summaryrefslogtreecommitdiffstats
path: root/filter
Commit message (Collapse)AuthorAgeFilesLines
* ip2bin: add AF_BRIDGE family support.Eric Leblond2009-03-061-1/+27
| | | | | This patch adds support for AF_BRIDGE family. It synchronizes code of IP2BIN module with the one of IP2STR.
* hwhdr: suppress explicit allocationEric Leblond2009-03-061-12/+12
| | | | | This patch suppresses all allocation and use a statically created array instead.
* ip2bin: suppress explicit allocation of some output key valuesEric Leblond2009-03-061-14/+14
| | | | | This patch suppresses explicit allocation and free for each packet and use a statically created array instead.
* ip2str: suppress explicit allocation of some output key valuesEric Leblond2009-03-061-17/+16
| | | | | This patch suppresses explicit allocation and free for each packet and use a statically created array instead.
* ifindex: avoid memory allocationEric Leblond2009-03-061-21/+16
| | | | | This patch modifies the interp function to avoid to do an explicit allocation of memory.
* Replace INCLUDES by AM_CPPFLAGS in Makefile.am.Eric Leblond2009-01-222-2/+2
| | | | | This patch fixes autotools warning about deprecated usage of INCLUDES in Makefile.am.
* build: use -avoid-version for modulesJan Engelhardt2009-01-202-9/+9
| | | | | | | The modules are pretty much bound to ulogd, and it does not seem to make sense to specially version these. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* HWHDR: Fix size of allocated string.Eric Leblond2009-01-131-1/+1
| | | | | This patch fixes a incorrect computing of the allocation size of a string.
* Return true/false instead of ULOGD_IRET_OK/STOPThomas Jacob2008-12-091-2/+2
| | | | | Signed-off-by: Thomas Jacob <jacob@internet24.de> Signed-off-by: Eric Leblond <eric@inl.fr>
* Add SCTP support to BASE plugin.Eric Leblond2008-12-091-0/+53
| | | | | | THis patch adds basic support for SCTP in the BASE plugin. Signed-off-by: Eric Leblond <eric@inl.fr>
* add ukey_* function for key assignationPablo Neira Ayuso2008-12-0910-228/+165
| | | | | | | | | This patch cleans up the current key assignation by introducing a set of functions ukey_* to set the key value as Eric Leblond and we discussed during the latest Netfilter Workshop. This patch is based on an idea from Holger Eitzenberger. Signed-off-by: Eric Leblond <eric@inl.fr>
* Fix light memory error in parse_mac2strPierre Chifflier2008-12-091-2/+8
| | | | | | | | | When len is 0 (for ex. when the input mac is NULL), parse_mac2str tries to calloc a 0-bytes bloc, which leads to a conditional jump based on uninitialized value (spotted by valgrind). Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Eric Leblond <eric@inl.fr>
* hwhdr: finish missing renamingPierre Chifflier2008-10-201-2/+2
| | | | | | | MAC2STR has been renamed to HWHDR. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hwhdr: fix segfault when RAW_MAC is NULLPierre Chifflier2008-10-201-1/+1
| | | | | | | This fixes a segfault when RAW_MAC key is NULL in MAC2STR plugin. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: fix compilation warning related to signed and unsigned comparisonsEric Leblond2008-07-313-4/+5
| | | | | | This patch fixes the warning related to signed and unsigned comparaison. Signed-off-by: Eric Leblond <eric@inl.fr>
* cleanup: fix gcc warningsEric Leblond2008-07-294-7/+3
| | | | | | | | | This patch fixes some gcc warnings: * Unused variables * Functions with wrong return (or without return) Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* MAC2STR: Rename it to HWHDREric Leblond2008-07-292-3/+3
| | | | | | | Use a more appropriate name for this filter. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* MAC2STR: add support for the new RAW MAC keysEric Leblond2008-07-291-22/+152
| | | | | | | | | | | This patch modifies MAC2STR to use the new MAC keys that gives us more accurate information to parse the link layer header. This patch also does some probing based on the header and field size in the case of ULOG (since we do not have enough information to perform accurate parsing). Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix wrong casting warning during compilationEric Leblond2008-07-231-1/+1
| | | | | | | This patch cast a expression to avoid a warning. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use ULOGD_IRET_* as return for all interpretersEric Leblond2008-06-128-38/+38
| | | | | | | | This patch modifies plugins to use the already defined but not used define. This also fixes some weird behaviours in error treatment (like not stopping after OOM). Signed-off-by: Eric Leblond <eric@inl.fr>
* New MARK-based filterEric Leblond2008-06-122-1/+127
| | | | | | | | | This module filters message by using the mark to decide wether or not a packet or a flow has to be logged. It takes a mark and a mask option. It demonstrates the usage of ULOGD_IRET_STOP which can be used to abort iteration through the stack. Signed-off-by: Eric Leblond <eric@inl.fr>
* Source and destination addresses were put in ptr field of the target structureEric Leblond2008-06-021-2/+4
| | | | | instead of being put in the new type ui128. The result was an improper value of the IPv6 source add destination addresses.
* cleanup for key builder and fix IPv6 support and introduce 128-bits typePablo Neira Ayuso2008-06-022-2/+2
| | | | | | This patch cleans up the key building by breaking lines at 80 columns and it fixes the IPv6 support (use of a pointer after free) by introducing a new 128 bit type.
