5 * Bart De Schuymer <bdschuym@pandora.be>
6 * Harald Welte <laforge@netfilter.org>
11 #include <linux/module.h>
14 #include <linux/if_arp.h>
15 #include <linux/spinlock.h>
16 #include <net/netfilter/nf_log.h>
17 #include <linux/ipv6.h>
19 #include <linux/in6.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter_bridge/ebtables.h>
22 #include <linux/netfilter_bridge/ebt_log.h>
23 #include <linux/netfilter.h>
25 static DEFINE_SPINLOCK(ebt_log_lock
);
27 static bool ebt_log_tg_check(const struct xt_tgchk_param
*par
)
29 struct ebt_log_info
*info
= par
->targinfo
;
31 if (info
->bitmask
& ~EBT_LOG_MASK
)
33 if (info
->loglevel
>= 8)
35 info
->prefix
[EBT_LOG_PREFIX_SIZE
- 1] = '\0';
47 unsigned char mac_src
[ETH_ALEN
];
48 unsigned char ip_src
[4];
49 unsigned char mac_dst
[ETH_ALEN
];
50 unsigned char ip_dst
[4];
53 static void print_MAC(const unsigned char *p
)
57 for (i
= 0; i
< ETH_ALEN
; i
++, p
++)
58 printk("%02x%c", *p
, i
== ETH_ALEN
- 1 ? ' ':':');
62 print_ports(const struct sk_buff
*skb
, uint8_t protocol
, int offset
)
64 if (protocol
== IPPROTO_TCP
||
65 protocol
== IPPROTO_UDP
||
66 protocol
== IPPROTO_UDPLITE
||
67 protocol
== IPPROTO_SCTP
||
68 protocol
== IPPROTO_DCCP
) {
69 const struct tcpudphdr
*pptr
;
70 struct tcpudphdr _ports
;
72 pptr
= skb_header_pointer(skb
, offset
,
73 sizeof(_ports
), &_ports
);
75 printk(" INCOMPLETE TCP/UDP header");
78 printk(" SPT=%u DPT=%u", ntohs(pptr
->src
), ntohs(pptr
->dst
));
83 ebt_log_packet(u_int8_t pf
, unsigned int hooknum
,
84 const struct sk_buff
*skb
, const struct net_device
*in
,
85 const struct net_device
*out
, const struct nf_loginfo
*loginfo
,
90 spin_lock_bh(&ebt_log_lock
);
91 printk("<%c>%s IN=%s OUT=%s MAC source = ", '0' + loginfo
->u
.log
.level
,
92 prefix
, in
? in
->name
: "", out
? out
->name
: "");
94 print_MAC(eth_hdr(skb
)->h_source
);
95 printk("MAC dest = ");
96 print_MAC(eth_hdr(skb
)->h_dest
);
98 printk("proto = 0x%04x", ntohs(eth_hdr(skb
)->h_proto
));
100 if (loginfo
->type
== NF_LOG_TYPE_LOG
)
101 bitmask
= loginfo
->u
.log
.logflags
;
103 bitmask
= NF_LOG_MASK
;
105 if ((bitmask
& EBT_LOG_IP
) && eth_hdr(skb
)->h_proto
==
107 const struct iphdr
*ih
;
110 ih
= skb_header_pointer(skb
, 0, sizeof(_iph
), &_iph
);
112 printk(" INCOMPLETE IP header");
115 printk(" IP SRC=%pI4 IP DST=%pI4, IP tos=0x%02X, IP proto=%d",
116 &ih
->saddr
, &ih
->daddr
, ih
->tos
, ih
->protocol
);
117 print_ports(skb
, ih
->protocol
, ih
->ihl
*4);
121 #if defined(CONFIG_BRIDGE_EBT_IP6) || defined(CONFIG_BRIDGE_EBT_IP6_MODULE)
122 if ((bitmask
& EBT_LOG_IP6
) && eth_hdr(skb
)->h_proto
==
124 const struct ipv6hdr
*ih
;
129 ih
