net/netfilter/nf_log_common.c

   1 /* (C) 1999-2001 Paul `Rusty' Russell
   2  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/spinlock.h>
  11 #include <linux/skbuff.h>
  12 #include <linux/if_arp.h>
  13 #include <linux/ip.h>
  14 #include <net/icmp.h>
  15 #include <net/udp.h>
  16 #include <net/tcp.h>
  17 #include <net/route.h>
  18
  19 #include <linux/netfilter.h>
  20 #include <linux/netfilter_bridge.h>
  21 #include <linux/netfilter/xt_LOG.h>
  22 #include <net/netfilter/nf_log.h>
  23
  24 int nf_log_dump_udp_header(struct nf_log_buf *m, const struct sk_buff *skb,
  25                            u8 proto, int fragment, unsigned int offset)
  26 {
  27         struct udphdr _udph;
  28         const struct udphdr *uh;
  29
  30         if (proto == IPPROTO_UDP)
  31                 /* Max length: 10 "PROTO=UDP "     */
  32                 nf_log_buf_add(m, "PROTO=UDP ");
  33         else    /* Max length: 14 "PROTO=UDPLITE " */
  34                 nf_log_buf_add(m, "PROTO=UDPLITE ");
  35
  36         if (fragment)
  37                 goto out;
  38
  39         /* Max length: 25 "INCOMPLETE [65535 bytes] " */
  40         uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
  41         if (uh == NULL) {
  42                 nf_log_buf_add(m, "INCOMPLETE [%u bytes] ", skb->len - offset);
  43
  44                 return 1;
  45         }
  46
  47         /* Max length: 20 "SPT=65535 DPT=65535 " */
  48         nf_log_buf_add(m, "SPT=%u DPT=%u LEN=%u ",
  49                        ntohs(uh->source), ntohs(uh->dest), ntohs(uh->len));
  50
  51 out:
  52         return 0;
  53 }
  54 EXPORT_SYMBOL_GPL(nf_log_dump_udp_header);
  55
  56 int nf_log_dump_tcp_header(struct nf_log_buf *m, const struct sk_buff *skb,
  57                            u8 proto, int fragment, unsigned int offset,
  58                            unsigned int logflags)
  59 {
  60         struct tcphdr _tcph;
  61         const struct tcphdr *th;
  62
  63         /* Max length: 10 "PROTO=TCP " */
  64         nf_log_buf_add(m, "PROTO=TCP ");
  65
  66         if (fragment)
  67                 return 0;
  68
  69         /* Max length: 25 "INCOMPLETE [65535 bytes] " */
  70         th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
  71         if (th == NULL) {
  72                 nf_log_buf_add(m, "INCOMPLETE [%u bytes] ", skb->len - offset);
  73                 return 1;
  74         }
  75
  76         /* Max length: 20 "SPT=65535 DPT=65535 " */
  77         nf_log_buf_add(m, "SPT=%u DPT=%u ",
  78                        ntohs(th->source), ntohs(th->dest));
  79         /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
  80         if (logflags & NF_LOG_TCPSEQ) {
  81                 nf_log_buf_add(m, "SEQ=%u ACK=%u ",
  82                                ntohl(th->seq), ntohl(th->ack_seq));
  83         }
  84
  85         /* Max length: 13 "WINDOW=65535 " */
  86         nf_log_buf_add(m, "WINDOW=%u ", ntohs(th->window));
  87         /* Max length: 9 "RES=0x3C " */
  88         nf_log_buf_add(m, "RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) &
  89                                             TCP_RESERVED_BITS) >> 22));
  90         /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
  91         if (th->cwr)
  92                 nf_log_buf_add(m, "CWR ");
  93         if (th->ece)
  94                 nf_log_buf_add(m, "ECE ");
  95         if (th->urg)
  96                 nf_log_buf_add(m, "URG ");
  97         if (th->ack)
  98                 nf_log_buf_add(m, "ACK ");
  99         if (th->psh)
 100                 nf_log_buf_add(m, "PSH ");
 101         if (th->rst)
 102                 nf_log_buf_add(m, "RST ");
 103         if (th->syn)
 104                 nf_log_buf_add(m, "SYN ");
 105         if (th->fin)
 106                 nf_log_buf_add(m, "FIN ");
 107         /* Max length: 11 "URGP=65535 " */
 108         nf_log_buf_add(m, "URGP=%u ", ntohs(th->urg_ptr));
 109
 110         if ((logflags & NF_LOG_TCPOPT) && th->doff*4 > sizeof(struct tcphdr)) {
 111                 u_int8_t _opt[60 - sizeof(struct tcphdr)];
 112                 const u_int8_t *op;
 113                 unsigned int i;