* add missing ulogd_filter_MAC2STR/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-0/+111
|
* An error in the type of an argument in the call to inet_ntop was causing IPv6/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-051-1/+1
| | | | | | | address to be transformed in a string not really related to the real Ipv6 address. Signed-off-by: Eric Leblond <eric@inl.fr>
* Arp related key have to be optionnal to be able to use the IP2STR module/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-051-2/+2
| | | | | | for flow display. Signed-off-by: Eric Leblond <eric@inl.fr>
* This patch introduces a new plugin MAC2STR which is in charge/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-051-1/+5
| | | | | | | of conversion to string of MAC address. It is used by database output plugin to store MAC related information. Signed-off-by: Eric Leblond <eric@inl.fr>
* IP2BIN filter convert IP address from host storage to a "binary" string which/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-251-6/+6
| | | | | | | | | | | can be use by MySQL. This is not strictly speaking raw data but it was of type RAW. Following remark from Hugo Mildenberger, I introduce in this patch a dedicated type ULOGD_RET_RAWSTR. The main reason not to use a ULOGD_RET_STRING parameter is that the paramater is not human readable. Signed-off-by: Eric Leblond <eric@inl.fr>
* adds AF_BRIDGE support to IP2STR/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-17/+71
| | | | | | This patch make the ip address string converter AF_BRIDGE compatible and add ip address ARP keys in order to make them also convert. Signed-off-by: Peter Warasin <peter@endian.com>
* Adds AF_BRIDGE and ARP header interpreter to BASE plugin/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-2/+130
| | | | | | This patch adds an AF_BRIDGE interpreter to ulogd_raw2packet_BASE plugin, which allows to log packets coming from ebtables. It also adds an ARP header decoder. Signed-off-by: Peter Warasin <peter@endian.com>
* revert r7369 until clarified/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-141-125/+2
|
* Adds AF_BRIDGE and ARP header interpreter to BASE plugin/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-141-2/+125
| | | | | | | | | This patch adds an AF_BRIDGE interpreter to ulogd_raw2packet_BASE plugin, which allows to log packets coming from ebtables. It also adds an ARP header decoder. Signed-off-by: Peter Warasin <peter@endian.com>
* Adds input key enumeration in order to address the fields/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-141-4/+12
| | | | | | | with symbols instead of numbers. Shortens the lines by the use of GET_VALUE() Signed-off-by: Peter Warasin <peter@endian.com>
* revert r7348/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-101-23/+9
|
* From: Eric Leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-092-10/+0
| | | | | | | Some macros were defined several time. This was the case of GET_VALUE, pp_is_valid. This patch puts the definition in ulogd.h and fixes the definition of pp_is_valid which was wrong (causing segfault by acessing to fields at NULL).
* From: Eric Leblond <eric@inl.fr>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-091-9/+23
| | | | | | | | | | | | When using NFLOG or ULOG, obb.family (protocol IPv4 or IPv6) has to be setup manually in ulogd.conf configuration file. This is used by the BASE filter to properly parse the packet. This patch suppress oob.family as output keys of NFLOG and ULOG and let the BASE filter determine the family of the packet by itself (by parsing the raw header). A good side effect is to be able to log in IPv6 and IPv4 in the same group. Before that, two loggers have to be setup separatly.
* From Eric Leblond <eric@inl.fr>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-076-589/+46
| | | | | | | This patch modify ulogd_filter_IFINDEX to use libnfnetlink for index to interface name mapping instead of using local version. This requires at least libnfnetlink 0.0.30. This dependancy is checked in configure (thanks to Sebastien Tricaud for his patch).
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-0/+4
| | | | | With this patch, BASE filter module is able fill oob_family when parsing IPv6 address.
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-0/+2
| | | | Fix a bug in IPv4 output of IP2BIN module.
* From: Eric Leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-5/+2
| | | | Fix description and indenting (cleanups)
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-032-1/+220
| | | | | This module convert IP from internal notation to a string in binary notation which is used by the MySQL output plugin.
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-24/+4
| | | | | - This patch suppress key relative to IPv6 address because IPv4 and IPv6 can be stored in the same key. - Add missing IP2STR line to ulogd.conf.in
* From: Eric leblond <eric@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-032-1/+190
| | | | This module is a generic module which is used to convert an IP from internal representation to string representation. This is a task needed by several modules like printpkt or pgsql. This module factorizes the code.
* From: Eric Leblond <eric@inl.fr>: /C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-2/+2
| | | | | Put O at the real end of the string. Based on Marius Tomaschewski work.
* From: Eric Leblond <eric@inl.fr>:/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-0/+1
| | | | | Added explicit null termination of the hostname buffer This patch is a backport of Marius Tomaschewski <mt@suse.de> work on ulogd.
* Add IPv6 support, fix a few incorrect key assignments and make sure this doesn't/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kaber/emailAddress=kaber@netfilter.org2007-03-061-189/+514
| | | | | repeat by using symbolic names to make sure the assignment matches the array index.
* Add a printflow plugin is similar to the PRINTPKT plugin, but for flows. It's/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-05-232-1/+70
| | | | output is compatible with the SYSLOG and LOGEMU plugins. (Philip Craig)
* Move the printpkt functionality out of SYSLOG and LOGEMU, and into/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-05-232-1/+71
| | | | | a separate PRINTPKT plugin. This reduces code duplication, and also makes the SYSLOG and LOGEMU plugins more general. (Philip Craig)
* rtnl.c warning fix (Christian Hentschel)/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-01-121-1/+1
|
* now 'make dist-bzip2' finally works/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=laforge/emailAddress=laforge@netfilter.org2006-01-081-0/+2
|