summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* XML: show both nflog packet and conntrackHEADmasterKen-ichirou MATSUZAWA8 days1-11/+22
| | | | | | | | This patch enables to show "ct" as well as "raw" if output type is ULOGD_DTYPE_RAW and "ct" input exists. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: attach struct nf_conntrackKen-ichirou MATSUZAWA8 days2-6/+68
| | | | | | | | put nf_conntrack in ct outputkey when "attach_conntrack" is specified. But there is no way to show both nflog "raw" and "ct" now. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: add NFULNL_CFG_F_CONNTRACK flagKen-ichirou MATSUZAWA8 days1-1/+10
| | | | | | | acquiring conntrack information by specifying "attack_conntrack=1" Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: IPFIX: correct format specifiersJeremy Sowden8 days1-4/+5
| | | | | | | | | | | There are a couple of logging calls which use the wrong specifiers for their integer arguments. Change the specifiers to match the arguments. Use the correct type for the variable holding the return-value of `send(2)`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: UNIXSOCK: correct format specifiersJeremy Sowden8 days1-5/+6
| | | | | | | | There are a couple of logging calls which use the wrong specifiers for their integer arguments. Change the specifiers to match the arguments. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: fix order of log argumentsJeremy Sowden8 days1-1/+1
| | | | | | | | | If `daemon` fails during start-up, ulogd attempts to print `errno` and `strerror(errno)` to the log. However, the arguments are the wrong way round. Swap them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: remove empty log-lineJeremy Sowden8 days1-1/+0
| | | | | | | | | | There is a `strdup` at the beginning of `create_stack`. If it fails, an empty log-line is printed. It's not useful, so remove it. This is consistent with the error-handling of the `malloc` which immediately follows it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: add `format` attribute to `__ulogd_log` declarationJeremy Sowden8 days1-2/+3
| | | | | | | | | | `__ulogd_log` takes a printf-style format string and matching arguments. Add the gcc `format` attribute to its declaration in order to allow the compiler to type-check the function arguments against the specifiers in the format string. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: missing ipfix.h header when running make distcheckPablo Neira Ayuso2021-11-161-0/+2
| | | | | | make distcheck reports ipfix.h is not included in the tarball file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use `AS_IF` consistently in configure.acJeremy Sowden2021-11-161-79/+37
| | | | | | | | | | | | | configure.ac contains a mix of `AS_IF` and `if` conditionals. Prefer the portable M4sh `AS_IF` macro. In some cases, where there are both `AS_IF` and `if` conditionals evaluating the same predicates, the latter are merged into the former. Replace three instance of `test -n "$var"` with the usual, more portable, autoconf idiom: `test "x$var" != "x"`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: quote autoconf macro argumentsJeremy Sowden2021-11-151-32/+60
| | | | | | | | | | Arguments are supposed to be quoted in square brackets. Fix several that weren't. Sort and reformat the `AC_OUTPUT_FILES` argument list while we're at it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove commented-out codeJeremy Sowden2021-11-151-12/+0
| | | | | | | | There are a couple of blocks of macros in configure.ac which were commented out in 2006. Remove them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: update obsolete autoconf macrosJeremy Sowden2021-11-151-4/+2
| | | | | | | | | | | | | `AC_CONFIG_HEADER` has been superseded by `AC_CONFIG_HEADERS`. `AC_PROG_LIBTOOL` has been superseded by `LT_INIT`. `AC_DISABLE_STATIC` can be replaced by an argument to `LT_INIT`. `AC_HEADER_STDC` is obsolete. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use correct automake variable for library dependenciesJeremy Sowden2021-11-152-2/+4
| | | | | | | | A couple of library dependencies are specified in `_LDFLAGS` variables. They are supposed to be specified in `_LIBADD` variables. Move them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: delete commented-out codeJeremy Sowden2021-11-151-4/+1
| | | | | | | | There are a few of commented-out variable definitions left over from the introduction of Automake. Remove them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: group `*_la_*` variables with their librariesJeremy Sowden2021-11-151-8/+8
| | | | | | | | | | Move the `_SOURCES`, `_LIBADD` and `_LDFLAGS` variables for each input-packet library alongside the matching `.la` definition. In particular, move the `NFLOG` and `ULOG` variables inside the conditionals controlling whether the libraries get built. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: skip sub-directories containing disabled pluginsJeremy Sowden2021-11-1512-33/+38
| | | | | | | | | | | | | | | Currently, make enters all sub-directories containing source-code, even if they only contain optional targets which are not configured to be built. Instead, change the Makefiles so that the sub-directories are optional, rather than the targets. Group sub-directory definitions consistently at the top of the Makefiles that contain them. Trim a few leading and trailing blank lines. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use `dist_man_MANS` to declare man-pagesJeremy Sowden2021-11-151-2/+2
