git.oblomov.eu Git - linux-2.6/blob - net/ipv4/netfilter/ipt_LOG.c

   1 /*
   2  * This is a module which is used for logging packets.
   3  */
   4
   5 /* (C) 1999-2001 Paul `Rusty' Russell
   6  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #include <linux/module.h>
  14 #include <linux/spinlock.h>
  15 #include <linux/skbuff.h>
  16 #include <linux/ip.h>
  17 #include <net/icmp.h>
  18 #include <net/udp.h>
  19 #include <net/tcp.h>
  20 #include <net/route.h>
  21
  22 #include <linux/netfilter.h>
  23 #include <linux/netfilter/x_tables.h>
  24 #include <linux/netfilter_ipv4/ipt_LOG.h>
  25
  26 MODULE_LICENSE("GPL");
  27 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  28 MODULE_DESCRIPTION("iptables syslog logging module");
  29
  30 /* Use lock to serialize, so printks don't overlap */
  31 static DEFINE_SPINLOCK(log_lock);
  32
  33 /* One level of recursion won't kill us */
  34 static void dump_packet(const struct nf_loginfo *info,
  35                         const struct sk_buff *skb,
  36                         unsigned int iphoff)
  37 {
  38         struct iphdr _iph;
  39         const struct iphdr *ih;
  40         unsigned int logflags;
  41
  42         if (info->type == NF_LOG_TYPE_LOG)
  43                 logflags = info->u.log.logflags;
  44         else
  45                 logflags = NF_LOG_MASK;
  46
  47         ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);
  48         if (ih == NULL) {
  49                 printk("TRUNCATED");
  50                 return;
  51         }
  52
  53         /* Important fields:
  54          * TOS, len, DF/MF, fragment offset, TTL, src, dst, options. */
  55         /* Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 " */
  56         printk("SRC=%u.%u.%u.%u DST=%u.%u.%u.%u ",
  57                NIPQUAD(ih->saddr), NIPQUAD(ih->daddr));
  58
  59         /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */
  60         printk("LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
  61                ntohs(ih->tot_len), ih->tos & IPTOS_TOS_MASK,
  62                ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id));
  63
  64         /* Max length: 6 "CE DF MF " */
  65         if (ntohs(ih->frag_off) & IP_CE)
  66                 printk("CE ");
  67         if (ntohs(ih->frag_off) & IP_DF)
  68                 printk("DF ");
  69         if (ntohs(ih->frag_off) & IP_MF)
  70                 printk("MF ");
  71
  72         /* Max length: 11 "FRAG:65535 " */
  73         if (ntohs(ih->frag_off) & IP_OFFSET)
  74                 printk("FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
  75
  76         if ((logflags & IPT_LOG_IPOPT)
  77             && ih->ihl * 4 > sizeof(struct iphdr)) {
  78                 unsigned char _opt[4 * 15 - sizeof(struct iphdr)], *op;
  79                 unsigned int i, optsize;
  80
  81                 optsize = ih->ihl * 4 - sizeof(struct iphdr);
  82                 op = skb_header_pointer(skb, iphoff+sizeof(_iph),
  83                                         optsize, _opt);
  84                 if (op == NULL) {
  85                         printk("TRUNCATED");
  86                         return;
  87                 }
  88
  89                 /* Max length: 127 "OPT (" 15*4*2chars ") " */
  90                 printk("OPT (");
  91                 for (i = 0; i < optsize; i++)
  92                         printk("%02X", op[i]);
  93                 printk(") ");
  94         }
  95
  96         switch (ih->protocol) {
  97         case IPPROTO_TCP: {
  98                 struct tcphdr _tcph;
  99                 const struct tcphdr *th;
 100
 101                 /* Max length: 10 "PROTO=TCP " */
 102                 printk("PROTO=TCP ");
 103
 104                 if (ntohs(ih->frag_off) & IP_OFFSET)
 105                         break;
 106
 107                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
 108                 th = skb_header_pointer(skb, iphoff + ih->ihl * 4,
 109                                         sizeof(_tcph), &_tcph);
 110                 if (th == NULL) {