= skb_header_pointer(skb
, 0, sizeof(_iph
), &_iph
);
131 printk(" INCOMPLETE IPv6 header");
134 printk(" IPv6 SRC=%pI6 IPv6 DST=%pI6, IPv6 priority=0x%01X, Next Header=%d",
135 &ih
->saddr
, &ih
->daddr
, ih
->priority
, ih
->nexthdr
);
136 nexthdr
= ih
->nexthdr
;
137 offset_ph
= ipv6_skip_exthdr(skb
, sizeof(_iph
), &nexthdr
);
140 print_ports(skb
, nexthdr
, offset_ph
);
145 if ((bitmask
& EBT_LOG_ARP
) &&
146 ((eth_hdr(skb
)->h_proto
== htons(ETH_P_ARP
)) ||
147 (eth_hdr(skb
)->h_proto
== htons(ETH_P_RARP
)))) {
148 const struct arphdr
*ah
;
151 ah
= skb_header_pointer(skb
, 0, sizeof(_arph
), &_arph
);
153 printk(" INCOMPLETE ARP header");
156 printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
157 ntohs(ah
->ar_hrd
), ntohs(ah
->ar_pro
),
160 /* If it's for Ethernet and the lengths are OK,
161 * then log the ARP payload */
162 if (ah
->ar_hrd
== htons(1) &&
163 ah
->ar_hln
== ETH_ALEN
&&
164 ah
->ar_pln
== sizeof(__be32
)) {
165 const struct arppayload
*ap
;
166 struct arppayload _arpp
;
168 ap
= skb_header_pointer(skb
, sizeof(_arph
),
169 sizeof(_arpp
), &_arpp
);
171 printk(" INCOMPLETE ARP payload");
174 printk(" ARP MAC SRC=");
175 print_MAC(ap
->mac_src
);
176 printk(" ARP IP SRC=%pI4", ap
->ip_src
);
177 printk(" ARP MAC DST=");
178 print_MAC(ap
->mac_dst
);
179 printk(" ARP IP DST=%pI4", ap
->ip_dst
);
184 spin_unlock_bh(&ebt_log_lock
);
189 ebt_log_tg(struct sk_buff
*skb
, const struct xt_target_param
*par
)
191 const struct ebt_log_info
*info
= par
->targinfo
;
192 struct nf_loginfo li
;
194 li
.type
= NF_LOG_TYPE_LOG
;
195 li
.u
.log
.level
= info
->loglevel
;
196 li
.u
.log
.logflags
= info
->bitmask
;
198 if (info
->bitmask
& EBT_LOG_NFLOG
)
199 nf_log_packet(NFPROTO_BRIDGE
, par
->hooknum
, skb
, par
->in
,
200 par
->out
, &li
, "%s", info
->prefix
);
202 ebt_log_packet(NFPROTO_BRIDGE
, par
->hooknum
, skb
, par
->in
,
203 par
->out
, &li
, info
->prefix
);
207 static struct xt_target ebt_log_tg_reg __read_mostly
= {
210 .family
= NFPROTO_BRIDGE
,
211 .target
= ebt_log_tg
,
212 .checkentry
= ebt_log_tg_check
,
213 .targetsize
= XT_ALIGN(sizeof(struct ebt_log_info
)),
217 static struct nf_logger ebt_log_logger __read_mostly
= {
219 .logfn
= &ebt_log_packet
,
223 static int __init
ebt_log_init(void)
227 ret
= xt_register_target(&ebt_log_tg_reg
);
230 nf_log_register(NFPROTO_BRIDGE
, &ebt_log_logger
);
234 static void __exit
ebt_log_fini(void)
236 nf_log_unregister(&ebt_log_logger
);
237 xt_unregister_target(&ebt_log_tg_reg
);
240 module_init(ebt_log_init
);
241 module_exit(ebt_log_fini
);
242 MODULE_DESCRIPTION("Ebtables: Packet logging to syslog");
243 MODULE_LICENSE("GPL");