1// SPDX-License-Identifier: GPL-2.0-only
2/* (C) 1999-2001 Paul `Rusty' Russell
3 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
4 */
5
6#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7
8#include <linux/kernel.h>
9#include <linux/module.h>
10#include <linux/spinlock.h>
11#include <linux/skbuff.h>
12#include <linux/if_arp.h>
13#include <linux/ip.h>
14#include <net/ipv6.h>
15#include <net/icmp.h>
16#include <net/udp.h>
17#include <net/tcp.h>
18#include <net/route.h>
19
20#include <linux/netfilter.h>
21#include <linux/netfilter_bridge.h>
22#include <linux/netfilter_ipv6.h>
23#include <linux/netfilter/xt_LOG.h>
24#include <net/netfilter/nf_log.h>
25
26static const struct nf_loginfo default_loginfo = {
27 .type = NF_LOG_TYPE_LOG,
28 .u = {
29 .log = {
30 .level = LOGLEVEL_NOTICE,
31 .logflags = NF_LOG_DEFAULT_MASK,
32 },
33 },
34};
35
36struct arppayload {
37 unsigned char mac_src[ETH_ALEN];
38 unsigned char ip_src[4];
39 unsigned char mac_dst[ETH_ALEN];
40 unsigned char ip_dst[4];
41};
42
43/* Guard against containers flooding syslog. */
44static bool nf_log_allowed(const struct net *net)
45{
46 return net_eq(net1: net, net2: &init_net) || sysctl_nf_log_all_netns;
47}
48
49static void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb)
50{
51 u16 vid;
52
53 if (!skb_vlan_tag_present(skb))
54 return;
55
56 vid = skb_vlan_tag_get(skb);
57 nf_log_buf_add(m, f: "VPROTO=%04x VID=%u ", ntohs(skb->vlan_proto), vid);
58}
59static void noinline_for_stack
60dump_arp_packet(struct nf_log_buf *m,
61 const struct nf_loginfo *info,
62 const struct sk_buff *skb, unsigned int nhoff)
63{
64 const struct arppayload *ap;
65 struct arppayload _arpp;
66 const struct arphdr *ah;
67 unsigned int logflags;
68 struct arphdr _arph;
69
70 ah = skb_header_pointer(skb, offset: nhoff, len: sizeof(_arph), buffer: &_arph);
71 if (!ah) {
72 nf_log_buf_add(m, f: "TRUNCATED");
73 return;
74 }
75
76 if (info->type == NF_LOG_TYPE_LOG)
77 logflags = info->u.log.logflags;
78 else
79 logflags = NF_LOG_DEFAULT_MASK;
80
81 if (logflags & NF_LOG_MACDECODE) {
82 nf_log_buf_add(m, f: "MACSRC=%pM MACDST=%pM ",
83 eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
84 nf_log_dump_vlan(m, skb);
85 nf_log_buf_add(m, f: "MACPROTO=%04x ",
86 ntohs(eth_hdr(skb)->h_proto));
87 }
88
89 nf_log_buf_add(m, f: "ARP HTYPE=%d PTYPE=0x%04x OPCODE=%d",
90 ntohs(ah->ar_hrd), ntohs(ah->ar_pro), ntohs(ah->ar_op));
91 /* If it's for Ethernet and the lengths are OK, then log the ARP
92 * payload.
93 */
94 if (ah->ar_hrd != htons(ARPHRD_ETHER) ||
95 ah->ar_hln != ETH_ALEN ||
96 ah->ar_pln != sizeof(__be32))
97 return;
98
99 ap = skb_header_pointer(skb, offset: nhoff + sizeof(_arph), len: sizeof(_arpp), buffer: &_arpp);
100 if (!ap) {
101 nf_log_buf_add(m, f: " INCOMPLETE [%zu bytes]",
102 skb->len - sizeof(_arph));
103 return;
104 }
105 nf_log_buf_add(m, f: " MACSRC=%pM IPSRC=%pI4 MACDST=%pM IPDST=%pI4",
106 ap->mac_src, ap->ip_src, ap->mac_dst, ap->ip_dst);
107}
108
109static void
110nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf,
111 unsigned int hooknum, const struct sk_buff *skb,
112 const struct net_device *in,
113 const struct net_device *out,
114 const struct nf_loginfo *loginfo, const char *prefix,
115 struct net *net)
116{
117 const struct net_device *physoutdev __maybe_unused;
118 const struct net_device *physindev __maybe_unused;
119
120 nf_log_buf_add(m, KERN_SOH "%c%sIN=%s OUT=%s ",
121 '0' + loginfo->u.log.level, prefix,
122 in ? in->name : "",
123 out ? out->name : "");
124#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
125 physindev = nf_bridge_get_physindev(skb, net);
126 if (physindev && in != physindev)
127 nf_log_buf_add(m, "PHYSIN=%s ", physindev->name);
128 physoutdev = nf_bridge_get_physoutdev(skb);
129 if (physoutdev && out != physoutdev)
