summaryrefslogtreecommitdiffstats
path: root/filter
Commit message (Collapse)AuthorAgeFilesLines
* filter: IP2BIN: correct spelling of variableJeremy Sowden2022-12-081-2/+2
| | | | | Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: fix buffer sizes in filter plug-insJeremy Sowden2022-12-084-13/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Three of the filter plug-ins define arrays to hold output key values. The arrays are sized based on the values of enums. For example: enum output_keys { KEY_MAC_TYPE, KEY_MAC_PROTOCOL, KEY_MAC_SADDR, START_KEY = KEY_MAC_SADDR, KEY_MAC_DADDR, KEY_MAC_ADDR, MAX_KEY = KEY_MAC_ADDR, }; static char hwmac_str[MAX_KEY - START_KEY][HWADDR_LENGTH]; The arrays are indexed by subtracting `START_KEY` from the enum value of the key currently being processed: `hwmac_str[okey - START_KEY]`. However, this means that the last key (`KEY_MAC_ADDR` in this example) will run off the end of the array. Increase the size of the arrays. In the case of `IP2BIN` and `IP2HBIN`, there is no overrun, but only because they use the wrong upper bound when looping over the keys, and thus don't assign a value to the last key. Correct the bound. Also some small white-space tweaks. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=890 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: PWSNIFF: replace malloc+strncpy with strndupJeremy Sowden2021-11-301-9/+9
| | | | | | | | | | | | There are a couple of instances of allocating memory with `malloc`, followed by copying a string to it with `strncpy` and adding an explicit assignment of `\0` to terminate the string. Replace them with `strndup`. Add an enum to name indices of output keys. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: HWHDR: remove zero-initialization of MAC typeJeremy Sowden2021-11-301-1/+1
| | | | | | | | | We don't need to initialize `type`, and even if we did the right value would be `ARPHDR_VOID`, not `0`, which is a valid MAC type (`ARPHDR_NETROM`). Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: HWHDR: re-order KEY_RAW_MAC checksJeremy Sowden2021-11-301-18/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, in `interp_mac2str` we have: if (/* KEY_RAW_MAC is valid */) { /* * set mac type */ } if (/* mac type is ethernet */) // parse ethernet if (/* KEY_RAW_MAC is not valid */) // return early. The MAC type will not be set to ethernet unless KEY_RAW_MAC is valid, so we can move the last check up and drop the first one: if (/* KEY_RAW_MAC is not valid */) // return early. /* * set mac type */ if (/* mac type is ethernet */) // parse ethernet Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* filter: HWHDR: simplify flow-controlJeremy Sowden2021-11-301-13/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `interp_mac2str` function concludes with a `switch` followed by a `return` statement. The `switch` has one case falling through to a default: switch (expr) { case X: // ... X code ... default: // ... default code ... } This is equivalent to the simpler and more readily comprehensible: if (expr == X) { // ... X code ... } // ... default code ... Replace the former with the latter. Doing so makes it obvious that the following `return` statement is never reached. Remove it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: add Make_global.am for common flagsJeremy Sowden2021-11-152-5/+4
| | | | | | | | | | Move `${regular_CFLAGS}` from configure.ac to Make_global.am, renaming it to `AM_CFLAGS`. Add `AM_CPPFGLAGS` to include `$(top_srcdir)/include`. Include the new file in the Makefiles that require it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove empty filter sub-directoryJeremy Sowden2021-11-152-1/+1
| | | | | | | The only file in filter/packet2flow is an empty Makefile.am. Remove it. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* raw2packet: fix comma instead of semicolonTimon Ulrich2020-10-301-1/+1
| | | | | Signed-off-by: Timon Ulrich <t.ulrich@anapur.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip2bin: fix plugin link for some compilerEric Leblond2017-07-021-1/+1
| | | | | | | Declaring a function inline and building with -O0 was causing the following message: undefined symbol: uint32_to_ipv6 By declaring the function as static we fix the problem.
