5 * Bart De Schuymer <bdschuym@pandora.be>
6 * Harald Welte <laforge@netfilter.org>
13 #include <linux/netfilter_bridge/ebtables.h>
14 #include <linux/netfilter_bridge/ebt_log.h>
15 #include <linux/netfilter.h>
16 #include <linux/module.h>
18 #include <linux/if_arp.h>
19 #include <linux/spinlock.h>
21 static DEFINE_SPINLOCK(ebt_log_lock);
23 static int ebt_log_check(const char *tablename, unsigned int hookmask,
24 const struct ebt_entry *e, void *data, unsigned int datalen)
26 struct ebt_log_info *info = (struct ebt_log_info *)data;
28 if (datalen != EBT_ALIGN(sizeof(struct ebt_log_info)))
30 if (info->bitmask & ~EBT_LOG_MASK)
32 if (info->loglevel >= 8)
34 info->prefix[EBT_LOG_PREFIX_SIZE - 1] = '\0';
46 unsigned char mac_src[ETH_ALEN];
47 unsigned char ip_src[4];
48 unsigned char mac_dst[ETH_ALEN];
49 unsigned char ip_dst[4];
52 static void print_MAC(unsigned char *p)
56 for (i = 0; i < ETH_ALEN; i++, p++)
57 printk("%02x%c", *p, i == ETH_ALEN - 1 ? ' ':':');
60 #define myNIPQUAD(a) a[0], a[1], a[2], a[3]
62 ebt_log_packet(unsigned int pf, unsigned int hooknum,
63 const struct sk_buff *skb, const struct net_device *in,
64 const struct net_device *out, const struct nf_loginfo *loginfo,
69 spin_lock_bh(&ebt_log_lock);
70 printk("<%c>%s IN=%s OUT=%s MAC source = ", '0' + loginfo->u.log.level,
71 prefix, in ? in->name : "", out ? out->name : "");
73 print_MAC(eth_hdr(skb)->h_source);
74 printk("MAC dest = ");
75 print_MAC(eth_hdr(skb)->h_dest);
77 printk("proto = 0x%04x", ntohs(eth_hdr(skb)->h_proto));
79 if (loginfo->type == NF_LOG_TYPE_LOG)
80 bitmask = loginfo->u.log.logflags;
82 bitmask = NF_LOG_MASK;
84 if ((bitmask & EBT_LOG_IP) && eth_hdr(skb)->h_proto ==
86 struct iphdr _iph, *ih;
88 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
90 printk(" INCOMPLETE IP header");
93 printk(" IP SRC=%u.%u.%u.%u IP DST=%u.%u.%u.%u, IP "
94 "tos=0x%02X, IP proto=%d", NIPQUAD(ih->saddr),
95 NIPQUAD(ih->daddr), ih->tos, ih->protocol);
96 if (ih->protocol == IPPROTO_TCP ||
97 ih->protocol == IPPROTO_UDP) {
98 struct tcpudphdr _ports, *pptr;
100 pptr = skb_header_pointer(skb, ih->ihl*4,
101 sizeof(_ports), &_ports);
103 printk(" INCOMPLETE TCP/UDP header");
106 printk(" SPT=%u DPT=%u", ntohs(pptr->src),
112 if ((bitmask & EBT_LOG_ARP) &&
113 ((eth_hdr(skb)->h_proto == htons(ETH_P_ARP)) ||
114 (eth_hdr(skb)->h_proto == htons(ETH_P_RARP)))) {
115 struct arphdr _arph, *ah;
117 ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);
119 printk(" INCOMPLETE ARP header");
122 printk(" ARP HTYPE=%d, PTYPE=0x%04x, OPCODE=%d",
123 ntohs(ah->ar_hrd), ntohs(ah->ar_pro),
126 /* If it's for Ethernet and the lengths are OK,
127 * then log the ARP payload */
128 if (ah->ar_hrd == htons(1) &&
129 ah->ar_hln == ETH_ALEN &&
130 ah->ar_pln == sizeof(uint32_t)) {
131 struct arppayload _arpp, *ap;
133 ap = skb_header_pointer(skb, sizeof(_arph),
134 sizeof(_arpp), &_arpp);
136 printk(" INCOMPLETE ARP payload");
139 printk(" ARP MAC SRC=");
140 print_MAC(ap->mac_src);
141 printk(" ARP IP SRC=%u.%u.%u.%u",
142 myNIPQUAD(ap->ip_src));
143 printk(" ARP MAC DST=");
144 print_MAC(ap->mac_dst);
145 printk(" ARP IP DST=%u.%u.%u.%u",
146 myNIPQUAD(ap->ip_dst));
151 spin_unlock_bh(&ebt_log_lock);
155 static void ebt_log(const struct sk_buff *skb, unsigned int hooknr,
156 const struct net_device *in, const struct net_device *out,
157 const void *data, unsigned int datalen)
159 struct ebt_log_info *info = (struct ebt_log_info *)data;
160 struct nf_loginfo li;
162 li.type = NF_LOG_TYPE_LOG;
163 li.u.log.level = info->loglevel;
164 li.u.log.logflags = info->bitmask;
166 nf_log_packet(PF_BRIDGE, hooknr, skb, in, out, &li, info->prefix);
169 static struct ebt_watcher log =
171 .name = EBT_LOG_WATCHER,
173 .check = ebt_log_check,
177 static struct nf_logger ebt_log_logger = {
179 .logfn = &ebt_log_packet,
183 static int __init init(void)
187 ret = ebt_register_watcher(&log);
190 if (nf_log_register(PF_BRIDGE, &ebt_log_logger) < 0) {
191 printk(KERN_WARNING "ebt_log: not logging via system console "
192 "since somebody else already registered for PF_INET\n");
193 /* we cannot make module load fail here, since otherwise
194 * ebtables userspace would abort */
200 static void __exit fini(void)
202 nf_log_unregister_logger(&ebt_log_logger);
203 ebt_unregister_watcher(&log);
208 MODULE_LICENSE("GPL");