Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 1 | /* Shared library add-on to iptables to add LOG support. */ |
| 2 | #include <stdio.h> |
| 3 | #include <netdb.h> |
| 4 | #include <string.h> |
| 5 | #include <stdlib.h> |
| 6 | #include <syslog.h> |
| 7 | #include <getopt.h> |
Jan Engelhardt | 5d9678a | 2008-11-20 10:15:35 +0100 | [diff] [blame] | 8 | #include <xtables.h> |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 9 | #include <linux/netfilter_ipv4/ipt_LOG.h> |
| 10 | |
| 11 | #define LOG_DEFAULT_LEVEL LOG_WARNING |
| 12 | |
Martin Josefsson | 2b9a577 | 2005-01-05 15:21:15 +0000 | [diff] [blame] | 13 | #ifndef IPT_LOG_UID /* Old kernel */ |
| 14 | #define IPT_LOG_UID 0x08 /* Log UID owning local socket */ |
| 15 | #undef IPT_LOG_MASK |
| 16 | #define IPT_LOG_MASK 0x0f |
| 17 | #endif |
| 18 | |
Jan Engelhardt | 1d5b63d | 2007-10-04 16:29:00 +0000 | [diff] [blame] | 19 | static void LOG_help(void) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 20 | { |
| 21 | printf( |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 22 | "LOG target options:\n" |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 23 | " --log-level level Level of logging (numeric or see syslog.conf)\n" |
| 24 | " --log-prefix prefix Prefix log messages with this prefix.\n\n" |
| 25 | " --log-tcp-sequence Log TCP sequence numbers.\n\n" |
| 26 | " --log-tcp-options Log TCP options.\n\n" |
John Lange | f46e1af | 2005-01-02 23:33:12 +0000 | [diff] [blame] | 27 | " --log-ip-options Log IP options.\n\n" |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 28 | " --log-uid Log UID owning the local socket.\n\n"); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 29 | } |
| 30 | |
Jan Engelhardt | 1d5b63d | 2007-10-04 16:29:00 +0000 | [diff] [blame] | 31 | static const struct option LOG_opts[] = { |
Patrick McHardy | 500f483 | 2007-09-08 15:59:04 +0000 | [diff] [blame] | 32 | { .name = "log-level", .has_arg = 1, .val = '!' }, |
| 33 | { .name = "log-prefix", .has_arg = 1, .val = '#' }, |
| 34 | { .name = "log-tcp-sequence", .has_arg = 0, .val = '1' }, |
| 35 | { .name = "log-tcp-options", .has_arg = 0, .val = '2' }, |
| 36 | { .name = "log-ip-options", .has_arg = 0, .val = '3' }, |
| 37 | { .name = "log-uid", .has_arg = 0, .val = '4' }, |
Max Kellermann | 9ee386a | 2008-01-29 13:48:05 +0000 | [diff] [blame] | 38 | { .name = NULL } |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 39 | }; |
| 40 | |
Jan Engelhardt | 1d5b63d | 2007-10-04 16:29:00 +0000 | [diff] [blame] | 41 | static void LOG_init(struct xt_entry_target *t) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 42 | { |
| 43 | struct ipt_log_info *loginfo = (struct ipt_log_info *)t->data; |
| 44 | |
| 45 | loginfo->level = LOG_DEFAULT_LEVEL; |
| 46 | |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 47 | } |
| 48 | |
| 49 | struct ipt_log_names { |
| 50 | const char *name; |
| 51 | unsigned int level; |
| 52 | }; |
| 53 | |
Jan Engelhardt | 0e2abed | 2007-10-04 16:25:58 +0000 | [diff] [blame] | 54 | static const struct ipt_log_names ipt_log_names[] |
Stephane Ouellette | 2be28ab | 2003-08-11 19:58:56 +0000 | [diff] [blame] | 55 | = { { .name = "alert", .level = LOG_ALERT }, |
| 56 | { .name = "crit", .level = LOG_CRIT }, |
| 57 | { .name = "debug", .level = LOG_DEBUG }, |
| 58 | { .name = "emerg", .level = LOG_EMERG }, |
| 59 | { .name = "error", .level = LOG_ERR }, /* DEPRECATED */ |
| 60 | { .name = "info", .level = LOG_INFO }, |
| 61 | { .name = "notice", .level = LOG_NOTICE }, |
| 62 | { .name = "panic", .level = LOG_EMERG }, /* DEPRECATED */ |
| 63 | { .name = "warning", .level = LOG_WARNING } |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 64 | }; |