130 nf_log_buf_add(m, "PHYSOUT=%s ", physoutdev->name);
131#endif
132}
133
134static void nf_log_arp_packet(struct net *net, u_int8_t pf,
135 unsigned int hooknum, const struct sk_buff *skb,
136 const struct net_device *in,
137 const struct net_device *out,
138 const struct nf_loginfo *loginfo,
139 const char *prefix)
140{
141 struct nf_log_buf *m;
142
143 if (!nf_log_allowed(net))
144 return;
145
146 m = nf_log_buf_open();
147
148 if (!loginfo)
149 loginfo = &default_loginfo;
150
151 nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo,
152 prefix, net);
153 dump_arp_packet(m, info: loginfo, skb, nhoff: skb_network_offset(skb));
154
155 nf_log_buf_close(m);
156}
157
158static struct nf_logger nf_arp_logger __read_mostly = {
159 .name = "nf_log_arp",
160 .type = NF_LOG_TYPE_LOG,
161 .logfn = nf_log_arp_packet,
162 .me = THIS_MODULE,
163};
164
165static void nf_log_dump_sk_uid_gid(struct net *net, struct nf_log_buf *m,
166 struct sock *sk)
167{
168 if (!sk || !sk_fullsock(sk) || !net_eq(net1: net, net2: sock_net(sk)))
169 return;
170
171 read_lock_bh(&sk->sk_callback_lock);
172 if (sk->sk_socket && sk->sk_socket->file) {
173 const struct cred *cred = sk->sk_socket->file->f_cred;
174
175 nf_log_buf_add(m, f: "UID=%u GID=%u ",
176 from_kuid_munged(to: &init_user_ns, kuid: cred->fsuid),
177 from_kgid_munged(to: &init_user_ns, kgid: cred->fsgid));
178 }
179 read_unlock_bh(&sk->sk_callback_lock);
180}
181
182static noinline_for_stack int
183nf_log_dump_tcp_header(struct nf_log_buf *m,
184 const struct sk_buff *skb,
185 u8 proto, int fragment,
186 unsigned int offset,
187 unsigned int logflags)
188{
189 struct tcphdr _tcph;
190 const struct tcphdr *th;
191
192 /* Max length: 10 "PROTO=TCP " */
193 nf_log_buf_add(m, f: "PROTO=TCP ");
194
195 if (fragment)
196 return 0;
197
198 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
199 th = skb_header_pointer(skb, offset, len: sizeof(_tcph), buffer: &_tcph);
200 if (!th) {
201 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] ", skb->len - offset);
202 return 1;
203 }
204
205 /* Max length: 20 "SPT=65535 DPT=65535 " */
206 nf_log_buf_add(m, f: "SPT=%u DPT=%u ",
207 ntohs(th->source), ntohs(th->dest));
208 /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
209 if (logflags & NF_LOG_TCPSEQ) {
210 nf_log_buf_add(m, f: "SEQ=%u ACK=%u ",
211 ntohl(th->seq), ntohl(th->ack_seq));
212 }
213
214 /* Max length: 13 "WINDOW=65535 " */
215 nf_log_buf_add(m, f: "WINDOW=%u ", ntohs(th->window));
216 /* Max length: 9 "RES=0x3C " */
217 nf_log_buf_add(m, f: "RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) &
218 TCP_RESERVED_BITS) >> 22));
219 /* Max length: 35 "AE CWR ECE URG ACK PSH RST SYN FIN " */
220 if (th->ae)
221 nf_log_buf_add(m, f: "AE ");
222 if (th->cwr)
223 nf_log_buf_add(m, f: "CWR ");
224 if (th->ece)
225 nf_log_buf_add(m, f: "ECE ");
226 if (th->urg)
227 nf_log_buf_add(m, f: "URG ");
228 if (th->ack)
229 nf_log_buf_add(m, f: "ACK ");
230 if (th->psh)
231 nf_log_buf_add(m, f: "PSH ");
232 if (th->rst)
233 nf_log_buf_add(m, f: "RST ");
234 if (th->syn)
235 nf_log_buf_add(m, f: "SYN ");
236 if (th->fin)
237 nf_log_buf_add(m, f: "FIN ");
238 /* Max length: 11 "URGP=65535 " */
239 nf_log_buf_add(m, f: "URGP=%u ", ntohs(th->urg_ptr));
240
241 if ((logflags & NF_LOG_TCPOPT) && th->doff * 4 > sizeof(struct tcphdr)) {
242 unsigned int optsize = th->doff * 4 - sizeof(struct tcphdr);
243 u8 _opt[60 - sizeof(struct tcphdr)];
244 unsigned int i;
245 const u8 *op;
246
247 op = skb_header_pointer(skb, offset: offset + sizeof(struct tcphdr),
248 len: optsize, buffer: _opt);
249 if (!op) {
250 nf_log_buf_add(m, f: "OPT (TRUNCATED)");
251 return 1;
252 }
253
254 /* Max length: 127 "OPT (" 15*4*2chars ") " */
255 nf_log_buf_add(m, f: "OPT (");
256 for (i = 0; i < optsize; i++)
257 nf_log_buf_add(m, f: "%02X", op[i]);
258
259 nf_log_buf_add(m, f: ") ");