 111                         printk("INCOMPLETE [%u bytes] ",
 112                                skb->len - iphoff - ih->ihl*4);
 113                         break;
 114                 }
 115
 116                 /* Max length: 20 "SPT=65535 DPT=65535 " */
 117                 printk("SPT=%u DPT=%u ",
 118                        ntohs(th->source), ntohs(th->dest));
 119                 /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
 120                 if (logflags & IPT_LOG_TCPSEQ)
 121                         printk("SEQ=%u ACK=%u ",
 122                                ntohl(th->seq), ntohl(th->ack_seq));
 123                 /* Max length: 13 "WINDOW=65535 " */
 124                 printk("WINDOW=%u ", ntohs(th->window));
 125                 /* Max length: 9 "RES=0x3F " */
 126                 printk("RES=0x%02x ", (u8)(ntohl(tcp_flag_word(th) & TCP_RESERVED_BITS) >> 22));
 127                 /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
 128                 if (th->cwr)
 129                         printk("CWR ");
 130                 if (th->ece)
 131                         printk("ECE ");
 132                 if (th->urg)
 133                         printk("URG ");
 134                 if (th->ack)
 135                         printk("ACK ");
 136                 if (th->psh)
 137                         printk("PSH ");
 138                 if (th->rst)
 139                         printk("RST ");
 140                 if (th->syn)
 141                         printk("SYN ");
 142                 if (th->fin)
 143                         printk("FIN ");
 144                 /* Max length: 11 "URGP=65535 " */
 145                 printk("URGP=%u ", ntohs(th->urg_ptr));
 146
 147                 if ((logflags & IPT_LOG_TCPOPT)
 148                     && th->doff * 4 > sizeof(struct tcphdr)) {
 149                         unsigned char _opt[4 * 15 - sizeof(struct tcphdr)];
 150                         const unsigned char *op;
 151                         unsigned int i, optsize;
 152
 153                         optsize = th->doff * 4 - sizeof(struct tcphdr);
 154                         op = skb_header_pointer(skb,
 155                                                 iphoff+ih->ihl*4+sizeof(_tcph),
 156                                                 optsize, _opt);
 157                         if (op == NULL) {
 158                                 printk("TRUNCATED");
 159                                 return;
 160                         }
 161
 162                         /* Max length: 127 "OPT (" 15*4*2chars ") " */
 163                         printk("OPT (");
 164                         for (i = 0; i < optsize; i++)
 165                                 printk("%02X", op[i]);
 166                         printk(") ");
 167                 }
 168                 break;
 169         }
 170         case IPPROTO_UDP:
 171         case IPPROTO_UDPLITE: {
 172                 struct udphdr _udph;
 173                 const struct udphdr *uh;
 174
 175                 if (ih->protocol == IPPROTO_UDP)
 176                         /* Max length: 10 "PROTO=UDP "     */
 177                         printk("PROTO=UDP " );
 178                 else    /* Max length: 14 "PROTO=UDPLITE " */
 179                         printk("PROTO=UDPLITE ");
 180
 181                 if (ntohs(ih->frag_off) & IP_OFFSET)
 182                         break;
 183
 184                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
 185                 uh = skb_header_pointer(skb, iphoff+ih->ihl*4,
 186                                         sizeof(_udph), &_udph);
 187                 if (uh == NULL) {
 188                         printk("INCOMPLETE [%u bytes] ",
 189                                skb->len - iphoff - ih->ihl*4);
 190                         break;
 191                 }
 192
 193                 /* Max length: 20 "SPT=65535 DPT=65535 " */
 194                 printk("SPT=%u DPT=%u LEN=%u ",
 195                        ntohs(uh->source), ntohs(uh->dest),
 196                        ntohs(uh->len));
 197                 break;
