; 54 const struct nlattr *nla; 55 int err; 56 57 li->type = NF_LOG_TYPE_LOG; 58 if (tb[NFTA_LOG_LEVEL] != NULL && 59 tb[NFTA_LOG_GROUP] != NULL) 60 return -EINVAL; 61 if (tb[NFTA_LOG_GROUP] != NULL) 62 li->type = NF_LOG_TYPE_ULOG; 63 64 nla = tb[NFTA_LOG_PREFIX]; 65 if (nla != NULL) { 66 priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL); 67 if (priv->prefix == NULL) 68 return -ENOMEM; 69 nla_strlcpy(priv->prefix, nla, nla_len(nla) + 1); 70 } else { 71 priv->prefix = (char *)nft_log_null_prefix; 72 } 73 74 switch (li->type) { 75 case NF_LOG_TYPE_LOG: 76 if (tb[NFTA_LOG_LEVEL] != NULL) { 77 li->u.log.level = 78 ntohl(nla_get_be32(tb[NFTA_LOG_LEVEL])); 79 } else { 80 li->u.log.level = LOGLEVEL_WARNING; 81 } 82 if (li->u.log.level > LOGLEVEL_DEBUG) { 83 err = -EINVAL; 84 goto err1; 85 } 86 87 if (tb[NFTA_LOG_FLAGS] != NULL) { 88 li->u.log.logflags = 89 ntohl(nla_get_be32(tb[NFTA_LOG_FLAGS])); 90 } 91 break; 92 case NF_LOG_TYPE_ULOG: 93 li->u.ulog.group = ntohs(nla_get_be16(tb[NFTA_LOG_GROUP])); 94 if (tb[NFTA_LOG_SNAPLEN] != NULL) { 95 li->u.ulog.flags |= NF_LOG_F_COPY_LEN; 96 li->u.ulog.copy_len = 97 ntohl(nla_get_be32(tb[NFTA_LOG_SNAPLEN])); 98 } 99 if (tb[NFTA_LOG_QTHRESHOLD] != NULL) { 100 li->u.ulog.qthreshold = 101 ntohs(nla_get_be16(tb[NFTA_LOG_QTHRESHOLD])); 102 } 103 break; 104 } 105 106 err = nf_logger_find_get(ctx->afi->family, li->type); 107 if (err < 0) 108 goto err1; 109 110 return 0; 111 112 err1: 113 if (priv->prefix != nft_log_null_prefix) 114 kfree(priv->prefix); 115 return err; 116 } 117 118 static void nft_log_destroy(const struct nft_ctx *ctx, 119 const struct nft_expr *expr) 120 { 121 struct nft_log *priv = nft_expr_priv(expr); 122 struct nf_loginfo *li = &priv->loginfo; 123 124 if (priv->prefix != nft_log_null_prefix) 125 kfree(priv->prefix); 126 127 nf_logger_put(ctx->afi->family, li->type); 128 } 129 130 static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr) 131 { 132 const struct nft_log *priv = nft_expr_priv(expr); 133 const struct nf_loginfo *li = &priv->loginfo; 134 135 if (priv->prefix != nft_log_null_prefix) 136 if (nla_put_string(skb, NFTA_LOG_PREFIX, priv->prefix)) 137 goto nla_put_failure; 138 switch (li->type) { 139 case NF_LOG_TYPE_LOG: 140 if (nla_put_be32(skb, NFTA_LOG_LEVEL, htonl(li->u.log.level))) 141 goto nla_put_failure; 142 143 if (li->u.log.logflags) { 144 if (nla_put_be32(skb, NFTA_LOG_FLAGS, 145 htonl(li->u.log.logflags))) 146 goto nla_put_failure; 147 } 148 break; 149 case NF_LOG_TYPE_ULOG: 150 if (nla_put_be16(skb, NFTA_LOG_GROUP, htons(li->u.ulog.group))) 151 goto nla_put_failure; 152 153 if (li->u.ulog.flags & NF_LOG_F_COPY_LEN) { 154 if (nla_put_be32(skb, NFTA_LOG_SNAPLEN, 155 htonl(li->u.ulog.copy_len))) 156 goto nla_put_failure; 157 } 158 if (li->u.ulog.qthreshold) { 159 if (nla_put_be16(skb, NFTA_LOG_QTHRESHOLD, 160 htons(li->u.ulog.qthreshold))) 161 goto nla_put_failure; 162 } 163 break; 164 } 165 return 0; 166 167 nla_put_failure: 168 return -1; 169 } 170 171 static struct nft_expr_type nft_log_type; 172 static const struct nft_expr_ops nft_log_ops = { 173 .type = &nft_log_type, 174 .size = NFT_EXPR_SIZE(sizeof(struct nft_log)), 175 .eval = nft_log_eval, 176 .init = nft_log_init, 177 .destroy = nft_log_destroy, 178 .dump = nft_log_dump, 179 }; 180 181 static struct nft_expr_type nft_log_type __read_mostly = { 182 .name = "log", 183 .ops = &nft_log_ops, 184 .policy = nft_log_policy, 185 .maxattr = NFTA_LOG_MAX, 186 .owner = THIS_MODULE, 187 }; 188 189 static int __init nft_log_module_init(void) 190 { 191 return nft_register_expr(&nft_log_type); 192 } 193 194 static void __exit nft_log_module_exit(void) 195 { 196 nft_unregister_expr(&nft_log_type); 197 } 198 199 module_init(nft_log_module_init); 200 module_exit(nft_log_module_exit); 201 202 MODULE_LICENSE("GPL"); 203 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 204 MODULE_ALIAS_NFT_EXPR("log"); 205