1 #include <stdbool.h>
2 #include <stdlib.h>
3 #include <stdio.h>
4 #include <string.h>
5 #include <getopt.h>
6 #include <xtables.h>
7
8 #include <linux/netfilter/x_tables.h>
9 #include <linux/netfilter/xt_NFLOG.h>
10
11 enum {
12 O_GROUP = 0,
13 O_PREFIX,
14 O_RANGE,
15 O_SIZE,
16 O_THRESHOLD,
17 F_RANGE = 1 << O_RANGE,
18 F_SIZE = 1 << O_SIZE,
19 };
20
21 #define s struct xt_nflog_info
22 static const struct xt_option_entry NFLOG_opts[] = {
23 {.name = "nflog-group", .id = O_GROUP, .type = XTTYPE_UINT16,
24 .flags = XTOPT_PUT, XTOPT_POINTER(s, group)},
25 {.name = "nflog-prefix", .id = O_PREFIX, .type = XTTYPE_STRING,
26 .min = 1, .flags = XTOPT_PUT, XTOPT_POINTER(s, prefix)},
27 {.name = "nflog-range", .id = O_RANGE, .type = XTTYPE_UINT32,
28 .excl = F_SIZE, .flags = XTOPT_PUT, XTOPT_POINTER(s, len)},
29 {.name = "nflog-size", .id = O_SIZE, .type = XTTYPE_UINT32,
30 .excl = F_RANGE, .flags = XTOPT_PUT, XTOPT_POINTER(s, len)},
31 {.name = "nflog-threshold", .id = O_THRESHOLD, .type = XTTYPE_UINT16,
32 .flags = XTOPT_PUT, XTOPT_POINTER(s, threshold)},
33 XTOPT_TABLEEND,
34 };
35 #undef s
36
NFLOG_help(void)37 static void NFLOG_help(void)
38 {
39 printf("NFLOG target options:\n"
40 " --nflog-group NUM NETLINK group used for logging\n"
41 " --nflog-range NUM This option has no effect, use --nflog-size\n"
42 " --nflog-size NUM Number of bytes to copy\n"
43 " --nflog-threshold NUM Message threshold of in-kernel queue\n"
44 " --nflog-prefix STRING Prefix string for log messages\n");
45 }
46
NFLOG_init(struct xt_entry_target * t)47 static void NFLOG_init(struct xt_entry_target *t)
48 {
49 struct xt_nflog_info *info = (struct xt_nflog_info *)t->data;
50
51 info->threshold = XT_NFLOG_DEFAULT_THRESHOLD;
52 }
53
NFLOG_parse(struct xt_option_call * cb)54 static void NFLOG_parse(struct xt_option_call *cb)
55 {
56 xtables_option_parse(cb);
57 switch (cb->entry->id) {
58 case O_PREFIX:
59 if (strchr(cb->arg, '\n') != NULL)
60 xtables_error(PARAMETER_PROBLEM,
61 "Newlines not allowed in --log-prefix");
62 break;
63 }
64 }
65
NFLOG_check(struct xt_fcheck_call * cb)66 static void NFLOG_check(struct xt_fcheck_call *cb)
67 {
68 struct xt_nflog_info *info = cb->data;
69
70 if (cb->xflags & F_RANGE)
71 fprintf(stderr, "warn: --nflog-range has never worked and is no"
72 " longer supported, please use --nflog-size insted\n");
73
74 if (cb->xflags & F_SIZE)
75 info->flags |= XT_NFLOG_F_COPY_LEN;
76 }
77
nflog_print(const struct xt_nflog_info * info,char * prefix)78 static void nflog_print(const struct xt_nflog_info *info, char *prefix)
79 {
80 if (info->prefix[0] != '\0') {
81 printf(" %snflog-prefix ", prefix);
82 xtables_save_string(info->prefix);
83 }
84 if (info->group)
85 printf(" %snflog-group %u", prefix, info->group);
86 if (info->flags & XT_NFLOG_F_COPY_LEN)
87 printf(" %snflog-size %u", prefix, info->len);
88 else if (info->len)
89 printf(" %snflog-range %u", prefix, info->len);
90 if (info->threshold != XT_NFLOG_DEFAULT_THRESHOLD)
91 printf(" %snflog-threshold %u", prefix, info->threshold);
92 }
93
NFLOG_print(const void * ip,const struct xt_entry_target * target,int numeric)94 static void NFLOG_print(const void *ip, const struct xt_entry_target *target,
95 int numeric)
96 {
97 const struct xt_nflog_info *info = (struct xt_nflog_info *)target->data;
98
99 nflog_print(info, "");
100 }
101
NFLOG_save(const void * ip,const struct xt_entry_target * target)102 static void NFLOG_save(const void *ip, const struct xt_entry_target *target)
103 {
104 const struct xt_nflog_info *info = (struct xt_nflog_info *)target->data;
105
106 nflog_print(info, "--");
107 }
108
nflog_print_xlate(const struct xt_nflog_info * info,struct xt_xlate * xl,bool escape_quotes)109 static void nflog_print_xlate(const struct xt_nflog_info *info,
110 struct xt_xlate *xl, bool escape_quotes)
111 {
112 xt_xlate_add(xl, "log ");
113 if (info->prefix[0] != '\0') {
114 if (escape_quotes)
115 xt_xlate_add(xl, "prefix \\\"%s\\\" ", info->prefix);
116 else
117 xt_xlate_add(xl, "prefix \"%s\" ", info->prefix);
118
119 }
120 if (info->flags & XT_NFLOG_F_COPY_LEN)
121 xt_xlate_add(xl, "snaplen %u ", info->len);
122 if (info->threshold != XT_NFLOG_DEFAULT_THRESHOLD)
123 xt_xlate_add(xl, "queue-threshold %u ", info->threshold);
124 xt_xlate_add(xl, "group %u ", info->group);
125 }
126
NFLOG_xlate(struct xt_xlate * xl,const struct xt_xlate_tg_params * params)127 static int NFLOG_xlate(struct xt_xlate *xl,
128 const struct xt_xlate_tg_params *params)
129 {
130 const struct xt_nflog_info *info =
131 (struct xt_nflog_info *)params->target->data;
132
133 nflog_print_xlate(info, xl, params->escape_quotes);
134
135 return 1;
136 }
137
138 static struct xtables_target nflog_target = {
139 .family = NFPROTO_UNSPEC,
140 .name = "NFLOG",
141 .version = XTABLES_VERSION,
142 .size = XT_ALIGN(sizeof(struct xt_nflog_info)),
143 .userspacesize = XT_ALIGN(sizeof(struct xt_nflog_info)),
144 .help = NFLOG_help,
145 .init = NFLOG_init,
146 .x6_fcheck = NFLOG_check,
147 .x6_parse = NFLOG_parse,
148 .print = NFLOG_print,
149 .save = NFLOG_save,
150 .x6_options = NFLOG_opts,
151 .xlate = NFLOG_xlate,
152 };
153
_init(void)154 void _init(void)
155 {
156 xtables_register_target(&nflog_target);
157 }
158