summaryrefslogtreecommitdiffstats
path: root/filter
Commit message (Collapse)AuthorAgeFilesLines
* ip2bin: fix plugin link for some compilerEric Leblond2017-07-021-1/+1
| | | | | | | Declaring a function inline and building with -O0 was causing the following message: undefined symbol: uint32_to_ipv6 By declaring the function as static we fix the problem.
* ulogd: fix crash when ipv4 packet is truncatedLiping Zhang2016-10-171-1/+2
| | | | | | | | | | | If ipv4 packet is truncated, we should not try to dereference the iph pointer. Otherwise, if the user add such iptables rules "-j NFLOG --nflog-size 0", we will dereference the NULL pointer and crash may happen. Reported-by: Chris Caputo <ccaputo@alt.net> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use stdint types everywhereFelix Janda2015-06-266-27/+28
| | | | Signed-off-by: Felix Janda <felix.janda@posteo.de>
* Define _GNU_SOURCE to get members of tcphdrFelix Janda2015-06-232-0/+2
| | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de>
* store Common Information Model name in ulogd keyEric Leblond2014-01-282-2/+12
| | | | | | | | | | | | | | | | | | | This patch adds storage for CIM field name in ulogd key. This will be used by JSON output to interoperate with logging collector such as logstash or splunk. Common Information Model is an open standard that defines how managed elements in an IT environment are represented as a common set of objects and relationships between them: http://www.dmtf.org/standards/cim This seems to be mainly XML based but there is a JSON version of some aspects of the model. One of the main documentation on CIM in JSON format seems to be: http://docs.splunk.com/Documentation/PCI/2.0/DataSource/CommonInformationModelFieldReference Using the correct CIM field name allow events coming from ulogd to be correlated with events coming from other sources.
* base: fix warning on pointer handlingEric Leblond2013-01-181-4/+4
|
* Get rid of SVN tag in comment.Eric Leblond2013-01-187-15/+5
| | | | This patch also update some copyright and licence declaration.
* Add additional ip6 header fields to database scriptsBob Hockney2012-12-191-1/+1
| | | | | Rename internal keyname ip6.payload_len to remove "_" to facilitate this.
* Fix parsing of ipv6 flowlabel and tc fieldsBob Hockney2012-12-191-2/+2
| | | | Mask should be applied after ntohl conversion.
* build: move remaining preprocessor flags into CPPFLAGSJan Engelhardt2012-11-271-2/+2
| | | | | | | | The flags retrieved from `pkg-config --cflags ...` are generally only preprocessor flags (mostly -I to point to the directories), since anything else would inconvenience downstream users. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* filter: IP2HBIN: fix compilation warning with gcc-4.7Pablo Neira Ayuso2012-08-031-1/+0
| | | | | | | ulogd_filter_IP2HBIN.c: In function 'interp_ip2hbin': ulogd_filter_IP2HBIN.c:122:6: warning: unused variable 'fret' [-Wunused-variable] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix version that -V displaysPablo Neira Ayuso2012-08-0310-10/+10
| | | | | | | It was wrong, use VERSION constant which uses the version information available in configure.ac. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkglibdir instead of pkglibexecdir for automakeBjörn Lässig2012-05-182-2/+2
| | | | | | | | | | | This fixes the following problem while running `autoreconf -fi` `pkglibexecdir' is not a legitimate directory for `LTLIBRARIES' variable `ulogd_filter_PRINTPKT_la_SOURCES' is defined but no program or library has `ulogd_filter_PRINTPKT_la' as canonical name (possible typo) Signed-off-by: Björn Lässig <laessig@bitformer.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* A simple filter plugin called IP2HBIN addedJozsef Kadlecsik2012-01-162-1/+204
| | | | | | | | The plugin converts the IPv4 addresses to host order for databases like MySQL. The expected name of the table fields are ip.hsaddr, ip.hdaddr, etc. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: use compile/link information from pkgconfigJan Engelhardt2011-02-011-2/+3
| | | | | | | This is important for when the libraries are in a non-default path. Also, libs must be listed in LDADD/LIBADD, not LDFLAGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: use appropriate location for program modulesJan Engelhardt2011-02-012-5/+5
| | | | | | | Modules - since they are dependent on the executable - generally go to libexec/. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* filter/HWHDR: remove redundant sizeof(char)Jan Engelhardt2010-11-051-1/+1
| | | | | | It is 1 by definition. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: propagate global CFLAGSJan Engelhardt2010-11-052-0/+2
| | | | | | | | | We must not override CFLAGS, because that will break when the user overrides CFLAGS again at make time (which he is entitled to). So, name our CFLAGS regular_CFLAGS, and also include that across all Makefiles so that they are actually uesd for all the code. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused $(all_includes)Jan Engelhardt2010-11-052-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* HWHDR: Fix various crashesEric Leblond2010-09-221-19/+17
| | | | | | This patch fixes the HWHDR plugin. The logic of the interaction with exiting plugin was not correctly coded and this was leading to crashes due to the lack of sanity check.
