2 * netfilter module for userspace packet logging daemons
4 * (C) 2000-2004 by Harald Welte <laforge@netfilter.org>
5 * (C) 1999-2001 Paul `Rusty' Russell
6 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 as
10 * published by the Free Software Foundation.
12 * This module accepts two parameters:
15 * The parameter specifies how big the buffer for each netlink multicast
16 * group is. e.g. If you say nlbufsiz=8192, up to eight kb of packets will
17 * get accumulated in the kernel until they are sent to userspace. It is
18 * NOT possible to allocate more than 128kB, and it is strongly discouraged,
19 * because atomically allocating 128kB inside the network rx softirq is not
20 * reliable. Please also keep in mind that this buffer size is allocated for
21 * each nlgroup you are using, so the total kernel memory usage increases
24 * Actually you should use nlbufsiz a bit smaller than PAGE_SIZE, since
25 * nlbufsiz is used with alloc_skb, which adds another
26 * sizeof(struct skb_shared_info). Use NLMSG_GOODSIZE instead.
29 * Specify, after how many hundredths of a second the queue should be
30 * flushed even if it is not full yet.
33 #include <linux/module.h>
34 #include <linux/spinlock.h>
35 #include <linux/socket.h>
36 #include <linux/skbuff.h>
37 #include <linux/kernel.h>
38 #include <linux/timer.h>
39 #include <linux/netlink.h>
40 #include <linux/netdevice.h>
42 #include <linux/moduleparam.h>
43 #include <linux/netfilter.h>
44 #include <linux/netfilter/x_tables.h>
45 #include <linux/netfilter_ipv4/ipt_ULOG.h>
47 #include <linux/bitops.h>
48 #include <asm/unaligned.h>
50 MODULE_LICENSE("GPL");
51 MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
52 MODULE_DESCRIPTION("iptables userspace logging module");
53 MODULE_ALIAS_NET_PF_PROTO(PF_NETLINK
, NETLINK_NFLOG
);
55 #define ULOG_NL_EVENT 111 /* Harald's favorite number */
56 #define ULOG_MAXNLGROUPS 32 /* numer of nlgroups */
59 #define DEBUGP(format, args...) printk("%s:%s:" format, \
60 __FILE__, __FUNCTION__ , ## args)
62 #define DEBUGP(format, args...)
65 #define PRINTR(format, args...) do { if (net_ratelimit()) printk(format , ## args); } while (0)
67 static unsigned int nlbufsiz
= NLMSG_GOODSIZE
;
68 module_param(nlbufsiz
, uint
, 0400);
69 MODULE_PARM_DESC(nlbufsiz
, "netlink buffer size");
71 static unsigned int flushtimeout
= 10;
72 module_param(flushtimeout
, uint
, 0600);
73 MODULE_PARM_DESC(flushtimeout
, "buffer flush timeout (hundredths of a second)");
76 module_param(nflog
, bool, 0400);
77 MODULE_PARM_DESC(nflog
, "register as internal netfilter logging module");
79 /* global data structures */
82 unsigned int qlen
; /* number of nlmsgs' in the skb */
83 struct nlmsghdr
*lastnlh
; /* netlink header of last msg in skb */
84 struct sk_buff
*skb
; /* the pre-allocated skb */
85 struct timer_list timer
; /* the timer function */
88 static ulog_buff_t ulog_buffers
