net/ipv6/netfilter/ip6t_LOG.c

   1 /*
   2  * This is a module which is used for logging packets.
   3  */
   4
   5 /* (C) 2001 Jan Rekorajski <baggins@pld.org.pl>
   6  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #include <linux/module.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/ip.h>
  16 #include <linux/spinlock.h>
  17 #include <linux/icmpv6.h>
  18 #include <net/udp.h>
  19 #include <net/tcp.h>
  20 #include <net/ipv6.h>
  21 #include <linux/netfilter.h>
  22 #include <linux/netfilter_ipv6/ip6_tables.h>
  23
  24 MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
  25 MODULE_DESCRIPTION("IP6 tables LOG target module");
  26 MODULE_LICENSE("GPL");
  27
  28 static unsigned int nflog = 1;
  29 MODULE_PARM(nflog, "i");
  30 MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
  31
  32 struct in_device;
  33 #include <net/route.h>
  34 #include <linux/netfilter_ipv6/ip6t_LOG.h>
  35
  36 #if 0
  37 #define DEBUGP printk
  38 #else
  39 #define DEBUGP(format, args...)
  40 #endif
  41
  42 struct esphdr {
  43         __u32   spi;
  44 }; /* FIXME evil kludge */
  45
  46 /* Use lock to serialize, so printks don't overlap */
  47 static spinlock_t log_lock = SPIN_LOCK_UNLOCKED;
  48
  49 /* takes in current header and pointer to the header */
  50 /* if another header exists, sets hdrptr to the next header
  51    and returns the new header value, else returns 0 */
  52 static u_int8_t ip6_nexthdr(u_int8_t currenthdr, u_int8_t **hdrptr)
  53 {
  54         u_int8_t hdrlen, nexthdr = 0;
  55
  56         switch(currenthdr){
  57                 case IPPROTO_AH:
  58                 /* whoever decided to do the length of AUTH for ipv6
  59                 in 32bit units unlike other headers should be beaten...
  60                 repeatedly...with a large stick...no, an even LARGER
  61                 stick...no, you're still not thinking big enough */
  62                         nexthdr = **hdrptr;
  63                         hdrlen = *hdrptr[1] * 4 + 8;
  64                         *hdrptr = *hdrptr + hdrlen;
  65                         break;
  66                 /*stupid rfc2402 */
  67                 case IPPROTO_DSTOPTS:
  68                 case IPPROTO_ROUTING:
  69                 case IPPROTO_HOPOPTS:
  70                         nexthdr = **hdrptr;
  71                         hdrlen = *hdrptr[1] * 8 + 8;
  72                         *hdrptr = *hdrptr + hdrlen;
  73                         break;
  74                 case IPPROTO_FRAGMENT:
  75                         nexthdr = **hdrptr;
  76                         *hdrptr = *hdrptr + 8;
  77                         break;
  78         }
  79         return nexthdr;
  80
  81 }
  82
  83 /* One level of recursion won't kill us */
  84 static void dump_packet(const struct ip6t_log_info *info,
  85                         struct ipv6hdr *ipv6h, int recurse)
  86 {
  87         u_int8_t currenthdr = ipv6h->nexthdr;
  88         u_int8_t *hdrptr;
  89         int fragment;
  90
  91         /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000" */
  92         printk("SRC=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->saddr));
  93         printk("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->daddr));
  94
  95         /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
  96         printk("LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
  97                ntohs(ipv6h->payload_len) + sizeof(struct ipv6hdr),
  98                (ntohl(*(u_int32_t *)ipv6h) & 0x0ff00000) >> 20,
  99                ipv6h->hop_limit,
 100                (ntohl(*(u_int32_t *)ipv6h) & 0x000fffff));
 101
 102         fragment = 0;
 103         hdrptr = (u_int8_t *)(ipv6h + 1);
 104         while (currenthdr) {
 105                 if ((currenthdr == IPPROTO_TCP) ||
 106                     (currenthdr == IPPROTO_UDP) ||
 107                     (currenthdr == IPPROTO_ICMPV6))
 108                         break;
 109                 /* Max length: 48 "OPT (...) " */
 110                 printk("OPT ( ");
 111                 switch (currenthdr) {
 112                 case IPPROTO_FRAGMENT: {
 113                         struct frag_hdr *fhdr = (struct frag_hdr *)hdrptr;
 114
