From b2e283aeb083f2034cc857b045ac5b4bcb9e7033 Mon Sep 17 00:00:00 2001 From: laforge Date: Thu, 15 Feb 2001 08:05:09 +0000 Subject: LOG Target for IPv6 (Jan Rekorajski) --- extensions/.LOG-test6 | 2 + extensions/.NETLINK-test | 2 + extensions/libip6t_LOG.c | 261 ++++++++++++++++++++++++++++++++++++++++++++ extensions/libipt_NETLINK.c | 158 +++++++++++++++++++++++++++ 4 files changed, 423 insertions(+) create mode 100755 extensions/.LOG-test6 create mode 100755 extensions/.NETLINK-test create mode 100644 extensions/libip6t_LOG.c create mode 100644 extensions/libipt_NETLINK.c diff --git a/extensions/.LOG-test6 b/extensions/.LOG-test6 new file mode 100755 index 0000000..0dcbdf3 --- /dev/null +++ b/extensions/.LOG-test6 @@ -0,0 +1,2 @@ +#!/bin/sh +[ -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_LOG.c ] && echo LOG diff --git a/extensions/.NETLINK-test b/extensions/.NETLINK-test new file mode 100755 index 0000000..fe94c0c --- /dev/null +++ b/extensions/.NETLINK-test @@ -0,0 +1,2 @@ +#! /bin/sh +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_NETLINK.c ] && echo NETLINK diff --git a/extensions/libip6t_LOG.c b/extensions/libip6t_LOG.c new file mode 100644 index 0000000..c147d1c --- /dev/null +++ b/extensions/libip6t_LOG.c @@ -0,0 +1,261 @@ +/* Shared library add-on to iptables to add LOG support. */ +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define LOG_DEFAULT_LEVEL LOG_WARNING + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"LOG v%s options:\n" +" --log-level level Level of logging (numeric or see syslog.conf)\n" +" --log-prefix prefix Prefix log messages with this prefix.\n\n" +" --log-tcp-sequence Log TCP sequence numbers.\n\n" +" --log-tcp-options Log TCP options.\n\n" +" --log-ip-options Log IP options.\n\n", +NETFILTER_VERSION); +} + +static struct option opts[] = { + { "log-level", 1, 0, '!' }, + { "log-prefix", 1, 0, '#' }, + { "log-tcp-sequence", 0, 0, '1' }, + { "log-tcp-options", 0, 0, '2' }, + { "log-ip-options", 0, 0, '3' }, + { 0 } +}; + +/* Initialize the target. */ +static void +init(struct ip6t_entry_target *t, unsigned int *nfcache) +{ + struct ip6t_log_info *loginfo = (struct ip6t_log_info *)t->data; + + loginfo->level = LOG_DEFAULT_LEVEL; + + /* Can't cache this */ + *nfcache |= NFC_UNKNOWN; +} + +struct ip6t_log_names { + const char *name; + unsigned int level; +}; + +static struct ip6t_log_names ip6t_log_names[] += { { "alert", LOG_ALERT }, + { "crit", LOG_CRIT }, + { "debug", LOG_DEBUG }, + { "emerg", LOG_EMERG }, + { "error", LOG_ERR }, /* DEPRECATED */ + { "info", LOG_INFO }, + { "notice", LOG_NOTICE }, + { "panic", LOG_EMERG }, /* DEPRECATED */ + { "warning", LOG_WARNING } +}; + +static u_int8_t +parse_level(const char *level) +{ + int lev; + + lev = string_to_number(level, 0, 7); + if (lev == -1) { + unsigned int i = 0; + + for (i = 0; + i < sizeof(ip6t_log_names) / sizeof(struct ip6t_log_names); + i++) { + if (strncasecmp(level, ip6t_log_names[i].name, + strlen(level)) == 0) { + if (lev != -1) + exit_error(PARAMETER_PROBLEM, + "log-level `%s' ambiguous", + level); + lev = ip6t_log_names[i].level; + } + } + + if (lev == -1) + exit_error(PARAMETER_PROBLEM, + "log-level `%s' unknown", level); + } + + return (u_int8_t)lev; +} + +#define IP6T_LOG_OPT_LEVEL 0x01 +#define IP6T_LOG_OPT_PREFIX 0x02 +#define IP6T_LOG_OPT_TCPSEQ 0x04 +#define IP6T_LOG_OPT_TCPOPT 0x08 +#define IP6T_LOG_OPT_IPOPT 0x10 + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + struct ip6t_entry_target **target) +{ + struct ip6t_log_info *loginfo = (struct ip6t_log_info *)(*target)->data; + + switch (c) { + case '!': + if (*flags & IP6T_LOG_OPT_LEVEL) + exit_error(PARAMETER_PROBLEM, + "Can't specify --log-level twice"); + + if (check_inverse(optarg, &invert)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --log-level"); + + loginfo->level = parse_level(optarg); + *flags |= IP6T_LOG_OPT_LEVEL; + break; + + case '#': + if (*flags & IP6T_LOG_OPT_PREFIX) + exit_error(PARAMETER_PROBLEM, + "Can't specify --log-prefix twice"); + + if (check_inverse(optarg, &invert)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --log-prefix"); + + if (strlen(optarg) > sizeof(loginfo->prefix) - 1) + exit_error(PARAMETER_PROBLEM, + "Maximum prefix length %u for --log-prefix", + sizeof(loginfo->prefix) - 1); + + strcpy(loginfo->prefix, optarg); + *flags |= IP6T_LOG_OPT_PREFIX; + break; + + case '1': + if (*flags & IP6T_LOG_OPT_TCPSEQ) + exit_error(PARAMETER_PROBLEM, + "Can't specify --log-tcp-sequence " + "twice"); + + loginfo->logflags |= IP6T_LOG_TCPSEQ; + *flags |= IP6T_LOG_OPT_TCPSEQ; + break; + + case '2': + if (*flags & IP6T_LOG_OPT_TCPOPT) + exit_error(PARAMETER_PROBLEM, + "Can't specify --log-tcp-options twice"); + + loginfo->logflags |= IP6T_LOG_TCPOPT; + *flags |= IP6T_LOG_OPT_TCPOPT; + break; + + case '3': + if (*flags & IP6T_LOG_OPT_IPOPT) + exit_error(PARAMETER_PROBLEM, + "Can't specify --log-ip-options twice"); + + loginfo->logflags |= IP6T_LOG_IPOPT; + *flags |= IP6T_LOG_OPT_IPOPT; + break; + + default: + return 0; + } + + return 1; +} + +/* Final check; nothing. */ +static void final_check(unsigned int flags) +{ +} + +/* Prints out the targinfo. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_target *target, + int numeric) +{ + const struct ip6t_log_info *loginfo + = (const struct ip6t_log_info *)target->data; + unsigned int i = 0; + + printf("LOG "); + if (numeric) + printf("flags %u level %u ", + loginfo->logflags, loginfo->level); + else { + for (i = 0; + i < sizeof(ip6t_log_names) / sizeof(struct ip6t_log_names); + i++) { + if (loginfo->level == ip6t_log_names[i].level) { + printf("level %s ", ip6t_log_names[i].name); + break; + } + } + if (i == sizeof(ip6t_log_names) / sizeof(struct ip6t_log_names)) + printf("UNKNOWN level %u ", loginfo->level); + if (loginfo->logflags & IP6T_LOG_TCPSEQ) + printf("tcp-sequence "); + if (loginfo->logflags & IP6T_LOG_TCPOPT) + printf("tcp-options "); + if (loginfo->logflags & IP6T_LOG_IPOPT) + printf("ip-options "); + if (loginfo->logflags & ~(IP6T_LOG_MASK)) + printf("unknown-flags "); + } + + if (strcmp(loginfo->prefix, "") != 0) + printf("prefix `%s' ", loginfo->prefix); +} + +/* Saves the union ip6t_targinfo in parsable form to stdout. */ +static void +save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target) +{ + const struct ip6t_log_info *loginfo + = (const struct ip6t_log_info *)target->data; + + if (strcmp(loginfo->prefix, "") != 0) + printf("--log-prefix %s ", loginfo->prefix); + + if (loginfo->level != LOG_DEFAULT_LEVEL) + printf("--log-level %u ", loginfo->level); + + if (loginfo->logflags & IP6T_LOG_TCPSEQ) + printf("--log-tcp-sequence "); + if (loginfo->logflags & IP6T_LOG_TCPOPT) + printf("--log-tcp-options "); + if (loginfo->logflags & IP6T_LOG_IPOPT) + printf("--log-ip-options "); +} + +struct ip6tables_target log += { NULL, + "LOG", + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_log_info)), + IP6T_ALIGN(sizeof(struct