| 65 | |
| 66 | static u_int8_t |
| 67 | parse_level(const char *level) |
| 68 | { |
Marc Boucher | 459357f | 2001-09-08 02:16:51 +0000 | [diff] [blame] | 69 | unsigned int lev = -1; |
Harald Welte | 3e44c50 | 2001-10-22 08:16:24 +0000 | [diff] [blame] | 70 | unsigned int set = 0; |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 71 | |
Jan Engelhardt | 5f2922c | 2009-01-27 18:43:01 +0100 | [diff] [blame] | 72 | if (!xtables_strtoui(level, NULL, &lev, 0, 7)) { |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 73 | unsigned int i = 0; |
| 74 | |
Jan Engelhardt | 2c69b55 | 2009-04-30 19:32:02 +0200 | [diff] [blame^] | 75 | for (i = 0; i < ARRAY_SIZE(ipt_log_names); ++i) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 76 | if (strncasecmp(level, ipt_log_names[i].name, |
| 77 | strlen(level)) == 0) { |
Harald Welte | 3e44c50 | 2001-10-22 08:16:24 +0000 | [diff] [blame] | 78 | if (set++) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 79 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 80 | "log-level `%s' ambiguous", |
| 81 | level); |
| 82 | lev = ipt_log_names[i].level; |
| 83 | } |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 84 | |
Harald Welte | 3e44c50 | 2001-10-22 08:16:24 +0000 | [diff] [blame] | 85 | if (!set) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 86 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 87 | "log-level `%s' unknown", level); |
| 88 | } |
| 89 | |
Jan Engelhardt | 213e185 | 2009-01-27 17:24:34 +0100 | [diff] [blame] | 90 | return lev; |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 91 | } |
| 92 | |
| 93 | #define IPT_LOG_OPT_LEVEL 0x01 |
| 94 | #define IPT_LOG_OPT_PREFIX 0x02 |
| 95 | #define IPT_LOG_OPT_TCPSEQ 0x04 |
| 96 | #define IPT_LOG_OPT_TCPOPT 0x08 |
| 97 | #define IPT_LOG_OPT_IPOPT 0x10 |
John Lange | f46e1af | 2005-01-02 23:33:12 +0000 | [diff] [blame] | 98 | #define IPT_LOG_OPT_UID 0x20 |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 99 | |
Jan Engelhardt | 1d5b63d | 2007-10-04 16:29:00 +0000 | [diff] [blame] | 100 | static int LOG_parse(int c, char **argv, int invert, unsigned int *flags, |
| 101 | const void *entry, struct xt_entry_target **target) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 102 | { |
| 103 | struct ipt_log_info *loginfo = (struct ipt_log_info *)(*target)->data; |
| 104 | |
| 105 | switch (c) { |
| 106 | case '!': |
| 107 | if (*flags & IPT_LOG_OPT_LEVEL) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 108 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 109 | "Can't specify --log-level twice"); |
Rusty Russell | 7e53bf9 | 2000-03-20 07:03:28 +0000 | [diff] [blame] | 110 | |
Jan Engelhardt | 0f16c72 | 2009-01-30 04:55:38 +0100 | [diff] [blame] | 111 | if (xtables_check_inverse(optarg, &invert, NULL, 0)) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 112 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 113 | "Unexpected `!' after --log-level"); |
| 114 | |
| 115 | loginfo->level = parse_level(optarg); |
| 116 | *flags |= IPT_LOG_OPT_LEVEL; |
| 117 | break; |
| 118 | |
| 119 | case '#': |
| 120 | if (*flags & IPT_LOG_OPT_PREFIX) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 121 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 122 | "Can't specify --log-prefix twice"); |
Rusty Russell | 7e53bf9 | 2000-03-20 07:03:28 +0000 | [diff] [blame] | 123 | |
Jan Engelhardt | 0f16c72 | 2009-01-30 04:55:38 +0100 | [diff] [blame] | 124 | if (xtables_check_inverse(optarg, &invert, NULL, 0)) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 125 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 126 | "Unexpected `!' after --log-prefix"); |