| | | | | | | | By using `dist_man_MANS`, instead of `man_MANS`, we no longer need to include the man-pages in `EXTRA_DIST`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add Make_global.am for common flagsJeremy Sowden2021-11-1517-39/+36
| | | | | | | | | | Move `${regular_CFLAGS}` from configure.ac to Make_global.am, renaming it to `AM_CFLAGS`. Add `AM_CPPFGLAGS` to include `$(top_srcdir)/include`. Include the new file in the Makefiles that require it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: move CPP `-D` flag.Jeremy Sowden2021-11-152-3/+4
| | | | | | | | | The `ULOGD2_LIBDIR` macro is only used in one place, so move the flag defining it out of the common `regular_CFLAGS` variable to the `AM_CPPFLAGS` variable in the Makefile where it is needed. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove empty filter sub-directoryJeremy Sowden2021-11-153-2/+2
| | | | | | | The only file in filter/packet2flow is an empty Makefile.am. Remove it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove unused Makefile fragmentJeremy Sowden2021-11-153-45/+1
| | | | | | | | | | Rules.make.in contains a number of variables defined by configure. It is left-over from the pre-Automake build-system, in which it used to fill a similar role to Make_global.am. It is no longer used anywhere. Remove it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* gitignore: ignore .dirstampJeremy Sowden2021-11-151-0/+1
| | | | | | | | | It's created by automake while making sure that build directories (utils/ and utils/.deps/, in this case) exist if the `subdir-objects` option is enabled. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* gitignore: add Emacs artefactsJeremy Sowden2021-11-151-0/+3
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: fix seq global flag settingKen-ichirou MATSUZAWA2021-10-121-1/+1
| | | | | | | | Otherwise this is incorrectly setting on NFULNL_CFG_F_SEQ_GLOBAL if local sequence number via NFULNL_CFG_F_SEQ is requested. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* XML: support nflog pkt outputKen-ichirou MATSUZAWA2021-10-121-1/+1
| | | | | | | plugin input type ULOGD_DTYPE_RAW was missing Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* printpkt: print pkt mark like kernelCole Dishington2021-05-271-1/+1
| | | | | | | | Print the pkt mark in hex with a preceding '0x', like the kernel prints pkts logged by netfilter. Signed-off-by: Cole Dishington <Cole.Dishington@alliedtelesis.co.nz> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* raw2packet: fix comma instead of semicolonTimon Ulrich2020-10-301-1/+1
| | | | | Signed-off-by: Timon Ulrich <t.ulrich@anapur.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: printpkt: always print IPv6 protocolAndreas Jaggi2020-02-231-0/+3
| | | | | | | Print the protocol number for protocols not known by name. Signed-off-by: Andreas Jaggi <andreas.jaggi@waterwave.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* IPFIX: Introduce template record supportAnder Juaristi2019-04-304-37/+139
| | | | | | | | | | | | | | | | | | | | This commit adds the ability to send template records to the remote collector. In addition, it also introduces a new configuration parameter 'send_template', which tells when template records should be sent. It accepts the following string values: - "once": Send the template record only the first time (might be coalesced with data records). - "always": Send the template record always, with every data record that is sent to the collector (multiple data records might be sent together). - "never": Assume the collector knows the schema already. Do not send template records. If omitted, the default value for 'send_template' is "once". Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* IPFIX: Add IPFIX output pluginAnder Juaristi2019-04-309-550/+747
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds an IPFIX output plugin to ulogd2. It generates NetFlow/IPFIX traces and sends them to a remote server (collector) via TCP or UDP. Based on original work by Holger Eitzenberger <holger@eitzenberger.org>. How to test this ---------------- I am currently testing this with the NFCT input and Wireshark. Place the following in ulogd.conf: # this will print all flows on screen loglevel=1 # load NFCT and IPFIX plugins plugin="/lib/ulogd/ulogd_inpflow_NFCT.so" plugin="/lib/ulogd/ulogd_output_IPFIX.so" stack=ct1:NFCT,ipfix1:IPFIX [ct1] netlink_socket_buffer_size=217088 netlink_socket_buffer_maxsize=1085440 accept_proto_filter=tcp,sctp [ipfix1] oid=1 host="127.0.0.1" #port=4739 #send_template="once" I am currently testing it by launching a plain NetCat listener on port 4739 (the default for IPFIX) and then running Wireshark and see that it dissects the IPFIX/NetFlow traffic correctly (obviously this relies on the Wireshark NetFlow dissector being correct). First: nc -vvvv -l 127.0.0.1 4739 Then: sudo ulogd -vc ulogd.conf Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: fix build with musl libcCameron Norman2018-11-011-0/+1
| | | | | | | | The attached patch fixes building ulogd2 with musl libc. It is being used on Void Linux right now. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1278 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: json: send messages to a remote host / unix socketAndreas Jaggi2018-06-012-21/+281
| | | | | | | | Extend the JSON output plugin so that the generated JSON stream can be sent to a remote host via TCP/UDP or to a local unix socket. Signed-off-by: Andreas Jaggi <andreas.jaggi@waterwave.ch> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* remove ulogd2.rotate and ulogd2.spec from Makefile.amulogd-2.0.7Arturo Borrero Gonzalez2018-04-271-1/+1
