1 // SPDX-License-Identifier: GPL-2.0-only
2 /* (C) 1999-2001 Paul `Rusty' Russell
3  * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
4  */
5 
6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7 
8 #include <linux/kernel.h>
9 #include <linux/module.h>
10 #include <linux/spinlock.h>
11 #include <linux/skbuff.h>
12 #include <linux/if_arp.h>
13 #include <linux/ip.h>
14 #include <net/ipv6.h>
15 #include <net/icmp.h>
16 #include <net/udp.h>
17 #include <net/tcp.h>
18 #include <net/route.h>
19 
20 #include <linux/netfilter.h>
21 #include <linux/netfilter_bridge.h>
22 #include <linux/netfilter_ipv6.h>
23 #include <linux/netfilter/xt_LOG.h>
24 #include <net/netfilter/nf_log.h>
25 
26 static const struct nf_loginfo default_loginfo = {
27 	.type	= NF_LOG_TYPE_LOG,
28 	.u = {
29 		.log = {
30 			.level	  = LOGLEVEL_NOTICE,
31 			.logflags = NF_LOG_DEFAULT_MASK,
32 		},
33 	},
34 };
35 
36 struct arppayload {
37 	unsigned char mac_src[ETH_ALEN];
38 	unsigned char ip_src[4];
39 	unsigned char mac_dst[ETH_ALEN];
40 	unsigned char ip_dst[4];
41 };
42 
43 /* Guard against containers flooding syslog. */
44 static bool nf_log_allowed(const struct net *net)
45 {
46 	return net_eq(net, &init_net) || sysctl_nf_log_all_netns;
47 }
48 
49 static void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb)
50 {
51 	u16 vid;
52 
53 	if (!skb_vlan_tag_present(skb))
54 		return;
55 
56 	vid = skb_vlan_tag_get(skb);
57 	nf_log_buf_add(m, "VPROTO=%04x VID=%u ", ntohs(skb->vlan_proto), vid);
58 }
59 static void noinline_for_stack
60 dump_arp_packet(struct nf_log_buf *m,
61 		const struct nf_loginfo *info,
62 		const struct sk_buff *skb, unsigned int nhoff)
63 {
64 	const struct arppayload *ap;
65 	struct arppayload _arpp;
66 	const struct arphdr *ah;
67 	unsigned int logflags;
68 	struct arphdr _arph;
69 
70 	ah = skb_header_pointer(skb, nhoff, sizeof(_arph), &_arph);
71 	if (!ah) {
72 		nf_log_buf_add(m, "TRUNCATED");
73 		return;
74 	}
75 
76 	if (info->type == NF_LOG_TYPE_LOG)
77 		logflags = info->u.log.logflags;
78 	else
79 		logflags = NF_LOG_DEFAULT_MASK;
80 
81 	if (logflags & NF_LOG_MACDECODE) {
82 		nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",
83 			       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
84 		nf_log_dump_vlan(m, skb);
85 		nf_log_buf_add(m, "MACPROTO=%04x ",
86 			       ntohs(eth_hdr(skb)->h_proto));
87 	}
88 
89 	nf_log_buf_add(m, "ARP HTYPE=%d PTYPE=0x%04x OPCODE=%d",
90 		       ntohs(ah->ar_hrd), ntohs(ah->ar_pro), ntohs(ah->ar_op));
91 	/* If it's for Ethernet and the lengths are OK, then log the ARP
92 	 * payload.
93 	 */
94 	if (ah->ar_hrd != htons(ARPHRD_ETHER) ||
95 	    ah->ar_hln != ETH_ALEN ||
96 	    ah->ar_pln != sizeof(__be32))
97 		return;
98 
99 	ap = skb_header_pointer(skb, nhoff + sizeof(_arph), sizeof(_arpp), &_arpp);
100 	if (!ap) {
101 		nf_log_buf_add(m, " INCOMPLETE [%zu bytes]",
102 			       skb->len - sizeof(_arph));
103 		return;
104 	}
105 	nf_log_buf_add(m, " MACSRC=%pM IPSRC=%pI4 MACDST=%pM IPDST=%pI4",
106 		       ap->mac_src, ap->ip_src, ap->mac_dst, ap->ip_dst);
107 }
108 
109 static void
110 nf_log_dump_packet_common(struct nf_log_buf *m, u8 pf,
111 			  unsigned int hooknum, const struct sk_buff *skb,
112 			  const struct net_device *in,
113 			  const struct net_device *out,
114 			  const struct nf_loginfo *loginfo, const char *prefix,
115 			  struct net *net)
116 {
117 	const struct net_device *physoutdev __maybe_unused;
118 	const struct net_device *physindev __maybe_unused;
119 
120 	nf_log_buf_add(m, KERN_SOH "%c%sIN=%s OUT=%s ",
121 		       '0' + loginfo->u.log.level, prefix,
122 			in ? in->name : "",
123 			out ? out->name : "");
124 #if IS_ENABLED(CONFIG_BRIDGE_NETFILTER)
125 	physindev = nf_bridge_get_physindev(skb, net);
126 	if (physindev && in != physindev)
127 		nf_log_buf_add(m, "PHYSIN=%s ", physindev->name);
128 	physoutdev = nf_bridge_get_physoutdev(skb);
129 	if (physoutdev && out != physoutdev)
130 		nf_log_buf_add(m, "PHYSOUT=%s ", physoutdev->name);
