summaryrefslogtreecommitdiffstats
path: root/input
Commit message (Collapse)AuthorAgeFilesLines
* Use `NFPROTO_*` constants for protocol familiesJeremy Sowden2025-06-012-14/+16
| | | | | | | | | | | | | | | | Netfilter has a set of `NFPROTO_*` constants for the protocol families that it supports, in part because it supports protocols and pseudo-protocols that do not have `PF_*` (and `AF_*`) constants. Currently, ulogd uses `AF_*` constants for protocol families, because it does not support any families which do not have `AF_*` constants. Switch to `NFPROTO_*` constants instead, so we can add ARP support later. In the IP2* filters, retain `AF_*` for address family variables. Remove a stray semicolon. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* nfacct: add network namespace supportCorubba Smith2025-05-201-2/+31
| | | | | Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nflog: add network namespace supportCorubba Smith2025-05-201-1/+31
| | | | | Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nfct: add network namespace supportCorubba Smith2025-05-201-13/+69
| | | | | | | | | | | | | | | | | | | Allow the plugin to fetch data from a different network namespace. This is possible by changing the network namespace before opening the netlink socket, and immediately changing back to the original network namespace once the socket is open. The number of nfct_open usages here warranted a dedicated wrapper function. If changing back to the original network namespace fails, ulogd will log an error, but continue to run in a different network namespace than it was started in, which may cause unexpected behaviour. But I don't see a way to properly "escalate" it such that ulogd aborts entirely. Also slightly adjust the error log messages to specify which socket failed to open. Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* ulog: remove input pluginCorubba Smith2025-03-292-340/+0
| | | | | | | | | | The ULOG target was removed from the linux kernel with 7200135bc1e6 ("netfilter: kill ulog targets") aka v3.17, so remove the input plugin for it. It's successor NFLOG should be used instead, which has its own input plugin. Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nfct: add flow end timestamp on hashtable purgeCorubba Smith2025-03-251-0/+1
| | | | | | | | | | | | | | | | | In polling mode during normal operation, as well as in event mode with hashtable when an overrun occurs, the hashtable is fully re-synced against conntrack. When removing flows from the hashtable that are no longer in conntrack, there is no way to get the actual end timestamp of the flow from conntrack because it is already gone. Since the last conntrack data in the hashtable for these flows will never contain an end timestamp in this case, set_timestamp_from_ct() will always fall back to using the current time, aka when the plugin determines that the flow disappeared from conntrack. That is only an approximation, but should be good enough; and certainly more accurate than no end timestamp at all. Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nfct: fix counter-reset without hashtableCorubba Smith2025-03-251-0/+3
| | | | | | | | | | | | | | | In event mode the hashtable is optional, and sending SIGUSR2 to ulogd will call get_ctr_zero(). The dump_reset_handler will try to update the hashtable regardless of whether it is used (and thus initialized), which results in a segfault if it isn't. Instead just short-circuit the handler, and skip any further result processing because it's not used in this case anyway. All flow counters in conntrack are reset regardless of the return value of the handler/callback. Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* all: remove trivial configure hooksCorubba Smith2025-03-124-39/+0
| | | | | | | These are now covered by the default implementation. Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* all: use config_parse_file function in all pluginsCorubba Smith2025-03-125-7/+5
| | | | | | | | | | Replace all usages of `config_parse_file()` in plugins with the new `ulogd_parse_configfile()` function, adding error handling where it was missing. I used the same codestyle as the surrounding code, which varies between plugins. Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nfct: add icmpv6Corubba Smith2025-03-121-0/+26