| | | | | Fixes: 42b384044dab ("ulogd2: cleanup downstream files") Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* Set release number to 2.0.7.Arturo Borrero Gonzalez2018-04-271-1/+1
| | | | Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org>
* ulogd2: cleanup downstream filesArturo Borrero Gonzalez2018-04-113-187/+0
| | | | | | | | | | | | These files are outdated and they belong to downstream users (distributions). Providing outdated and unmaintained files here serves no purpose other than confusing users and annoy packagers. If an user is using ulogd2 directly from the source tarball, I would expect it to be proficient enough to generate these files by itself. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: load all plugins by defaultArturo Borrero Gonzalez2018-01-083-20/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | This new configuration behaviour option eases a bit the configuration of ulogd2 by allowing to load all plugins in one go, without having to know their full path. Choosing concrete plugins and using full path for them is great for some environmnets, but I don't think it's a common case. The common case is to load all plugins, even ignoring where do they live in the filesystem. Even worse, the full path may be architecture-dependant, which makes copying the ulogd.conf file between machines unnecesarily complex. To experiment this new behaviour, don't put any 'plugin=' directive in the config file. Plugins will be loaded from a default directory, choosen at build/configure time (--with-ulogd2libdir). If no specified, this is something like '/usr/local/lib/ulogd/'. This new configuration option doesn't implement any special logic. We simply open the dir and try to load all files ending with '.so'. The log message level for plugins loading is increased so users can see by default which plugins are loaded. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: use a RT scheduler by defaultArturo Borrero Gonzalez2017-09-201-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Is common that ulogd runs in scenarios where a lot of packets are to be logged. If there are more packets than ulogd can handle, users can start seing log messages like this: ulogd[556]: We are losing events. Please, consider using the clauses \ `netlink_socket_buffer_size' and `netlink_socket_buffer_maxsize' Which means that Netlink buffer overrun have happened. There are several approaches to prevent this situation: * in the ruleset, limit the amount of packet queued for log * in the ruleset, instruct the kernel to use a queue-threshold * from userspace, increment Netlink buffer sizes * from userspace, configure ulogd to run as high priority process The first 3 method can be configured by users at runtime. This patch deals with the last method. SCHED_RR is configured by default, with no associated configuration parameter for users, since I believe this is common enough, and should produce no harm. A similar approach is used in the conntrackd daemon. Signed-off-by: Arturo Borrero Gonzalez <arturo@netfilter.org> Acked-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip2bin: fix plugin link for some compilerEric Leblond2017-07-021-1/+1
| | | | | | | Declaring a function inline and building with -O0 was causing the following message: undefined symbol: uint32_to_ipv6 By declaring the function as static we fix the problem.
* ulogd: fix crash when plugin version are incorrectEric Leblond2017-07-021-0/+1
| | | | | Format string in error message had more arguments than given and it was resulting in a crash at start.
* Set release number to 2.0.6.Eric Leblond2017-05-161-1/+1
|
* rotate all default output filesKaarle Ritvanen2017-05-161-1/+1
| | | | Signed-off-by: Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
* harmonize log file defaults with ulogd.confKaarle Ritvanen2017-05-165-6/+6
| | | | Signed-off-by: Kaarle Ritvanen <kaarle.ritvanen@datakunkku.fi>
* ulogd.conf: fix incorrect stackEric Leblond2017-03-211-1/+1
| | | | | | | The stack was not correctly defined triggering an error on type conflict. Signed-off-by: Eric Leblond <eric@regit.org>
* ulogd: use strncpy instead of memcpyEric Leblond2017-03-211-1/+1
| | | | | | | | | On some architecture, ulogd is not starting due to a crash in memcpy. This patch switches to strncpy to avoid the problem. Reported-by: Alexandru Ardelean <ardeleanalex@gmail.com> Signed-off-by: Eric Leblond <eric@regit.org>
* ulogd: add automake optionEric Leblond2017-03-211-1/+1
| | | | | | This option will be needed for future version of automake. Signed-off-by: Eric Leblond <eric@regit.org>
* ulogd: fix crash when ipv4 packet is truncatedLiping Zhang2016-10-171-1/+2
| | | | | | | | | | | If ipv4 packet is truncated, we should not try to dereference the iph pointer. Otherwise, if the user add such iptables rules "-j NFLOG --nflog-size 0", we will dereference the NULL pointer and crash may happen. Reported-by: Chris Caputo <ccaputo@alt.net> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd: fix indentation in acinclude.m4Eric Leblond2016-03-311-70/+66
| | | | | | Some imbricated tests were not indented. Signed-off-by: Eric Leblond <eric@regit.org>
* ulogd: fix cross compilation errors with mysql_configHelmut Schaa2016-03-311-2/+2
| | | | | | | | | | | When cross-compiling ulogd, mysql_config and pg_config will return build host configuration not build target configuration. This leads to build failures if mysql_config is installed on the host system but mysql is not available on the build target. Fix this by not using mysql_config and pg_config for cross-compilation. Signed-off-by: Helmut Schaa <helmut.schaa@googlemail.com>
* ulogd: add missing newline in log messageEric Leblond2016-02-051-1/+1
|