131 #endif
132 }
133 
134 static void nf_log_arp_packet(struct net *net, u_int8_t pf,
135 			      unsigned int hooknum, const struct sk_buff *skb,
136 			      const struct net_device *in,
137 			      const struct net_device *out,
138 			      const struct nf_loginfo *loginfo,
139 			      const char *prefix)
140 {
141 	struct nf_log_buf *m;
142 
143 	if (!nf_log_allowed(net))
144 		return;
145 
146 	m = nf_log_buf_open();
147 
148 	if (!loginfo)
149 		loginfo = &default_loginfo;
150 
151 	nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo,
152 				  prefix, net);
153 	dump_arp_packet(m, loginfo, skb, skb_network_offset(skb));
154 
155 	nf_log_buf_close(m);
156 }
157 
158 static struct nf_logger nf_arp_logger __read_mostly = {
159 	.name		= "nf_log_arp",
160 	.type		= NF_LOG_TYPE_LOG,
161 	.logfn		= nf_log_arp_packet,
162 	.me		= THIS_MODULE,
163 };
164 
165 static void nf_log_dump_sk_uid_gid(struct net *net, struct nf_log_buf *m,
166 				   struct sock *sk)
167 {
168 	if (!sk || !sk_fullsock(sk) || !net_eq(net, sock_net(sk)))
169 		return;
170 
171 	read_lock_bh(&sk->sk_callback_lock);
172 	if (sk->sk_socket && sk->sk_socket->file) {
173 		const struct cred *cred = sk->sk_socket->file->f_cred;
174 
175 		nf_log_buf_add(m, "UID=%u GID=%u ",
176 			       from_kuid_munged(&init_user_ns, cred->fsuid),
177 			       from_kgid_munged(&init_user_ns, cred->fsgid));
178 	}
179 	read_unlock_bh(&sk->sk_callback_lock);
180 }
181 
182 static noinline_for_stack int
183 nf_log_dump_tcp_header(struct nf_log_buf *m,
184 		       const struct sk_buff *skb,
185 		       u8 proto, int fragment,
186 		       unsigned int offset,
187 		       unsigned int logflags)
188 {
189 	struct tcphdr _tcph;
190 	const struct tcphdr *th;
191 
192 	/* Max length: 10 "PROTO=TCP " */
193 	nf_log_buf_add(m, "PROTO=TCP ");
194 
195 	if (fragment)
196 		return 0;
197 
198 	/* Max length: 25 "INCOMPLETE [65535 bytes] " */
199 	th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
200 	if (!th) {
201 		nf_log_buf_add(m, "INCOMPLETE [%u bytes] ", skb->len - offset);
202 		return 1;
203 	}
204 
205 	/* Max length: 20 "SPT=65535 DPT=65535 " */
206 	nf_log_buf_add(m, "SPT=%u DPT=%u ",
207 		       ntohs(th->source), ntohs(th->dest));
208 	/* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
209 	if (logflags & NF_LOG_TCPSEQ) {
210 		nf_log_buf_add(m, "SEQ=%u ACK=%u ",
211 			       ntohl(th->seq), ntohl(th->ack_seq));
212 	}
213 
214 	/* Max length: 13 "WINDOW=65535 " */
215 	nf_log_buf_add(m, "WINDOW=%u ", ntohs(th->window));
216 	/* Max length: 9 "RES=0x3C " */
217 	nf_log_buf_add(m, "RES=0x%02x ", (u_int8_t)(ntohl(tcp_flag_word(th) &
218 					    TCP_RESERVED_BITS) >> 22));
219 	/* Max length: 35 "AE CWR ECE URG ACK PSH RST SYN FIN " */
220 	if (th->ae)
221 		nf_log_buf_add(m, "AE ");
222 	if (th->cwr)
223 		nf_log_buf_add(m, "CWR ");
224 	if (th->ece)
225 		nf_log_buf_add(m, "ECE ");
226 	if (th->urg)
227 		nf_log_buf_add(m, "URG ");
228 	if (th->ack)
229 		nf_log_buf_add(m, "ACK ");
230 	if (th->psh)
231 		nf_log_buf_add(m, "PSH ");
232 	if (th->rst)
233 		nf_log_buf_add(m, "RST ");
234 	if (th->syn)
235 		nf_log_buf_add(m, "SYN ");
236 	if (th->fin)
237 		nf_log_buf_add(m, "FIN ");
238 	/* Max length: 11 "URGP=65535 " */
239 	nf_log_buf_add(m, "URGP=%u ", ntohs(th->urg_ptr));
240 
241 	if ((logflags & NF_LOG_TCPOPT) && th->doff * 4 > sizeof(struct tcphdr)) {
242 		unsigned int optsize = th->doff * 4 - sizeof(struct tcphdr);
243 		u8 _opt[60 - sizeof(struct tcphdr)];
244 		unsigned int i;
245 		const u8 *op;
246 
247 		op = skb_header_pointer(skb, offset + sizeof(struct tcphdr),
248 					optsize, _opt);
249 		if (!op) {
250 			nf_log_buf_add(m, "OPT (TRUNCATED)");
251 			return 1;
252 		}
253 
254 		/* Max length: 127 "OPT (" 15*4*2chars ") " */
255 		nf_log_buf_add(m, "OPT (");
256 		for (i = 0; i < optsize; i++)
257 			nf_log_buf_add(m, "%02X", op[i]);
258 
259 		nf_log_buf_add(m, ") ");
260 	}
261 
262 	return 0;