| | | | | | | | | | | | | Add two new dedicated fields to provide the ICMPv6 code and type. While libnetfilter_conntrack uses the same attribute for both ICMPv4 and v6, there are no version-agnostic ICMP IEs in IPFIX. The fields are annotated with the appropriate IPFIX metadata, which is currently not actually used anywhere. You may call it consistency, future-proofing or cargo-culting. Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nfct: add newline to reliable log messageCorubba Smith2025-03-111-1/+1
| | | | | | Fixes: 4bc3b22e426d ("NFCT: add `reliable' config option to enable reliable flow-based logging") Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* nfct: fix calloc argument orderCorubba Smith2025-03-091-5/+5
| | | | | | | | | | | | The first argument to calloc() is the number of elements, the second is the size of a single element. Having the arguments switched shouldn't make any difference during runtime, but GCC warns about it when using -Wcalloc-transposed-args [0]. [0] https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wcalloc-transposed-args Signed-off-by: Corubba Smith <corubba@gmx.de> Signed-off-by: Florian Westphal <fw@strlen.de>
* input: UNIXSOCK: prevent unaligned pointer accessJeremy Sowden2021-11-301-9/+9
| | | | | | | | | | | | | `struct ulogd_unixsock_packet_t` is packed, so taking the address of its `struct iphdr payload` member may yield an unaligned pointer value. We only actually dereference the pointer to get the IP version, so replace the pointer with a version variable and elsewhere use `pkt.payload` directly. Remove a couple of stray semicolons. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: UNIXSOCK: fix possible truncation of socket pathJeremy Sowden2021-11-301-5/+10
| | | | | | | | Verify that the socket path is short enough, and replace `strncpy` with `strcpy`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: UNIXSOCK: remove stat of socket-pathJeremy Sowden2021-11-301-14/+5
| | | | | | | | | | | When creating the UNIX socket, there is a TOCTOU race between the stat(2) and bind(2) calls, and if the path is already bound, the bind(2) call will fail in any case. Remove the stat(2) call. Tidy up a couple of error message. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: attach struct nf_conntrackKen-ichirou MATSUZAWA2021-11-232-6/+68
| | | | | | | | put nf_conntrack in ct outputkey when "attach_conntrack" is specified. But there is no way to show both nflog "raw" and "ct" now. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: add NFULNL_CFG_F_CONNTRACK flagKen-ichirou MATSUZAWA2021-11-231-1/+10
| | | | | | | acquiring conntrack information by specifying "attack_conntrack=1" Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: UNIXSOCK: correct format specifiersJeremy Sowden2021-11-231-5/+6
| | | | | | | | There are a couple of logging calls which use the wrong specifiers for their integer arguments. Change the specifiers to match the arguments. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use correct automake variable for library dependenciesJeremy Sowden2021-11-152-2/+4
| | | | | | | | A couple of library dependencies are specified in `_LDFLAGS` variables. They are supposed to be specified in `_LIBADD` variables. Move them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: delete commented-out codeJeremy Sowden2021-11-151-4/+1
| | | | | | | | There are a few of commented-out variable definitions left over from the introduction of Automake. Remove them. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: group `*_la_*` variables with their librariesJeremy Sowden2021-11-151-8/+8
| | | | | | | | | | Move the `_SOURCES`, `_LIBADD` and `_LDFLAGS` variables for each input-packet library alongside the matching `.la` definition. In particular, move the `NFLOG` and `ULOG` variables inside the conditionals controlling whether the libraries get built. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: skip sub-directories containing disabled pluginsJeremy Sowden2021-11-153-5/+9
| | | | | | | | | | | | | | | Currently, make enters all sub-directories containing source-code, even if they only contain optional targets which are not configured to be built. Instead, change the Makefiles so that the sub-directories are optional, rather than the targets. Group sub-directory definitions consistently at the top of the Makefiles that contain them. Trim a few leading and trailing blank lines. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add Make_global.am for common flagsJeremy Sowden2021-11-153-6/+8
