1
2
3
4
5
6
7
8#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
9
10#include <linux/module.h>
11#include <linux/spinlock.h>
12#include <linux/skbuff.h>
13#include <linux/if_arp.h>
14#include <linux/ip.h>
15#include <net/ipv6.h>
16#include <net/icmp.h>
17#include <net/udp.h>
18#include <net/tcp.h>
19#include <net/route.h>
20
21#include <linux/netfilter.h>
22#include <linux/netfilter_ipv6/ip6_tables.h>
23#include <linux/netfilter/xt_LOG.h>
24#include <net/netfilter/nf_log.h>
25
26static struct nf_loginfo default_loginfo = {
27 .type = NF_LOG_TYPE_LOG,
28 .u = {
29 .log = {
30 .level = 5,
31 .logflags = NF_LOG_MASK,
32 },
33 },
34};
35
36
37static void dump_ipv6_packet(struct nf_log_buf *m,
38 const struct nf_loginfo *info,
39 const struct sk_buff *skb, unsigned int ip6hoff,
40 int recurse)
41{
42 u_int8_t currenthdr;
43 int fragment;
44 struct ipv6hdr _ip6h;
45 const struct ipv6hdr *ih;
46 unsigned int ptr;
47 unsigned int hdrlen = 0;
48 unsigned int logflags;
49
50 if (info->type == NF_LOG_TYPE_LOG)
51 logflags = info->u.log.logflags;
52 else
53 logflags = NF_LOG_MASK;
54
55 ih = skb_header_pointer(skb, ip6hoff, sizeof(_ip6h), &_ip6h);
56 if (ih == NULL) {
57 nf_log_buf_add(m, "TRUNCATED");
58 return;
59 }
60
61
62 nf_log_buf_add(m, "SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
63
64
65 nf_log_buf_add(m, "LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
66 ntohs(ih->payload_len) + sizeof(struct ipv6hdr),
67 (ntohl(*(__be32 *)ih) & 0x0ff00000) >> 20,
68 ih->hop_limit,
69 (ntohl(*(__be32 *)ih) & 0x000fffff));
70
71 fragment = 0;
72 ptr = ip6hoff + sizeof(struct ipv6hdr);
73 currenthdr = ih->nexthdr;
74 while (currenthdr != NEXTHDR_NONE && ip6t_ext_hdr(currenthdr)) {
75 struct ipv6_opt_hdr _hdr;
76 const struct ipv6_opt_hdr *hp;
77
78 hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
79 if (hp == NULL) {
80 nf_log_buf_add(m, "TRUNCATED");
81 return;
82 }
83
84
85 if (logflags & XT_LOG_IPOPT)
86 nf_log_buf_add(m, "OPT ( ");
87
88 switch (currenthdr) {
89 case IPPROTO_FRAGMENT: {
90 struct frag_hdr _fhdr;
91 const struct frag_hdr *fh;
92
93 nf_log_buf_add(m, "FRAG:");
94 fh = skb_header_pointer(skb, ptr, sizeof(_fhdr),
95 &_fhdr);
96 if (fh == NULL) {
97 nf_log_buf_add(m, "TRUNCATED ");
98 return;
99 }
100
101
102 nf_log_buf_add(m, "%u ", ntohs(fh->frag_off) & 0xFFF8);
103
104
105 if (fh->frag_off & htons(0x0001))
106 nf_log_buf_add(m, "INCOMPLETE ");
107
108 nf_log_buf_add(m, "ID:%08x ",
109 ntohl(fh->identification));
110
111 if (ntohs(fh->frag_off) & 0xFFF8)
112 fragment = 1;
113
114 hdrlen = 8;
115
116 break;
117 }
118 case IPPROTO_DSTOPTS:
119 case IPPROTO_ROUTING:
120 case IPPROTO_HOPOPTS:
121 if (fragment) {
122 if (logflags & XT_LOG_IPOPT)
123 nf_log_buf_add(m, ")");
124 return;
125 }
126 hdrlen = ipv6_optlen(hp);
127 break;
128
129 case IPPROTO_AH:
130 if (logflags & XT_LOG_IPOPT) {
131 struct ip_auth_hdr _ahdr;
132 const struct ip_auth_hdr *ah;
133
134
135 nf_log_buf_add(m, "AH ");
136
137 if (fragment) {
138 nf_log_buf_add(m, ")");
139 return;
140 }
141
142 ah = skb_header_pointer(skb, ptr, sizeof(_ahdr),