263 }
264 
265 static noinline_for_stack int
266 nf_log_dump_udp_header(struct nf_log_buf *m,
267 		       const struct sk_buff *skb,
268 		       u8 proto, int fragment,
269 		       unsigned int offset)
270 {
271 	struct udphdr _udph;
272 	const struct udphdr *uh;
273 
274 	if (proto == IPPROTO_UDP)
275 		/* Max length: 10 "PROTO=UDP "     */
276 		nf_log_buf_add(m, "PROTO=UDP ");
277 	else	/* Max length: 14 "PROTO=UDPLITE " */
278 		nf_log_buf_add(m, "PROTO=UDPLITE ");
279 
280 	if (fragment)
281 		goto out;
282 
283 	/* Max length: 25 "INCOMPLETE [65535 bytes] " */
284 	uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
285 	if (!uh) {
286 		nf_log_buf_add(m, "INCOMPLETE [%u bytes] ", skb->len - offset);
287 
288 		return 1;
289 	}
290 
291 	/* Max length: 20 "SPT=65535 DPT=65535 " */
292 	nf_log_buf_add(m, "SPT=%u DPT=%u LEN=%u ",
293 		       ntohs(uh->source), ntohs(uh->dest), ntohs(uh->len));
294 
295 out:
296 	return 0;
297 }
298 
299 /* One level of recursion won't kill us */
300 static noinline_for_stack void
301 dump_ipv4_packet(struct net *net, struct nf_log_buf *m,
302 		 const struct nf_loginfo *info,
303 		 const struct sk_buff *skb, unsigned int iphoff)
304 {
305 	const struct iphdr *ih;
306 	unsigned int logflags;
307 	struct iphdr _iph;
308 
309 	if (info->type == NF_LOG_TYPE_LOG)
310 		logflags = info->u.log.logflags;
311 	else
312 		logflags = NF_LOG_DEFAULT_MASK;
313 
314 	ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);
315 	if (!ih) {
316 		nf_log_buf_add(m, "TRUNCATED");
317 		return;
318 	}
319 
320 	/* Important fields:
321 	 * TOS, len, DF/MF, fragment offset, TTL, src, dst, options.
322 	 * Max length: 40 "SRC=255.255.255.255 DST=255.255.255.255 "
323 	 */
324 	nf_log_buf_add(m, "SRC=%pI4 DST=%pI4 ", &ih->saddr, &ih->daddr);
325 
326 	/* Max length: 46 "LEN=65535 TOS=0xFF PREC=0xFF TTL=255 ID=65535 " */
327 	nf_log_buf_add(m, "LEN=%u TOS=0x%02X PREC=0x%02X TTL=%u ID=%u ",
328 		       iph_totlen(skb, ih), ih->tos & IPTOS_TOS_MASK,
329 		       ih->tos & IPTOS_PREC_MASK, ih->ttl, ntohs(ih->id));
330 
331 	/* Max length: 6 "CE DF MF " */
332 	if (ntohs(ih->frag_off) & IP_CE)
333 		nf_log_buf_add(m, "CE ");
334 	if (ntohs(ih->frag_off) & IP_DF)
335 		nf_log_buf_add(m, "DF ");
336 	if (ntohs(ih->frag_off) & IP_MF)
337 		nf_log_buf_add(m, "MF ");
338 
339 	/* Max length: 11 "FRAG:65535 " */
340 	if (ntohs(ih->frag_off) & IP_OFFSET)
341 		nf_log_buf_add(m, "FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
342 
343 	if ((logflags & NF_LOG_IPOPT) &&
344 	    ih->ihl * 4 > sizeof(struct iphdr)) {
345 		unsigned char _opt[4 * 15 - sizeof(struct iphdr)];
346 		const unsigned char *op;
347 		unsigned int i, optsize;
348 
349 		optsize = ih->ihl * 4 - sizeof(struct iphdr);
350 		op = skb_header_pointer(skb, iphoff + sizeof(_iph),
351 					optsize, _opt);
352 		if (!op) {
353 			nf_log_buf_add(m, "TRUNCATED");
354 			return;
355 		}
356 
357 		/* Max length: 127 "OPT (" 15*4*2chars ") " */
358 		nf_log_buf_add(m, "OPT (");
359 		for (i = 0; i < optsize; i++)
360 			nf_log_buf_add(m, "%02X", op[i]);
361 		nf_log_buf_add(m, ") ");
362 	}
363 
364 	switch (ih->protocol) {
365 	case IPPROTO_TCP:
366 		if (nf_log_dump_tcp_header(m, skb, ih->protocol,
367 					   ntohs(ih->frag_off) & IP_OFFSET,
368 					   iphoff + ih->ihl * 4, logflags))
369 			return;
370 		break;
371 	case IPPROTO_UDP:
372 	case IPPROTO_UDPLITE:
373 		if (nf_log_dump_udp_header(m, skb, ih->protocol,
374 					   ntohs(ih->frag_off) & IP_OFFSET,
375 					   iphoff + ih->ihl * 4))
376 			return;
377 		break;
378 	case IPPROTO_ICMP: {
379 		static const size_t required_len[NR_ICMP_TYPES + 1] = {
380 			[ICMP_ECHOREPLY] = 4,
381 			[ICMP_DEST_UNREACH] = 8 + sizeof(struct iphdr),
382 			[ICMP_SOURCE_QUENCH] = 8 + sizeof(struct iphdr),
383 			[ICMP_REDIRECT] = 8 + sizeof(struct iphdr),
384 			[ICMP_ECHO] = 4,
385 			[ICMP_TIME_EXCEEDED] = 8 + sizeof(struct iphdr),
386 			[ICMP_PARAMETERPROB] = 8 + sizeof(struct iphdr),