| 127 | |
| 128 | if (strlen(optarg) > sizeof(loginfo->prefix) - 1) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 129 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 130 | "Maximum prefix length %u for --log-prefix", |
Martin Josefsson | a28d495 | 2004-05-26 16:04:48 +0000 | [diff] [blame] | 131 | (unsigned int)sizeof(loginfo->prefix) - 1); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 132 | |
Mike Frysinger | ed26b7b | 2006-10-10 06:18:40 +0000 | [diff] [blame] | 133 | if (strlen(optarg) == 0) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 134 | xtables_error(PARAMETER_PROBLEM, |
Mike Frysinger | ed26b7b | 2006-10-10 06:18:40 +0000 | [diff] [blame] | 135 | "No prefix specified for --log-prefix"); |
| 136 | |
Phil Oester | 182f3f6 | 2005-04-01 07:07:00 +0000 | [diff] [blame] | 137 | if (strlen(optarg) != strlen(strtok(optarg, "\n"))) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 138 | xtables_error(PARAMETER_PROBLEM, |
Phil Oester | 182f3f6 | 2005-04-01 07:07:00 +0000 | [diff] [blame] | 139 | "Newlines not allowed in --log-prefix"); |
| 140 | |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 141 | strcpy(loginfo->prefix, optarg); |
| 142 | *flags |= IPT_LOG_OPT_PREFIX; |
| 143 | break; |
| 144 | |
| 145 | case '1': |
| 146 | if (*flags & IPT_LOG_OPT_TCPSEQ) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 147 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 148 | "Can't specify --log-tcp-sequence " |
| 149 | "twice"); |
| 150 | |
| 151 | loginfo->logflags |= IPT_LOG_TCPSEQ; |
| 152 | *flags |= IPT_LOG_OPT_TCPSEQ; |
| 153 | break; |
| 154 | |
| 155 | case '2': |
| 156 | if (*flags & IPT_LOG_OPT_TCPOPT) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 157 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 158 | "Can't specify --log-tcp-options twice"); |
| 159 | |
| 160 | loginfo->logflags |= IPT_LOG_TCPOPT; |
| 161 | *flags |= IPT_LOG_OPT_TCPOPT; |
| 162 | break; |
| 163 | |
| 164 | case '3': |
| 165 | if (*flags & IPT_LOG_OPT_IPOPT) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 166 | xtables_error(PARAMETER_PROBLEM, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 167 | "Can't specify --log-ip-options twice"); |
| 168 | |
| 169 | loginfo->logflags |= IPT_LOG_IPOPT; |
| 170 | *flags |= IPT_LOG_OPT_IPOPT; |
| 171 | break; |
| 172 | |
John Lange | f46e1af | 2005-01-02 23:33:12 +0000 | [diff] [blame] | 173 | case '4': |
| 174 | if (*flags & IPT_LOG_OPT_UID) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 175 | xtables_error(PARAMETER_PROBLEM, |
John Lange | f46e1af | 2005-01-02 23:33:12 +0000 | [diff] [blame] | 176 | "Can't specify --log-uid twice"); |
| 177 | |
| 178 | loginfo->logflags |= IPT_LOG_UID; |
| 179 | *flags |= IPT_LOG_OPT_UID; |
| 180 | break; |
| 181 | |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 182 | default: |
| 183 | return 0; |
| 184 | } |
| 185 | |
| 186 | return 1; |
| 187 | } |
| 188 | |
Jan Engelhardt | 1d5b63d | 2007-10-04 16:29:00 +0000 | [diff] [blame] | 189 | static void LOG_print(const void *ip, const struct xt_entry_target *target, |
| 190 | int numeric) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 191 | { |
| 192 | const struct ipt_log_info *loginfo |
| 193 | = (const struct ipt_log_info *)target->data; |
| 194 | unsigned int i = 0; |
| 195 | |
| 196 | printf("LOG "); |
| 197 | if (numeric) |
| 198 | printf("flags %u level %u ", |
| 199 | loginfo->logflags, loginfo->level); |
| 200 | else { |