[ULOG_MAXNLGROUPS
]; /* array of buffers */
90 static struct sock
*nflognl
; /* our socket */
91 static DEFINE_SPINLOCK(ulog_lock
); /* spinlock */
93 /* send one ulog_buff_t to userspace */
94 static void ulog_send(unsigned int nlgroupnum
)
96 ulog_buff_t
*ub
= &ulog_buffers
[nlgroupnum
];
98 if (timer_pending(&ub
->timer
)) {
99 DEBUGP("ipt_ULOG: ulog_send: timer was pending, deleting\n");
100 del_timer(&ub
->timer
);
104 DEBUGP("ipt_ULOG: ulog_send: nothing to send\n");
108 /* last nlmsg needs NLMSG_DONE */
110 ub
->lastnlh
->nlmsg_type
= NLMSG_DONE
;
112 NETLINK_CB(ub
->skb
).dst_group
= nlgroupnum
+ 1;
113 DEBUGP("ipt_ULOG: throwing %d packets to netlink group %u\n",
114 ub
->qlen
, nlgroupnum
+ 1);
115 netlink_broadcast(nflognl
, ub
->skb
, 0, nlgroupnum
+ 1, GFP_ATOMIC
);
123 /* timer function to flush queue in flushtimeout time */
124 static void ulog_timer(unsigned long data
)
126 DEBUGP("ipt_ULOG: timer function called, calling ulog_send\n");
128 /* lock to protect against somebody modifying our structure
129 * from ipt_ulog_target at the same time */
130 spin_lock_bh(&ulog_lock
);
132 spin_unlock_bh(&ulog_lock
);
135 static struct sk_buff
*ulog_alloc_skb(unsigned int size
)
140 /* alloc skb which should be big enough for a whole
141 * multipart message. WARNING: has to be <= 131000
142 * due to slab allocator restrictions */
144 n
= max(size
, nlbufsiz
);
145 skb
= alloc_skb(n
, GFP_ATOMIC
);
147 PRINTR("ipt_ULOG: can't alloc whole buffer %ub!\n", n
);
150 /* try to allocate only as much as we need for
153 skb
= alloc_skb(size
, GFP_ATOMIC
);
155 PRINTR("ipt_ULOG: can't even allocate %ub\n",
163 static void ipt_ulog_packet(unsigned int hooknum
,
164 const struct sk_buff
*skb
,
165 const struct net_device
*in
,
166 const struct net_device
*out
,
167 const struct ipt_ulog_info
*loginfo
,
171 ulog_packet_msg_t
*pm
;
172 size_t size
, copy_len
;
173 struct nlmsghdr
*nlh
;
176 /* ffs == find first bit set, necessary because userspace
177 * is already shifting groupnumber, but we need unshifted.
178 * ffs() returns [1..32], we need [0..31] */
179 unsigned int groupnum
= ffs(loginfo
->nl_group
) - 1;
181 /* calculate the size of the skb needed */
182 if ((loginfo
->copy_range
== 0) ||
183 (loginfo
->copy_range
> skb
->len
)) {
186 copy_len
= loginfo
->copy_range
;
189 size
= NLMSG_SPACE(sizeof(*pm
) + copy_len
);
191 ub
= &ulog_buffers
[groupnum
];
193 spin_lock_bh(&ulog_lock
);
196 if (!(ub
->skb
= ulog_alloc_skb(size
)))
198 } else if (ub
->qlen
>= loginfo
->qthreshold
||
199 size
> skb_tailroom(ub
->skb
)) {
200 /* either the queue len is too high or we don't have
201 * enough room in nlskb left. send it to userspace. */
205 if (!(ub
->skb
= ulog_alloc_skb(size
)))
209 DEBUGP("ipt_ULOG: qlen %d, qthreshold %d\n", ub
->qlen
,
210 loginfo
->qthreshold
);
212 /* NLMSG_PUT contains a hidden goto nlmsg_failure !!! */
213 nlh