387 			[ICMP_TIMESTAMP] = 20,
388 			[ICMP_TIMESTAMPREPLY] = 20,
389 			[ICMP_ADDRESS] = 12,
390 			[ICMP_ADDRESSREPLY] = 12 };
391 		const struct icmphdr *ich;
392 		struct icmphdr _icmph;
393 
394 		/* Max length: 11 "PROTO=ICMP " */
395 		nf_log_buf_add(m, "PROTO=ICMP ");
396 
397 		if (ntohs(ih->frag_off) & IP_OFFSET)
398 			break;
399 
400 		/* Max length: 25 "INCOMPLETE [65535 bytes] " */
401 		ich = skb_header_pointer(skb, iphoff + ih->ihl * 4,
402 					 sizeof(_icmph), &_icmph);
403 		if (!ich) {
404 			nf_log_buf_add(m, "INCOMPLETE [%u bytes] ",
405 				       skb->len - iphoff - ih->ihl * 4);
406 			break;
407 		}
408 
409 		/* Max length: 18 "TYPE=255 CODE=255 " */
410 		nf_log_buf_add(m, "TYPE=%u CODE=%u ", ich->type, ich->code);
411 
412 		/* Max length: 25 "INCOMPLETE [65535 bytes] " */
413 		if (ich->type <= NR_ICMP_TYPES &&
414 		    required_len[ich->type] &&
415 		    skb->len - iphoff - ih->ihl * 4 < required_len[ich->type]) {
416 			nf_log_buf_add(m, "INCOMPLETE [%u bytes] ",
417 				       skb->len - iphoff - ih->ihl * 4);
418 			break;
419 		}
420 
421 		switch (ich->type) {
422 		case ICMP_ECHOREPLY:
423 		case ICMP_ECHO:
424 			/* Max length: 19 "ID=65535 SEQ=65535 " */
425 			nf_log_buf_add(m, "ID=%u SEQ=%u ",
426 				       ntohs(ich->un.echo.id),
427 				       ntohs(ich->un.echo.sequence));
428 			break;
429 
430 		case ICMP_PARAMETERPROB:
431 			/* Max length: 14 "PARAMETER=255 " */
432 			nf_log_buf_add(m, "PARAMETER=%u ",
433 				       ntohl(ich->un.gateway) >> 24);
434 			break;
435 		case ICMP_REDIRECT:
436 			/* Max length: 24 "GATEWAY=255.255.255.255 " */
437 			nf_log_buf_add(m, "GATEWAY=%pI4 ", &ich->un.gateway);
438 			fallthrough;
439 		case ICMP_DEST_UNREACH:
440 		case ICMP_SOURCE_QUENCH:
441 		case ICMP_TIME_EXCEEDED:
442 			/* Max length: 3+maxlen */
443 			if (!iphoff) { /* Only recurse once. */
444 				nf_log_buf_add(m, "[");
445 				dump_ipv4_packet(net, m, info, skb,
446 						 iphoff + ih->ihl * 4 + sizeof(_icmph));
447 				nf_log_buf_add(m, "] ");
448 			}
449 
450 			/* Max length: 10 "MTU=65535 " */
451 			if (ich->type == ICMP_DEST_UNREACH &&
452 			    ich->code == ICMP_FRAG_NEEDED) {
453 				nf_log_buf_add(m, "MTU=%u ",
454 					       ntohs(ich->un.frag.mtu));
455 			}
456 		}
457 		break;
458 	}
459 	/* Max Length */
460 	case IPPROTO_AH: {
461 		const struct ip_auth_hdr *ah;
462 		struct ip_auth_hdr _ahdr;
463 
464 		if (ntohs(ih->frag_off) & IP_OFFSET)
465 			break;
466 
467 		/* Max length: 9 "PROTO=AH " */
468 		nf_log_buf_add(m, "PROTO=AH ");
469 
470 		/* Max length: 25 "INCOMPLETE [65535 bytes] " */
471 		ah = skb_header_pointer(skb, iphoff + ih->ihl * 4,
472 					sizeof(_ahdr), &_ahdr);
473 		if (!ah) {
474 			nf_log_buf_add(m, "INCOMPLETE [%u bytes] ",
475 				       skb->len - iphoff - ih->ihl * 4);
476 			break;
477 		}
478 
479 		/* Length: 15 "SPI=0xF1234567 " */
480 		nf_log_buf_add(m, "SPI=0x%x ", ntohl(ah->spi));
481 		break;
482 	}
483 	case IPPROTO_ESP: {
484 		const struct ip_esp_hdr *eh;
485 		struct ip_esp_hdr _esph;
486 
487 		/* Max length: 10 "PROTO=ESP " */
488 		nf_log_buf_add(m, "PROTO=ESP ");
489 
490 		if (ntohs(ih->frag_off) & IP_OFFSET)
491 			break;
492 
493 		/* Max length: 25 "INCOMPLETE [65535 bytes] " */
494 		eh = skb_header_pointer(skb, iphoff + ih->ihl * 4,
495 					sizeof(_esph), &_esph);
496 		if (!eh) {
497 			nf_log_buf_add(m, "INCOMPLETE [%u bytes] ",
498 				       skb->len - iphoff - ih->ihl * 4);
499 			break;
500 		}
501 
502 		/* Length: 15 "SPI=0xF1234567 " */
503 		nf_log_buf_add(m, "SPI=0x%x ", ntohl(eh->spi));
504 		break;
505 	}
506 	/* Max length: 10 "PROTO 255 " */
507 	default:
508 		nf_log_buf_add(m, "PROTO=%u ", ih->protocol);
509 	}
510 
511 	/* Max length: 15 "UID=4294967295 " */
512 	if ((logflags & NF_LOG_UID) && !iphoff)
513 		nf_log_dump_sk_uid_gid(net, m, skb->sk);
514 
515 	/* Max length: 16 "MARK=0xFFFFFFFF " */
516 	if (!iphoff && skb->mark)
517 		nf_log_buf_add(m, "MARK=0x%x ", skb->mark);