260 }
261
262 return 0;
263}
264
265static noinline_for_stack int
266nf_log_dump_udp_header(struct nf_log_buf *m,
267 const struct sk_buff *skb,
268 u8 proto, int fragment,
269 unsigned int offset)
270{
271 struct udphdr _udph;
272 const struct udphdr *uh;
273
274 if (proto == IPPROTO_UDP)
275 /* Max length: 10 "PROTO=UDP " */
276 nf_log_buf_add(m, f: "PROTO=UDP ");
277 else /* Max length: 14 "PROTO=UDPLITE " */
278 nf_log_buf_add(m, f: "PROTO=UDPLITE ");
279
280 if (fragment)
281 goto out;
282
283 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
284 uh = skb_header_pointer(skb, offset, len: sizeof(_udph), buffer: &_udph);
285 if (!uh) {
286 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] ", skb->len - offset);
287
288 return 1;
289 }
290
291 /* Max length: 20 "SPT=65535 DPT=65535 " */
292 nf_log_buf_add(m, f: "SPT=%u DPT=%u LEN=%u ",
293 ntohs(uh->source), ntohs(uh->dest), ntohs(uh->len));
294
295out:
296 return 0;
297}
298
299/* One level of recursion won't kill us */
300static noinline_for_stack void
301dump_ipv4_packet(struct net *net, struct nf_log_buf *m,
302 const struct nf_loginfo *info,
303 const struct sk_buff *skb, unsigned int iphoff)
304{
305 const struct iphdr *ih;
306 unsigned int logflags;
307 struct iphdr _iph;
308
309 if (info->type == NF_LOG_TYPE_LOG)
310 logflags = info->u.log.logflags;
311 else
312 logflags = NF_LOG_DEFAULT_MASK;
313
314 ih = skb_header_pointer(skb, offset: iphoff, len: sizeof(_iph), buffer: &_iph);
315 if (!ih) {
316 nf_log_buf_add(m, f: "TRUNCATED");
317 return;
318 }
319
320 /* Important fields:
321 * TOS, len, DF/MF, fragment offset, TTL, src, dst, options.
322 * Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 "
323 */
324 nf_log_buf_add(m, f: "SRC=%pI4 DST=%pI4 ", &ih->saddr, &ih->daddr);
325
326 /* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */
327 nf_log_buf_add(m, f: "LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
328 iph_totlen(skb, iph: ih), ih->tos & IPTOS_TOS_MASK,
329 ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id));
330
331 /* Max length: 6 "CE DF MF " */
332 if (ntohs(ih->frag_off) & IP_CE)
333 nf_log_buf_add(m, f: "CE ");
334 if (ntohs(ih->frag_off) & IP_DF)
335 nf_log_buf_add(m, f: "DF ");
336 if (ntohs(ih->frag_off) & IP_MF)
337 nf_log_buf_add(m, f: "MF ");
338
339 /* Max length: 11 "FRAG:65535 " */
340 if (ntohs(ih->frag_off) & IP_OFFSET)
341 nf_log_buf_add(m, f: "FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
342
343 if ((logflags & NF_LOG_IPOPT) &&
344 ih->ihl * 4 > sizeof(struct iphdr)) {
345 unsigned char _opt[4 * 15 - sizeof(struct iphdr)];
346 const unsigned char *op;
347 unsigned int i, optsize;
348
349 optsize = ih->ihl * 4 - sizeof(struct iphdr);
350 op = skb_header_pointer(skb, offset: iphoff + sizeof(_iph),
351 len: optsize, buffer: _opt);
352 if (!op) {
353 nf_log_buf_add(m, f: "TRUNCATED");
354 return;
355 }
356
357 /* Max length: 127 "OPT (" 15*4*2chars ") " */
358 nf_log_buf_add(m, f: "OPT (");
359 for (i = 0; i < optsize; i++)
360 nf_log_buf_add(m, f: "%02X", op[i]);
361 nf_log_buf_add(m, f: ") ");
362 }
363
364 switch (ih->protocol) {
365 case IPPROTO_TCP:
366 if (nf_log_dump_tcp_header(m, skb, proto: ih->protocol,
367 ntohs(ih->frag_off) & IP_OFFSET,
368 offset: iphoff + ih->ihl * 4, logflags))
369 return;
370 break;
371 case IPPROTO_UDP:
372 case IPPROTO_UDPLITE:
373 if (nf_log_dump_udp_header(m, skb, proto: ih->protocol,
374 ntohs(ih->frag_off) & IP_OFFSET,
375 offset: iphoff + ih->ihl * 4))
376 return;
377 break;
378 case IPPROTO_ICMP: {
379 static const size_t required_len[NR_ICMP_TYPES + 1] = {
380 [ICMP_ECHOREPLY] = 4,
381 [ICMP_DEST_UNREACH] = 8 + sizeof(struct iphdr),
382 [ICMP_SOURCE_QUENCH] = 8 + sizeof(struct iphdr),
383 [ICMP_REDIRECT] = 8 + sizeof(struct iphdr),
384 [ICMP_ECHO] = 4,