| | | | | | | | | | Move `${regular_CFLAGS}` from configure.ac to Make_global.am, renaming it to `AM_CFLAGS`. Add `AM_CPPFGLAGS` to include `$(top_srcdir)/include`. Include the new file in the Makefiles that require it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFLOG: fix seq global flag settingKen-ichirou MATSUZAWA2021-10-121-1/+1
| | | | | | | | Otherwise this is incorrectly setting on NFULNL_CFG_F_SEQ_GLOBAL if local sequence number via NFULNL_CFG_F_SEQ is requested. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* IPFIX: Add IPFIX output pluginAnder Juaristi2019-04-301-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds an IPFIX output plugin to ulogd2. It generates NetFlow/IPFIX traces and sends them to a remote server (collector) via TCP or UDP. Based on original work by Holger Eitzenberger <holger@eitzenberger.org>. How to test this ---------------- I am currently testing this with the NFCT input and Wireshark. Place the following in ulogd.conf: # this will print all flows on screen loglevel=1 # load NFCT and IPFIX plugins plugin="/lib/ulogd/ulogd_inpflow_NFCT.so" plugin="/lib/ulogd/ulogd_output_IPFIX.so" stack=ct1:NFCT,ipfix1:IPFIX [ct1] netlink_socket_buffer_size=217088 netlink_socket_buffer_maxsize=1085440 accept_proto_filter=tcp,sctp [ipfix1] oid=1 host="127.0.0.1" #port=4739 #send_template="once" I am currently testing it by launching a plain NetCat listener on port 4739 (the default for IPFIX) and then running Wireshark and see that it dissects the IPFIX/NetFlow traffic correctly (obviously this relies on the Wireshark NetFlow dissector being correct). First: nc -vvvv -l 127.0.0.1 4739 Then: sudo ulogd -vc ulogd.conf Signed-off-by: Ander Juaristi <a@juaristi.eus> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use stdint types everywhereFelix Janda2015-06-262-25/+25
| | | | Signed-off-by: Felix Janda <felix.janda@posteo.de>
* Add flag to disable ULOG input pluginEric Leblond2015-04-241-1/+6
| | | | | ULOG target is removed from kernel so we can prepare the removal of the plugin for ulogd. For now, we just add a configure flag.
* nfct: use start timestamp if providedEric Leblond2014-02-221-4/+14
| | | | | | | | When hash table is not used, the start timestamp was not used even if the kernel is sending it. This patch modifies the code to use it when available. This allows to log connection with start and end with a single message per connection and without the cost of maintaining the hash table.
* ulogd: ulogd_inppkt_NFLOG: close nflog handle after unbindingChris Boot2013-11-181-1/+1
| | | | | | | | The nflog handle is closed, and then nflog_unbind_pf() is called on it, which triggers an assertion failure within libnfnetlink. This patch simply moves the nflog_close() just after the nflog_unbind_pf() calls. Signed-off-by: Chris Boot <bootc@bootc.net>
* nfct: make NFCT packet counter/length 64 bitUlrich Weber2013-10-101-12/+12
| | | | | | | | | | | | | | Kernel and libnetfilter_conntrack counters are 64bit, so use 64bit too in ulogd instead of 32bit. Worked fine on little endian systems but big endian systems had zero counter... Didn't test ipfix output, but RFC allows template with either 32 or 64 counters, so should be safe. Signed-off-by: Ulrich Weber <uw@xyne.com> Signed-off-by: Eric Leblond <eric@regit.org>
* nfct: use timestamp of conntrack object.Eric Leblond2013-03-051-10/+32
| | | | | | | If conntrack object sent by connection tracking system is containing a timestamp we use it instead of a gettimeofday() based counter. Signed-off-by: Eric Leblond <eric@regit.org>
* Suppress dead FIXME.Eric Leblond2013-02-181-2/+0
|
* nfct: add protocol filterEric Leblond2013-01-051-2/+58
| | | | | | | This patch adds a new configuration variable which is used to limit conntrack event to connection of these protocols: For example: accept_proto_filter=tcp,sctp
* nfct: implement src and dst filterEric Leblond2013-01-051-2/+214
| | | | | | | This patch implements two filtering options in NFCT input plugin. If 'accept_src_filter' is set to a network it will only catch the event where the source is that specific network. 'accept_dst_filter' does the same for the destination.
* nfct: call register callback on opened handlerEric Leblond2013-01-051-1/+1
| | | | | nfctp_callback_register was called on the regular handler instead of begin called on the newly opened handler dedicated to the dump.