518 
519 	/* Proto    Max log string length */
520 	/* IP:	    40+46+6+11+127 = 230 */
521 	/* TCP:     10+max(25,20+30+13+9+35+11+127) = 255 */
522 	/* UDP:     10+max(25,20) = 35 */
523 	/* UDPLITE: 14+max(25,20) = 39 */
524 	/* ICMP:    11+max(25, 18+25+max(19,14,24+3+n+10,3+n+10)) = 91+n */
525 	/* ESP:     10+max(25)+15 = 50 */
526 	/* AH:	    9+max(25)+15 = 49 */
527 	/* unknown: 10 */
528 
529 	/* (ICMP allows recursion one level deep) */
530 	/* maxlen =  IP + ICMP +  IP + max(TCP,UDP,ICMP,unknown) */
531 	/* maxlen = 230+   91  + 230 + 255 = 806 */
532 }
533 
534 static noinline_for_stack void
535 dump_ipv6_packet(struct net *net, struct nf_log_buf *m,
536 		 const struct nf_loginfo *info,
537 		 const struct sk_buff *skb, unsigned int ip6hoff,
538 		 int recurse)
539 {
540 	const struct ipv6hdr *ih;
541 	unsigned int hdrlen = 0;
542 	unsigned int logflags;
543 	struct ipv6hdr _ip6h;
544 	unsigned int ptr;
545 	u8 currenthdr;
546 	int fragment;
547 
548 	if (info->type == NF_LOG_TYPE_LOG)
549 		logflags = info->u.log.logflags;
550 	else
551 		logflags = NF_LOG_DEFAULT_MASK;
552 
553 	ih = skb_header_pointer(skb, ip6hoff, sizeof(_ip6h), &_ip6h);
554 	if (!ih) {
555 		nf_log_buf_add(m, "TRUNCATED");
556 		return;
557 	}
558 
559 	/* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000 " */
560 	nf_log_buf_add(m, "SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
561 
562 	/* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
563 	nf_log_buf_add(m, "LEN=%zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
564 		       ntohs(ih->payload_len) + sizeof(struct ipv6hdr),
565 		       (ntohl(*(__be32 *)ih) & 0x0ff00000) >> 20,
566 		       ih->hop_limit,
567 		       (ntohl(*(__be32 *)ih) & 0x000fffff));
568 
569 	fragment = 0;
570 	ptr = ip6hoff + sizeof(struct ipv6hdr);
571 	currenthdr = ih->nexthdr;
572 	while (currenthdr != NEXTHDR_NONE && nf_ip6_ext_hdr(currenthdr)) {
573 		struct ipv6_opt_hdr _hdr;
574 		const struct ipv6_opt_hdr *hp;
575 
576 		hp = skb_header_pointer(skb, ptr, sizeof(_hdr), &_hdr);
577 		if (!hp) {
578 			nf_log_buf_add(m, "TRUNCATED");
579 			return;
580 		}
581 
582 		/* Max length: 48 "OPT (...) " */
583 		if (logflags & NF_LOG_IPOPT)
584 			nf_log_buf_add(m, "OPT ( ");
585 
586 		switch (currenthdr) {
587 		case IPPROTO_FRAGMENT: {
588 			struct frag_hdr _fhdr;
589 			const struct frag_hdr *fh;
590 
591 			nf_log_buf_add(m, "FRAG:");
592 			fh = skb_header_pointer(skb, ptr, sizeof(_fhdr),
593 						&_fhdr);
594 			if (!fh) {
595 				nf_log_buf_add(m, "TRUNCATED ");
596 				return;
597 			}
598 
599 			/* Max length: 6 "65535 " */
600 			nf_log_buf_add(m, "%u ", ntohs(fh->frag_off) & 0xFFF8);
601 
602 			/* Max length: 11 "INCOMPLETE " */
603 			if (fh->frag_off & htons(0x0001))
604 				nf_log_buf_add(m, "INCOMPLETE ");
605 
606 			nf_log_buf_add(m, "ID:%08x ",
607 				       ntohl(fh->identification));
608 
609 			if (ntohs(fh->frag_off) & 0xFFF8)
610 				fragment = 1;
611 
612 			hdrlen = 8;
613 			break;
614 		}
615 		case IPPROTO_DSTOPTS:
616 		case IPPROTO_ROUTING:
617 		case IPPROTO_HOPOPTS:
618 			if (fragment) {
619 				if (logflags & NF_LOG_IPOPT)
620 					nf_log_buf_add(m, ")");
621 				return;
622 			}
623 			hdrlen = ipv6_optlen(hp);
624 			break;
625 		/* Max Length */
626 		case IPPROTO_AH:
627 			if (logflags & NF_LOG_IPOPT) {
628 				struct ip_auth_hdr _ahdr;
629 				const struct ip_auth_hdr *ah;
630 
631 				/* Max length: 3 "AH " */
632 				nf_log_buf_add(m, "AH ");
633 
634 				if (fragment) {
635 					nf_log_buf_add(m, ")");
636 					return;
637 				}
638 
639 				ah = skb_header_pointer(skb, ptr, sizeof(_ahdr),
640 							&_ahdr);
641 				if (!ah) {
642 					/* Max length: 26 "INCOMPLETE [65535 bytes] )" */
643 					nf_log_buf_add(m, "INCOMPLETE [%u bytes] )",
644 						       skb->len - ptr);
645 					return;
646 				}
647 
648 				/* Length: 15 "SPI=0xF1234567 */
649 				nf_log_buf_add(m, "SPI=0x%x ", ntohl(ah->spi));
650 			}
651 