 115                         /* Max length: 11 "FRAG:65535 " */
 116                         printk("FRAG:%u ", ntohs(fhdr->frag_off) & 0xFFF8);
 117
 118                         /* Max length: 11 "INCOMPLETE " */
 119                         if (fhdr->frag_off & htons(0x0001))
 120                                 printk("INCOMPLETE ");
 121
 122                         printk("ID:%08x ", fhdr->identification);
 123
 124                         if (ntohs(fhdr->frag_off) & 0xFFF8)
 125                                 fragment = 1;
 126
 127                         break;
 128                 }
 129                 case IPPROTO_DSTOPTS:
 130                 case IPPROTO_ROUTING:
 131                 case IPPROTO_HOPOPTS:
 132                         break;
 133                 /* Max Length */
 134                 case IPPROTO_AH:
 135                 case IPPROTO_ESP:
 136                         if (info->logflags & IP6T_LOG_IPOPT) {
 137                                 struct esphdr *esph = (struct esphdr *)hdrptr;
 138                                 int esp = (currenthdr == IPPROTO_ESP);
 139
 140                                 /* Max length: 4 "ESP " */
 141                                 printk("%s ",esp ? "ESP" : "AH");
 142
 143                                 /* Length: 15 "SPI=0xF1234567 " */
 144                                 printk("SPI=0x%x ", ntohl(esph->spi) );
 145                                 break;
 146                         }
 147                 default:
 148                         break;
 149                 }
 150                 printk(") ");
 151                 currenthdr = ip6_nexthdr(currenthdr, &hdrptr);
 152         }
 153
 154         switch (currenthdr) {
 155         case IPPROTO_TCP: {
 156                 struct tcphdr *tcph = (struct tcphdr *)hdrptr;
 157
 158                 /* Max length: 10 "PROTO=TCP " */
 159                 printk("PROTO=TCP ");
 160
 161                 if (fragment)
 162                         break;
 163
 164                 /* Max length: 20 "SPT=65535 DPT=65535 " */
 165                 printk("SPT=%u DPT=%u ",
 166                        ntohs(tcph->source), ntohs(tcph->dest));
 167                 /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
 168                 if (info->logflags & IP6T_LOG_TCPSEQ)
 169                         printk("SEQ=%u ACK=%u ",
 170                                ntohl(tcph->seq), ntohl(tcph->ack_seq));
 171                 /* Max length: 13 "WINDOW=65535 " */
 172                 printk("WINDOW=%u ", ntohs(tcph->window));
 173                 /* Max length: 9 "RES=0x3F " */
 174                 printk("RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(tcph) & TCP_RESERVED_BITS) >> 22));
 175                 /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
 176                 if (tcph->cwr)
 177                         printk("CWR ");
 178                 if (tcph->ece)
 179                         printk("ECE ");
 180                 if (tcph->urg)
 181                         printk("URG ");
 182                 if (tcph->ack)
 183                         printk("ACK ");
 184                 if (tcph->psh)
 185                         printk("PSH ");
 186                 if (tcph->rst)
 187                         printk("RST ");
 188                 if (tcph->syn)
 189                         printk("SYN ");
 190                 if (tcph->fin)
 191                         printk("FIN ");
 192                 /* Max length: 11 "URGP=65535 " */
 193                 printk("URGP=%u ", ntohs(tcph->urg_ptr));
 194
 195                 if ((info->logflags & IP6T_LOG_TCPOPT)
 196                     && tcph->doff * 4 != sizeof(struct tcphdr)) {
 197                         unsigned int i;
 198
 199                         /* Max length: 127 "OPT (" 15*4*2chars ") " */
 200                         printk("OPT (");
 201                         for (i =sizeof(struct tcphdr); i < tcph->doff * 4; i++)
 202                                 printk("%02X", ((u_int8_t *)tcph)[i]);
 203                         printk(") ");
 204                 }
 205                 break;
 206         }
 207         case IPPROTO_UDP: {
 208                 struct udphdr *udph = (struct udphdr *)hdrptr;
 209
 210                 /* Max length: 10 "PROTO=UDP " */
