1 /* 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 3 * Copyright (c) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Development of this code funded by Astaro AG (http://www.astaro.com/) 10 */ 11 12 #include <linux/kernel.h> 13 #include <linux/init.h> 14 #include <linux/module.h> 15 #include <linux/netlink.h> 16 #include <linux/netfilter.h> 17 #include <linux/netfilter/nf_tables.h> 18 #include <net/netfilter/nf_tables.h> 19 #include <net/netfilter/nf_log.h> 20 #include <linux/netdevice.h> 21 22 static const char *nft_log_null_prefix = ""; 23 24 struct nft_log { 25 struct nf_loginfo loginfo; 26 char *prefix; 27 }; 28 29 static void nft_log_eval(const struct nft_expr *expr, 30 struct nft_regs *regs, 31 const struct nft_pktinfo *pkt) 32 { 33 const struct nft_log *priv = nft_expr_priv(expr); 34 struct net *net = dev_net(pkt->in ? pkt->in : pkt->out); 35 36 nf_log_packet(net, pkt->ops->pf, pkt->ops->hooknum, pkt->skb, pkt->in, 37 pkt->out, &priv->loginfo, "%s", priv->prefix); 38 } 39 40 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = { 41 [NFTA_LOG_GROUP] = { .type = NLA_U16 }, 42 [NFTA_LOG_PREFIX] = { .type = NLA_STRING }, 43 [NFTA_LOG_SNAPLEN] = { .type = NLA_U32 }, 44 [NFTA_LOG_QTHRESHOLD] = { .type = NLA_U16 }, 45 [NFTA_LOG_LEVEL] = { .type = NLA_U32 }, 46 [NFTA_LOG_FLAGS] = { .type = NLA_U32 }, 47 }; 48 49 static int nft_log_init(const struct nft_ctx *ctx, 50 const struct nft_expr *expr, 51 const struct nlattr * const tb[]) 52 { 53 struct nft_log *priv = nft_expr_priv(expr); 54 struct nf_loginfo *li = &priv->loginfo; 55 const struct nlattr *nla; 56 int ret; 57 58 nla = tb[NFTA_LOG_PREFIX]; 59 if (nla != NULL) { 60 priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL); 61 if (priv->prefix == NULL) 62 return -ENOMEM; 63 nla_strlcpy(priv->prefix, nla, nla_len(nla) + 1); 64 } else { 65 priv->prefix = (char *)nft_log_null_prefix; 66 } 67 68 li->type = NF_LOG_TYPE_LOG; 69 if (tb[NFTA_LOG_LEVEL] != NULL && 70 tb[NFTA_LOG_GROUP] != NULL) 71 return -EINVAL; 72 if (tb[NFTA_LOG_GROUP] != NULL) 73 li->type = NF_LOG_TYPE_ULOG; 74 75 switch (li->type) { 76 case NF_LOG_TYPE_LOG: 77 if (tb[NFTA_LOG_LEVEL] != NULL) { 78 li->u.log.level = 79 ntohl(nla_get_be32(tb[NFTA_LOG_LEVEL])); 80 } else { 81 li->u.log.level = LOGLEVEL_WARNING; 82 } 83 if (tb[NFTA_LOG_FLAGS] != NULL) { 84 li->u.log.logflags = 85 ntohl(nla_get_be32(tb[NFTA_LOG_FLAGS])); 86 } 87 break; 88 case NF_LOG_TYPE_ULOG: 89 li->u.ulog.group = ntohs(nla_get_be16(tb[NFTA_LOG_GROUP])); 90 if (tb[NFTA_LOG_SNAPLEN] != NULL) { 91 li->u.ulog.copy_len = 92 ntohl(nla_get_be32(tb[NFTA_LOG_SNAPLEN])); 93 } 94 if (tb[NFTA_LOG_QTHRESHOLD] != NULL) { 95 li->u.ulog.qthreshold = 96 ntohs(nla_get_be16(tb[NFTA_LOG_QTHRESHOLD])); 97 } 98 break; 99 } 100 101 if (ctx->afi->family == NFPROTO_INET) { 102 ret = nf_logger_find_get(NFPROTO_IPV4, li->type); 103 if (ret < 0) 104 return ret; 105 106 ret = nf_logger_find_get(NFPROTO_IPV6, li->type); 107 if (ret < 0) { 108 nf_logger_put(NFPROTO_IPV4, li->type); 109 return ret; 110 } 111 return 0; 112 } 113 114 return nf_logger_find_get(ctx->afi->family, li->type); 115 } 116 117 static void nft_log_destroy(const struct nft_ctx *ctx, 118 const struct nft_expr *expr) 119 { 120 struct nft_log *priv = nft_expr_priv(expr); 121 struct nf_loginfo *li = &priv->loginfo; 122 123 if (priv->prefix != nft_log_null_prefix) 124 kfree(priv->prefix); 125 126 if (ctx->afi->family == NFPROTO_INET) { 127 nf_logger_put(NFPROTO_IPV4, li->type); 128 nf_logger_put(NFPROTO_IPV6, li->type); 129 } else { 130 nf_logger_put(ctx->afi->family, li->type); 131 } 132 } 133 134 static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr) 135 { 136 const struct nft_log *priv = nft_expr_priv(expr); 137 const struct nf_loginfo *li = &priv->loginfo; 138 139 if (priv->prefix != nft_log_null_prefix) 140 if (nla_put_string(skb, NFTA_LOG_PREFIX, priv->prefix)) 141 goto nla_put_failure; 142 switch (li->type) { 143 case NF_LOG_TYPE_LOG: 144 if (nla_put_be32(skb, NFTA_LOG_LEVEL, htonl(li->u.log.level))) 145 goto nla_put_failure; 146 147 if (li->u.log.logflags) { 148 if (nla_put_be32(skb, NFTA_LOG_FLAGS, 149 htonl(li->u.log.logflags))) 150 goto nla_put_failure; 151 } 152 break; 153 case NF_LOG_TYPE_ULOG: 154 if (nla_put_be16(skb, NFTA_LOG_GROUP, htons(li->u.ulog.group))) 155 goto nla_put_failure; 156 157 if (li->u.ulog.copy_len) { 158 if (nla_put_be32(skb, NFTA_LOG_SNAPLEN, 159 htonl(li->u.ulog.copy_len))) 160 goto nla_put_failure; 161 } 162 if (li->u.ulog.qthreshold) { 163 if (nla_put_be16(skb, NFTA_LOG_QTHRESHOLD, 164 htons(li->u.ulog.qthreshold))) 165 goto nla_put_failure; 166 } 167 break; 168 } 169 return 0; 170 171 nla_put_failure: 172 return -1; 173 } 174 175 static struct nft_expr_type nft_log_type; 176 static const struct nft_expr_ops nft_log_ops = { 177 .type = &nft_log_type, 178 .size = NFT_EXPR_SIZE(sizeof(struct nft_log)), 179 .eval = nft_log_eval, 180 .init = nft_log_init, 181 .destroy = nft_log_destroy, 182 .dump = nft_log_dump, 183 }; 184 185 static struct nft_expr_type nft_log_type __read_mostly = { 186 .name = "log", 187 .ops = &nft_log_ops, 188 .policy = nft_log_policy, 189 .maxattr = NFTA_LOG_MAX, 190 .owner = THIS_MODULE, 191 }; 192 193 static int __init nft_log_module_init(void) 194 { 195 return nft_register_expr(&nft_log_type); 196 } 197 198 static void __exit nft_log_module_exit(void) 199 { 200 nft_unregister_expr(&nft_log_type); 201 } 202 203 module_init(nft_log_module_init); 204 module_exit(nft_log_module_exit); 205 206 MODULE_LICENSE("GPL"); 207 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 208 MODULE_ALIAS_NFT_EXPR("log"); 209