385 [ICMP_TIME_EXCEEDED] = 8 + sizeof(struct iphdr),
386 [ICMP_PARAMETERPROB] = 8 + sizeof(struct iphdr),
387 [ICMP_TIMESTAMP] = 20,
388 [ICMP_TIMESTAMPREPLY] = 20,
389 [ICMP_ADDRESS] = 12,
390 [ICMP_ADDRESSREPLY] = 12 };
391 const struct icmphdr *ich;
392 struct icmphdr _icmph;
393
394 /* Max length: 11 "PROTO=ICMP " */
395 nf_log_buf_add(m, f: "PROTO=ICMP ");
396
397 if (ntohs(ih->frag_off) & IP_OFFSET)
398 break;
399
400 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
401 ich = skb_header_pointer(skb, offset: iphoff + ih->ihl * 4,
402 len: sizeof(_icmph), buffer: &_icmph);
403 if (!ich) {
404 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] ",
405 skb->len - iphoff - ih->ihl * 4);
406 break;
407 }
408
409 /* Max length: 18 "TYPE=255 CODE=255 " */
410 nf_log_buf_add(m, f: "TYPE=%u CODE=%u ", ich->type, ich->code);
411
412 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
413 if (ich->type <= NR_ICMP_TYPES &&
414 required_len[ich->type] &&
415 skb->len - iphoff - ih->ihl * 4 < required_len[ich->type]) {
416 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] ",
417 skb->len - iphoff - ih->ihl * 4);
418 break;
419 }
420
421 switch (ich->type) {
422 case ICMP_ECHOREPLY:
423 case ICMP_ECHO:
424 /* Max length: 19 "ID=65535 SEQ=65535 " */
425 nf_log_buf_add(m, f: "ID=%u SEQ=%u ",
426 ntohs(ich->un.echo.id),
427 ntohs(ich->un.echo.sequence));
428 break;
429
430 case ICMP_PARAMETERPROB:
431 /* Max length: 14 "PARAMETER=255 " */
432 nf_log_buf_add(m, f: "PARAMETER=%u ",
433 ntohl(ich->un.gateway) >> 24);
434 break;
435 case ICMP_REDIRECT:
436 /* Max length: 24 "GATEWAY=255.255.255.255 " */
437 nf_log_buf_add(m, f: "GATEWAY=%pI4 ", &ich->un.gateway);
438 fallthrough;
439 case ICMP_DEST_UNREACH:
440 case ICMP_SOURCE_QUENCH:
441 case ICMP_TIME_EXCEEDED:
442 /* Max length: 3+maxlen */
443 if (!iphoff) { /* Only recurse once. */
444 nf_log_buf_add(m, f: "[");
445 dump_ipv4_packet(net, m, info, skb,
446 iphoff: iphoff + ih->ihl * 4 + sizeof(_icmph));
447 nf_log_buf_add(m, f: "] ");
448 }
449
450 /* Max length: 10 "MTU=65535 " */
451 if (ich->type == ICMP_DEST_UNREACH &&
452 ich->code == ICMP_FRAG_NEEDED) {
453 nf_log_buf_add(m, f: "MTU=%u ",
454 ntohs(ich->un.frag.mtu));
455 }
456 }
457 break;
458 }
459 /* Max Length */
460 case IPPROTO_AH: {
461 const struct ip_auth_hdr *ah;
462 struct ip_auth_hdr _ahdr;
463
464 if (ntohs(ih->frag_off) & IP_OFFSET)
465 break;
466
467 /* Max length: 9 "PROTO=AH " */
468 nf_log_buf_add(m, f: "PROTO=AH ");
469
470 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
471 ah = skb_header_pointer(skb, offset: iphoff + ih->ihl * 4,
472 len: sizeof(_ahdr), buffer: &_ahdr);
473 if (!ah) {
474 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] ",
475 skb->len - iphoff - ih->ihl * 4);
476 break;
477 }
478
479 /* Length: 15 "SPI=0xF1234567 " */
480 nf_log_buf_add(m, f: "SPI=0x%x ", ntohl(ah->spi));
481 break;
482 }
483 case IPPROTO_ESP: {
484 const struct ip_esp_hdr *eh;
485 struct ip_esp_hdr _esph;
486
487 /* Max length: 10 "PROTO=ESP " */
488 nf_log_buf_add(m, f: "PROTO=ESP ");
489
490 if (ntohs(ih->frag_off) & IP_OFFSET)
491 break;
492
493 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
494 eh = skb_header_pointer(skb, offset: iphoff + ih->ihl * 4,
495 len: sizeof(_esph), buffer: &_esph);
496 if (!eh) {
497 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] ",
498 skb->len - iphoff - ih->ihl * 4);
499 break;
500 }
501
502 /* Length: 15 "SPI=0xF1234567 " */
503 nf_log_buf_add(m, f: "SPI=0x%x ", ntohl(eh->spi));
504 break;
505 }
506 /* Max length: 10 "PROTO 255 " */
507 default:
508 nf_log_buf_add(m, f: "PROTO=%u ", ih->protocol);
509 }
510
511 /* Max length: 15 "UID=4294967295 " */
512 if ((logflags & NF_LOG_UID) && !iphoff)
513 nf_log_dump_sk_uid_gid(net, m, sk: skb->sk);
514
515 /* Max length: 16 "MARK=0xFFFFFFFF " */