 211                 printk("PROTO=UDP ");
 212
 213                 if (fragment)
 214                         break;
 215
 216                 /* Max length: 20 "SPT=65535 DPT=65535 " */
 217                 printk("SPT=%u DPT=%u LEN=%u ",
 218                        ntohs(udph->source), ntohs(udph->dest),
 219                        ntohs(udph->len));
 220                 break;
 221         }
 222         case IPPROTO_ICMPV6: {
 223                 struct icmp6hdr *icmp6h = (struct icmp6hdr *)hdrptr;
 224
 225                 /* Max length: 13 "PROTO=ICMPv6 " */
 226                 printk("PROTO=ICMPv6 ");
 227
 228                 if (fragment)
 229                         break;
 230
 231                 /* Max length: 18 "TYPE=255 CODE=255 " */
 232                 printk("TYPE=%u CODE=%u ", icmp6h->icmp6_type, icmp6h->icmp6_code);
 233
 234                 switch (icmp6h->icmp6_type) {
 235                 case ICMPV6_ECHO_REQUEST:
 236                 case ICMPV6_ECHO_REPLY:
 237                         /* Max length: 19 "ID=65535 SEQ=65535 " */
 238                         printk("ID=%u SEQ=%u ",
 239                                 ntohs(icmp6h->icmp6_identifier),
 240                                 ntohs(icmp6h->icmp6_sequence));
 241                         break;
 242                 case ICMPV6_MGM_QUERY:
 243                 case ICMPV6_MGM_REPORT:
 244                 case ICMPV6_MGM_REDUCTION:
 245                         break;
 246
 247                 case ICMPV6_PARAMPROB:
 248                         /* Max length: 17 "POINTER=ffffffff " */
 249                         printk("POINTER=%08x ", ntohl(icmp6h->icmp6_pointer));
 250                         /* Fall through */
 251                 case ICMPV6_DEST_UNREACH:
 252                 case ICMPV6_PKT_TOOBIG:
 253                 case ICMPV6_TIME_EXCEED:
 254                         /* Max length: 3+maxlen */
 255                         if (recurse) {
 256                                 printk("[");
 257                                 dump_packet(info, (struct ipv6hdr *)(icmp6h + 1), 0);
 258                                 printk("] ");
 259                         }
 260
 261                         /* Max length: 10 "MTU=65535 " */
 262                         if (icmp6h->icmp6_type == ICMPV6_PKT_TOOBIG)
 263                                 printk("MTU=%u ", ntohl(icmp6h->icmp6_mtu));
 264                 }
 265                 break;
 266         }
 267         /* Max length: 10 "PROTO 255 " */
 268         default:
 269                 printk("PROTO=%u ", currenthdr);
 270         }
 271 }
 272
 273 static void
 274 ip6t_log_packet(unsigned int hooknum,
 275                 const struct sk_buff *skb,
 276                 const struct net_device *in,
 277                 const struct net_device *out,
 278                 const struct ip6t_log_info *loginfo,
 279                 const char *level_string,
 280                 const char *prefix)
 281 {
 282         struct ipv6hdr *ipv6h = skb->nh.ipv6h;
 283
 284         spin_lock_bh(&log_lock);
 285         printk(level_string);
 286         printk("%sIN=%s OUT=%s ",
 287                 prefix == NULL ? loginfo->prefix : prefix,
 288                 in ? in->name : "",
 289                 out ? out->name : "");
 290         if (in && !out) {
 291                 /* MAC logging for input chain only. */
 292                 printk("MAC=");
 293                 if (skb->dev && skb->dev->hard_header_len && skb->mac.raw != (void*)ipv6h) {
 294                         if (skb->dev->type != ARPHRD_SIT){
 295                           int i;
 296                           unsigned char *p = skb->mac.raw;
 297                           for (i = 0; i < skb->dev->hard_header_len; i++,p++)
 298                                 printk("%02x%c", *p,
 299                                         i==skb->dev->hard_header_len - 1
 300                                         ? ' ':':');
 301                         } else {
 302                           int i;
 303                           unsigned char *p = skb->mac.raw;
 304                           if ( p - (ETH_ALEN*2+2) > skb->head ){
 305                             p -= (ETH_ALEN+2);