652 			hdrlen = ipv6_authlen(hp);
653 			break;
654 		case IPPROTO_ESP:
655 			if (logflags & NF_LOG_IPOPT) {
656 				struct ip_esp_hdr _esph;
657 				const struct ip_esp_hdr *eh;
658 
659 				/* Max length: 4 "ESP " */
660 				nf_log_buf_add(m, "ESP ");
661 
662 				if (fragment) {
663 					nf_log_buf_add(m, ")");
664 					return;
665 				}
666 
667 				/* Max length: 26 "INCOMPLETE [65535 bytes] )" */
668 				eh = skb_header_pointer(skb, ptr, sizeof(_esph),
669 							&_esph);
670 				if (!eh) {
671 					nf_log_buf_add(m, "INCOMPLETE [%u bytes] )",
672 						       skb->len - ptr);
673 					return;
674 				}
675 
676 				/* Length: 16 "SPI=0xF1234567 )" */
677 				nf_log_buf_add(m, "SPI=0x%x )",
678 					       ntohl(eh->spi));
679 			}
680 			return;
681 		default:
682 			/* Max length: 20 "Unknown Ext Hdr 255" */
683 			nf_log_buf_add(m, "Unknown Ext Hdr %u", currenthdr);
684 			return;
685 		}
686 		if (logflags & NF_LOG_IPOPT)
687 			nf_log_buf_add(m, ") ");
688 
689 		currenthdr = hp->nexthdr;
690 		ptr += hdrlen;
691 	}
692 
693 	switch (currenthdr) {
694 	case IPPROTO_TCP:
695 		if (nf_log_dump_tcp_header(m, skb, currenthdr, fragment,
696 					   ptr, logflags))
697 			return;
698 		break;
699 	case IPPROTO_UDP:
700 	case IPPROTO_UDPLITE:
701 		if (nf_log_dump_udp_header(m, skb, currenthdr, fragment, ptr))
702 			return;
703 		break;
704 	case IPPROTO_ICMPV6: {
705 		struct icmp6hdr _icmp6h;
706 		const struct icmp6hdr *ic;
707 
708 		/* Max length: 13 "PROTO=ICMPv6 " */
709 		nf_log_buf_add(m, "PROTO=ICMPv6 ");
710 
711 		if (fragment)
712 			break;
713 
714 		/* Max length: 25 "INCOMPLETE [65535 bytes] " */
715 		ic = skb_header_pointer(skb, ptr, sizeof(_icmp6h), &_icmp6h);
716 		if (!ic) {
717 			nf_log_buf_add(m, "INCOMPLETE [%u bytes] ",
718 				       skb->len - ptr);
719 			return;
720 		}
721 
722 		/* Max length: 18 "TYPE=255 CODE=255 " */
723 		nf_log_buf_add(m, "TYPE=%u CODE=%u ",
724 			       ic->icmp6_type, ic->icmp6_code);
725 
726 		switch (ic->icmp6_type) {
727 		case ICMPV6_ECHO_REQUEST:
728 		case ICMPV6_ECHO_REPLY:
729 			/* Max length: 19 "ID=65535 SEQ=65535 " */
730 			nf_log_buf_add(m, "ID=%u SEQ=%u ",
731 				       ntohs(ic->icmp6_identifier),
732 				       ntohs(ic->icmp6_sequence));
733 			break;
734 		case ICMPV6_MGM_QUERY:
735 		case ICMPV6_MGM_REPORT:
736 		case ICMPV6_MGM_REDUCTION:
737 			break;
738 
739 		case ICMPV6_PARAMPROB:
740 			/* Max length: 17 "POINTER=ffffffff " */
741 			nf_log_buf_add(m, "POINTER=%08x ",
742 				       ntohl(ic->icmp6_pointer));
743 			fallthrough;
744 		case ICMPV6_DEST_UNREACH:
745 		case ICMPV6_PKT_TOOBIG:
746 		case ICMPV6_TIME_EXCEED:
747 			/* Max length: 3+maxlen */
748 			if (recurse) {
749 				nf_log_buf_add(m, "[");
750 				dump_ipv6_packet(net, m, info, skb,
751 						 ptr + sizeof(_icmp6h), 0);
752 				nf_log_buf_add(m, "] ");
753 			}
754 
755 			/* Max length: 10 "MTU=65535 " */
756 			if (ic->icmp6_type == ICMPV6_PKT_TOOBIG) {
757 				nf_log_buf_add(m, "MTU=%u ",
758 					       ntohl(ic->icmp6_mtu));
759 			}
760 		}
761 		break;
762 	}
763 	/* Max length: 10 "PROTO=255 " */
764 	default:
765 		nf_log_buf_add(m, "PROTO=%u ", currenthdr);
766 	}
767 
768 	/* Max length: 15 "UID=4294967295 " */
769 	if ((logflags & NF_LOG_UID) && recurse)
770 		nf_log_dump_sk_uid_gid(net, m, skb->sk);
771 
772 	/* Max length: 16 "MARK=0xFFFFFFFF " */
773 	if (recurse && skb->mark)
774 		nf_log_buf_add(m, "MARK=0x%x ", skb->mark);
775 }
776 
777 static void dump_mac_header(struct nf_log_buf *m,
778 			    const struct nf_loginfo *info,
779 			    const struct sk_buff *skb)
780 {
781 	struct net_device *dev = skb->dev;
782 	unsigned int logflags = 0;
783 
784 	if (info->type == NF_LOG_TYPE_LOG)
785 		logflags = info->u.log.logflags;
786 
787 	if (!(logflags & NF_LOG_MACDECODE))
788 		goto fallback;
789 
790 	switch (dev->type) {
791 	case ARPHRD_ETHER:
792 		nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",
793 			       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
