Commit 0d9826bc authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: nf_log: missing vlan offload tag and proto 



Dump vlan tag and proto for the usual vlan offload case if the
NF_LOG_MACDECODE flag is set on. Without this information the logging is
misleading as there is no reference to the VLAN header.

[12716.993704] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0800 SRC=192.168.10.2 DST=172.217.168.163 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=2548 DF PROTO=TCP SPT=55848 DPT=80 WINDOW=501 RES=0x00 ACK FIN URGP=0
[12721.157643] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0806 ARP HTYPE=1 PTYPE=0x0800 OPCODE=2 MACSRC=86:6c:92:ea:d6:73 IPSRC=192.168.10.2 MACDST=0e:3b:eb:86:73:76 IPDST=192.168.10.1

Fixes: 83e96d44 ("netfilter: log: split family specific code to nf_log_{ip,ip6,common}.c files")
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 98a381a7

include/net/netfilter/nf_log.h

+1 −0
Original line number Diff line number Diff line
@@ -108,6 +108,7 @@ int nf_log_dump_tcp_header(struct nf_log_buf *m, const struct sk_buff *skb, 
			   unsigned int logflags);

void nf_log_dump_sk_uid_gid(struct net *net, struct nf_log_buf *m,

			    struct sock *sk);

void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb);

void nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf,

			       unsigned int hooknum, const struct sk_buff *skb,

			       const struct net_device *in,

net/ipv4/netfilter/nf_log_arp.c

+17 −2
Original line number Diff line number Diff line
@@ -43,16 +43,31 @@ static void dump_arp_packet(struct nf_log_buf *m, 
			    const struct nf_loginfo *info,

			    const struct sk_buff *skb, unsigned int nhoff)

{

	const struct arphdr *ah;

	struct arphdr _arph;

	const struct arppayload *ap;

	struct arppayload _arpp;

	const struct arphdr *ah;

	unsigned int logflags;

	struct arphdr _arph;



	ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph);

	if (ah == NULL) {

		nf_log_buf_add(m, "TRUNCATED");

		return;

	}



	if (info->type == NF_LOG_TYPE_LOG)

		logflags = info->u.log.logflags;

	else

		logflags = NF_LOG_DEFAULT_MASK;



	if (logflags & NF_LOG_MACDECODE) {

		nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",

			       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);

		nf_log_dump_vlan(m, skb);

		nf_log_buf_add(m, "MACPROTO=%04x ",

			       ntohs(eth_hdr(skb)->h_proto));

	}



	nf_log_buf_add(m, "ARP HTYPE=%d PTYPE=0x%04x OPCODE=%d",

		       ntohs(ah->ar_hrd), ntohs(ah->ar_pro), ntohs(ah->ar_op));

net/ipv4/netfilter/nf_log_ipv4.c

+4 −2
Original line number Diff line number Diff line
@@ -284,8 +284,10 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m, 


	switch (dev->type) {

	case ARPHRD_ETHER:

		nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",

			       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,

		nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",

			       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);

		nf_log_dump_vlan(m, skb);

		nf_log_buf_add(m, "MACPROTO=%04x ",

			       ntohs(eth_hdr(skb)->h_proto));

		return;

	default:

net/ipv6/netfilter/nf_log_ipv6.c

+5 −3
Original line number Diff line number Diff line
@@ -297,8 +297,10 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m, 


	switch (dev->type) {

	case ARPHRD_ETHER:

		nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ",

		       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest,

		nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",

			       eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);

		nf_log_dump_vlan(m, skb);

		nf_log_buf_add(m, "MACPROTO=%04x ",

			       ntohs(eth_hdr(skb)->h_proto));

		return;

	default:

net/netfilter/nf_log_common.c

+12 −0
Original line number Diff line number Diff line
@@ -171,6 +171,18 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf, 
}

EXPORT_SYMBOL_GPL(nf_log_dump_packet_common);



void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb)

{

	u16 vid;



	if (!skb_vlan_tag_present(skb))

		return;



	vid = skb_vlan_tag_get(skb);

	nf_log_buf_add(m, "VPROTO=%04x VID=%u ", ntohs(skb->vlan_proto), vid);

}

EXPORT_SYMBOL_GPL(nf_log_dump_vlan);



/* bridge and netdev logging families share this code. */

void nf_log_l2packet(struct net *net, u_int8_t pf,

		     __be16 protocol,

CRA Git | Maintained and supported by SUSTech CRA and CCSE