 306                             for (i = 0; i < (ETH_ALEN); i++,p++)
 307                                 printk("%02x%s", *p,
 308                                         i == ETH_ALEN-1 ? "->" : ":");
 309                             p -= (ETH_ALEN*2);
 310                             for (i = 0; i < (ETH_ALEN); i++,p++)
 311                                 printk("%02x%c", *p,
 312                                         i == ETH_ALEN-1 ? ' ' : ':');
 313                           }
 314
 315                           if ((skb->dev->addr_len == 4) &&
 316                               skb->dev->hard_header_len > 20){
 317                             printk("TUNNEL=");
 318                             p = skb->mac.raw + 12;
 319                             for (i = 0; i < 4; i++,p++)
 320                                 printk("%3d%s", *p,
 321                                         i == 3 ? "->" : ".");
 322                             for (i = 0; i < 4; i++,p++)
 323                                 printk("%3d%c", *p,
 324                                         i == 3 ? ' ' : '.');
 325                           }
 326                         }
 327                 } else
 328                         printk(" ");
 329         }
 330
 331         dump_packet(loginfo, ipv6h, 1);
 332         printk("\n");
 333         spin_unlock_bh(&log_lock);
 334 }
 335
 336 static unsigned int
 337 ip6t_log_target(struct sk_buff **pskb,
 338                 unsigned int hooknum,
 339                 const struct net_device *in,
 340                 const struct net_device *out,
 341                 const void *targinfo,
 342                 void *userinfo)
 343 {
 344         const struct ip6t_log_info *loginfo = targinfo;
 345         char level_string[4] = "< >";
 346
 347         level_string[1] = '0' + (loginfo->level % 8);
 348         ip6t_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
 349
 350         return IP6T_CONTINUE;
 351 }
 352
 353 static void
 354 ip6t_logfn(unsigned int hooknum,
 355            const struct sk_buff *skb,
 356            const struct net_device *in,
 357            const struct net_device *out,
 358            const char *prefix)
 359 {
 360         struct ip6t_log_info loginfo = {
 361                 .level = 0,
 362                 .logflags = IP6T_LOG_MASK,
 363                 .prefix = ""
 364         };
 365
 366         ip6t_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
 367 }
 368
 369 static int ip6t_log_checkentry(const char *tablename,
 370                                const struct ip6t_entry *e,
 371                                void *targinfo,
 372                                unsigned int targinfosize,
 373                                unsigned int hook_mask)
 374 {
 375         const struct ip6t_log_info *loginfo = targinfo;
 376
 377         if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_log_info))) {
 378                 DEBUGP("LOG: targinfosize %u != %u\n",
 379                        targinfosize, IP6T_ALIGN(sizeof(struct ip6t_log_info)));
 380                 return 0;
 381         }
 382
 383         if (loginfo->level >= 8) {
 384                 DEBUGP("LOG: level %u >= 8\n", loginfo->level);
 385                 return 0;
 386         }
 387
 388         if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
 389                 DEBUGP("LOG: prefix term %i\n",
 390                        loginfo->prefix[sizeof(loginfo->prefix)-1]);
 391                 return 0;
 392         }
 393
 394         return 1;
 395 }
 396
 397 static struct ip6t_target ip6t_log_reg = {
 398         .name           = "LOG",
 399         .target         = ip6t_log_target,
 400         .checkentry     = ip6t_log_checkentry,
 401         .me             = THIS_MODULE,
 402 };
 403
 404 static int __init init(void)
 405 {
 406         if (ip6t_register_target(&ip6t_log_reg))
 407                 return -EINVAL;
 408         if (nflog)
 409                 nf_log_register(PF_INET6, &ip6t_logfn);
 410
 411         return 0;
 412 }
 413
 414 static void __exit fini(void)
 415 {
 416         if (nflog)
 417                 nf_log_unregister(PF_INET6, &ip6t_logfn);
 418         ip6t_unregister_target(&ip6t_log_reg);
 419 }
 420
 421 module_init(init);
 422 module_exit(fini);