| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
It was always default if not specified by command parameter.
Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
|
|
|
|
|
|
|
| |
This patch supresses the oob.time.sec from the input keys as this
is not used when creating the string corresponding to the packet.
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
|
| |
This patch updates the JSON output plugin to have it use the
timestamp of the packet if available. The date format used
for the timestamp is now using ISO 8601 to have an easy
import in most software (tested with logstash and splunk).
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
| |
When hash table is not used, the start timestamp was not used even
if the kernel is sending it. This patch modifies the code to use it
when available. This allows to log connection with start and end
with a single message per connection and without the cost of
maintaining the hash table.
|
|
|
|
|
|
|
| |
If the file is in DOS mode, the string coming from config file
parsing are containing the carriage return. The result is that
string are not correct and the parsing of confuguration file
is failling.
|
|
|
|
|
| |
In case there is no logfile, ulogd could possibly display each
log message twice to stderr.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch introduces a new JSON output plugin. This
patch displays CIM field name instead of ulogd key valu
if this CIM field is available.
The module does not display binary address but uses the
string version of them. So a complete stack is for example:
stack=log2:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,json1:JSON
If boolean_label is set to 1, then the numeric_label put on packet
by the input plugin is coding the decision on packet. If 0, then
packet has been blocked and if non null it has been accepted.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds storage for CIM field name in ulogd key. This
will be used by JSON output to interoperate with logging
collector such as logstash or splunk.
Common Information Model is an open standard that defines how managed
elements in an IT environment are represented as a common set of objects
and relationships between them:
http://www.dmtf.org/standards/cim
This seems to be mainly XML based but there is a JSON version of some
aspects of the model. One of the main documentation on CIM in JSON
format seems to be:
http://docs.splunk.com/Documentation/PCI/2.0/DataSource/CommonInformationModelFieldReference
Using the correct CIM field name allow events coming from ulogd to be
correlated with events coming from other sources.
|
|
|
|
|
|
| |
This patch improves database reconnection handling in ring buffer
mode. Ulogd now redo the failed query and do not loose anymore
one packet.
|
|
|
|
|
|
| |
Injection thread was not cancelled when a termination signal was
sent. This was causing a crash in some cases. This patch fixes this
by canceling the thread when a SIGTERM or SIGINT signal is received.
|
|
|
|
|
|
|
|
|
| |
As default size was non null, the ring system was activated by
default. It was only possible to desactivate the ring system
by setting it to ring_buffer_size to 0 in the configuration.
This was not the attended behavior. This patch set it to 0 to have
only explicit activation of the ring feature.
|
|
|
|
|
|
|
| |
pp_print macro was not correctly formatting u64. This patch renames
it to pp_print_u as it is only used to print integer. It also use
the PRIu* macros to have a correct format string for all integers
type.
|
|
|
|
|
|
| |
Some counter have been recently switch to u64. This has caused warnings
relative to format string. This patch uses PRIu64 macro to fix these
warnings.
|
|
|
|
|
|
|
|
|
| |
Some uClibc-based toolchains lack threading support, so use
AC_SEARCH_LIB instead of AC_CHECK_LIB to check for libpthread
availability and link conditionally if found since it's only used for
the database backends.
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
|
|
|
|
| |
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
| |
The nflog handle is closed, and then nflog_unbind_pf() is called on it, which
triggers an assertion failure within libnfnetlink. This patch simply moves
the nflog_close() just after the nflog_unbind_pf() calls.
Signed-off-by: Chris Boot <bootc@bootc.net>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Kernel and libnetfilter_conntrack counters are 64bit,
so use 64bit too in ulogd instead of 32bit.
Worked fine on little endian systems but big endian systems
had zero counter...
Didn't test ipfix output, but RFC allows template with
either 32 or 64 counters, so should be safe.
Signed-off-by: Ulrich Weber <uw@xyne.com>
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
| |
This patches update the daemonization code. It is done earlier and
it uses the daemon(à function which is used for daemonization by
most projects.
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
| |
Pcap file variable was not quoted. This was confusing
as the correct file was not open if the user did
uncomment the variable.
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
|
| |
This patch adds a configuration variable for PostgreSQL output.
Named connstring it stores the character string that will be
used to connect to the PostgreSQL server. This allows the user
to use all options available like TLS parameters for example.
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
|
|
| |
This patch improves latest patch by splitting in two part the pid
file creation. This allows to display a message to stdout when
ulogd can not be started. Another linked improvement is that the
plugin initialization is not done if the pid file existence will
result in a ulogd exit.