ip6t_log_info)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void _init(void) +{ + register_target6(&log); +} diff --git a/extensions/libipt_NETLINK.c b/extensions/libipt_NETLINK.c new file mode 100644 index 0000000..31c0b15 --- /dev/null +++ b/extensions/libipt_NETLINK.c @@ -0,0 +1,158 @@ +/* Provides a NETLINK target, identical to that of the ipchains -o flag */ +/* AUTHOR: Gianni Tedesco */ +#include +#include +#include +#include +#include +#include +#include +#include + +#include "ipt_NETLINK.h" + +static void help(void) +{ + printf("NETLINK v%s options:\n" + " --nldrop Drop the packet too\n" + " --nlmark Mark the packet\n" + " --nlsize Limit packet size\n", + NETFILTER_VERSION); +} + +static struct option opts[] = { + {"nldrop", 0, 0, 'd'}, + {"nlmark", 1, 0, 'm'}, + {"nlsize", 1, 0, 's'}, + {0} +}; + +static void init(struct ipt_entry_target *t, unsigned int *nfcache) +{ + struct ipt_nldata *nld = (struct ipt_nldata *) t->data; + + nld->flags=0; + + *nfcache |= NFC_UNKNOWN; +} + +/* Parse command options */ +static int parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + struct ipt_entry_target **target) +{ + struct ipt_nldata *nld=(struct ipt_nldata *)(*target)->data; + + switch (c) { + case 'd': + if (MASK(*flags, USE_DROP)) + exit_error(PARAMETER_PROBLEM, + "Can't specify --nldrop twice"); + + if ( check_inverse(optarg, &invert) ) { + MASK_UNSET(nld->flags, USE_DROP); + } else { + MASK_SET(nld->flags, USE_DROP); + } + + MASK_SET(*flags, USE_DROP); + + break; + case 'm': + if (MASK(*flags, USE_MARK)) + exit_error(PARAMETER_PROBLEM, + "Can't specify --nlmark twice"); + + if (check_inverse(optarg, &invert)) { + MASK_UNSET(nld->flags, USE_MARK); + }else{ + MASK_SET(nld->flags, USE_MARK); + nld->mark=atoi(optarg); + } + + MASK_SET(*flags, USE_MARK); + break; + case 's': + if (MASK(*flags, USE_SIZE)) + exit_error(PARAMETER_PROBLEM, + "Can't specify --nlsize twice"); + + if ( atoi(optarg) <= 0 ) + exit_error(PARAMETER_PROBLEM, + "--nlsize must be larger than zero"); + + + if (check_inverse(optarg, &invert)) { + MASK_UNSET(nld->flags, USE_SIZE); + }else{ + MASK_SET(nld->flags, USE_SIZE); + nld->size=atoi(optarg); + } + MASK_SET(*flags, USE_SIZE); + break; + + default: + return 0; + } + return 1; +} + +static void final_check(unsigned int flags) +{ + /* ?? */ +} + +/* Saves the union ipt_targinfo in parsable form to stdout. */ +static void save(const struct ipt_ip *ip, + const struct ipt_entry_target *target) +{ + const struct ipt_nldata *nld + = (const struct ipt_nldata *) target->data; + + if ( MASK(nld->flags, USE_DROP) ) + printf("--nldrop "); + + if ( MASK(nld->flags, USE_MARK) ) + printf("--nlmark %i ", nld->mark); + + if ( MASK(nld->flags, USE_SIZE) ) + printf("--nlsize %i ", nld->size); +} + +/* Prints out the targinfo. */ +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_target *target, int numeric) +{ + const struct ipt_nldata *nld + = (const struct ipt_nldata *) target->data; + + if ( MASK(nld->flags, USE_DROP) ) + printf("nldrop "); + + if ( MASK(nld->flags, USE_MARK) ) + printf("nlmark %i ", nld->mark); + + if ( MASK(nld->flags, USE_SIZE) ) + printf("nlsize %i ", nld->size); +} + +struct iptables_target netlink = { NULL, + "NETLINK", + NETFILTER_VERSION, + IPT_ALIGN(sizeof(struct ipt_nldata)), + IPT_ALIGN(sizeof(struct ipt_nldata)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void _init(void) +{ + register_target(&netlink); +} + -- cgit v1.2.3