 198         }
 199         case IPPROTO_ICMP: {
 200                 struct icmphdr _icmph;
 201                 const struct icmphdr *ich;
 202                 static const size_t required_len[NR_ICMP_TYPES+1]
 203                         = { [ICMP_ECHOREPLY] = 4,
 204                             [ICMP_DEST_UNREACH]
 205                             = 8 + sizeof(struct iphdr),
 206                             [ICMP_SOURCE_QUENCH]
 207                             = 8 + sizeof(struct iphdr),
 208                             [ICMP_REDIRECT]
 209                             = 8 + sizeof(struct iphdr),
 210                             [ICMP_ECHO] = 4,
 211                             [ICMP_TIME_EXCEEDED]
 212                             = 8 + sizeof(struct iphdr),
 213                             [ICMP_PARAMETERPROB]
 214                             = 8 + sizeof(struct iphdr),
 215                             [ICMP_TIMESTAMP] = 20,
 216                             [ICMP_TIMESTAMPREPLY] = 20,
 217                             [ICMP_ADDRESS] = 12,
 218                             [ICMP_ADDRESSREPLY] = 12 };
 219
 220                 /* Max length: 11 "PROTO=ICMP " */
 221                 printk("PROTO=ICMP ");
 222
 223                 if (ntohs(ih->frag_off) & IP_OFFSET)
 224                         break;
 225
 226                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
 227                 ich = skb_header_pointer(skb, iphoff + ih->ihl * 4,
 228                                          sizeof(_icmph), &_icmph);
 229                 if (ich == NULL) {
 230                         printk("INCOMPLETE [%u bytes] ",
 231                                skb->len - iphoff - ih->ihl*4);
 232                         break;
 233                 }
 234
 235                 /* Max length: 18 "TYPE=255 CODE=255 " */
 236                 printk("TYPE=%u CODE=%u ", ich->type, ich->code);
 237
 238                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
 239                 if (ich->type <= NR_ICMP_TYPES
 240                     && required_len[ich->type]
 241                     && skb->len-iphoff-ih->ihl*4 < required_len[ich->type]) {
 242                         printk("INCOMPLETE [%u bytes] ",
 243                                skb->len - iphoff - ih->ihl*4);
 244                         break;
 245                 }
 246
 247                 switch (ich->type) {
 248                 case ICMP_ECHOREPLY:
 249                 case ICMP_ECHO:
 250                         /* Max length: 19 "ID=65535 SEQ=65535 " */
 251                         printk("ID=%u SEQ=%u ",
 252                                ntohs(ich->un.echo.id),
 253                                ntohs(ich->un.echo.sequence));
 254                         break;
 255
 256                 case ICMP_PARAMETERPROB:
 257                         /* Max length: 14 "PARAMETER=255 " */
 258                         printk("PARAMETER=%u ",
 259                                ntohl(ich->un.gateway) >> 24);
 260                         break;
 261                 case ICMP_REDIRECT:
 262                         /* Max length: 24 "GATEWAY=255.255.255.255 " */
 263                         printk("GATEWAY=%u.%u.%u.%u ",
 264                                NIPQUAD(ich->un.gateway));
 265                         /* Fall through */
 266                 case ICMP_DEST_UNREACH:
 267                 case ICMP_SOURCE_QUENCH:
 268                 case ICMP_TIME_EXCEEDED:
 269                         /* Max length: 3+maxlen */
 270                         if (!iphoff) { /* Only recurse once. */
 271                                 printk("[");
 272                                 dump_packet(info, skb,
 273                                             iphoff + ih->ihl*4+sizeof(_icmph));
 274                                 printk("] ");
 275                         }
 276
 277                         /* Max length: 10 "MTU=65535 " */
 278                         if (ich->type == ICMP_DEST_UNREACH
 279                             && ich->code == ICMP_FRAG_NEEDED)