516 if (!iphoff && skb->mark)
517 nf_log_buf_add(m, f: "MARK=0x%x ", skb->mark);
518
519 /* Proto Max log string length */
520 /* IP: 40+46+6+11+127 = 230 */
521 /* TCP: 10+max(25,20+30+13+9+35+11+127) = 255 */
522 /* UDP: 10+max(25,20) = 35 */
523 /* UDPLITE: 14+max(25,20) = 39 */
524 /* ICMP: 11+max(25, 18+25+max(19,14,24+3+n+10,3+n+10)) = 91+n */
525 /* ESP: 10+max(25)+15 = 50 */
526 /* AH: 9+max(25)+15 = 49 */
527 /* unknown: 10 */
528
529 /* (ICMP allows recursion one level deep) */
530 /* maxlen = IP + ICMP + IP + max(TCP,UDP,ICMP,unknown) */
531 /* maxlen = 230+ 91 + 230 + 255 = 806 */
532}
533
534static noinline_for_stack void
535dump_ipv6_packet(struct net *net, struct nf_log_buf *m,
536 const struct nf_loginfo *info,
537 const struct sk_buff *skb, unsigned int ip6hoff,
538 int recurse)
539{
540 const struct ipv6hdr *ih;
541 unsigned int hdrlen = 0;
542 unsigned int logflags;
543 struct ipv6hdr _ip6h;
544 unsigned int ptr;
545 u8 currenthdr;
546 int fragment;
547
548 if (info->type == NF_LOG_TYPE_LOG)
549 logflags = info->u.log.logflags;
550 else
551 logflags = NF_LOG_DEFAULT_MASK;
552
553 ih = skb_header_pointer(skb, offset: ip6hoff, len: sizeof(_ip6h), buffer: &_ip6h);
554 if (!ih) {
555 nf_log_buf_add(m, f: "TRUNCATED");
556 return;
557 }
558
559 /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000 " */
560 nf_log_buf_add(m, f: "SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
561
562 /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
563 nf_log_buf_add(m, f: "LEN=%zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
564 ntohs(ih->payload_len) + sizeof(struct ipv6hdr),
565 (ntohl(*(__be32 *)ih) & 0x0ff00000) >> 20,
566 ih->hop_limit,
567 (ntohl(*(__be32 *)ih) & 0x000fffff));
568
569 fragment = 0;
570 ptr = ip6hoff + sizeof(struct ipv6hdr);
571 currenthdr = ih->nexthdr;
572 while (currenthdr != NEXTHDR_NONE && nf_ip6_ext_hdr(nexthdr: currenthdr)) {
573 struct ipv6_opt_hdr _hdr;
574 const struct ipv6_opt_hdr *hp;
575
576 hp = skb_header_pointer(skb, offset: ptr, len: sizeof(_hdr), buffer: &_hdr);
577 if (!hp) {
578 nf_log_buf_add(m, f: "TRUNCATED");
579 return;
580 }
581
582 /* Max length: 48 "OPT (...) " */
583 if (logflags & NF_LOG_IPOPT)
584 nf_log_buf_add(m, f: "OPT ( ");
585
586 switch (currenthdr) {
587 case IPPROTO_FRAGMENT: {
588 struct frag_hdr _fhdr;
589 const struct frag_hdr *fh;
590
591 nf_log_buf_add(m, f: "FRAG:");
592 fh = skb_header_pointer(skb, offset: ptr, len: sizeof(_fhdr),
593 buffer: &_fhdr);
594 if (!fh) {
595 nf_log_buf_add(m, f: "TRUNCATED ");
596 return;
597 }
598
599 /* Max length: 6 "65535 " */
600 nf_log_buf_add(m, f: "%u ", ntohs(fh->frag_off) & 0xFFF8);
601
602 /* Max length: 11 "INCOMPLETE " */
603 if (fh->frag_off & htons(0x0001))
604 nf_log_buf_add(m, f: "INCOMPLETE ");
605
606 nf_log_buf_add(m, f: "ID:%08x ",
607 ntohl(fh->identification));
608
609 if (ntohs(fh->frag_off) & 0xFFF8)
610 fragment = 1;
611
612 hdrlen = 8;
613 break;
614 }
615 case IPPROTO_DSTOPTS:
616 case IPPROTO_ROUTING:
617 case IPPROTO_HOPOPTS:
618 if (fragment) {
619 if (logflags & NF_LOG_IPOPT)
620 nf_log_buf_add(m, f: ")");
621 return;
622 }
623 hdrlen = ipv6_optlen(hp);
624 break;
625 /* Max Length */
626 case IPPROTO_AH:
627 if (logflags & NF_LOG_IPOPT) {
628 struct ip_auth_hdr _ahdr;
629 const struct ip_auth_hdr *ah;
630
631 /* Max length: 3 "AH " */
632 nf_log_buf_add(m, f: "AH ");
633
634 if (fragment) {
635 nf_log_buf_add(m, f: ")");
636 return;
637 }
638
639 ah = skb_header_pointer(skb, offset: ptr, len: sizeof(_ahdr),
640 buffer: &_ahdr);
641 if (!ah) {
642 /* Max length: 26 "INCOMPLETE [65535 bytes] )" */
643 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] )",
644 skb->len - ptr);
645 return;
646 }
647
648 /* Length: 15 "SPI=0xF1234567 */
649 nf_log_buf_add(m, f: "SPI=0x%x ", ntohl(ah->spi));
650 }
651
