1 /* (C) 1999-2001 Paul `Rusty' Russell
2 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
9 #include <linux/module.h>
10 #include <linux/spinlock.h>
11 #include <linux/skbuff.h>
12 #include <linux/if_arp.h>
17 #include <net/route.h>
19 #include <linux/netfilter.h>
20 #include <linux/netfilter/xt_LOG.h>
21 #include <net/netfilter/nf_log.h>
23 int nf_log_dump_udp_header(struct nf_log_buf
*m
, const struct sk_buff
*skb
,
24 u8 proto
, int fragment
, unsigned int offset
)
27 const struct udphdr
*uh
;
29 if (proto
== IPPROTO_UDP
)
30 /* Max length: 10 "PROTO=UDP " */
31 nf_log_buf_add(m
, "PROTO=UDP ");
32 else /* Max length: 14 "PROTO=UDPLITE " */
33 nf_log_buf_add(m
, "PROTO=UDPLITE ");
38 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
39 uh
= skb_header_pointer(skb
, offset
, sizeof(_udph
), &_udph
);
41 nf_log_buf_add(m
, "INCOMPLETE [%u bytes] ", skb
->len
- offset
);
46 /* Max length: 20 "SPT=65535 DPT=65535 " */
47 nf_log_buf_add(m
, "SPT=%u DPT=%u LEN=%u ",
48 ntohs(uh
->source
), ntohs(uh
->dest
), ntohs(uh
->len
));
53 EXPORT_SYMBOL_GPL(nf_log_dump_udp_header
);
55 int nf_log_dump_tcp_header(struct nf_log_buf
*m
, const struct sk_buff
*skb
,
56 u8 proto
, int fragment
, unsigned int offset
,
57 unsigned int logflags
)
60 const struct tcphdr
*th
;
62 /* Max length: 10 "PROTO=TCP " */
63 nf_log_buf_add(m
, "PROTO=TCP ");
68 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
69 th
= skb_header_pointer(skb
, offset
, sizeof(_tcph
), &_tcph
);
71 nf_log_buf_add(m
, "INCOMPLETE [%u bytes] ", skb
->len
- offset
);
75 /* Max length: 20 "SPT=65535 DPT=65535 " */
76 nf_log_buf_add(m
, "SPT=%u DPT=%u ",
77 ntohs(th
->source
), ntohs(th
->dest
));
78 /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
79 if (logflags
& XT_LOG_TCPSEQ
) {
80 nf_log_buf_add(m
, "SEQ=%u ACK=%u ",
81 ntohl(th
->seq
), ntohl(th
->ack_seq
));
84 /* Max length: 13 "WINDOW=65535 " */
85 nf_log_buf_add(m
, "WINDOW=%u ", ntohs(th
->window
));
86 /* Max length: 9 "RES=0x3C " */
87 nf_log_buf_add(m
, "RES=0x%02x ", (u_int8_t
)(ntohl(tcp_flag_word(th
) &
88 TCP_RESERVED_BITS
) >> 22));
89 /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
91 nf_log_buf_add(m
, "CWR ");
93 nf_log_buf_add(m
, "ECE ");
95 nf_log_buf_add(m
, "URG ");
97 nf_log_buf_add(m
, "ACK ");
99 nf_log_buf_add(m
, "PSH ");
101 nf_log_buf_add(m
, "RST ");
103 nf_log_buf_add(m
, "SYN ");
105 nf_log_buf_add(m
, "FIN ");
106 /* Max length: 11 "URGP=65535 " */
107 nf_log_buf_add(m
, "URGP=%u ", ntohs(th
->urg_ptr
));
109 if ((logflags
& XT_LOG_TCPOPT
) && th
->doff
*4 > sizeof(struct tcphdr
)) {
110 u_int8_t _opt
[60 - sizeof(struct tcphdr
)];
113 unsigned int optsize
= th
->doff
*4 - sizeof(struct tcphdr
);
115 op
= skb_header_pointer(skb
, offset
+ sizeof(struct tcphdr
),
118 nf_log_buf_add(m
, "OPT (TRUNCATED)");
122 /* Max length: 127 "OPT (" 15*4*2chars ") " */
123 nf_log_buf_add(m
, "OPT (");
124 for (i
= 0; i
< optsize
; i
++)
125 nf_log_buf_add(m
, "%02X", op
[i
]);
127 nf_log_buf_add(m
, ") ");
132 EXPORT_SYMBOL_GPL(nf_log_dump_tcp_header
);
134 void nf_log_dump_sk_uid_gid(struct nf_log_buf
*m
, struct sock
*sk
)
136 if (!sk
|| sk
->sk_state
== TCP_TIME_WAIT
)
139 read_lock_bh(&sk
->sk_callback_lock
);
140 if (sk
->sk_socket
&& sk
->sk_socket
->file
) {
141 const struct cred
*cred
= sk
->sk_socket
->file
->f_cred
;
142 nf_log_buf_add(m
, "UID=%u GID=%u ",
143 from_kuid_munged(&init_user_ns
, cred
->fsuid
),
144 from_kgid_munged(&init_user_ns
, cred
->fsgid
));
146 read_unlock_bh(&sk
->sk_callback_lock
);
148 EXPORT_SYMBOL_GPL(nf_log_dump_sk_uid_gid
);
151 nf_log_dump_packet_common(struct nf_log_buf
*m
, u_int8_t pf
,
152 unsigned int hooknum
, const struct sk_buff
*skb
,
153 const struct net_device
*in
,
154 const struct net_device
*out
,
155 const struct nf_loginfo
*loginfo
, const char *prefix
)
157 nf_log_buf_add(m
, KERN_SOH
"%c%sIN=%s OUT=%s ",
158 '0' + loginfo
->u
.log
.level
, prefix
,
160 out
? out
->name
: "");
161 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
162 if (skb
->nf_bridge
) {
163 const struct net_device
*physindev
;
164 const struct net_device
*physoutdev
;
166 physindev
= skb
->nf_bridge
->physindev
;
167 if (physindev
&& in
!= physindev
)
168 nf_log_buf_add(m
, "PHYSIN=%s ", physindev
->name
);
169 physoutdev
= skb
->nf_bridge
->physoutdev
;
170 if (physoutdev
&& out
!= physoutdev
)
171 nf_log_buf_add(m
, "PHYSOUT=%s ", physoutdev
->name
);
175 EXPORT_SYMBOL_GPL(nf_log_dump_packet_common
);
177 static int __init
nf_log_common_init(void)
182 static void __exit
nf_log_common_exit(void) {}
184 module_init(nf_log_common_init
);
185 module_exit(nf_log_common_exit
);
187 MODULE_LICENSE("GPL");