* ulogd: fix crash when ipv4 packet is truncatedLiping Zhang2016-10-171-1/+2
| | | | | | | | | | | If ipv4 packet is truncated, we should not try to dereference the iph pointer. Otherwise, if the user add such iptables rules "-j NFLOG --nflog-size 0", we will dereference the NULL pointer and crash may happen. Reported-by: Chris Caputo <ccaputo@alt.net> Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use stdint types everywhereFelix Janda2015-06-266-27/+28
| | | | Signed-off-by: Felix Janda <felix.janda@posteo.de>
* Define _GNU_SOURCE to get members of tcphdrFelix Janda2015-06-232-0/+2
| | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de>
* store Common Information Model name in ulogd keyEric Leblond2014-01-282-2/+12
| | | | | | | | | | | | | | | | | | | This patch adds storage for CIM field name in ulogd key. This will be used by JSON output to interoperate with logging collector such as logstash or splunk. Common Information Model is an open standard that defines how managed elements in an IT environment are represented as a common set of objects and relationships between them: http://www.dmtf.org/standards/cim This seems to be mainly XML based but there is a JSON version of some aspects of the model. One of the main documentation on CIM in JSON format seems to be: http://docs.splunk.com/Documentation/PCI/2.0/DataSource/CommonInformationModelFieldReference Using the correct CIM field name allow events coming from ulogd to be correlated with events coming from other sources.
* base: fix warning on pointer handlingEric Leblond2013-01-181-4/+4
|
* Get rid of SVN tag in comment.Eric Leblond2013-01-187-15/+5
| | | | This patch also update some copyright and licence declaration.
* Add additional ip6 header fields to database scriptsBob Hockney2012-12-191-1/+1
| | | | | Rename internal keyname ip6.payload_len to remove "_" to facilitate this.
* Fix parsing of ipv6 flowlabel and tc fieldsBob Hockney2012-12-191-2/+2
| | | | Mask should be applied after ntohl conversion.
* build: move remaining preprocessor flags into CPPFLAGSJan Engelhardt2012-11-271-2/+2
| | | | | | | | The flags retrieved from `pkg-config --cflags ...` are generally only preprocessor flags (mostly -I to point to the directories), since anything else would inconvenience downstream users. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* filter: IP2HBIN: fix compilation warning with gcc-4.7Pablo Neira Ayuso2012-08-031-1/+0
| | | | | | | ulogd_filter_IP2HBIN.c: In function 'interp_ip2hbin': ulogd_filter_IP2HBIN.c:122:6: warning: unused variable 'fret' [-Wunused-variable] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: fix version that -V displaysPablo Neira Ayuso2012-08-0310-10/+10
| | | | | | | It was wrong, use VERSION constant which uses the version information available in configure.ac. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: use pkglibdir instead of pkglibexecdir for automakeBjörn Lässig2012-05-182-2/+2
| | | | | | | | | | | This fixes the following problem while running `autoreconf -fi` `pkglibexecdir' is not a legitimate directory for `LTLIBRARIES' variable `ulogd_filter_PRINTPKT_la_SOURCES' is defined but no program or library has `ulogd_filter_PRINTPKT_la' as canonical name (possible typo) Signed-off-by: Björn Lässig <laessig@bitformer.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* A simple filter plugin called IP2HBIN addedJozsef Kadlecsik2012-01-162-1/+204
| | | | | | | | The plugin converts the IPv4 addresses to host order for databases like MySQL. The expected name of the table fields are ip.hsaddr, ip.hdaddr, etc. Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
* build: use compile/link information from pkgconfigJan Engelhardt2011-02-011-2/+3
| | | | | | | This is important for when the libraries are in a non-default path. Also, libs must be listed in LDADD/LIBADD, not LDFLAGS. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: use appropriate location for program modulesJan Engelhardt2011-02-012-5/+5
| | | | | | | Modules - since they are dependent on the executable - generally go to libexec/. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* filter/HWHDR: remove redundant sizeof(char)Jan Engelhardt2010-11-051-1/+1
| | | | | | It is 1 by definition. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: propagate global CFLAGSJan Engelhardt2010-11-052-0/+2
| | | | | | | | | We must not override CFLAGS, because that will break when the user overrides CFLAGS again at make time (which he is entitled to). So, name our CFLAGS regular_CFLAGS, and also include that across all Makefiles so that they are actually uesd for all the code. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: remove unused $(all_includes)Jan Engelhardt2010-11-052-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* HWHDR: Fix various crashesEric Leblond2010-09-221-19/+17
| | | | | | This patch fixes the HWHDR plugin. The logic of the interaction with exiting plugin was not correctly coded and this was leading to crashes due to the lack of sanity check.
* IP2BIN: fix missing protocol keyChristophe Fish2010-04-021-0/+5
| | | | | | | | | | | | | | | | | ulogd2 from git won't start using filter IP2BIN. It gives the following error message in the log: <1> ulogd.c:670 traversing plugin `IP2BIN' <1> ulogd.c:627 log4(NFLOG) <1> ulogd.c:733 assigning `oob.family(?)' as source for IP2BIN(oob.family) <7> ulogd.c:727 cannot find key `' in stack <1> ulogd.c:863 destroying stack Filling up ip2bin_inp[] declaration with missing section in filter/ulogd_filter_IP2BIN.c solves the problem: Signed-off-by: Christophe Fish <christophe.fish@free.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ip2bin: add AF_BRIDGE family support.Eric Leblond2009-03-061-1/+27
| | | | | This patch adds support for AF_BRIDGE family. It synchronizes code of IP2BIN module with the one of IP2STR.