* build: avoid per-target CFLAGSJan Engelhardt2012-11-272-4/+2
| | | | | | | | There is no harm in putting the includes in the global AM_CPPFLAGS; this can generally save number of compilations of a file when a source file is used multiple times. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* configure: add flag to disable NFLOG buildEric Leblond2012-11-041-2/+4
|
* configure: add flag to disable NFCT buildEric Leblond2012-11-041-0/+2
|
* configure: add flag to disable NFACCT buildEric Leblond2012-11-041-2/+2
| | | | | | It is now possible to pass the --disable-nfacct flag to disable compilation of NFACCT input plugin. Doing this the build of ulogd is possible on system where nfacct is not available.
* nfacct: add timestamp optionEric Leblond2012-08-031-1/+31
| | | | | | | | | This patch adds a timestamp option to the nfacct plugin. If activated, nfacct output a timestamp which is computed just after sending the nfacct request. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix version that -V displaysPablo Neira Ayuso2012-08-035-5/+5
| | | | | | | It was wrong, use VERSION constant which uses the version information available in configure.ac. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: NFCT: fix compilation warning with gcc-4.7Pablo Neira Ayuso2012-08-031-2/+0
| | | | | | | | CC ulogd_inpflow_NFCT_la-ulogd_inpflow_NFCT.lo ulogd_inpflow_NFCT.c: In function 'configure_nfct': ulogd_inpflow_NFCT.c:977:28: warning: unused variable 'cpi' [-Wunused-variable] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfacct: add variable to not zero counter after readEric Leblond2012-08-031-9/+20
| | | | | | | | | | | | The default nfacct input plugin zeroes counter after each read. This is a limitation as other software can't use the counter at the same time as ulogd2. This patch adds the zerocounter variable to the NFACCT input plugin. If set to zero, the counters are not zeroed. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: fix crash in polling mode if used by two stacksEric Leblond2012-07-201-5/+5
| | | | | | | | | | | | The polling timer initialisation code was put in the configurator code. It was then created for all instances. But only first one has a valid NFCT handle. This was resulting in a crash. This patch moves the timer initialisation in the constructor which is called only once on the main NFCT instance. Signed-off-by: Eric Leblond <eric@regit.org> Reported-by: Gomathivinayagam Muthuvinayagam <sankarmail@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: support for NFACCT input pluginPablo Neira Ayuso2012-06-221-3/+10
| | | | | | | | | This patch extends XML plugin to support NFACCT. You can use the following line in ulogd.conf to test it: stack=acct1:NFACCT,xml1:XML Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ULOGD_DTYPE_SUM for nfacct-based accountingPablo Neira Ayuso2012-06-221-1/+1
| | | | | | This new type will be used in flow-up patch to support XML output. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nfacct: resolve build failureJan Engelhardt2012-06-051-3/+3
| | | | | | | | | | | CC ulogd_inpflow_NFACCT_la-ulogd_inpflow_NFACCT.lo ulogd_inpflow_NFACCT.c:24:27: fatal error: libmnl/libmnl.h: No such file or directory compilation terminated. LIBS is not interchangeable with C(PP)FLAGS. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: use pkglibdir instead of pkglibexecdir for automakeBjörn Lässig2012-05-183-3/+3
| | | | | | | | | | | This fixes the following problem while running `autoreconf -fi` `pkglibexecdir' is not a legitimate directory for `LTLIBRARIES' variable `ulogd_filter_PRINTPKT_la_SOURCES' is defined but no program or library has `ulogd_filter_PRINTPKT_la' as canonical name (possible typo) Signed-off-by: Björn Lässig <laessig@bitformer.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* NFCT: add `reliable' config option to enable reliable flow-based loggingPablo Neira Ayuso2012-03-051-1/+18
| | | | | | | | | | | | Reliability comes at the cost of dropping new flows if the destroy event that ctnetlink delivers to us is lost. Under heavy stress this may imply dropping packets, you've been warned. If you do want not to lose one single flow-logging information, enable this. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* input: add nfacct pluginPablo Neira Ayuso2012-02-223-1/+274
| | | | | | This patch adds the nfacct plugin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
generated by cgit v1.2.3 (git 2.25.0) at 2026-01-05 01:34:29 +0000