652 hdrlen = ipv6_authlen(hp);
653 break;
654 case IPPROTO_ESP:
655 if (logflags & NF_LOG_IPOPT) {
656 struct ip_esp_hdr _esph;
657 const struct ip_esp_hdr *eh;
658
659 /* Max length: 4 "ESP " */
660 nf_log_buf_add(m, f: "ESP ");
661
662 if (fragment) {
663 nf_log_buf_add(m, f: ")");
664 return;
665 }
666
667 /* Max length: 26 "INCOMPLETE [65535 bytes] )" */
668 eh = skb_header_pointer(skb, offset: ptr, len: sizeof(_esph),
669 buffer: &_esph);
670 if (!eh) {
671 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] )",
672 skb->len - ptr);
673 return;
674 }
675
676 /* Length: 16 "SPI=0xF1234567 )" */
677 nf_log_buf_add(m, f: "SPI=0x%x )",
678 ntohl(eh->spi));
679 }
680 return;
681 default:
682 /* Max length: 20 "Unknown Ext Hdr 255" */
683 nf_log_buf_add(m, f: "Unknown Ext Hdr %u", currenthdr);
684 return;
685 }
686 if (logflags & NF_LOG_IPOPT)
687 nf_log_buf_add(m, f: ") ");
688
689 currenthdr = hp->nexthdr;
690 ptr += hdrlen;
691 }
692
693 switch (currenthdr) {
694 case IPPROTO_TCP:
695 if (nf_log_dump_tcp_header(m, skb, proto: currenthdr, fragment,
696 offset: ptr, logflags))
697 return;
698 break;
699 case IPPROTO_UDP:
700 case IPPROTO_UDPLITE:
701 if (nf_log_dump_udp_header(m, skb, proto: currenthdr, fragment, offset: ptr))
702 return;
703 break;
704 case IPPROTO_ICMPV6: {
705 struct icmp6hdr _icmp6h;
706 const struct icmp6hdr *ic;
707
708 /* Max length: 13 "PROTO=ICMPv6 " */
709 nf_log_buf_add(m, f: "PROTO=ICMPv6 ");
710
711 if (fragment)
712 break;
713
714 /* Max length: 25 "INCOMPLETE [65535 bytes] " */
715 ic = skb_header_pointer(skb, offset: ptr, len: sizeof(_icmp6h), buffer: &_icmp6h);
716 if (!ic) {
717 nf_log_buf_add(m, f: "INCOMPLETE [%u bytes] ",
718 skb->len - ptr);
719 return;
720 }
721
722 /* Max length: 18 "TYPE=255 CODE=255 " */
723 nf_log_buf_add(m, f: "TYPE=%u CODE=%u ",
724 ic->icmp6_type, ic->icmp6_code);
725
726 switch (ic->icmp6_type) {
727 case ICMPV6_ECHO_REQUEST:
728 case ICMPV6_ECHO_REPLY:
729 /* Max length: 19 "ID=65535 SEQ=65535 " */
730 nf_log_buf_add(m, f: "ID=%u SEQ=%u ",
731 ntohs(ic->icmp6_identifier),
732 ntohs(ic->icmp6_sequence));
733 break;
734 case ICMPV6_MGM_QUERY:
735 case ICMPV6_MGM_REPORT:
736 case ICMPV6_MGM_REDUCTION:
737 break;
738
739 case ICMPV6_PARAMPROB:
740 /* Max length: 17 "POINTER=ffffffff " */
741 nf_log_buf_add(m, f: "POINTER=%08x ",
742 ntohl(ic->icmp6_pointer));
743 fallthrough;
744 case ICMPV6_DEST_UNREACH:
745 case ICMPV6_PKT_TOOBIG:
746 case ICMPV6_TIME_EXCEED:
747 /* Max length: 3+maxlen */
748 if (recurse) {
749 nf_log_buf_add(m, f: "[");
750 dump_ipv6_packet(net, m, info, skb,
751 ip6hoff: ptr + sizeof(_icmp6h), recurse: 0);
752 nf_log_buf_add(m, f: "] ");
753 }
754
755 /* Max length: 10 "MTU=65535 " */
756 if (ic->icmp6_type == ICMPV6_PKT_TOOBIG) {
757 nf_log_buf_add(m, f: "MTU=%u ",
758 ntohl(ic->icmp6_mtu));
759 }
760 }
761 break;
762 }
763 /* Max length: 10 "PROTO=255 " */
764 default:
765 nf_log_buf_add(m, f: "PROTO=%u ", currenthdr);
766 }
767
768 /* Max length: 15 "UID=4294967295 " */
769 if ((logflags & NF_LOG_UID) && recurse)
770 nf_log_dump_sk_uid_gid(net, m, sk: skb->sk);
771
772 /* Max length: 16 "MARK=0xFFFFFFFF " */
773 if (recurse && skb->mark)
774 nf_log_buf_add(m, f: "MARK=0x%x ", skb->mark);
775}
776
777static void dump_mac_header(struct nf_log_buf *m,
778 const struct nf_loginfo *info,
779 const struct sk_buff *skb)
780{
781 struct net_device *dev = skb->dev;
782 unsigned int logflags = 0;
783
784 if (info->type == NF_LOG_TYPE_LOG)
785 logflags = info->u.log.logflags;
786
787 if (!(logflags & NF_LOG_MACDECODE))
788 goto fallback;
789
790 switch (dev->type) {
791 case ARPHRD_ETHER:
792 nf_log_buf_add(m, f: "MACSRC=%pM MACDST=%pM ",
793 eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
794 nf_log_dump_vlan(m, skb);
795 nf_log_buf_add(m, f: "MACPROTO=%04x ",
796 ntohs(eth_hdr(skb)->h_proto));
