|
Packit |
7b22a4 |
#include <stdbool.h>
|
|
Packit |
7b22a4 |
#include <stdlib.h>
|
|
Packit |
7b22a4 |
#include <stdio.h>
|
|
Packit |
7b22a4 |
#include <string.h>
|
|
Packit |
7b22a4 |
#include <getopt.h>
|
|
Packit |
7b22a4 |
#include <xtables.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#include <linux/netfilter/x_tables.h>
|
|
Packit |
7b22a4 |
#include <linux/netfilter/xt_NFLOG.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
enum {
|
|
Packit |
7b22a4 |
O_GROUP = 0,
|
|
Packit |
7b22a4 |
O_PREFIX,
|
|
Packit |
7b22a4 |
O_RANGE,
|
|
Packit |
7b22a4 |
O_SIZE,
|
|
Packit |
7b22a4 |
O_THRESHOLD,
|
|
Packit |
7b22a4 |
F_RANGE = 1 << O_RANGE,
|
|
Packit |
7b22a4 |
F_SIZE = 1 << O_SIZE,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#define s struct xt_nflog_info
|
|
Packit |
7b22a4 |
static const struct xt_option_entry NFLOG_opts[] = {
|
|
Packit |
7b22a4 |
{.name = "nflog-group", .id = O_GROUP, .type = XTTYPE_UINT16,
|
|
Packit |
7b22a4 |
.flags = XTOPT_PUT, XTOPT_POINTER(s, group)},
|
|
Packit |
7b22a4 |
{.name = "nflog-prefix", .id = O_PREFIX, .type = XTTYPE_STRING,
|
|
Packit |
7b22a4 |
.min = 1, .flags = XTOPT_PUT, XTOPT_POINTER(s, prefix)},
|
|
Packit |
7b22a4 |
{.name = "nflog-range", .id = O_RANGE, .type = XTTYPE_UINT32,
|
|
Packit |
7b22a4 |
.excl = F_SIZE, .flags = XTOPT_PUT, XTOPT_POINTER(s, len)},
|
|
Packit |
7b22a4 |
{.name = "nflog-size", .id = O_SIZE, .type = XTTYPE_UINT32,
|
|
Packit |
7b22a4 |
.excl = F_RANGE, .flags = XTOPT_PUT, XTOPT_POINTER(s, len)},
|
|
Packit |
7b22a4 |
{.name = "nflog-threshold", .id = O_THRESHOLD, .type = XTTYPE_UINT16,
|
|
Packit |
7b22a4 |
.flags = XTOPT_PUT, XTOPT_POINTER(s, threshold)},
|
|
Packit |
7b22a4 |
XTOPT_TABLEEND,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
#undef s
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void NFLOG_help(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
printf("NFLOG target options:\n"
|
|
Packit |
7b22a4 |
" --nflog-group NUM NETLINK group used for logging\n"
|
|
Packit |
7b22a4 |
" --nflog-range NUM This option has no effect, use --nflog-size\n"
|
|
Packit |
7b22a4 |
" --nflog-size NUM Number of bytes to copy\n"
|
|
Packit |
7b22a4 |
" --nflog-threshold NUM Message threshold of in-kernel queue\n"
|
|
Packit |
7b22a4 |
" --nflog-prefix STRING Prefix string for log messages\n");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void NFLOG_init(struct xt_entry_target *t)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct xt_nflog_info *info = (struct xt_nflog_info *)t->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
info->threshold = XT_NFLOG_DEFAULT_THRESHOLD;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void NFLOG_parse(struct xt_option_call *cb)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
xtables_option_parse(cb);
|
|
Packit |
7b22a4 |
switch (cb->entry->id) {
|
|
Packit |
7b22a4 |
case O_PREFIX:
|
|
Packit |
7b22a4 |
if (strchr(cb->arg, '\n') != NULL)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"Newlines not allowed in --log-prefix");
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void NFLOG_check(struct xt_fcheck_call *cb)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct xt_nflog_info *info = cb->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (cb->xflags & F_RANGE)
|
|
Packit |
7b22a4 |
fprintf(stderr, "warn: --nflog-range has never worked and is no"
|
|
Packit |
7b22a4 |
" longer supported, please use --nflog-size insted\n");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (cb->xflags & F_SIZE)
|
|
Packit |
7b22a4 |
info->flags |= XT_NFLOG_F_COPY_LEN;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void nflog_print(const struct xt_nflog_info *info, char *prefix)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