* IP2BIN: fix missing protocol keyChristophe Fish2010-04-021-0/+5
| | | | | | | | | | | | | | | | | ulogd2 from git won't start using filter IP2BIN. It gives the following error message in the log: <1> ulogd.c:670 traversing plugin `IP2BIN' <1> ulogd.c:627 log4(NFLOG) <1> ulogd.c:733 assigning `oob.family(?)' as source for IP2BIN(oob.family) <7> ulogd.c:727 cannot find key `' in stack <1> ulogd.c:863 destroying stack Filling up ip2bin_inp[] declaration with missing section in filter/ulogd_filter_IP2BIN.c solves the problem: Signed-off-by: Christophe Fish <christophe.fish@free.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip2bin: add AF_BRIDGE family support.Eric Leblond2009-03-061-1/+27
| | | | | This patch adds support for AF_BRIDGE family. It synchronizes code of IP2BIN module with the one of IP2STR.
* hwhdr: suppress explicit allocationEric Leblond2009-03-061-12/+12
| | | | | This patch suppresses all allocation and use a statically created array instead.
* ip2bin: suppress explicit allocation of some output key valuesEric Leblond2009-03-061-14/+14
| | | | | This patch suppresses explicit allocation and free for each packet and use a statically created array instead.
* ip2str: suppress explicit allocation of some output key valuesEric Leblond2009-03-061-17/+16
| | | | | This patch suppresses explicit allocation and free for each packet and use a statically created array instead.
* ifindex: avoid memory allocationEric Leblond2009-03-061-21/+16
| | | | | This patch modifies the interp function to avoid to do an explicit allocation of memory.
* Replace INCLUDES by AM_CPPFLAGS in Makefile.am.Eric Leblond2009-01-222-2/+2
| | | | | This patch fixes autotools warning about deprecated usage of INCLUDES in Makefile.am.
* build: use -avoid-version for modulesJan Engelhardt2009-01-202-9/+9
| | | | | | | The modules are pretty much bound to ulogd, and it does not seem to make sense to specially version these. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* HWHDR: Fix size of allocated string.Eric Leblond2009-01-131-1/+1
| | | | | This patch fixes a incorrect computing of the allocation size of a string.