* hwhdr: suppress explicit allocationEric Leblond2009-03-061-12/+12
| | | | | This patch suppresses all allocation and use a statically created array instead.
* ip2bin: suppress explicit allocation of some output key valuesEric Leblond2009-03-061-14/+14
| | | | | This patch suppresses explicit allocation and free for each packet and use a statically created array instead.
* ip2str: suppress explicit allocation of some output key valuesEric Leblond2009-03-061-17/+16
| | | | | This patch suppresses explicit allocation and free for each packet and use a statically created array instead.
* ifindex: avoid memory allocationEric Leblond2009-03-061-21/+16
| | | | | This patch modifies the interp function to avoid to do an explicit allocation of memory.
* Replace INCLUDES by AM_CPPFLAGS in Makefile.am.Eric Leblond2009-01-222-2/+2
| | | | | This patch fixes autotools warning about deprecated usage of INCLUDES in Makefile.am.
* build: use -avoid-version for modulesJan Engelhardt2009-01-202-9/+9
| | | | | | | The modules are pretty much bound to ulogd, and it does not seem to make sense to specially version these. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* HWHDR: Fix size of allocated string.Eric Leblond2009-01-131-1/+1
| | | | | This patch fixes a incorrect computing of the allocation size of a string.
* Return true/false instead of ULOGD_IRET_OK/STOPThomas Jacob2008-12-091-2/+2
| | | | | Signed-off-by: Thomas Jacob <jacob@internet24.de> Signed-off-by: Eric Leblond <eric@inl.fr>
* Add SCTP support to BASE plugin.Eric Leblond2008-12-091-0/+53
| | | | | | THis patch adds basic support for SCTP in the BASE plugin. Signed-off-by: Eric Leblond <eric@inl.fr>
* add ukey_* function for key assignationPablo Neira Ayuso2008-12-0910-228/+165
| | | | | | | | | This patch cleans up the current key assignation by introducing a set of functions ukey_* to set the key value as Eric Leblond and we discussed during the latest Netfilter Workshop. This patch is based on an idea from Holger Eitzenberger. Signed-off-by: Eric Leblond <eric@inl.fr>
* Fix light memory error in parse_mac2strPierre Chifflier2008-12-091-2/+8
| | | | | | | | | When len is 0 (for ex. when the input mac is NULL), parse_mac2str tries to calloc a 0-bytes bloc, which leads to a conditional jump based on uninitialized value (spotted by valgrind). Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Eric Leblond <eric@inl.fr>
* hwhdr: finish missing renamingPierre Chifflier2008-10-201-2/+2
| | | | | | | MAC2STR has been renamed to HWHDR. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* hwhdr: fix segfault when RAW_MAC is NULLPierre Chifflier2008-10-201-1/+1
| | | | | | | This fixes a segfault when RAW_MAC key is NULL in MAC2STR plugin. Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* cleanup: fix compilation warning related to signed and unsigned comparisonsEric Leblond2008-07-313-4/+5
| | | | | | This patch fixes the warning related to signed and unsigned comparaison. Signed-off-by: Eric Leblond <eric@inl.fr>
* cleanup: fix gcc warningsEric Leblond2008-07-294-7/+3
| | | | | | | | | This patch fixes some gcc warnings: * Unused variables * Functions with wrong return (or without return) Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* MAC2STR: Rename it to HWHDREric Leblond2008-07-292-3/+3
| | | | | | | Use a more appropriate name for this filter. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* MAC2STR: add support for the new RAW MAC keysEric Leblond2008-07-291-22/+152
| | | | | | | | | | | This patch modifies MAC2STR to use the new MAC keys that gives us more accurate information to parse the link layer header. This patch also does some probing based on the header and field size in the case of ULOG (since we do not have enough information to perform accurate parsing). Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Fix wrong casting warning during compilationEric Leblond2008-07-231-1/+1
| | | | | | | This patch cast a expression to avoid a warning. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Use ULOGD_IRET_* as return for all interpretersEric Leblond2008-06-128-38/+38
| | | | | | | | This patch modifies plugins to use the already defined but not used define. This also fixes some weird behaviours in error treatment (like not stopping after OOM). Signed-off-by: Eric Leblond <eric@inl.fr>