 280                                 printk("MTU=%u ", ntohs(ich->un.frag.mtu));
 281                 }
 282                 break;
 283         }
 284         /* Max Length */
 285         case IPPROTO_AH: {
 286                 struct ip_auth_hdr _ahdr;
 287                 const struct ip_auth_hdr *ah;
 288
 289                 if (ntohs(ih->frag_off) & IP_OFFSET)
 290                         break;
 291
 292                 /* Max length: 9 "PROTO=AH " */
 293                 printk("PROTO=AH ");
 294
 295                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
 296                 ah = skb_header_pointer(skb, iphoff+ih->ihl*4,
 297                                         sizeof(_ahdr), &_ahdr);
 298                 if (ah == NULL) {
 299                         printk("INCOMPLETE [%u bytes] ",
 300                                skb->len - iphoff - ih->ihl*4);
 301                         break;
 302                 }
 303
 304                 /* Length: 15 "SPI=0xF1234567 " */
 305                 printk("SPI=0x%x ", ntohl(ah->spi));
 306                 break;
 307         }
 308         case IPPROTO_ESP: {
 309                 struct ip_esp_hdr _esph;
 310                 const struct ip_esp_hdr *eh;
 311
 312                 /* Max length: 10 "PROTO=ESP " */
 313                 printk("PROTO=ESP ");
 314
 315                 if (ntohs(ih->frag_off) & IP_OFFSET)
 316                         break;
 317
 318                 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
 319                 eh = skb_header_pointer(skb, iphoff+ih->ihl*4,
 320                                         sizeof(_esph), &_esph);
 321                 if (eh == NULL) {
 322                         printk("INCOMPLETE [%u bytes] ",
 323                                skb->len - iphoff - ih->ihl*4);
 324                         break;
 325                 }
 326
 327                 /* Length: 15 "SPI=0xF1234567 " */
 328                 printk("SPI=0x%x ", ntohl(eh->spi));
 329                 break;
 330         }
 331         /* Max length: 10 "PROTO 255 " */
 332         default:
 333                 printk("PROTO=%u ", ih->protocol);
 334         }
 335
 336         /* Max length: 15 "UID=4294967295 " */
 337         if ((logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
 338                 read_lock_bh(&skb->sk->sk_callback_lock);
 339                 if (skb->sk->sk_socket && skb->sk->sk_socket->file)
 340                         printk("UID=%u ", skb->sk->sk_socket->file->f_uid);
 341                 read_unlock_bh(&skb->sk->sk_callback_lock);
 342         }
 343
 344         /* Proto    Max log string length */
 345         /* IP:      40+46+6+11+127 = 230 */
 346         /* TCP:     10+max(25,20+30+13+9+32+11+127) = 252 */
 347         /* UDP:     10+max(25,20) = 35 */
 348         /* UDPLITE: 14+max(25,20) = 39 */
 349         /* ICMP:    11+max(25, 18+25+max(19,14,24+3+n+10,3+n+10)) = 91+n */
 350         /* ESP:     10+max(25)+15 = 50 */
 351         /* AH:      9+max(25)+15 = 49 */
 352         /* unknown: 10 */
 353
 354         /* (ICMP allows recursion one level deep) */
 355         /* maxlen =  IP + ICMP +  IP + max(TCP,UDP,ICMP,unknown) */
 356         /* maxlen = 230+   91  + 230 + 252 = 803 */
 357 }
 358
 359 static struct nf_loginfo default_loginfo = {
 360         .type   = NF_LOG_TYPE_LOG,
 361         .u = {
 362                 .log = {
 363                         .level    = 0,
 364                         .logflags = NF_LOG_MASK,
 365                 },
 366         },
 367 };
 368
 369 static void
 370 ipt_log_packet(unsigned int pf,
 371                unsigned int hooknum,
 372                const struct sk_buff *skb,
 373                const struct net_device *in,
 374                const struct net_device *out,
 375                const struct nf_loginfo *loginfo,
 376                const char *prefix)
 377 {
 378         if (!loginfo)
 379                 loginfo = &default_loginfo;
 380
 381         spin_lock_bh(&log_lock);
 382         printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
 383                prefix,