if (info->prefix[0] != '\0') {
|
|
Packit |
7b22a4 |
printf(" %snflog-prefix ", prefix);
|
|
Packit |
7b22a4 |
xtables_save_string(info->prefix);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
if (info->group)
|
|
Packit |
7b22a4 |
printf(" %snflog-group %u", prefix, info->group);
|
|
Packit |
7b22a4 |
if (info->flags & XT_NFLOG_F_COPY_LEN)
|
|
Packit |
7b22a4 |
printf(" %snflog-size %u", prefix, info->len);
|
|
Packit |
7b22a4 |
else if (info->len)
|
|
Packit |
7b22a4 |
printf(" %snflog-range %u", prefix, info->len);
|
|
Packit |
7b22a4 |
if (info->threshold != XT_NFLOG_DEFAULT_THRESHOLD)
|
|
Packit |
7b22a4 |
printf(" %snflog-threshold %u", prefix, info->threshold);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void NFLOG_print(const void *ip, const struct xt_entry_target *target,
|
|
Packit |
7b22a4 |
int numeric)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct xt_nflog_info *info = (struct xt_nflog_info *)target->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nflog_print(info, "");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void NFLOG_save(const void *ip, const struct xt_entry_target *target)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct xt_nflog_info *info = (struct xt_nflog_info *)target->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nflog_print(info, "--");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void nflog_print_xlate(const struct xt_nflog_info *info,
|
|
Packit |
7b22a4 |
struct xt_xlate *xl, bool escape_quotes)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "log ");
|
|
Packit |
7b22a4 |
if (info->prefix[0] != '\0') {
|
|
Packit |
7b22a4 |
if (escape_quotes)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "prefix \\\"%s\\\" ", info->prefix);
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "prefix \"%s\" ", info->prefix);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
if (info->flags & XT_NFLOG_F_COPY_LEN)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "snaplen %u ", info->len);
|
|
Packit |
7b22a4 |
if (info->threshold != XT_NFLOG_DEFAULT_THRESHOLD)
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "queue-threshold %u ", info->threshold);
|
|
Packit |
7b22a4 |
xt_xlate_add(xl, "group %u ", info->group);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int NFLOG_xlate(struct xt_xlate *xl,
|
|
Packit |
7b22a4 |
const struct xt_xlate_tg_params *params)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const struct xt_nflog_info *info =
|
|
Packit |
7b22a4 |
(struct xt_nflog_info *)params->target->data;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
nflog_print_xlate(info, xl, params->escape_quotes);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 1;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static struct xtables_target nflog_target = {
|
|
Packit |
7b22a4 |
.family = NFPROTO_UNSPEC,
|
|
Packit |
7b22a4 |
.name = "NFLOG",
|
|
Packit |
7b22a4 |
.version = XTABLES_VERSION,
|
|
Packit |
7b22a4 |
.size = XT_ALIGN(sizeof(struct xt_nflog_info)),
|
|
Packit |
7b22a4 |
.userspacesize = XT_ALIGN(sizeof(struct xt_nflog_info)),
|
|
Packit |
7b22a4 |
.help = NFLOG_help,
|
|
Packit |
7b22a4 |
.init = NFLOG_init,
|
|
Packit |
7b22a4 |
.x6_fcheck = NFLOG_check,
|
|
Packit |
7b22a4 |
.x6_parse = NFLOG_parse,
|
|
Packit |
7b22a4 |
.print = NFLOG_print,
|
|
Packit |
7b22a4 |
.save = NFLOG_save,
|
|
Packit |
7b22a4 |
.x6_options = NFLOG_opts,
|
|
Packit |
7b22a4 |
.xlate = NFLOG_xlate,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
void _init(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
xtables_register_target(&nflog_target);
|
|
Packit |
7b22a4 |
}
|