net/ipv6/netfilter/ip6t_LOG.c

   1 /*
   2  * This is a module which is used for logging packets.
   3  */
   4
   5 /* (C) 2001 Jan Rekorajski <baggins@pld.org.pl>
   6  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  */
  12
  13 #include <linux/module.h>
  14 #include <linux/skbuff.h>
  15 #include <linux/ip.h>
  16 #include <linux/spinlock.h>
  17 #include <linux/icmpv6.h>
  18 #include <net/udp.h>
  19 #include <net/tcp.h>
  20 #include <net/ipv6.h>
  21 #include <linux/netfilter.h>
  22 #include <linux/netfilter_ipv6/ip6_tables.h>
  23
  24 MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
  25 MODULE_DESCRIPTION("IP6 tables LOG target module");
  26 MODULE_LICENSE("GPL");
  27
  28 static unsigned int nflog = 1;
  29 MODULE_PARM(nflog, "i");
  30 MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
  31
  32 struct in_device;
  33 #include <net/route.h>
  34 #include <linux/netfilter_ipv6/ip6t_LOG.h>
  35
  36 #if 0
  37 #define DEBUGP printk
  38 #else
  39 #define DEBUGP(format, args...)
  40 #endif
  41
  42 struct esphdr {
  43         __u32   spi;
  44 }; /* FIXME evil kludge */
  45
  46 /* Use lock to serialize, so printks don't overlap */
  47 static spinlock_t log_lock = SPIN_LOCK_UNLOCKED;
  48
  49 /* takes in current header and pointer to the header */
  50 /* if another header exists, sets hdrptr to the next header
  51    and returns the new header value, else returns IPPROTO_NONE */
  52 static u_int8_t ip6_nexthdr(u_int8_t currenthdr, u_int8_t **hdrptr)
  53 {
  54         u_int8_t hdrlen, nexthdr = IPPROTO_NONE;
  55
  56         switch(currenthdr){
  57                 case IPPROTO_AH:
  58                 /* whoever decided to do the length of AUTH for ipv6
  59                 in 32bit units unlike other headers should be beaten...
  60                 repeatedly...with a large stick...no, an even LARGER
  61                 stick...no, you're still not thinking big enough */
  62                         nexthdr = **hdrptr;
  63                         hdrlen = *hdrptr[1] * 4 + 8;
  64                         *hdrptr = *hdrptr + hdrlen;
  65                         break;
  66                 /*stupid rfc2402 */
  67                 case IPPROTO_DSTOPTS:
  68                 case IPPROTO_ROUTING:
  69                 case IPPROTO_HOPOPTS:
  70                         nexthdr = **hdrptr;
  71                         hdrlen = *hdrptr[1] * 8 + 8;
  72                         *hdrptr = *hdrptr + hdrlen;
  73                         break;
  74                 case IPPROTO_FRAGMENT:
  75                         nexthdr = **hdrptr;
  76                         *hdrptr = *hdrptr + 8;
  77                         break;
  78         }
  79         return nexthdr;
  80 }
  81
  82 /* One level of recursion won't kill us */
  83 static void dump_packet(const struct ip6t_log_info *info,
  84                         struct ipv6hdr *ipv6h, int recurse)
  85 {
  86         u_int8_t currenthdr = ipv6h->nexthdr;
  87         u_int8_t *hdrptr;
  88         int fragment;
  89
  90         /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000" */
  91         printk("SRC=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->saddr));
  92         printk("DST=%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x ", NIP6(ipv6h->daddr));
  93
  94         /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
  95         printk("LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
  96                ntohs(ipv6h->payload_len) + sizeof(struct ipv6hdr),
  97                (ntohl(*(u_int32_t *)ipv6h) & 0x0ff00000) >> 20,
  98                ipv6h->hop_limit,
  99                (ntohl(*(u_int32_t *)ipv6h) & 0x000fffff));
 100
 101         fragment = 0;
 102         hdrptr = (u_int8_t *)(ipv6h + 1);
 103         while (currenthdr != IPPROTO_NONE) {
 104                 if ((currenthdr == IPPROTO_TCP) ||
 105                     (currenthdr == IPPROTO_UDP) ||
 106                     (currenthdr == IPPROTO_ICMPV6))
 107                         break;
 108                 /* Max length: 48 "OPT (...) " */
 109                 printk("OPT ( ");
 110                 switch (currenthdr) {
 111                 case IPPROTO_FRAGMENT: {
 112                         struct frag_hdr *fhdr = (struct frag_hdr *)hdrptr;