= NLMSG_PUT(ub
->skb
, 0, ub
->qlen
, ULOG_NL_EVENT
,
214 sizeof(*pm
)+copy_len
);
217 pm
= NLMSG_DATA(nlh
);
219 /* We might not have a timestamp, get one */
220 if (skb
->tstamp
.tv64
== 0)
221 __net_timestamp((struct sk_buff
*)skb
);
223 /* copy hook, prefix, timestamp, payload, etc. */
224 pm
->data_len
= copy_len
;
225 tv
= ktime_to_timeval(skb
->tstamp
);
226 put_unaligned(tv
.tv_sec
, &pm
->timestamp_sec
);
227 put_unaligned(tv
.tv_usec
, &pm
->timestamp_usec
);
228 put_unaligned(skb
->mark
, &pm
->mark
);
231 strncpy(pm
->prefix
, prefix
, sizeof(pm
->prefix
));
232 else if (loginfo
->prefix
[0] != '\0')
233 strncpy(pm
->prefix
, loginfo
->prefix
, sizeof(pm
->prefix
));
235 *(pm
->prefix
) = '\0';
237 if (in
&& in
->hard_header_len
> 0
238 && skb
->mac_header
!= skb
->network_header
239 && in
->hard_header_len
<= ULOG_MAC_LEN
) {
240 memcpy(pm
->mac
, skb_mac_header(skb
), in
->hard_header_len
);
241 pm
->mac_len
= in
->hard_header_len
;
246 strncpy(pm
->indev_name
, in
->name
, sizeof(pm
->indev_name
));
248 pm
->indev_name
[0] = '\0';
251 strncpy(pm
->outdev_name
, out
->name
, sizeof(pm
->outdev_name
));
253 pm
->outdev_name
[0] = '\0';
255 /* copy_len <= skb->len, so can't fail. */
256 if (skb_copy_bits(skb
, 0, pm
->payload
, copy_len
) < 0)
259 /* check if we are building multi-part messages */
261 ub
->lastnlh
->nlmsg_flags
|= NLM_F_MULTI
;
266 /* if timer isn't already running, start it */
267 if (!timer_pending(&ub
->timer
)) {
268 ub
->timer
.expires
= jiffies
+ flushtimeout
* HZ
/ 100;
269 add_timer(&ub
->timer
);
272 /* if threshold is reached, send message to userspace */
273 if (ub
->qlen
>= loginfo
->qthreshold
) {
274 if (loginfo
->qthreshold
> 1)
275 nlh
->nlmsg_type
= NLMSG_DONE
;
279 spin_unlock_bh(&ulog_lock
);
284 PRINTR("ipt_ULOG: error during NLMSG_PUT\n");
287 PRINTR("ipt_ULOG: Error building netlink message\n");
289 spin_unlock_bh(&ulog_lock
);
292 static unsigned int ipt_ulog_target(struct sk_buff
*skb
,
293 const struct net_device
*in
,
294 const struct net_device
*out
,
295 unsigned int hooknum
,
296 const struct xt_target
*target
,
297 const void *targinfo
)
299 struct ipt_ulog_info
*loginfo
= (struct ipt_ulog_info
*) targinfo
;
301 ipt_ulog_packet(hooknum
, skb
, in
, out
, loginfo
, NULL
);
306 static void ipt_logfn(unsigned int pf
,
307 unsigned int hooknum
,
308 const struct sk_buff
*skb
,
309 const struct net_device
*in
,
310 const struct net_device
*out
,
311 const struct nf_loginfo
*li
,
314 struct ipt_ulog_info loginfo
;
316 if (!li
|| li
->type
!= NF_LOG_TYPE_ULOG
) {
317 loginfo
.nl_group
= ULOG_DEFAULT_NLGROUP
;
318 loginfo
.copy_range
= 0;
319 loginfo
.qthreshold
= ULOG_DEFAULT_QTHRESHOLD
;
320 loginfo
.prefix
[0] = '\0';
322 loginfo
.nl_group
= li
->u
.ulog
.group
;
323 loginfo
.copy_range
= li
->u
.ulog
.copy_len
;
324 loginfo
.qthreshold
= li
->u
.ulog
.qthreshold
;
325 strlcpy(loginfo
