fab4085f4e
Before this patch, the nf_loginfo parameter specified the logging
configuration in case the specified default logger was loaded. This
patch updates the semantics of the nf_loginfo parameter in
nf_log_packet() which now indicates the logger that you explicitly
want to use.
Thus, nf_log_packet() is exposed as an unified interface which
internally routes the log message to the corresponding logger type
by family.
The module dependencies are expressed by the new nf_logger_find_get()
and nf_logger_put() functions which bump the logger module refcount.
Thus, you can not remove logger modules that are used by rules anymore.
Another important effect of this change is that the family specific
module is only loaded when required. Therefore, xt_LOG and nft_log
will just trigger the autoload of the nf_log_{ip,ip6} modules
according to the family.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
114 lines
2.8 KiB
C
114 lines
2.8 KiB
C
/*
|
|
* This is a module which is used for logging packets.
|
|
*/
|
|
|
|
/* (C) 1999-2001 Paul `Rusty' Russell
|
|
* (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*/
|
|
|
|
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
|
|
#include <linux/module.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/skbuff.h>
|
|
#include <linux/if_arp.h>
|
|
#include <linux/ip.h>
|
|
#include <net/ipv6.h>
|
|
#include <net/icmp.h>
|
|
#include <net/udp.h>
|
|
#include <net/tcp.h>
|
|
#include <net/route.h>
|
|
|
|
#include <linux/netfilter.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
#include <linux/netfilter/xt_LOG.h>
|
|
#include <linux/netfilter_ipv6/ip6_tables.h>
|
|
#include <net/netfilter/nf_log.h>
|
|
|
|
static unsigned int
|
|
log_tg(struct sk_buff *skb, const struct xt_action_param *par)
|
|
{
|
|
const struct xt_log_info *loginfo = par->targinfo;
|
|
struct nf_loginfo li;
|
|
struct net *net = dev_net(par->in ? par->in : par->out);
|
|
|
|
li.type = NF_LOG_TYPE_LOG;
|
|
li.u.log.level = loginfo->level;
|
|
li.u.log.logflags = loginfo->logflags;
|
|
|
|
nf_log_packet(net, par->family, par->hooknum, skb, par->in, par->out,
|
|
&li, loginfo->prefix);
|
|
return XT_CONTINUE;
|
|
}
|
|
|
|
static int log_tg_check(const struct xt_tgchk_param *par)
|
|
{
|
|
const struct xt_log_info *loginfo = par->targinfo;
|
|
|
|
if (par->family != NFPROTO_IPV4 && par->family != NFPROTO_IPV6)
|
|
return -EINVAL;
|
|
|
|
if (loginfo->level >= 8) {
|
|
pr_debug("level %u >= 8\n", loginfo->level);
|
|
return -EINVAL;
|
|
}
|
|
|
|
if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
|
|
pr_debug("prefix is not null-terminated\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
return nf_logger_find_get(par->family, NF_LOG_TYPE_LOG);
|
|
}
|
|
|
|
static void log_tg_destroy(const struct xt_tgdtor_param *par)
|
|
{
|
|
nf_logger_put(par->family, NF_LOG_TYPE_LOG);
|
|
}
|
|
|
|
static struct xt_target log_tg_regs[] __read_mostly = {
|
|
{
|
|
.name = "LOG",
|
|
.family = NFPROTO_IPV4,
|
|
.target = log_tg,
|
|
.targetsize = sizeof(struct xt_log_info),
|
|
.checkentry = log_tg_check,
|
|
.destroy = log_tg_destroy,
|
|
.me = THIS_MODULE,
|
|
},
|
|
#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
|
|
{
|
|
.name = "LOG",
|
|
.family = NFPROTO_IPV6,
|
|
.target = log_tg,
|
|
.targetsize = sizeof(struct xt_log_info),
|
|
.checkentry = log_tg_check,
|
|
.destroy = log_tg_destroy,
|
|
.me = THIS_MODULE,
|
|
},
|
|
#endif
|
|
};
|
|
|
|
static int __init log_tg_init(void)
|
|
{
|
|
return xt_register_targets(log_tg_regs, ARRAY_SIZE(log_tg_regs));
|
|
}
|
|
|
|
static void __exit log_tg_exit(void)
|
|
{
|
|
xt_unregister_targets(log_tg_regs, ARRAY_SIZE(log_tg_regs));
|
|
}
|
|
|
|
module_init(log_tg_init);
|
|
module_exit(log_tg_exit);
|
|
|
|
MODULE_LICENSE("GPL");
|
|
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
|
|
MODULE_AUTHOR("Jan Rekorajski <baggins@pld.org.pl>");
|
|
MODULE_DESCRIPTION("Xtables: IPv4/IPv6 packet logging");
|
|
MODULE_ALIAS("ipt_LOG");
|
|
MODULE_ALIAS("ip6t_LOG");
|