143 &_ahdr);
144 if (ah == NULL) {
145
146
147
148
149 nf_log_buf_add(m, "INCOMPLETE [%u bytes] )",
150 skb->len - ptr);
151 return;
152 }
153
154
155 nf_log_buf_add(m, "SPI=0x%x ", ntohl(ah->spi));
156
157 }
158
159 hdrlen = (hp->hdrlen+2)<<2;
160 break;
161 case IPPROTO_ESP:
162 if (logflags & XT_LOG_IPOPT) {
163 struct ip_esp_hdr _esph;
164 const struct ip_esp_hdr *eh;
165
166
167 nf_log_buf_add(m, "ESP ");
168
169 if (fragment) {
170 nf_log_buf_add(m, ")");
171 return;
172 }
173
174
175
176
177 eh = skb_header_pointer(skb, ptr, sizeof(_esph),
178 &_esph);
179 if (eh == NULL) {
180 nf_log_buf_add(m, "INCOMPLETE [%u bytes] )",
181 skb->len - ptr);
182 return;
183 }
184
185
186 nf_log_buf_add(m, "SPI=0x%x )",
187 ntohl(eh->spi));
188 }
189 return;
190 default:
191
192 nf_log_buf_add(m, "Unknown Ext Hdr %u", currenthdr);
193 return;
194 }
195 if (logflags & XT_LOG_IPOPT)
196 nf_log_buf_add(m, ") ");
197
198 currenthdr = hp->nexthdr;
199 ptr += hdrlen;
200 }
201
202 switch (currenthdr) {
203 case IPPROTO_TCP:
204 if (nf_log_dump_tcp_header(m, skb, currenthdr, fragment,
205 ptr, logflags))
206 return;
207 break;
208 case IPPROTO_UDP:
209 case IPPROTO_UDPLITE:
210 if (nf_log_dump_udp_header(m, skb, currenthdr, fragment, ptr))
211 return;
212 break;
213 case IPPROTO_ICMPV6: {
214 struct icmp6hdr _icmp6h;
215 const struct icmp6hdr *ic;
216
217
218 nf_log_buf_add(m, "PROTO=ICMPv6 ");
219
220 if (fragment)
221 break;
222
223
224 ic = skb_header_pointer(skb, ptr, sizeof(_icmp6h), &_icmp6h);
225 if (ic == NULL) {
226 nf_log_buf_add(m, "INCOMPLETE [%u bytes] ",
227 skb->len - ptr);
228 return;
229 }
230
231
232 nf_log_buf_add(m, "TYPE=%u CODE=%u ",
233 ic->icmp6_type, ic->icmp6_code);
234
235 switch (ic->icmp6_type) {
236 case ICMPV6_ECHO_REQUEST:
237 case ICMPV6_ECHO_REPLY:
238
239 nf_log_buf_add(m, "ID=%u SEQ=%u ",
240 ntohs(ic->icmp6_identifier),
241 ntohs(ic->icmp6_sequence));
242 break;
243 case ICMPV6_MGM_QUERY:
244 case ICMPV6_MGM_REPORT:
245 case ICMPV6_MGM_REDUCTION:
246 break;
247
248 case ICMPV6_PARAMPROB:
249
250 nf_log_buf_add(m, "POINTER=%08x ",
251 ntohl(ic->icmp6_pointer));
252
253 case ICMPV6_DEST_UNREACH:
254 case ICMPV6_PKT_TOOBIG:
255 case ICMPV6_TIME_EXCEED:
256
257 if (recurse) {
258 nf_log_buf_add(m, "[");
259 dump_ipv6_packet(m, info, skb,
260 ptr + sizeof(_icmp6h), 0);
261 nf_log_buf_add(m, "] ");
262 }
263
264
265 if (ic->icmp6_type == ICMPV6_PKT_TOOBIG) {
266 nf_log_buf_add(m, "MTU=%u ",
267 ntohl(ic->icmp6_mtu));
268 }
269 }
270 break;
271 }
272
273 default:
274 nf_log_buf_add(m, "PROTO=%u ", currenthdr);
275 }
276
277
278 if ((logflags & XT_LOG_UID) && recurse)
279 nf_log_dump_sk_uid_gid(m, skb->sk);
280
281
282 if (recurse && skb->mark)
283 nf_log_buf_add(m, "MARK=0x%x ", skb->mark);
284}
285
286static void dump_ipv6_mac_header(struct nf_log_buf *m,
287 const struct nf_loginfo *info,
288 const struct sk_buff *skb)
289{
290 struct net_device *dev = skb->dev;
291 unsigned int logflags = 0;
292
293 if (info->type == NF_LOG_TYPE_LOG)
294 logflags = info->u.log.logflags;
295
296 if (!(logflags & XT_LOG_MACDECODE))