 113
 114                         /* Max length: 11 "FRAG:65535 " */
 115                         printk("FRAG:%u ", ntohs(fhdr->frag_off) & 0xFFF8);
 116
 117                         /* Max length: 11 "INCOMPLETE " */
 118                         if (fhdr->frag_off & htons(0x0001))
 119                                 printk("INCOMPLETE ");
 120
 121                         printk("ID:%08x ", fhdr->identification);
 122
 123                         if (ntohs(fhdr->frag_off) & 0xFFF8)
 124                                 fragment = 1;
 125
 126                         break;
 127                 }
 128                 case IPPROTO_DSTOPTS:
 129                 case IPPROTO_ROUTING:
 130                 case IPPROTO_HOPOPTS:
 131                         break;
 132                 /* Max Length */
 133                 case IPPROTO_AH:
 134                 case IPPROTO_ESP:
 135                         if (info->logflags & IP6T_LOG_IPOPT) {
 136                                 struct esphdr *esph = (struct esphdr *)hdrptr;
 137                                 int esp = (currenthdr == IPPROTO_ESP);
 138
 139                                 /* Max length: 4 "ESP " */
 140                                 printk("%s ",esp ? "ESP" : "AH");
 141
 142                                 /* Length: 15 "SPI=0xF1234567 " */
 143                                 printk("SPI=0x%x ", ntohl(esph->spi) );
 144                                 break;
 145                         }
 146                 default:
 147                         break;
 148                 }
 149                 printk(") ");
 150                 currenthdr = ip6_nexthdr(currenthdr, &hdrptr);
 151         }
 152
 153         switch (currenthdr) {
 154         case IPPROTO_TCP: {
 155                 struct tcphdr *tcph = (struct tcphdr *)hdrptr;
 156
 157                 /* Max length: 10 "PROTO=TCP " */
 158                 printk("PROTO=TCP ");
 159
 160                 if (fragment)
 161                         break;
 162
 163                 /* Max length: 20 "SPT=65535 DPT=65535 " */
 164                 printk("SPT=%u DPT=%u ",
 165                        ntohs(tcph->source), ntohs(tcph->dest));
 166                 /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
 167                 if (info->logflags & IP6T_LOG_TCPSEQ)
 168                         printk("SEQ=%u ACK=%u ",
 169                                ntohl(tcph->seq), ntohl(tcph->ack_seq));
 170                 /* Max length: 13 "WINDOW=65535 " */
 171                 printk("WINDOW=%u ", ntohs(tcph->window));
 172                 /* Max length: 9 "RES=0x3F " */
 173                 printk("RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(tcph) & TCP_RESERVED_BITS) >> 22));
 174                 /* Max length: 32 "CWR ECE URG ACK PSH RST SYN FIN " */
 175                 if (tcph->cwr)
 176                         printk("CWR ");
 177                 if (tcph->ece)
 178                         printk("ECE ");
 179                 if (tcph->urg)
 180                         printk("URG ");
 181                 if (tcph->ack)
 182                         printk("ACK ");
 183                 if (tcph->psh)
 184                         printk("PSH ");
 185                 if (tcph->rst)
 186                         printk("RST ");
 187                 if (tcph->syn)
 188                         printk("SYN ");
 189                 if (tcph->fin)
 190                         printk("FIN ");
 191                 /* Max length: 11 "URGP=65535 " */
 192                 printk("URGP=%u ", ntohs(tcph->urg_ptr));
 193
 194                 if ((info->logflags & IP6T_LOG_TCPOPT)
 195                     && tcph->doff * 4 != sizeof(struct tcphdr)) {
 196                         unsigned int i;
 197
 198                         /* Max length: 127 "OPT (" 15*4*2chars ") " */
 199                         printk("OPT (");
 200                         for (i =sizeof(struct tcphdr); i < tcph->doff * 4; i++)
 201                                 printk("%02X", ((u_int8_t *)tcph)[i]);
 202                         printk(") ");
 203                 }
 204                 break;
 205         }
 206         case IPPROTO_UDP: {
 207                 struct udphdr *udph = (struct udphdr *)hdrptr;
 208
