1 /*
2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
10 */
11
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_log.h>
20 #include <linux/netdevice.h>
21
22 static const char *nft_log_null_prefix = "";
23
24 struct nft_log {
25 struct nf_loginfo loginfo;
26 char *prefix;
27 };
28
nft_log_eval(const struct nft_expr * expr,struct nft_regs * regs,const struct nft_pktinfo * pkt)29 static void nft_log_eval(const struct nft_expr *expr,
30 struct nft_regs *regs,
31 const struct nft_pktinfo *pkt)
32 {
33 const struct nft_log *priv = nft_expr_priv(expr);
34
35 nf_log_packet(pkt->net, pkt->pf, pkt->hook, pkt->skb, pkt->in,
36 pkt->out, &priv->loginfo, "%s", priv->prefix);
37 }
38
39 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
40 [NFTA_LOG_GROUP] = { .type = NLA_U16 },
41 [NFTA_LOG_PREFIX] = { .type = NLA_STRING,
42 .len = NF_LOG_PREFIXLEN - 1 },
43 [NFTA_LOG_SNAPLEN] = { .type = NLA_U32 },
44 [NFTA_LOG_QTHRESHOLD] = { .type = NLA_U16 },
45 [NFTA_LOG_LEVEL] = { .type = NLA_U32 },
46 [NFTA_LOG_FLAGS] = { .type = NLA_U32 },
47 };
48
nft_log_init(const struct nft_ctx * ctx,const struct nft_expr * expr,const struct nlattr * const tb[])49 static int nft_log_init(const struct nft_ctx *ctx,
50 const struct nft_expr *expr,
51 const struct nlattr * const tb[])
52 {
53 struct nft_log *priv = nft_expr_priv(expr);
54 struct nf_loginfo *li = &priv->loginfo;
55 const struct nlattr *nla;
56 int err;
57
58 li->type = NF_LOG_TYPE_LOG;
59 if (tb[NFTA_LOG_LEVEL] != NULL &&
60 tb[NFTA_LOG_GROUP] != NULL)
61 return -EINVAL;
62 if (tb[NFTA_LOG_GROUP] != NULL) {
63 li->type = NF_LOG_TYPE_ULOG;
64 if (tb[NFTA_LOG_FLAGS] != NULL)
65 return -EINVAL;
66 }
67
68 nla = tb[NFTA_LOG_PREFIX];
69 if (nla != NULL) {
70 priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
71 if (priv->prefix == NULL)
72 return -ENOMEM;
73 nla_strlcpy(priv->prefix, nla, nla_len(nla) + 1);
74 } else {
75 priv->prefix = (char *)nft_log_null_prefix;
76 }
77
78 switch (li->type) {
79 case NF_LOG_TYPE_LOG:
80 if (tb[NFTA_LOG_LEVEL] != NULL) {
81 li->u.log.level =
82 ntohl(nla_get_be32(tb[NFTA_LOG_LEVEL]));
83 } else {
84 li->u.log.level = LOGLEVEL_WARNING;
85 }
86 if (li->u.log.level > LOGLEVEL_DEBUG) {
87 err = -EINVAL;
88 goto err1;
89 }
90
91 if (tb[NFTA_LOG_FLAGS] != NULL) {
92 li->u.log.logflags =
93 ntohl(nla_get_be32(tb[NFTA_LOG_FLAGS]));
94 if (li->u.log.logflags & ~NF_LOG_MASK) {
95 err = -EINVAL;
96 goto err1;
97 }
98 }
99 break;
100 case NF_LOG_TYPE_ULOG:
101 li->u.ulog.group = ntohs(nla_get_be16(tb[NFTA_LOG_GROUP]));
102 if (tb[NFTA_LOG_SNAPLEN] != NULL) {
103 li->u.ulog.flags |= NF_LOG_F_COPY_LEN;
104 li->u.ulog.copy_len =
105 ntohl(nla_get_be32(tb[NFTA_LOG_SNAPLEN]));
106 }
107 if (tb[NFTA_LOG_QTHRESHOLD] != NULL) {
108 li->u.ulog.qthreshold =
109 ntohs(nla_get_be16(tb[NFTA_LOG_QTHRESHOLD]));