 114                 unsigned int optsize = th->doff*4 - sizeof(struct tcphdr);
 115
 116                 op = skb_header_pointer(skb, offset + sizeof(struct tcphdr),
 117                                         optsize, _opt);
 118                 if (op == NULL) {
 119                         nf_log_buf_add(m, "OPT (TRUNCATED)");
 120                         return 1;
 121                 }
 122
 123                 /* Max length: 127 "OPT (" 15*4*2chars ") " */
 124                 nf_log_buf_add(m, "OPT (");
 125                 for (i = 0; i < optsize; i++)
 126                         nf_log_buf_add(m, "%02X", op[i]);
 127
 128                 nf_log_buf_add(m, ") ");
 129         }
 130
 131         return 0;
 132 }
 133 EXPORT_SYMBOL_GPL(nf_log_dump_tcp_header);
 134
 135 void nf_log_dump_sk_uid_gid(struct nf_log_buf *m, struct sock *sk)
 136 {
 137         if (!sk || !sk_fullsock(sk))
 138                 return;
 139
 140         read_lock_bh(&sk->sk_callback_lock);
 141         if (sk->sk_socket && sk->sk_socket->file) {
 142                 const struct cred *cred = sk->sk_socket->file->f_cred;
 143                 nf_log_buf_add(m, "UID=%u GID=%u ",
 144                         from_kuid_munged(&init_user_ns, cred->fsuid),
 145                         from_kgid_munged(&init_user_ns, cred->fsgid));
 146         }
 147         read_unlock_bh(&sk->sk_callback_lock);
 148 }
 149 EXPORT_SYMBOL_GPL(nf_log_dump_sk_uid_gid);
 150
 151 void
 152 nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf,
 153                           unsigned int hooknum, const struct sk_buff *skb,
 154                           const struct net_device *in,
 155                           const struct net_device *out,
 156                           const struct nf_loginfo *loginfo, const char *prefix)
 157 {
 158         nf_log_buf_add(m, KERN_SOH "%c%sIN=%s OUT=%s ",
 159                '0' + loginfo->u.log.level, prefix,
 160                in ? in->name : "",
 161                out ? out->name : "");
 162 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
 163         if (skb->nf_bridge) {
 164                 const struct net_device *physindev;
 165                 const struct net_device *physoutdev;
 166
 167                 physindev = nf_bridge_get_physindev(skb);
 168                 if (physindev && in != physindev)
 169                         nf_log_buf_add(m, "PHYSIN=%s ", physindev->name);
 170                 physoutdev = nf_bridge_get_physoutdev(skb);
 171                 if (physoutdev && out != physoutdev)
 172                         nf_log_buf_add(m, "PHYSOUT=%s ", physoutdev->name);
 173         }
 174 #endif
 175 }
 176 EXPORT_SYMBOL_GPL(nf_log_dump_packet_common);
 177
 178 /* bridge and netdev logging families share this code. */
 179 void nf_log_l2packet(struct net *net, u_int8_t pf,
 180                      __be16 protocol,
 181                      unsigned int hooknum,
 182                      const struct sk_buff *skb,
 183                      const struct net_device *in,
 184                      const struct net_device *out,
 185                      const struct nf_loginfo *loginfo,
 186                      const char *prefix)
 187 {
 188         switch (protocol) {
 189         case htons(ETH_P_IP):
 190                 nf_log_packet(net, NFPROTO_IPV4, hooknum, skb, in, out,
 191                               loginfo, "%s", prefix);
 192                 break;
 193         case htons(ETH_P_IPV6):
 194                 nf_log_packet(net, NFPROTO_IPV6, hooknum, skb, in, out,
 195                               loginfo, "%s", prefix);
 196                 break;
 197         case htons(ETH_P_ARP):
 198         case htons(ETH_P_RARP):
 199                 nf_log_packet(net, NFPROTO_ARP, hooknum, skb, in, out,
 200                               loginfo, "%s", prefix);
 201                 break;
 202         }
 203 }
 204 EXPORT_SYMBOL_GPL(nf_log_l2packet);
 205
 206 static int __init nf_log_common_init(void)
 207 {
 208         return 0;
 209 }
 210
 211 static void __exit nf_log_common_exit(void) {}
 212
 213 module_init(nf_log_common_init);
 214 module_exit(nf_log_common_exit);
 215
 216 MODULE_LICENSE("GPL");