 209                 /* Max length: 10 "PROTO=UDP " */
 210                 printk("PROTO=UDP ");
 211
 212                 if (fragment)
 213                         break;
 214
 215                 /* Max length: 20 "SPT=65535 DPT=65535 " */
 216                 printk("SPT=%u DPT=%u LEN=%u ",
 217                        ntohs(udph->source), ntohs(udph->dest),
 218                        ntohs(udph->len));
 219                 break;
 220         }
 221         case IPPROTO_ICMPV6: {
 222                 struct icmp6hdr *icmp6h = (struct icmp6hdr *)hdrptr;
 223
 224                 /* Max length: 13 "PROTO=ICMPv6 " */
 225                 printk("PROTO=ICMPv6 ");
 226
 227                 if (fragment)
 228                         break;
 229
 230                 /* Max length: 18 "TYPE=255 CODE=255 " */
 231                 printk("TYPE=%u CODE=%u ", icmp6h->icmp6_type, icmp6h->icmp6_code);
 232
 233                 switch (icmp6h->icmp6_type) {
 234                 case ICMPV6_ECHO_REQUEST:
 235                 case ICMPV6_ECHO_REPLY:
 236                         /* Max length: 19 "ID=65535 SEQ=65535 " */
 237                         printk("ID=%u SEQ=%u ",
 238                                 ntohs(icmp6h->icmp6_identifier),
 239                                 ntohs(icmp6h->icmp6_sequence));
 240                         break;
 241                 case ICMPV6_MGM_QUERY:
 242                 case ICMPV6_MGM_REPORT:
 243                 case ICMPV6_MGM_REDUCTION:
 244                         break;
 245
 246                 case ICMPV6_PARAMPROB:
 247                         /* Max length: 17 "POINTER=ffffffff " */
 248                         printk("POINTER=%08x ", ntohl(icmp6h->icmp6_pointer));
 249                         /* Fall through */
 250                 case ICMPV6_DEST_UNREACH:
 251                 case ICMPV6_PKT_TOOBIG:
 252                 case ICMPV6_TIME_EXCEED:
 253                         /* Max length: 3+maxlen */
 254                         if (recurse) {
 255                                 printk("[");
 256                                 dump_packet(info, (struct ipv6hdr *)(icmp6h + 1), 0);
 257                                 printk("] ");
 258                         }
 259
 260                         /* Max length: 10 "MTU=65535 " */
 261                         if (icmp6h->icmp6_type == ICMPV6_PKT_TOOBIG)
 262                                 printk("MTU=%u ", ntohl(icmp6h->icmp6_mtu));
 263                 }
 264                 break;
 265         }
 266         /* Max length: 10 "PROTO=255 " */
 267         default:
 268                 printk("PROTO=%u ", currenthdr);
 269         }
 270 }
 271
 272 static void
 273 ip6t_log_packet(unsigned int hooknum,
 274                 const struct sk_buff *skb,
 275                 const struct net_device *in,
 276                 const struct net_device *out,
 277                 const struct ip6t_log_info *loginfo,
 278                 const char *level_string,
 279                 const char *prefix)
 280 {
 281         struct ipv6hdr *ipv6h = skb->nh.ipv6h;
 282
 283         spin_lock_bh(&log_lock);
 284         printk(level_string);
 285         printk("%sIN=%s OUT=%s ",
 286                 prefix == NULL ? loginfo->prefix : prefix,
 287                 in ? in->name : "",
 288                 out ? out->name : "");
 289         if (in && !out) {
 290                 /* MAC logging for input chain only. */
 291                 printk("MAC=");
 292                 if (skb->dev && skb->dev->hard_header_len && skb->mac.raw != (void*)ipv6h) {
 293                         if (skb->dev->type != ARPHRD_SIT){
 294                           int i;
 295                           unsigned char *p = skb->mac.raw;
 296                           for (i = 0; i < skb->dev->hard_header_len; i++,p++)
 297                                 printk("%02x%c", *p,
 298                                         i==skb->dev->hard_header_len - 1
 299                                         ? ' ':':');
 300                         } else {
 301                           int i;
 302                           unsigned char *p = skb->mac.raw;
 303                           if ( p - (ETH_ALEN*2+2) > skb->head ){
 304                             p -= (ETH_ALEN+2);