 384                in ? in->name : "",
 385                out ? out->name : "");
 386 #ifdef CONFIG_BRIDGE_NETFILTER
 387         if (skb->nf_bridge) {
 388                 const struct net_device *physindev;
 389                 const struct net_device *physoutdev;
 390
 391                 physindev = skb->nf_bridge->physindev;
 392                 if (physindev && in != physindev)
 393                         printk("PHYSIN=%s ", physindev->name);
 394                 physoutdev = skb->nf_bridge->physoutdev;
 395                 if (physoutdev && out != physoutdev)
 396                         printk("PHYSOUT=%s ", physoutdev->name);
 397         }
 398 #endif
 399
 400         if (in && !out) {
 401                 /* MAC logging for input chain only. */
 402                 printk("MAC=");
 403                 if (skb->dev && skb->dev->hard_header_len
 404                     && skb->mac_header != skb->network_header) {
 405                         int i;
 406                         const unsigned char *p = skb_mac_header(skb);
 407                         for (i = 0; i < skb->dev->hard_header_len; i++,p++)
 408                                 printk("%02x%c", *p,
 409                                        i==skb->dev->hard_header_len - 1
 410                                        ? ' ':':');
 411                 } else
 412                         printk(" ");
 413         }
 414
 415         dump_packet(loginfo, skb, 0);
 416         printk("\n");
 417         spin_unlock_bh(&log_lock);
 418 }
 419
 420 static unsigned int
 421 ipt_log_target(struct sk_buff *skb,
 422                const struct net_device *in,
 423                const struct net_device *out,
 424                unsigned int hooknum,
 425                const struct xt_target *target,
 426                const void *targinfo)
 427 {
 428         const struct ipt_log_info *loginfo = targinfo;
 429         struct nf_loginfo li;
 430
 431         li.type = NF_LOG_TYPE_LOG;
 432         li.u.log.level = loginfo->level;
 433         li.u.log.logflags = loginfo->logflags;
 434
 435         ipt_log_packet(PF_INET, hooknum, skb, in, out, &li,
 436                        loginfo->prefix);
 437         return XT_CONTINUE;
 438 }
 439
 440 static bool ipt_log_checkentry(const char *tablename,
 441                                const void *e,
 442                                const struct xt_target *target,
 443                                void *targinfo,
 444                                unsigned int hook_mask)
 445 {
 446         const struct ipt_log_info *loginfo = targinfo;
 447
 448         if (loginfo->level >= 8) {
 449                 pr_debug("LOG: level %u >= 8\n", loginfo->level);
 450                 return false;
 451         }
 452         if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
 453                 pr_debug("LOG: prefix term %i\n",
 454                          loginfo->prefix[sizeof(loginfo->prefix)-1]);
 455                 return false;
 456         }
 457         return true;
 458 }
 459
 460 static struct xt_target ipt_log_reg __read_mostly = {
 461         .name           = "LOG",
 462         .family         = AF_INET,
 463         .target         = ipt_log_target,
 464         .targetsize     = sizeof(struct ipt_log_info),
 465         .checkentry     = ipt_log_checkentry,
 466         .me             = THIS_MODULE,
 467 };
 468
 469 static struct nf_logger ipt_log_logger ={
 470         .name           = "ipt_LOG",
 471         .logfn          = &ipt_log_packet,
 472         .me             = THIS_MODULE,
 473 };
 474
 475 static int __init ipt_log_init(void)
 476 {
 477         int ret;
 478
 479         ret = xt_register_target(&ipt_log_reg);
 480         if (ret < 0)
 481                 return ret;
 482         nf_log_register(PF_INET, &ipt_log_logger);
 483         return 0;
 484 }
 485
 486 static void __exit ipt_log_fini(void)
 487 {
 488         nf_log_unregister(&ipt_log_logger);
 489         xt_unregister_target(&ipt_log_reg);
 490 }
 491
 492 module_init(ipt_log_init);
 493 module_exit(ipt_log_fini);