summaryrefslogtreecommitdiffstats
path: root/output
Commit message (Collapse)AuthorAgeFilesLines
* configure: add flag to disable NFACCT buildEric Leblond2012-11-041-1/+8
| | | | | | It is now possible to pass the --disable-nfacct flag to disable compilation of NFACCT input plugin. Doing this the build of ulogd is possible on system where nfacct is not available.
* ipfix: fix bracket imbalance if IPPROTO_SCTP is definedThomas Jarosch2012-08-061-0/+1
| | | | | | | Detected by cppcheck. Signed-off-by: Thomas Jarosch <thomas.jarosch@intra2net.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix version that -V displaysPablo Neira Ayuso2012-08-0312-12/+12
| | | | | | | It was wrong, use VERSION constant which uses the version information available in configure.ac. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* pgsql: only disable key if it starts with underscoreEric Leblond2012-08-031-2/+3
| | | | | | | | | | ulogd2 was magically making inactive the first key of description table. This patch improves this system by only doing so when the key start with an undescore. This way, system like nfacct which do not have a primary key can be implemented easily. Signed-off-by: Eric Leblond <eric@regit.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: Add more logging if database initialization fails.Michael Tremer2012-07-231-2/+6
| | | | | Signed-off-by: Michael Tremer <michael.tremer@ipfire.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: display time for NFACCTPablo Neira Ayuso2012-06-221-1/+2
| | | | | | <obj><name>test</name><pkts>00000000000000000000</pkts><bytes>00000000000000000000</bytes><hour>17</hour><min>46</min><sec>47</sec><wday>6</wday><day>22</day><month>6</month><year>2012</year></obj> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: support for NFACCT input pluginPablo Neira Ayuso2012-06-222-2/+31
| | | | | | | | | This patch extends XML plugin to support NFACCT. You can use the following line in ulogd.conf to test it: stack=acct1:NFACCT,xml1:XML Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ULOGD_DTYPE_SUM for nfacct-based accountingPablo Neira Ayuso2012-06-221-1/+1
| | | | | | This new type will be used in flow-up patch to support XML output. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* pcap: resolve unreliable detectionJan Engelhardt2012-06-051-2/+2
| | | | | | | | | | | | pcap is not found reliably by either --with-pcap=%_prefix or --with-pcap-lib=%_libdir --with-pcap-inc=%_includedir. If you have any special paths, just use ./configure CPPFLAGS="-I/my/pcap" LDFLAGS="-L/my/pcap" (And -lpcap is already known so no need to specify that.) Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* sqlite: resolve compiler warningsJan Engelhardt2012-06-051-1/+1
| | | | | | | | | | | | | | | | In file included from /usr/include/string.h:642:0, from ulogd_output_SQLITE3.c:34: In function 'strncat', inlined from 'db_count_cols' at ulogd_output_SQLITE3.c:306:9, inlined from 'sqlite3_init_db' at ulogd_output_SQLITE3.c:328:11: /usr/include/bits/string3.h:152:3: warning: call to __builtin___strncat_chk might overflow destination buffer [enabled by default] I: Statement might be overflowing a buffer in strncat. Common mistake: BAD: strncat(buffer,charptr,sizeof(buffer)) is wrong, it takes the left over size as 3rd argument GOOD: strncat(buffer,charptr,sizeof(buffer)-strlen(buffer)-1) E: ulogd2 bufferoverflowstrncat ulogd_output_SQLITE3.c:328:11 Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: use pkglibdir instead of pkglibexecdir for automakeBjörn Lässig2012-05-186-6/+6
| | | | | | | | | | | This fixes the following problem while running `autoreconf -fi` `pkglibexecdir' is not a legitimate directory for `LTLIBRARIES' variable `ulogd_filter_PRINTPKT_la_SOURCES' is defined but no program or library has `ulogd_filter_PRINTPKT_la' as canonical name (possible typo) Signed-off-by: Björn Lässig <laessig@bitformer.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ulogd2 / DBI / table nameHarald Welte2012-02-241-1/+4
| | | | | | | | | | | | | DBI: allow to define table name via table config option While using the DBI plugin of ulogd2 for NFCT based accounting, despite using table="conntrack", it always insisted in using the table "ulog" for deriving the keys/columns to be stored. I've hacked up a quick fix, and it seems to work as expected (though no proper null termination after strncpy). Signed-off-by: Harald Welte <laforge@netfilter.org>
* output: add GPRINT pluginPablo Neira Ayuso2012-02-222-1/+274
| | | | | | | | | | This patch adds GPRINT which is a generalization of OPRINT. It display the set of key-values separated by commas. This is the generic print that you can attach to whatever kind of input plugin. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* OPRINT: display u64 fieldsPablo Neira Ayuso2012-02-221-0/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: remove automatic creation of table `daily'Pablo Neira Ayuso2011-02-251-39/+7
| | | | | | | | | | | | | | | | | | | This patch removes the creation of the `daily' table. Now, we assume that the table that we use are created before launching ulogd2. This code is broken because you have to specify in the configuration file that the table used is `daily', otherwise this `daily' table is created and dropped during the daemon starting, but not used. Moreover, the code explicit shows a message that it says: /* FIXME make this configurable */ So, I think that this patch is the way to go :-). This patch also documents the table creation in ulogd.sgml Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: fix warning during compilationPablo Neira Ayuso2011-02-251-1/+1
| | | | | | | | | This patch fixes the following warning during the compilation: ulogd_output_SQLITE3.c: In function ‘ulogd_find_key’: ulogd_output_SQLITE3.c:292: warning: comparison between signed and unsigned integer expressions Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: cleanup error handling of sqlite3_bind_int() in sqlite3_interp()Pablo Neira Ayuso2011-02-251-20/+4
