Commit 4017a7ee authored by Pablo Neira Ayuso's avatar Pablo Neira Ayuso
Browse files

netfilter: restore rule tracing via nfnetlink_log 



Since fab4085f ("netfilter: log: nf_log_packet() as real unified
interface"), the loginfo structure that is passed to nf_log_packet() is
used to explicitly indicate the logger type you want to use.

This is a problem for people tracing rules through nfnetlink_log since
packets are always routed to the NF_LOG_TYPE logger after the
aforementioned patch.

We can fix this by removing the trace loginfo structures, but that still
changes the log level from 4 to 5 for tracing messages and there may be
someone relying on this outthere. So let's just introduce a new
nf_log_trace() function that restores the former behaviour.

Reported-by: default avatarMarkus Kötter <koetter@rrzn.uni-hannover.de>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent d6b6cb1d

include/net/netfilter/nf_log.h

+10 −0
Original line number Diff line number Diff line
@@ -79,6 +79,16 @@ void nf_log_packet(struct net *net, 
		   const struct nf_loginfo *li,

		   const char *fmt, ...);



__printf(8, 9)

void nf_log_trace(struct net *net,

		  u_int8_t pf,

		  unsigned int hooknum,

		  const struct sk_buff *skb,

		  const struct net_device *in,

		  const struct net_device *out,

		  const struct nf_loginfo *li,

		  const char *fmt, ...);



struct nf_log_buf;



struct nf_log_buf *nf_log_buf_open(void);

net/ipv4/netfilter/ip_tables.c

+3 −3
Original line number Diff line number Diff line
@@ -272,7 +272,7 @@ static void trace_packet(const struct sk_buff *skb, 
		    &chainname, &comment, &rulenum) != 0)

			break;



	nf_log_packet(net, AF_INET, hook, skb, in, out, &trace_loginfo,

	nf_log_trace(net, AF_INET, hook, skb, in, out, &trace_loginfo,

		     "TRACE: %s:%s:%s:%u ",

		     tablename, chainname, comment, rulenum);

}

net/ipv6/netfilter/ip6_tables.c

+3 −3
Original line number Diff line number Diff line
@@ -298,7 +298,7 @@ static void trace_packet(const struct sk_buff *skb, 
		    &chainname, &comment, &rulenum) != 0)

			break;



	nf_log_packet(net, AF_INET6, hook, skb, in, out, &trace_loginfo,

	nf_log_trace(net, AF_INET6, hook, skb, in, out, &trace_loginfo,

		     "TRACE: %s:%s:%s:%u ",

		     tablename, chainname, comment, rulenum);

}

net/netfilter/nf_log.c

+24 −0
Original line number Diff line number Diff line
@@ -212,6 +212,30 @@ void nf_log_packet(struct net *net, 
}

EXPORT_SYMBOL(nf_log_packet);



void nf_log_trace(struct net *net,

		  u_int8_t pf,

		  unsigned int hooknum,

		  const struct sk_buff *skb,

		  const struct net_device *in,

		  const struct net_device *out,

		  const struct nf_loginfo *loginfo, const char *fmt, ...)

{

	va_list args;

	char prefix[NF_LOG_PREFIXLEN];

	const struct nf_logger *logger;



	rcu_read_lock();

	logger = rcu_dereference(net->nf.nf_loggers[pf]);

	if (logger) {

		va_start(args, fmt);

		vsnprintf(prefix, sizeof(prefix), fmt, args);

		va_end(args);

		logger->logfn(net, pf, hooknum, skb, in, out, loginfo, prefix);

	}

	rcu_read_unlock();

}

EXPORT_SYMBOL(nf_log_trace);



#define S_SIZE (1024 - (sizeof(unsigned int) + 1))



struct nf_log_buf {

net/netfilter/nf_tables_core.c

+4 −4
Original line number Diff line number Diff line
@@ -94,7 +94,7 @@ static void nft_trace_packet(const struct nft_pktinfo *pkt, 
{

	struct net *net = dev_net(pkt->in ? pkt->in : pkt->out);



	nf_log_packet(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,

	nf_log_trace(net, pkt->xt.family, pkt->ops->hooknum, pkt->skb, pkt->in,

		     pkt->out, &trace_loginfo, "TRACE: %s:%s:%s:%u ",

		     chain->table->name, chain->name, comments[type],

		     rulenum);

CRA Git | Maintained and supported by SUSTech CRA and CCSE