110 }
111 break;
112 }
113
114 err = nf_logger_find_get(ctx->afi->family, li->type);
115 if (err < 0)
116 goto err1;
117
118 return 0;
119
120 err1:
121 if (priv->prefix != nft_log_null_prefix)
122 kfree(priv->prefix);
123 return err;
124 }
125
nft_log_destroy(const struct nft_ctx * ctx,const struct nft_expr * expr)126 static void nft_log_destroy(const struct nft_ctx *ctx,
127 const struct nft_expr *expr)
128 {
129 struct nft_log *priv = nft_expr_priv(expr);
130 struct nf_loginfo *li = &priv->loginfo;
131
132 if (priv->prefix != nft_log_null_prefix)
133 kfree(priv->prefix);
134
135 nf_logger_put(ctx->afi->family, li->type);
136 }
137
nft_log_dump(struct sk_buff * skb,const struct nft_expr * expr)138 static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)
139 {
140 const struct nft_log *priv = nft_expr_priv(expr);
141 const struct nf_loginfo *li = &priv->loginfo;
142
143 if (priv->prefix != nft_log_null_prefix)
144 if (nla_put_string(skb, NFTA_LOG_PREFIX, priv->prefix))
145 goto nla_put_failure;
146 switch (li->type) {
147 case NF_LOG_TYPE_LOG:
148 if (nla_put_be32(skb, NFTA_LOG_LEVEL, htonl(li->u.log.level)))
149 goto nla_put_failure;
150
151 if (li->u.log.logflags) {
152 if (nla_put_be32(skb, NFTA_LOG_FLAGS,
153 htonl(li->u.log.logflags)))
154 goto nla_put_failure;
155 }
156 break;
157 case NF_LOG_TYPE_ULOG:
158 if (nla_put_be16(skb, NFTA_LOG_GROUP, htons(li->u.ulog.group)))
159 goto nla_put_failure;
160
161 if (li->u.ulog.flags & NF_LOG_F_COPY_LEN) {
162 if (nla_put_be32(skb, NFTA_LOG_SNAPLEN,
163 htonl(li->u.ulog.copy_len)))
164 goto nla_put_failure;
165 }
166 if (li->u.ulog.qthreshold) {
167 if (nla_put_be16(skb, NFTA_LOG_QTHRESHOLD,
168 htons(li->u.ulog.qthreshold)))
169 goto nla_put_failure;
170 }
171 break;
172 }
173 return 0;
174
175 nla_put_failure:
176 return -1;
177 }
178
179 static struct nft_expr_type nft_log_type;
180 static const struct nft_expr_ops nft_log_ops = {
181 .type = &nft_log_type,
182 .size = NFT_EXPR_SIZE(sizeof(struct nft_log)),
183 .eval = nft_log_eval,
184 .init = nft_log_init,
185 .destroy = nft_log_destroy,
186 .dump = nft_log_dump,
187 };
188
189 static struct nft_expr_type nft_log_type __read_mostly = {
190 .name = "log",
191 .ops = &nft_log_ops,
192 .policy = nft_log_policy,
193 .maxattr = NFTA_LOG_MAX,
194 .owner = THIS_MODULE,
195 };
196
nft_log_module_init(void)197 static int __init nft_log_module_init(void)
198 {
199 return nft_register_expr(&nft_log_type);
200 }
201
nft_log_module_exit(void)202 static void __exit nft_log_module_exit(void)
203 {
204 nft_unregister_expr(&nft_log_type);
205 }
206
207 module_init(nft_log_module_init);
208 module_exit(nft_log_module_exit);
209
210 MODULE_LICENSE("GPL");
211 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
212 MODULE_ALIAS_NFT_EXPR("log");
213