| | | | | | | Move error handling after the switch statement since it's the same for all cases, we save several lines of code. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: use continue instead of goto in sqlite3_interp()Pablo Neira Ayuso2011-02-251-3/+2
| | | | | | | | | Use continue instead of goto inside loop. I don't need to scroll up and down in the code to know what the jump is performing. I think this improve code readability. It's a comestic cleanup, of course. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: simplify sqlite3 checkJan Engelhardt2011-02-251-3/+3
| | | | | | | | With pkg-config variables, even a non-installed sqlite3 can be configured easily. Signed-off-by: Jan Engelhardt <jengelh@medozas.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* sqlite3: initial support extracted from Holger Eitzenberger's workPablo Neira Ayuso2011-02-241-259/+350
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch imports the sqlite3 support from Holger. I applied folded the following patches, that Harald passed to me during the last Netfilter workshop, into one: 0001-ulog2-sqlite-port-to-v2.diff.patch 0002-ulog2-sqlite-prepare-fix.diff.patch 0003-ulogd-sqlite-new-logging.diff.patch 0004-ulogd-accounting-add-flow-start-day.patch 0005-ulogd-sqlite3-err-codes-fix.dif.patch 0006-ulogd-sqlite3-tbl-corrupt-fix.diff.patch 0007-ulogd-sqlite3-handle-schema-change.diff.patch 0008-SQLITE3-count-instead-of-log-table-busy-messags.patch 0009-ulogd-SQLITE-Added-flowstartsec.diff.patch Harald passed them to me with no description, so applying them separately does not provide more information. I'll start adding patches on top on these so Holger can get in sync with my work. This also can help him to take my patches and to integrate them to his tree. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use compile/link information from pkgconfigJan Engelhardt2011-02-011-3/+5
| | | | | | | This is important for when the libraries are in a non-default path. Also, libs must be listed in LDADD/LIBADD, not LDFLAGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: use appropriate location for program modulesJan Engelhardt2011-02-016-8/+8
| | | | | | | Modules - since they are dependent on the executable - generally go to libexec/. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: avoid use of LIBS variableJan Engelhardt2011-02-016-6/+5
| | | | | | | The variable contains global libraries linked into every possible object, which is unwanted. Clean up things. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: propagate global CFLAGSJan Engelhardt2010-11-056-0/+6
| | | | | | | | | We must not override CFLAGS, because that will break when the user overrides CFLAGS again at make time (which he is entitled to). So, name our CFLAGS regular_CFLAGS, and also include that across all Makefiles so that they are actually uesd for all the code. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* output/LOGEMU: resolve build warningJan Engelhardt2010-11-051-1/+1
| | | | | | | ulogd_output_LOGEMU.c:37:2: warning: #warning this libc does not define HOST_NAME_MAX Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused $(all_includes)Jan Engelhardt2010-11-056-6/+6
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* pcap: fix packet length handlingJan Andres2010-09-061-3/+21
| | | | | | | | | | | | | | | | | | | | | | | | Currently, the PCAP output plugin uses ip.totlen to determine both the "len" and "caplen" pcap header fields, as well as the amount of packet data written to the file. There are two issues with this: - For obvious reasons it doesn't work for IPv6. - AFAICT, in case of an incompletely captured packet (--nflog-range) it will attempt to write out the whole packet, not just the part captured. This patch changes the behavior to: - Use raw.pktlen to set the "caplen" field, and the amount of data written. - Determine the "len" (original length) field from ip.totlen or ip6.payload_len if possible, default to the same value as "caplen" otherwise. Signed-off-by: Jan Andres <jandres@gmx.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* IPFIX: remove plugin until it is usablePablo Neira Ayuso2010-06-171-4/+1
| | | | | | | | | This patch removes the IPFIX from the Makefile. Thus, we keep it in the tree in the hope that we'll have time to finish it in the future but don't compile it. This confuses users since they think that it works. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: add infix in output filePablo Neira Ayuso2010-06-171-1/+12
| | | | | | | | | | This patch adds an infix to the XML file to avoid problems if we are logging packets and flows at the same time. Thus, we create two different XML files whose filename describes the sort of logging information that it contains. It is also useful when listing files at a quick sight. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: XML: support reopening file via SIGHUPPablo Neira Ayuso2010-06-171-27/+63
| | | | | | This feature is useful for log-rotation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* output: add new plugin XML to output logs in XMLPablo Neira Ayuso2010-06-172-1/+246
| | | | | | | This patch adds XML that allows to log information in XML for ulogd2. It supports packet and flow-based accounting. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* LOGEMU: fix crash if output file cannot be accessedPablo Neira Ayuso2010-06-031-1/+1
| | | | | | This patch fixes a crash if the output file was not correctly opened. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* IPFIX: preliminary fixes, yet unusablePablo Neira Ayuso2009-07-291-9/+5
| | | | | | | | | This patch is a preliminary fix for the yet-unfinished IPFIX support. This patch resolves a couple of bugs that made ulogd crash and a couple of missing symbols that didn't allow to use this plugin in the configuration file. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Explicitely type PCAP input key.Eric Leblond2009-01-271-5/+15
| | | | This patch affect type and flag to PCAP input key.
