libip6t_LOG.c revision 182f3f62acbcb88b615b3d7d5940e316472be049 
1/* Shared library add-on to iptables to add LOG support. */
2#include <stdio.h>
3#include <netdb.h>
4#include <string.h>
5#include <stdlib.h>
6#include <syslog.h>
7#include <getopt.h>
8#include <ip6tables.h>
9#include <linux/netfilter_ipv6/ip6_tables.h>
10#include <linux/netfilter_ipv6/ip6t_LOG.h>
11
12#define LOG_DEFAULT_LEVEL LOG_WARNING
13
14/* Function which prints out usage message. */
15static void
16help(void)
17{
18	printf(
19"LOG v%s options:\n"
20" --log-level level		Level of logging (numeric or see syslog.conf)\n"
21" --log-prefix prefix		Prefix log messages with this prefix.\n\n"
22" --log-tcp-sequence		Log TCP sequence numbers.\n\n"
23" --log-tcp-options		Log TCP options.\n\n"
24" --log-ip-options		Log IP options.\n\n",
25IPTABLES_VERSION);
26}
27
28static struct option opts[] = {
29	{ .name = "log-level",        .has_arg = 1, .flag = 0, .val = '!' },
30	{ .name = "log-prefix",       .has_arg = 1, .flag = 0, .val = '#' },
31	{ .name = "log-tcp-sequence", .has_arg = 0, .flag = 0, .val = '1' },
32	{ .name = "log-tcp-options",  .has_arg = 0, .flag = 0, .val = '2' },
33	{ .name = "log-ip-options",   .has_arg = 0, .flag = 0, .val = '3' },
34	{ .name = 0 }
35};
36
37/* Initialize the target. */
38static void
39init(struct ip6t_entry_target *t, unsigned int *nfcache)
40{
41	struct ip6t_log_info *loginfo = (struct ip6t_log_info *)t->data;
42
43	loginfo->level = LOG_DEFAULT_LEVEL;
44
45}
46
47struct ip6t_log_names {
48	const char *name;
49	unsigned int level;
50};
51
52static struct ip6t_log_names ip6t_log_names[]
53= { { .name = "alert",   .level = LOG_ALERT },
54    { .name = "crit",    .level = LOG_CRIT },
55    { .name = "debug",   .level = LOG_DEBUG },
56    { .name = "emerg",   .level = LOG_EMERG },
57    { .name = "error",   .level = LOG_ERR },		/* DEPRECATED */
58    { .name = "info",    .level = LOG_INFO },
59    { .name = "notice",  .level = LOG_NOTICE },
60    { .name = "panic",   .level = LOG_EMERG },		/* DEPRECATED */
61    { .name = "warning", .level = LOG_WARNING }
62};
63
64static u_int8_t
65parse_level(const char *level)
66{
67	unsigned int lev = -1;
68	unsigned int set = 0;
69
70	if (string_to_number(level, 0, 7, &lev) == -1) {
71		unsigned int i = 0;
72
73		for (i = 0;
74		     i < sizeof(ip6t_log_names) / sizeof(struct ip6t_log_names);
75		     i++) {
76			if (strncasecmp(level, ip6t_log_names[i].name,
77					strlen(level)) == 0) {
78				if (set++)
79					exit_error(PARAMETER_PROBLEM,
80						   "log-level `%s' ambiguous",
81						   level);
82				lev = ip6t_log_names[i].level;
83			}
84		}
85
86		if (!set)
87			exit_error(PARAMETER_PROBLEM,
88				   "log-level `%s' unknown", level);
89	}
90
91	return (u_int8_t)lev;
92}
93
94#define IP6T_LOG_OPT_LEVEL 0x01
95#define IP6T_LOG_OPT_PREFIX 0x02
96#define IP6T_LOG_OPT_TCPSEQ 0x04
97#define IP6T_LOG_OPT_TCPOPT 0x08
98#define IP6T_LOG_OPT_IPOPT 0x10
99
100/* Function which parses command options; returns true if it
101   ate an option */
102static int
103parse(int c, char **argv, int invert, unsigned int *flags,
104      const struct ip6t_entry *entry,
105      struct ip6t_entry_target **target)
106{
107	struct ip6t_log_info *loginfo = (struct ip6t_log_info *)(*target)->data;
108
109	switch (c) {
110	case '!':
111		if (*flags & IP6T_LOG_OPT_LEVEL)
112			exit_error(PARAMETER_PROBLEM,
113				   "Can't specify --log-level twice");
114
115		if (check_inverse(optarg, &invert, NULL, 0))
116			exit_error(PARAMETER_PROBLEM,
117				   "Unexpected `!' after --log-level");
118
119		loginfo->level = parse_level(optarg);
120		*flags |= IP6T_LOG_OPT_LEVEL;
121		break;
122
123	case '#':
124		if (*flags & IP6T_LOG_OPT_PREFIX)
125			exit_error(PARAMETER_PROBLEM,
126				   "Can't specify --log-prefix twice");
127
128		if (check_inverse(optarg, &invert, NULL, 0))