794 		nf_log_dump_vlan(m, skb);
795 		nf_log_buf_add(m, "MACPROTO=%04x ",
796 			       ntohs(eth_hdr(skb)->h_proto));
797 		return;
798 	default:
799 		break;
800 	}
801 
802 fallback:
803 	nf_log_buf_add(m, "MAC=");
804 	if (dev->hard_header_len &&
805 	    skb->mac_header != skb->network_header) {
806 		const unsigned char *p = skb_mac_header(skb);
807 		unsigned int i;
808 
809 		if (dev->type == ARPHRD_SIT) {
810 			p -= ETH_HLEN;
811 
812 			if (p < skb->head)
813 				p = NULL;
814 		}
815 
816 		if (p) {
817 			nf_log_buf_add(m, "%02x", *p++);
818 			for (i = 1; i < dev->hard_header_len; i++)
819 				nf_log_buf_add(m, ":%02x", *p++);
820 		}
821 
822 		if (dev->type == ARPHRD_SIT) {
823 			const struct iphdr *iph =
824 				(struct iphdr *)skb_mac_header(skb);
825 
826 			nf_log_buf_add(m, " TUNNEL=%pI4->%pI4", &iph->saddr,
827 				       &iph->daddr);
828 		}
829 	}
830 	nf_log_buf_add(m, " ");
831 }
832 
833 static void nf_log_ip_packet(struct net *net, u_int8_t pf,
834 			     unsigned int hooknum, const struct sk_buff *skb,
835 			     const struct net_device *in,
836 			     const struct net_device *out,
837 			     const struct nf_loginfo *loginfo,
838 			     const char *prefix)
839 {
840 	struct nf_log_buf *m;
841 
842 	if (!nf_log_allowed(net))
843 		return;
844 
845 	m = nf_log_buf_open();
846 
847 	if (!loginfo)
848 		loginfo = &default_loginfo;
849 
850 	nf_log_dump_packet_common(m, pf, hooknum, skb, in,
851 				  out, loginfo, prefix, net);
852 
853 	if (in)
854 		dump_mac_header(m, loginfo, skb);
855 
856 	dump_ipv4_packet(net, m, loginfo, skb, skb_network_offset(skb));
857 
858 	nf_log_buf_close(m);
859 }
860 
861 static struct nf_logger nf_ip_logger __read_mostly = {
862 	.name		= "nf_log_ipv4",
863 	.type		= NF_LOG_TYPE_LOG,
864 	.logfn		= nf_log_ip_packet,
865 	.me		= THIS_MODULE,
866 };
867 
868 static void nf_log_ip6_packet(struct net *net, u_int8_t pf,
869 			      unsigned int hooknum, const struct sk_buff *skb,
870 			      const struct net_device *in,
871 			      const struct net_device *out,
872 			      const struct nf_loginfo *loginfo,
873 			      const char *prefix)
874 {
875 	struct nf_log_buf *m;
876 
877 	if (!nf_log_allowed(net))
878 		return;
879 
880 	m = nf_log_buf_open();
881 
882 	if (!loginfo)
883 		loginfo = &default_loginfo;
884 
885 	nf_log_dump_packet_common(m, pf, hooknum, skb, in, out,
886 				  loginfo, prefix, net);
887 
888 	if (in)
889 		dump_mac_header(m, loginfo, skb);
890 
891 	dump_ipv6_packet(net, m, loginfo, skb, skb_network_offset(skb), 1);
892 
893 	nf_log_buf_close(m);
894 }
895 
896 static struct nf_logger nf_ip6_logger __read_mostly = {
897 	.name		= "nf_log_ipv6",
898 	.type		= NF_LOG_TYPE_LOG,
899 	.logfn		= nf_log_ip6_packet,
900 	.me		= THIS_MODULE,
901 };
902 
903 static void nf_log_unknown_packet(struct net *net, u_int8_t pf,
904 				  unsigned int hooknum,
905 				  const struct sk_buff *skb,
906 				  const struct net_device *in,
907 				  const struct net_device *out,
908 				  const struct nf_loginfo *loginfo,
909 				  const char *prefix)
910 {
911 	struct nf_log_buf *m;
912 
913 	if (!nf_log_allowed(net))
914 		return;
915 
916 	m = nf_log_buf_open();
917 
918 	if (!loginfo)
919 		loginfo = &default_loginfo;
920 
921 	nf_log_dump_packet_common(m, pf, hooknum, skb, in, out, loginfo,
922 				  prefix, net);
923 
924 	dump_mac_header(m, loginfo, skb);
925 
926 	nf_log_buf_close(m);
927 }
928 
929 static void nf_log_netdev_packet(struct net *net, u_int8_t pf,
930 				 unsigned int hooknum,
931 				 const struct sk_buff *skb,
932 				 const struct net_device *in,
933 				 const struct net_device *out,
934 				 const struct nf_loginfo *loginfo,
935 				 const char *prefix)
936 {
937 	switch (skb->protocol) {
938 	case htons(ETH_P_IP):
939 		nf_log_ip_packet(net, pf, hooknum, skb, in, out, loginfo, prefix);
940 		break;
941 	case htons(ETH_P_IPV6):
942 		nf_log_ip6_packet(net, pf, hooknum, skb, in, out, loginfo, prefix);