Jan Engelhardt | 2c69b55 | 2009-04-30 19:32:02 +0200 | [diff] [blame^] | 201 | for (i = 0; i < ARRAY_SIZE(ipt_log_names); ++i) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 202 | if (loginfo->level == ipt_log_names[i].level) { |
| 203 | printf("level %s ", ipt_log_names[i].name); |
| 204 | break; |
| 205 | } |
Jan Engelhardt | 2c69b55 | 2009-04-30 19:32:02 +0200 | [diff] [blame^] | 206 | if (i == ARRAY_SIZE(ipt_log_names)) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 207 | printf("UNKNOWN level %u ", loginfo->level); |
| 208 | if (loginfo->logflags & IPT_LOG_TCPSEQ) |
| 209 | printf("tcp-sequence "); |
| 210 | if (loginfo->logflags & IPT_LOG_TCPOPT) |
| 211 | printf("tcp-options "); |
| 212 | if (loginfo->logflags & IPT_LOG_IPOPT) |
| 213 | printf("ip-options "); |
John Lange | f46e1af | 2005-01-02 23:33:12 +0000 | [diff] [blame] | 214 | if (loginfo->logflags & IPT_LOG_UID) |
| 215 | printf("uid "); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 216 | if (loginfo->logflags & ~(IPT_LOG_MASK)) |
| 217 | printf("unknown-flags "); |
| 218 | } |
| 219 | |
| 220 | if (strcmp(loginfo->prefix, "") != 0) |
| 221 | printf("prefix `%s' ", loginfo->prefix); |
| 222 | } |
| 223 | |
Jan Engelhardt | 1d5b63d | 2007-10-04 16:29:00 +0000 | [diff] [blame] | 224 | static void LOG_save(const void *ip, const struct xt_entry_target *target) |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 225 | { |
| 226 | const struct ipt_log_info *loginfo |
| 227 | = (const struct ipt_log_info *)target->data; |
| 228 | |
Max Kellermann | a5d0994 | 2008-01-29 13:44:34 +0000 | [diff] [blame] | 229 | if (strcmp(loginfo->prefix, "") != 0) { |
| 230 | printf("--log-prefix "); |
Jan Engelhardt | a0baae8 | 2009-01-30 04:32:50 +0100 | [diff] [blame] | 231 | xtables_save_string(loginfo->prefix); |
Max Kellermann | a5d0994 | 2008-01-29 13:44:34 +0000 | [diff] [blame] | 232 | } |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 233 | |
Thomas Woerner | 01cbaa6 | 2003-07-14 20:01:29 +0000 | [diff] [blame] | 234 | if (loginfo->level != LOG_DEFAULT_LEVEL) |
| 235 | printf("--log-level %d ", loginfo->level); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 236 | |
| 237 | if (loginfo->logflags & IPT_LOG_TCPSEQ) |
| 238 | printf("--log-tcp-sequence "); |
| 239 | if (loginfo->logflags & IPT_LOG_TCPOPT) |
| 240 | printf("--log-tcp-options "); |
| 241 | if (loginfo->logflags & IPT_LOG_IPOPT) |
| 242 | printf("--log-ip-options "); |
John Lange | f46e1af | 2005-01-02 23:33:12 +0000 | [diff] [blame] | 243 | if (loginfo->logflags & IPT_LOG_UID) |
| 244 | printf("--log-uid "); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 245 | } |
| 246 | |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 247 | static struct xtables_target log_tg_reg = { |
Stephane Ouellette | 2be28ab | 2003-08-11 19:58:56 +0000 | [diff] [blame] | 248 | .name = "LOG", |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 249 | .version = XTABLES_VERSION, |
Jan Engelhardt | 03d9948 | 2008-11-18 12:27:54 +0100 | [diff] [blame] | 250 | .family = NFPROTO_IPV4, |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 251 | .size = XT_ALIGN(sizeof(struct ipt_log_info)), |
| 252 | .userspacesize = XT_ALIGN(sizeof(struct ipt_log_info)), |
Jan Engelhardt | 1d5b63d | 2007-10-04 16:29:00 +0000 | [diff] [blame] | 253 | .help = LOG_help, |
| 254 | .init = LOG_init, |
| 255 | .parse = LOG_parse, |
| 256 | .print = LOG_print, |
| 257 | .save = LOG_save, |
| 258 | .extra_opts = LOG_opts, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 259 | }; |
| 260 | |
| 261 | void _init(void) |
| 262 | { |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 263 | xtables_register_target(&log_tg_reg); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 264 | } |