129			exit_error(PARAMETER_PROBLEM,
130				   "Unexpected `!' after --log-prefix");
131
132		if (strlen(optarg) > sizeof(loginfo->prefix) - 1)
133			exit_error(PARAMETER_PROBLEM,
134				   "Maximum prefix length %u for --log-prefix",
135				   (unsigned int)sizeof(loginfo->prefix) - 1);
136
137		if (strlen(optarg) != strlen(strtok(optarg, "\n")))
138			exit_error(PARAMETER_PROBLEM,
139				   "Newlines not allowed in --log-prefix");
140
141		strcpy(loginfo->prefix, optarg);
142		*flags |= IP6T_LOG_OPT_PREFIX;
143		break;
144
145	case '1':
146		if (*flags & IP6T_LOG_OPT_TCPSEQ)
147			exit_error(PARAMETER_PROBLEM,
148				   "Can't specify --log-tcp-sequence "
149				   "twice");
150
151		loginfo->logflags |= IP6T_LOG_TCPSEQ;
152		*flags |= IP6T_LOG_OPT_TCPSEQ;
153		break;
154
155	case '2':
156		if (*flags & IP6T_LOG_OPT_TCPOPT)
157			exit_error(PARAMETER_PROBLEM,
158				   "Can't specify --log-tcp-options twice");
159
160		loginfo->logflags |= IP6T_LOG_TCPOPT;
161		*flags |= IP6T_LOG_OPT_TCPOPT;
162		break;
163
164	case '3':
165		if (*flags & IP6T_LOG_OPT_IPOPT)
166			exit_error(PARAMETER_PROBLEM,
167				   "Can't specify --log-ip-options twice");
168
169		loginfo->logflags |= IP6T_LOG_IPOPT;
170		*flags |= IP6T_LOG_OPT_IPOPT;
171		break;
172
173	default:
174		return 0;
175	}
176
177	return 1;
178}
179
180/* Final check; nothing. */
181static void final_check(unsigned int flags)
182{
183}
184
185/* Prints out the targinfo. */
186static void
187print(const struct ip6t_ip6 *ip,
188      const struct ip6t_entry_target *target,
189      int numeric)
190{
191	const struct ip6t_log_info *loginfo
192		= (const struct ip6t_log_info *)target->data;
193	unsigned int i = 0;
194
195	printf("LOG ");
196	if (numeric)
197		printf("flags %u level %u ",
198		       loginfo->logflags, loginfo->level);
199	else {
200		for (i = 0;
201		     i < sizeof(ip6t_log_names) / sizeof(struct ip6t_log_names);
202		     i++) {
203			if (loginfo->level == ip6t_log_names[i].level) {
204				printf("level %s ", ip6t_log_names[i].name);
205				break;
206			}
207		}
208		if (i == sizeof(ip6t_log_names) / sizeof(struct ip6t_log_names))
209			printf("UNKNOWN level %u ", loginfo->level);
210		if (loginfo->logflags & IP6T_LOG_TCPSEQ)
211			printf("tcp-sequence ");
212		if (loginfo->logflags & IP6T_LOG_TCPOPT)
213			printf("tcp-options ");
214		if (loginfo->logflags & IP6T_LOG_IPOPT)
215			printf("ip-options ");
216		if (loginfo->logflags & ~(IP6T_LOG_MASK))
217			printf("unknown-flags ");
218	}
219
220	if (strcmp(loginfo->prefix, "") != 0)
221		printf("prefix `%s' ", loginfo->prefix);
222}
223
224/* Saves the union ip6t_targinfo in parsable form to stdout. */
225static void
226save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
227{
228	const struct ip6t_log_info *loginfo
229		= (const struct ip6t_log_info *)target->data;
230
231	if (strcmp(loginfo->prefix, "") != 0)
232		printf("--log-prefix \"%s\" ", loginfo->prefix);
233
234	if (loginfo->level != LOG_DEFAULT_LEVEL)
235		printf("--log-level %d ", loginfo->level);
236
237	if (loginfo->logflags & IP6T_LOG_TCPSEQ)
238		printf("--log-tcp-sequence ");
239	if (loginfo->logflags & IP6T_LOG_TCPOPT)
240		printf("--log-tcp-options ");
241	if (loginfo->logflags & IP6T_LOG_IPOPT)
242		printf("--log-ip-options ");
243}
244
245static
246struct ip6tables_target log
247= {
248    .name          = "LOG",
249    .version       = IPTABLES_VERSION,
250    .size          = IP6T_ALIGN(sizeof(struct ip6t_log_info)),
251    .userspacesize = IP6T_ALIGN(sizeof(struct ip6t_log_info)),
252    .help          = &help,
253    .init          = &init,
254    .parse         = &parse,
255    .final_check   = &final_check,
256    .print         = &print,
257    .save          = &save,
258    .extra_opts    = opts
259};
260
261void _init(void)
262{
263	register_target6(&log);
264}
265