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
|
|
|
| |
The deamon currently does not have the ability to write a PID file to track its
process ID. This is very useful to an init script and to ensure there is only
one running instance. This patch implements this functionality.
Signed-off-by: Chris Boot <bootc@bootc.net>
|
|
|
|
|
|
|
|
| |
The daemon code currently tries to nice(-1) just after having given up root
privileges, which fails. This patch moves the nice(-1) call to just before
the code that gives up the required privileges.
Signed-off-by: Chris Boot <bootc@bootc.net>
|
|
|
|
|
|
| |
In case nfacct is not enabled in ulogd2, libmnl is not used. So it shouldn't
be a hard global dependency, but instead only a dependency in case nfacct is
enabled.
|
| |
|
|
|
|
|
|
|
| |
The handling of signal when using threads can be complicated. When
ring buffer is used for query, this means ulogd will have to follow
some sort of mutex. Thus, it is easier and better performance wise
to disable the reload via SIGHUP when the ring buffer is used.
|
|
|
|
|
|
|
|
|
|
|
| |
This patch adds an optional ring buffer option which modify
the way database queries are made. The main thread is only handling
kernel message reading and query formatting. The SQL request is made
in a separate dedicated thread.
The idea is to try to avoid buffer overrun by minimizing the time
requested to treat kernel message. Doing synchronous SQL request, as
it was made before was causing a delay which could cause some messages
to be lost in case of burst from kernel side.
|
|
|
|
|
| |
Use an offset approach to get the start of values printing area. It
is more generic and will be use soon.
|
|
|
|
|
| |
The field is currently only used in a single function as a string
pointer and can thus be removed from the db instance structure.
|
|
|
|
|
|
|
| |
This patch is adding a mechanism to store query in a backlog build
in memory. This allow to store events during downtime in memory and
realize the effective insertion when the database comes back.
A memory cap is used to avoid any memory flooding.
|
|
|
|
| |
Nullify sqlite3 handler at deinit.
|
|
|
|
| |
Nullify mysql handler at deinit.
|
|
|
|
| |
Clean postgresql handler at deinit.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
ulogd has automagic deps for several output plugins right now, namely dbi,
pcap and sqlite3. These plugins are built if the appropriate libs are present
on user's system. While this situation is fine with binary distros it is not OK
on source-based ones such as Gentoo.
The problem arises when such a program links against libs without user's
request and libs are later removed from system which leaves program in a
broken state.
This patch is modifying configure.ac which we apply in our package and which
fixes mentioned issue. It adds 3 new configure options: --
without-{dbi,pcap.sqlite}. I would like to emphasize that this patch doesn't
change default behaviour of configure script at all, so all other distros won't
suffer. We simply add options to explicitly disable any attempts to try and
detect libs for automagic deps, which is enough to avoid unnecessary linkage.
|
| |
|
|
|
|
|
|
|
| |
This reverts commit 3179bd4de89de7c2388849f5bc48e8f5aad9e5b9.
Pointing to the wrong place. This is not the file descriptor
that ulogd is leaking.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Joan Touzet reported that file descriptor 3 was not ever closed
in the exit path of the parent process:
open("ulogd.conf", O_RDONLY) = 3
That corresponds to the the file descriptor that was used to
parse the configuration file was not closed.
This closes: http://bugzilla.netfilter.org/show_bug.cgi?id=793
Reported-by: Joan Touzet <joant@cloudant.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
|
|
| |
The "registering plugin" message is not really useful as the message
is really explicit if a plugin is missing.
|
|
|
|
|
|
|
| |
If conntrack object sent by connection tracking system is containing
a timestamp we use it instead of a gettimeofday() based counter.
Signed-off-by: Eric Leblond <eric@regit.org>
|
|
|
|
|
| |
Update release number and delete Changes file because we can use
git changelog fot that.
|
|
|
|
| |
Get rid of ULOG only documentation and adds some new stuffs.
|
| |
|
| |
|
|
|
|
|
| |
When an argument or a line is too long, it can not be store
into ulogd configuration and this must results in a error.
|
| |
|
|
|
|
|
| |
This patch adds a call to access to check the readability of the
configuration file.
|
| |
|
|
|
|
| |
Try to sync TODO with real state of the project.
|
|
|
|
|
|
|
|
| |
It seems a cast of time_t is needed for i386 system to avoid a
crash. I've added a cast to uint64_t that should be ok on all
Linux system.
Reported-by: netfilter@openenterprise.co.uk
|
|
|
|
| |
Recently introduced addr.h was missing from Makefile.am.
|