797 return;
798 default:
799 break;
800 }
801
802fallback:
803 nf_log_buf_add(m, f: "MAC=");
804 if (dev->hard_header_len &&
805 skb->mac_header != skb->network_header) {
806 const unsigned char *p = skb_mac_header(skb);
807 unsigned int i;
808
809 if (dev->type == ARPHRD_SIT) {
810 p -= ETH_HLEN;
811
812 if (p < skb->head)
813 p = NULL;
814 }
815
816 if (p) {
817 nf_log_buf_add(m, f: "%02x", *p++);
818 for (i = 1; i < dev->hard_header_len; i++)
819 nf_log_buf_add(m, f: ":%02x", *p++);
820 }
821
822 if (dev->type == ARPHRD_SIT) {
823 const struct iphdr *iph =
824 (struct iphdr *)skb_mac_header(skb);
825
826 nf_log_buf_add(m, f: " TUNNEL=%pI4->%pI4", &iph->saddr,
827 &iph->daddr);
828 }
829 }
830 nf_log_buf_add(m, f: " ");
831}
832
833static void nf_log_ip_packet(struct net *net, u_int8_t pf,
834 unsigned int hooknum, const struct sk_buff *skb,
835 const struct net_device *in,
836 const struct net_device *out,
837 const struct nf_loginfo *loginfo,
838 const char *prefix)
839{
840 struct nf_log_buf *m;
841
842 if (!nf_log_allowed(net))
843 return;
844
845 m = nf_log_buf_open();
846
847 if (!loginfo)
848 loginfo = &default_loginfo;
849
850 nf_log_dump_packet_common(m, pf, hooknum, skb, in,
851 out, loginfo, prefix, net);
852
853 if (in)
854 dump_mac_header(m, info: loginfo, skb);
855
856 dump_ipv4_packet(net, m, info: loginfo, skb, iphoff: skb_network_offset(skb));
857
858 nf_log_buf_close(m);
859}
860
861static struct nf_logger nf_ip_logger __read_mostly = {
862 .name = "nf_log_ipv4",
863 .type = NF_LOG_TYPE_LOG,
864 .logfn = nf_log_ip_packet,
865 .me = THIS_MODULE,
866};
867
868static void nf_log_ip6_packet(struct net *net, u_int8_t pf,
869 unsigned int hooknum, const struct sk_buff *skb,
870 const struct net_device *in,
871 const struct net_device *out,
872 const struct nf_loginfo *loginfo,
873 const char *prefix)
874{
875 struct nf_log_buf *m;
876
877 if (!nf_log_allowed(net))
878 return;
879
880 m = nf_log_buf_open();
881
882 if (!loginfo)
883 loginfo = &default_loginfo;
884
885 nf_log_dump_packet_common(m, pf, hooknum, skb, in, out,
886 loginfo, prefix, net);
887
888 if (in)
889 dump_mac_header(m, info: loginfo, skb);
890
891 dump_ipv6_packet(net, m, info: loginfo, skb, ip6hoff: skb_network_offset(skb), recurse: 1);
892
893 nf_log_buf_close(m);
894}
895
896static struct nf_logger nf_ip6_logger __read_mostly = {
897 .name = "nf_log_ipv6",
898 .type = NF_LOG_TYPE_LOG,
899 .logfn = nf_log_ip6_packet,
900 .me = THIS_MODULE,
901};
902
903static void nf_log_unknown_packet(struct net *net, u_int8_t pf,
904 unsigned int hooknum,
905 const struct sk_buff *skb,
906 const struct net_device *in,
907 const struct net_device *out,
908 const struct nf_loginfo *loginfo,
909 const char *prefix)
910{
911 struct nf_log_buf *m;
912
913 if (!nf_log_allowed(net))
914 return;
915
916 m = nf_log_buf_open();
917
918 if (!loginfo)
919 loginfo = &default_loginfo;
920
921 nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo,
922 prefix, net);
923
924 dump_mac_header(m, info: loginfo, skb);
925
926 nf_log_buf_close(m);
927}
928
929static void nf_log_netdev_packet(struct net *net, u_int8_t pf,
930 unsigned int hooknum,
931 const struct sk_buff *skb,
932 const struct net_device *in,
933 const struct net_device *out,
934 const struct nf_loginfo *loginfo,
935 const char *prefix)
936{
937 switch (skb->protocol) {
938 case htons(ETH_P_IP):
939 nf_log_ip_packet(net, pf, hooknum, skb, in, out, loginfo, prefix);
940 break;
941 case htons(ETH_P_IPV6):
942 nf_log_ip6_packet(net, pf, hooknum, skb, in, out, loginfo, prefix);
943 break;
944 case htons(ETH_P_ARP):
945 case htons(ETH_P_RARP):
946 nf_log_arp_packet(net, pf, hooknum, skb, in, out, loginfo, prefix);
947 break;
948 default:
949 nf_log_unknown_packet(net, pf, hooknum, skb,
950 in, out, loginfo, prefix);
951 break;
952 }