* Return true/false instead of ULOGD_IRET_OK/STOPThomas Jacob2008-12-091-2/+2
| | | | | Signed-off-by: Thomas Jacob <jacob@internet24.de> Signed-off-by: Eric Leblond <eric@inl.fr>
* Add SCTP support to BASE plugin.Eric Leblond2008-12-091-0/+53
| | | | | | THis patch adds basic support for SCTP in the BASE plugin. Signed-off-by: Eric Leblond <eric@inl.fr>
* add ukey_* function for key assignationPablo Neira Ayuso2008-12-0910-228/+165
| | | | | | | | | This patch cleans up the current key assignation by introducing a set of functions ukey_* to set the key value as Eric Leblond and we discussed during the latest Netfilter Workshop. This patch is based on an idea from Holger Eitzenberger. Signed-off-by: Eric Leblond <eric@inl.fr>
* Fix light memory error in parse_mac2strPierre Chifflier2008-12-091-2/+8
| | | | | | | | | When len is 0 (for ex. when the input mac is NULL), parse_mac2str tries to calloc a 0-bytes bloc, which leads to a conditional jump based on uninitialized value (spotted by valgrind). Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Eric Leblond <eric@inl.fr>
* hwhdr: finish missing renamingPierre Chifflier2008-10-201-2/+2
| | | | | | | MAC2STR has been renamed to HWHDR. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hwhdr: fix segfault when RAW_MAC is NULLPierre Chifflier2008-10-201-1/+1
| | | | | | | This fixes a segfault when RAW_MAC key is NULL in MAC2STR plugin. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: fix compilation warning related to signed and unsigned comparisonsEric Leblond2008-07-313-4/+5
| | | | | | This patch fixes the warning related to signed and unsigned comparaison. Signed-off-by: Eric Leblond <eric@inl.fr>
* cleanup: fix gcc warningsEric Leblond2008-07-294-7/+3
| | | | | | | | | This patch fixes some gcc warnings: * Unused variables * Functions with wrong return (or without return) Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* MAC2STR: Rename it to HWHDREric Leblond2008-07-292-3/+3
| | | | | | | Use a more appropriate name for this filter. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* MAC2STR: add support for the new RAW MAC keysEric Leblond2008-07-291-22/+152
| | | | | | | | | | | This patch modifies MAC2STR to use the new MAC keys that gives us more accurate information to parse the link layer header. This patch also does some probing based on the header and field size in the case of ULOG (since we do not have enough information to perform accurate parsing). Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix wrong casting warning during compilationEric Leblond2008-07-231-1/+1
| | | | | | | This patch cast a expression to avoid a warning. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use ULOGD_IRET_* as return for all interpretersEric Leblond2008-06-128-38/+38
| | | | | | | | This patch modifies plugins to use the already defined but not used define. This also fixes some weird behaviours in error treatment (like not stopping after OOM). Signed-off-by: Eric Leblond <eric@inl.fr>
* New MARK-based filterEric Leblond2008-06-122-1/+127
| | | | | | | | | This module filters message by using the mark to decide wether or not a packet or a flow has to be logged. It takes a mark and a mask option. It demonstrates the usage of ULOGD_IRET_STOP which can be used to abort iteration through the stack. Signed-off-by: Eric Leblond <eric@inl.fr>
* Source and destination addresses were put in ptr field of the target structureEric Leblond2008-06-021-2/+4
| | | | | instead of being put in the new type ui128. The result was an improper value of the IPv6 source add destination addresses.
* cleanup for key builder and fix IPv6 support and introduce 128-bits typePablo Neira Ayuso2008-06-022-2/+2
| | | | | | This patch cleans up the key building by breaking lines at 80 columns and it fixes the IPv6 support (use of a pointer after free) by introducing a new 128 bit type.
* add missing ulogd_filter_MAC2STR/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-0/+111
|
* An error in the type of an argument in the call to inet_ntop was causing IPv6/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-051-1/+1
| | | | | | | address to be transformed in a string not really related to the real Ipv6 address. Signed-off-by: Eric Leblond <eric@inl.fr>
* Arp related key have to be optionnal to be able to use the IP2STR module/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-051-2/+2
| | | | | | for flow display. Signed-off-by: Eric Leblond <eric@inl.fr>
* This patch introduces a new plugin MAC2STR which is in charge/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-051-1/+5
| | | | | | | of conversion to string of MAC address. It is used by database output plugin to store MAC related information. Signed-off-by: Eric Leblond <eric@inl.fr>
* IP2BIN filter convert IP address from host storage to a "binary" string which/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-03-251-6/+6
| | | | | | | | | | | can be use by MySQL. This is not strictly speaking raw data but it was of type RAW. Following remark from Hugo Mildenberger, I introduce in this patch a dedicated type ULOGD_RET_RAWSTR. The main reason not to use a ULOGD_RET_STRING parameter is that the paramater is not human readable. Signed-off-by: Eric Leblond <eric@inl.fr>
* adds AF_BRIDGE support to IP2STR/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-191-17/+71
| | | | | | This patch make the ip address string converter AF_BRIDGE compatible and add ip address ARP keys in order to make them also convert. Signed-off-by: Peter Warasin <peter@endian.com>