 305                             for (i = 0; i < (ETH_ALEN); i++,p++)
 306                                 printk("%02x%s", *p,
 307                                         i == ETH_ALEN-1 ? "->" : ":");
 308                             p -= (ETH_ALEN*2);
 309                             for (i = 0; i < (ETH_ALEN); i++,p++)
 310                                 printk("%02x%c", *p,
 311                                         i == ETH_ALEN-1 ? ' ' : ':');
 312                           }
 313
 314                           if ((skb->dev->addr_len == 4) &&
 315                               skb->dev->hard_header_len > 20){
 316                             printk("TUNNEL=");
 317                             p = skb->mac.raw + 12;
 318                             for (i = 0; i < 4; i++,p++)
 319                                 printk("%3d%s", *p,
 320                                         i == 3 ? "->" : ".");
 321                             for (i = 0; i < 4; i++,p++)
 322                                 printk("%3d%c", *p,
 323                                         i == 3 ? ' ' : '.');
 324                           }
 325                         }
 326                 } else
 327                         printk(" ");
 328         }
 329
 330         dump_packet(loginfo, ipv6h, 1);
 331         printk("\n");
 332         spin_unlock_bh(&log_lock);
 333 }
 334
 335 static unsigned int
 336 ip6t_log_target(struct sk_buff **pskb,
 337                 unsigned int hooknum,
 338                 const struct net_device *in,
 339                 const struct net_device *out,
 340                 const void *targinfo,
 341                 void *userinfo)
 342 {
 343         const struct ip6t_log_info *loginfo = targinfo;
 344         char level_string[4] = "< >";
 345
 346         level_string[1] = '0' + (loginfo->level % 8);
 347         ip6t_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
 348
 349         return IP6T_CONTINUE;
 350 }
 351
 352 static void
 353 ip6t_logfn(unsigned int hooknum,
 354            const struct sk_buff *skb,
 355            const struct net_device *in,
 356            const struct net_device *out,
 357            const char *prefix)
 358 {
 359         struct ip6t_log_info loginfo = {
 360                 .level = 0,
 361                 .logflags = IP6T_LOG_MASK,
 362                 .prefix = ""
 363         };
 364
 365         ip6t_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
 366 }
 367
 368 static int ip6t_log_checkentry(const char *tablename,
 369                                const struct ip6t_entry *e,
 370                                void *targinfo,
 371                                unsigned int targinfosize,
 372                                unsigned int hook_mask)
 373 {
 374         const struct ip6t_log_info *loginfo = targinfo;
 375
 376         if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_log_info))) {
 377                 DEBUGP("LOG: targinfosize %u != %u\n",
 378                        targinfosize, IP6T_ALIGN(sizeof(struct ip6t_log_info)));
 379                 return 0;
 380         }
 381
 382         if (loginfo->level >= 8) {
 383                 DEBUGP("LOG: level %u >= 8\n", loginfo->level);
 384                 return 0;
 385         }
 386
 387         if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
 388                 DEBUGP("LOG: prefix term %i\n",
 389                        loginfo->prefix[sizeof(loginfo->prefix)-1]);
 390                 return 0;
 391         }
 392
 393         return 1;
 394 }
 395
 396 static struct ip6t_target ip6t_log_reg = {
 397         .name           = "LOG",
 398         .target         = ip6t_log_target,
 399         .checkentry     = ip6t_log_checkentry,
 400         .me             = THIS_MODULE,
 401 };
 402
 403 static int __init init(void)
 404 {
 405         if (ip6t_register_target(&ip6t_log_reg))
 406                 return -EINVAL;
 407         if (nflog)
 408                 nf_log_register(PF_INET6, &ip6t_logfn);
 409
 410         return 0;
 411 }
 412
 413 static void __exit fini(void)
 414 {
 415         if (nflog)
 416                 nf_log_unregister(PF_INET6, &ip6t_logfn);
 417         ip6t_unregister_target(&ip6t_log_reg);
 418 }
 419
 420 module_init(init);
 421 module_exit(fini);