953}
954
955static struct nf_logger nf_netdev_logger __read_mostly = {
956 .name = "nf_log_netdev",
957 .type = NF_LOG_TYPE_LOG,
958 .logfn = nf_log_netdev_packet,
959 .me = THIS_MODULE,
960};
961
962static struct nf_logger nf_bridge_logger __read_mostly = {
963 .name = "nf_log_bridge",
964 .type = NF_LOG_TYPE_LOG,
965 .logfn = nf_log_netdev_packet,
966 .me = THIS_MODULE,
967};
968
969static int __net_init nf_log_syslog_net_init(struct net *net)
970{
971 int ret = nf_log_set(net, pf: NFPROTO_IPV4, logger: &nf_ip_logger);
972
973 if (ret)
974 return ret;
975
976 ret = nf_log_set(net, pf: NFPROTO_ARP, logger: &nf_arp_logger);
977 if (ret)
978 goto err1;
979
980 ret = nf_log_set(net, pf: NFPROTO_IPV6, logger: &nf_ip6_logger);
981 if (ret)
982 goto err2;
983
984 ret = nf_log_set(net, pf: NFPROTO_NETDEV, logger: &nf_netdev_logger);
985 if (ret)
986 goto err3;
987
988 ret = nf_log_set(net, pf: NFPROTO_BRIDGE, logger: &nf_bridge_logger);
989 if (ret)
990 goto err4;
991 return 0;
992err4:
993 nf_log_unset(net, logger: &nf_netdev_logger);
994err3:
995 nf_log_unset(net, logger: &nf_ip6_logger);
996err2:
997 nf_log_unset(net, logger: &nf_arp_logger);
998err1:
999 nf_log_unset(net, logger: &nf_ip_logger);
1000 return ret;
1001}
1002
1003static void __net_exit nf_log_syslog_net_exit(struct net *net)
1004{
1005 nf_log_unset(net, logger: &nf_ip_logger);
1006 nf_log_unset(net, logger: &nf_arp_logger);
1007 nf_log_unset(net, logger: &nf_ip6_logger);
1008 nf_log_unset(net, logger: &nf_netdev_logger);
1009 nf_log_unset(net, logger: &nf_bridge_logger);
1010}
1011
1012static struct pernet_operations nf_log_syslog_net_ops = {
1013 .init = nf_log_syslog_net_init,
1014 .exit = nf_log_syslog_net_exit,
1015};
1016
1017static int __init nf_log_syslog_init(void)
1018{
1019 int ret;
1020
1021 ret = register_pernet_subsys(&nf_log_syslog_net_ops);
1022 if (ret < 0)
1023 return ret;
1024
1025 ret = nf_log_register(pf: NFPROTO_IPV4, logger: &nf_ip_logger);
1026 if (ret < 0)
1027 goto err1;
1028
1029 ret = nf_log_register(pf: NFPROTO_ARP, logger: &nf_arp_logger);
1030 if (ret < 0)
1031 goto err2;
1032
1033 ret = nf_log_register(pf: NFPROTO_IPV6, logger: &nf_ip6_logger);
1034 if (ret < 0)
1035 goto err3;
1036
1037 ret = nf_log_register(pf: NFPROTO_NETDEV, logger: &nf_netdev_logger);
1038 if (ret < 0)
1039 goto err4;
1040
1041 ret = nf_log_register(pf: NFPROTO_BRIDGE, logger: &nf_bridge_logger);
1042 if (ret < 0)
1043 goto err5;
1044
1045 return 0;
1046err5:
1047 nf_log_unregister(logger: &nf_netdev_logger);
1048err4:
1049 nf_log_unregister(logger: &nf_ip6_logger);
1050err3:
1051 nf_log_unregister(logger: &nf_arp_logger);
1052err2:
1053 nf_log_unregister(logger: &nf_ip_logger);
1054err1:
1055 pr_err("failed to register logger\n");
1056 unregister_pernet_subsys(&nf_log_syslog_net_ops);
1057 return ret;
1058}
1059
1060static void __exit nf_log_syslog_exit(void)
1061{
1062 unregister_pernet_subsys(&nf_log_syslog_net_ops);
1063 nf_log_unregister(logger: &nf_ip_logger);
1064 nf_log_unregister(logger: &nf_arp_logger);
1065 nf_log_unregister(logger: &nf_ip6_logger);
1066 nf_log_unregister(logger: &nf_netdev_logger);
1067 nf_log_unregister(logger: &nf_bridge_logger);
1068}
1069
1070module_init(nf_log_syslog_init);
1071module_exit(nf_log_syslog_exit);
1072
1073MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1074MODULE_DESCRIPTION("Netfilter syslog packet logging");
1075MODULE_LICENSE("GPL");
1076MODULE_ALIAS("nf_log_arp");
1077MODULE_ALIAS("nf_log_bridge");
1078MODULE_ALIAS("nf_log_ipv4");
1079MODULE_ALIAS("nf_log_ipv6");
1080MODULE_ALIAS("nf_log_netdev");
1081MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 0);
1082MODULE_ALIAS_NF_LOGGER(AF_INET, 0);
1083MODULE_ALIAS_NF_LOGGER(3, 0);
1084MODULE_ALIAS_NF_LOGGER(5, 0); /* NFPROTO_NETDEV */
1085MODULE_ALIAS_NF_LOGGER(AF_INET6, 0);
1086