297 goto fallback;
298
299 switch (dev->type) {
300 case ARPHRD_ETHER:
301 nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",
302 eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,
303 ntohs(eth_hdr(skb)->h_proto));
304 return;
305 default:
306 break;
307 }
308
309fallback:
310 nf_log_buf_add(m, "MAC=");
311 if (dev->hard_header_len &&
312 skb->mac_header != skb->network_header) {
313 const unsigned char *p = skb_mac_header(skb);
314 unsigned int len = dev->hard_header_len;
315 unsigned int i;
316
317 if (dev->type == ARPHRD_SIT) {
318 p -= ETH_HLEN;
319
320 if (p < skb->head)
321 p = NULL;
322 }
323
324 if (p != NULL) {
325 nf_log_buf_add(m, "%02x", *p++);
326 for (i = 1; i < len; i++)
327 nf_log_buf_add(m, ":%02x", *p++);
328 }
329 nf_log_buf_add(m, " ");
330
331 if (dev->type == ARPHRD_SIT) {
332 const struct iphdr *iph =
333 (struct iphdr *)skb_mac_header(skb);
334 nf_log_buf_add(m, "TUNNEL=%pI4->%pI4 ", &iph->saddr,
335 &iph->daddr);
336 }
337 } else {
338 nf_log_buf_add(m, " ");
339 }
340}
341
342static void nf_log_ip6_packet(struct net *net, u_int8_t pf,
343 unsigned int hooknum, const struct sk_buff *skb,
344 const struct net_device *in,
345 const struct net_device *out,
346 const struct nf_loginfo *loginfo,
347 const char *prefix)
348{
349 struct nf_log_buf *m;
350
351
352 if (!net_eq(net, &init_net))
353 return;
354
355 m = nf_log_buf_open();
356
357 if (!loginfo)
358 loginfo = &default_loginfo;
359
360 nf_log_dump_packet_common(m, pf, hooknum, skb, in, out,
361 loginfo, prefix);
362
363 if (in != NULL)
364 dump_ipv6_mac_header(m, loginfo, skb);
365
366 dump_ipv6_packet(m, loginfo, skb, skb_network_offset(skb), 1);
367
368 nf_log_buf_close(m);
369}
370
371static struct nf_logger nf_ip6_logger __read_mostly = {
372 .name = "nf_log_ipv6",
373 .type = NF_LOG_TYPE_LOG,
374 .logfn = nf_log_ip6_packet,
375 .me = THIS_MODULE,
376};
377
378static int __net_init nf_log_ipv6_net_init(struct net *net)
379{
380 nf_log_set(net, NFPROTO_IPV6, &nf_ip6_logger);
381 return 0;
382}
383
384static void __net_exit nf_log_ipv6_net_exit(struct net *net)
385{
386 nf_log_unset(net, &nf_ip6_logger);
387}
388
389static struct pernet_operations nf_log_ipv6_net_ops = {
390 .init = nf_log_ipv6_net_init,
391 .exit = nf_log_ipv6_net_exit,
392};
393
394static int __init nf_log_ipv6_init(void)
395{
396 int ret;
397
398 ret = register_pernet_subsys(&nf_log_ipv6_net_ops);
399 if (ret < 0)
400 return ret;
401
402 ret = nf_log_register(NFPROTO_IPV6, &nf_ip6_logger);
403 if (ret < 0) {
404 pr_err("failed to register logger\n");
405 goto err1;
406 }
407
408 return 0;
409
410err1:
411 unregister_pernet_subsys(&nf_log_ipv6_net_ops);
412 return ret;
413}
414
415static void __exit nf_log_ipv6_exit(void)
416{
417 unregister_pernet_subsys(&nf_log_ipv6_net_ops);
418 nf_log_unregister(&nf_ip6_logger);
419}
420
421module_init(nf_log_ipv6_init);
422module_exit(nf_log_ipv6_exit);
423
424MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
425MODULE_DESCRIPTION("Netfilter IPv6 packet logging");
426MODULE_LICENSE("GPL");
427MODULE_ALIAS_NF_LOGGER(AF_INET6, 0);
428