* Replace INCLUDES by AM_CPPFLAGS in Makefile.am.Eric Leblond2009-01-226-6/+6
| | | | | This patch fixes autotools warning about deprecated usage of INCLUDES in Makefile.am.
* build: use -avoid-version for modulesJan Engelhardt2009-01-206-10/+10
| | | | | | | The modules are pretty much bound to ulogd, and it does not seem to make sense to specially version these. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* PostgreSQL: allow local connectionsPierre Chifflier2009-01-071-1/+2
| | | | | | | | This patch allows to connect to the server using the local (unix) socket, thus not using a network socket and SSL encryption. Local connection is used if host parameter is omitted or empty. Signed-off-by: Pierre Chifflier <chifflier@inl.fr>
* DBI: lower column name before comparing to keyPierre Chifflier2009-01-071-0/+14
| | | | | | | Some databases (e.g Oracle) return column name in uppercase, while key name is in lowercase. This patch allows to match keys correctly. Signed-off-by: Pierre Chifflier <chifflier@inl.fr>
* add ukey_* function for key assignationPablo Neira Ayuso2008-12-092-23/+22
| | | | | | | | | This patch cleans up the current key assignation by introducing a set of functions ukey_* to set the key value as Eric Leblond and we discussed during the latest Netfilter Workshop. This patch is based on an idea from Holger Eitzenberger. Signed-off-by: Eric Leblond <eric@inl.fr>
* Add new output plugin DBIPierre Chifflier2008-12-093-1/+326
| | | | | | | | | libdbi implements a database-independent abstraction layer in C, similar to the DBI/DBD layer in Perl. This module brings support for all database types supported by libdbi. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Eric Leblond <eric@inl.fr>
* cleanup: fix warning due to lack of parenthesisEric Leblond2008-07-311-1/+1
| | | | | | | Fix gcc warning related to the lack of parenthesis. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: fix compilation warning about lack of parenthesisEric Leblond2008-07-311-2/+2
| | | | | | | | This patch adds parenthesis around an expression to avoid confusion between order preference of && and || operators. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: fix compilation warnings related to pointer comparisonsEric Leblond2008-07-313-6/+6
| | | | | | | | This patch cast to (char *) some (void *) to avoid a gcc warning in string format parsing. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org
* syslog: cleanly stops syslogEric Leblond2008-07-311-1/+5
| | | | | | | | This patch adds a stop function to the module which closes the connection to the log system. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: fix gcc warningsEric Leblond2008-07-292-3/+0
| | | | | | | | | This patch fixes some gcc warnings: * Unused variables * Functions with wrong return (or without return) Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Minor IPFIX fixesEric Leblond2008-07-231-5/+7
| | | | | | | IPFIX needs some huge work. This patch fixes some basic logic errors. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* This patch is a backport of Jaap Keuter fix for PCAP output module.Eric Leblond2008-06-181-1/+1
| | | | Signed-off-by: Eric Leblond <eric@inl.fr>
* Use ULOGD_IRET_* as return for all interpretersEric Leblond2008-06-126-9/+9
| | | | | | | | This patch modifies plugins to use the already defined but not used define. This also fixes some weird behaviours in error treatment (like not stopping after OOM). Signed-off-by: Eric Leblond <eric@inl.fr>
* NACCT was IPv4 only and was heavily dependant of the order of NFCT keys./C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-04-091-41/+96
| | | | | | | This patch introduces a explicit list of input keys and obtains IPv6 compliance by using IP2STR output as input for IP address. Signed-off-by: Eric Leblond <eric@inl.fr>
* From: Pierre Chifflier <chifflier@inl.fr>/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org2008-02-031-3/+3
| | | | | This patch fixes the type of some fields in the SQL schema to sync with datatype of the corresponding ulogd2 keys.