.prefix
, prefix
, sizeof(loginfo
.prefix
));
328 ipt_ulog_packet(hooknum
, skb
, in
, out
, &loginfo
, prefix
);
331 static int ipt_ulog_checkentry(const char *tablename
,
333 const struct xt_target
*target
,
335 unsigned int hookmask
)
337 struct ipt_ulog_info
*loginfo
= (struct ipt_ulog_info
*) targinfo
;
339 if (loginfo
->prefix
[sizeof(loginfo
->prefix
) - 1] != '\0') {
340 DEBUGP("ipt_ULOG: prefix term %i\n",
341 loginfo
->prefix
[sizeof(loginfo
->prefix
) - 1]);
344 if (loginfo
->qthreshold
> ULOG_MAX_QLEN
) {
345 DEBUGP("ipt_ULOG: queue threshold %i > MAX_QLEN\n",
346 loginfo
->qthreshold
);
353 struct compat_ipt_ulog_info
{
354 compat_uint_t nl_group
;
355 compat_size_t copy_range
;
356 compat_size_t qthreshold
;
357 char prefix
[ULOG_PREFIX_LEN
];
360 static void compat_from_user(void *dst
, void *src
)
362 struct compat_ipt_ulog_info
*cl
= src
;
363 struct ipt_ulog_info l
= {
364 .nl_group
= cl
->nl_group
,
365 .copy_range
= cl
->copy_range
,
366 .qthreshold
= cl
->qthreshold
,
369 memcpy(l
.prefix
, cl
->prefix
, sizeof(l
.prefix
));
370 memcpy(dst
, &l
, sizeof(l
));
373 static int compat_to_user(void __user
*dst
, void *src
)
375 struct ipt_ulog_info
*l
= src
;
376 struct compat_ipt_ulog_info cl
= {
377 .nl_group
= l
->nl_group
,
378 .copy_range
= l
->copy_range
,
379 .qthreshold
= l
->qthreshold
,
382 memcpy(cl
.prefix
, l
->prefix
, sizeof(cl
.prefix
));
383 return copy_to_user(dst
, &cl
, sizeof(cl
)) ? -EFAULT
: 0;
385 #endif /* CONFIG_COMPAT */
387 static struct xt_target ipt_ulog_reg
= {
390 .target
= ipt_ulog_target
,
391 .targetsize
= sizeof(struct ipt_ulog_info
),
392 .checkentry
= ipt_ulog_checkentry
,
394 .compatsize
= sizeof(struct compat_ipt_ulog_info
),
395 .compat_from_user
= compat_from_user
,
396 .compat_to_user
= compat_to_user
,
401 static struct nf_logger ipt_ulog_logger
= {
407 static int __init
ipt_ulog_init(void)
411 DEBUGP("ipt_ULOG: init module\n");
413 if (nlbufsiz
> 128*1024) {
414 printk("Netlink buffer has to be <= 128kB\n");
418 /* initialize ulog_buffers */
419 for (i
= 0; i
< ULOG_MAXNLGROUPS
; i
++)
420 setup_timer(&ulog_buffers
[i
].timer
, ulog_timer
, i
);
422 nflognl
= netlink_kernel_create(NETLINK_NFLOG
, ULOG_MAXNLGROUPS
, NULL
,
427 ret
= xt_register_target(&ipt_ulog_reg
);
429 sock_release(nflognl
->sk_socket
);
433 nf_log_register(PF_INET
, &ipt_ulog_logger
);
438 static void __exit
ipt_ulog_fini(void)
443 DEBUGP("ipt_ULOG: cleanup_module\n");
446 nf_log_unregister(&ipt_ulog_logger
);
447 xt_unregister_target(&ipt_ulog_reg
);
448 sock_release(nflognl
->sk_socket
);
450 /* remove pending timers and free allocated skb's */
451 for (i
= 0; i
< ULOG_MAXNLGROUPS
; i
++) {
452 ub
= &ulog_buffers
[i
];
453 if (timer_pending(&ub
->timer
)) {
454 DEBUGP("timer was pending, deleting\n");
455 del_timer(&ub
->timer
);
465 module_init(ipt_ulog_init
);
466 module_exit(ipt_ulog_fini
);