943 		break;
944 	case htons(ETH_P_ARP):
945 	case htons(ETH_P_RARP):
946 		nf_log_arp_packet(net, pf, hooknum, skb, in, out, loginfo, prefix);
947 		break;
948 	default:
949 		nf_log_unknown_packet(net, pf, hooknum, skb,
950 				      in, out, loginfo, prefix);
951 		break;
952 	}
953 }
954 
955 static struct nf_logger nf_netdev_logger __read_mostly = {
956 	.name		= "nf_log_netdev",
957 	.type		= NF_LOG_TYPE_LOG,
958 	.logfn		= nf_log_netdev_packet,
959 	.me		= THIS_MODULE,
960 };
961 
962 static struct nf_logger nf_bridge_logger __read_mostly = {
963 	.name		= "nf_log_bridge",
964 	.type		= NF_LOG_TYPE_LOG,
965 	.logfn		= nf_log_netdev_packet,
966 	.me		= THIS_MODULE,
967 };
968 
969 static int __net_init nf_log_syslog_net_init(struct net *net)
970 {
971 	int ret = nf_log_set(net, NFPROTO_IPV4, &nf_ip_logger);
972 
973 	if (ret)
974 		return ret;
975 
976 	ret = nf_log_set(net, NFPROTO_ARP, &nf_arp_logger);
977 	if (ret)
978 		goto err1;
979 
980 	ret = nf_log_set(net, NFPROTO_IPV6, &nf_ip6_logger);
981 	if (ret)
982 		goto err2;
983 
984 	ret = nf_log_set(net, NFPROTO_NETDEV, &nf_netdev_logger);
985 	if (ret)
986 		goto err3;
987 
988 	ret = nf_log_set(net, NFPROTO_BRIDGE, &nf_bridge_logger);
989 	if (ret)
990 		goto err4;
991 	return 0;
992 err4:
993 	nf_log_unset(net, &nf_netdev_logger);
994 err3:
995 	nf_log_unset(net, &nf_ip6_logger);
996 err2:
997 	nf_log_unset(net, &nf_arp_logger);
998 err1:
999 	nf_log_unset(net, &nf_ip_logger);
1000 	return ret;
1001 }
1002 
1003 static void __net_exit nf_log_syslog_net_exit(struct net *net)
1004 {
1005 	nf_log_unset(net, &nf_ip_logger);
1006 	nf_log_unset(net, &nf_arp_logger);
1007 	nf_log_unset(net, &nf_ip6_logger);
1008 	nf_log_unset(net, &nf_netdev_logger);
1009 	nf_log_unset(net, &nf_bridge_logger);
1010 }
1011 
1012 static struct pernet_operations nf_log_syslog_net_ops = {
1013 	.init = nf_log_syslog_net_init,
1014 	.exit = nf_log_syslog_net_exit,
1015 };
1016 
1017 static int __init nf_log_syslog_init(void)
1018 {
1019 	int ret;
1020 
1021 	ret = register_pernet_subsys(&nf_log_syslog_net_ops);
1022 	if (ret < 0)
1023 		return ret;
1024 
1025 	ret = nf_log_register(NFPROTO_IPV4, &nf_ip_logger);
1026 	if (ret < 0)
1027 		goto err1;
1028 
1029 	ret = nf_log_register(NFPROTO_ARP, &nf_arp_logger);
1030 	if (ret < 0)
1031 		goto err2;
1032 
1033 	ret = nf_log_register(NFPROTO_IPV6, &nf_ip6_logger);
1034 	if (ret < 0)
1035 		goto err3;
1036 
1037 	ret = nf_log_register(NFPROTO_NETDEV, &nf_netdev_logger);
1038 	if (ret < 0)
1039 		goto err4;
1040 
1041 	ret = nf_log_register(NFPROTO_BRIDGE, &nf_bridge_logger);
1042 	if (ret < 0)
1043 		goto err5;
1044 
1045 	return 0;
1046 err5:
1047 	nf_log_unregister(&nf_netdev_logger);
1048 err4:
1049 	nf_log_unregister(&nf_ip6_logger);
1050 err3:
1051 	nf_log_unregister(&nf_arp_logger);
1052 err2:
1053 	nf_log_unregister(&nf_ip_logger);
1054 err1:
1055 	pr_err("failed to register logger\n");
1056 	unregister_pernet_subsys(&nf_log_syslog_net_ops);
1057 	return ret;
1058 }
1059 
1060 static void __exit nf_log_syslog_exit(void)
1061 {
1062 	unregister_pernet_subsys(&nf_log_syslog_net_ops);
1063 	nf_log_unregister(&nf_ip_logger);
1064 	nf_log_unregister(&nf_arp_logger);
1065 	nf_log_unregister(&nf_ip6_logger);
1066 	nf_log_unregister(&nf_netdev_logger);
1067 	nf_log_unregister(&nf_bridge_logger);
1068 }
1069 
1070 module_init(nf_log_syslog_init);
1071 module_exit(nf_log_syslog_exit);
1072 
1073 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
1074 MODULE_DESCRIPTION("Netfilter syslog packet logging");
1075 MODULE_LICENSE("GPL");
1076 MODULE_ALIAS("nf_log_arp");
1077 MODULE_ALIAS("nf_log_bridge");
1078 MODULE_ALIAS("nf_log_ipv4");
1079 MODULE_ALIAS("nf_log_ipv6");
1080 MODULE_ALIAS("nf_log_netdev");
1081 MODULE_ALIAS_NF_LOGGER(AF_BRIDGE, 0);
1082 MODULE_ALIAS_NF_LOGGER(AF_INET, 0);
1083 MODULE_ALIAS_NF_LOGGER(3, 0);
1084 MODULE_ALIAS_NF_LOGGER(5, 0); /* NFPROTO_NETDEV */
1085 MODULE_ALIAS_NF_LOGGER(AF_INET6, 0);
1086