[NETFILTER]: Extend netfilter logging API

This patch is in preparation to nfnetlink_log:
- loggers now have to register struct nf_logger instead of nf_logfn
- nf_log_unregister() replaced by nf_log_unregister_pf() and
  nf_log_unregister_logger()
- add comment to ip[6]t_LOG.h to assure nobody redefines flags
- add /proc/net/netfilter/nf_log to tell user which logger is currently
  registered for which address family
- if user has configured logging, but no logging backend (logger) is
  available, always spit a message to syslog, not just the first time.
- split ip[6]t_LOG.c into two parts:
  Backend: Always try to register as logger for the respective address family
  Frontend: Always log via nf_log_packet() API
- modify all users of nf_log_packet() to accomodate additional argument

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

5 files changed, 90 insertions, 64 deletions

diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 3f90cb9979ac..838d1d69b36e 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -217,7 +217,7 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
         icmph = skb_header_pointer(skb, skb->nh.iph->ihl*4, sizeof(_ih), &_ih);
         if (icmph == NULL) {
                 if (LOG_INVALID(IPPROTO_ICMP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL,
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                       "ip_ct_icmp: short packet ");
                 return -NF_ACCEPT;
         }
@@ -231,13 +231,13 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
                 if (!(u16)csum_fold(skb->csum)) 
                         break;
                 if (LOG_INVALID(IPPROTO_ICMP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                       "ip_ct_icmp: bad HW ICMP checksum ");
                 return -NF_ACCEPT;
         case CHECKSUM_NONE:
                 if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0))) {
                         if (LOG_INVALID(IPPROTO_ICMP))
-                                nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                                nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                               "ip_ct_icmp: bad ICMP checksum ");
                         return -NF_ACCEPT;
                 }
@@ -254,7 +254,7 @@ checksum_skipped:
          */
         if (icmph->type > NR_ICMP_TYPES) {
                 if (LOG_INVALID(IPPROTO_ICMP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL,
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                       "ip_ct_icmp: invalid ICMP type ");
                 return -NF_ACCEPT;
         }
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index c2bce22d4031..f23ef1f88c46 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -716,7 +716,7 @@ static int tcp_in_window(struct ip_ct_tcp *state,
                 res = 1;
         } else {
                 if (LOG_INVALID(IPPROTO_TCP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL,
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                         "ip_ct_tcp: %s ",
                         before(seq, sender->td_maxend + 1) ?
                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
@@ -815,7 +815,7 @@ static int tcp_error(struct sk_buff *skb,
                                 sizeof(_tcph), &_tcph);
         if (th == NULL) {
                 if (LOG_INVALID(IPPROTO_TCP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                 "ip_ct_tcp: short packet ");
                 return -NF_ACCEPT;
         }
@@ -823,7 +823,7 @@ static int tcp_error(struct sk_buff *skb,
         /* Not whole TCP header or malformed packet */
         if (th->doff*4 < sizeof(struct tcphdr) || tcplen < th->doff*4) {
                 if (LOG_INVALID(IPPROTO_TCP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                 "ip_ct_tcp: truncated/malformed packet ");
                 return -NF_ACCEPT;
         }
@@ -840,7 +840,7 @@ static int tcp_error(struct sk_buff *skb,
                                  skb->ip_summed == CHECKSUM_HW ? skb->csum
                                  : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
                 if (LOG_INVALID(IPPROTO_TCP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_tcp: bad TCP checksum ");
                 return -NF_ACCEPT;
         }
@@ -849,7 +849,7 @@ static int tcp_error(struct sk_buff *skb,
         tcpflags = (((u_int8_t *)th)[13] & ~(TH_ECE|TH_CWR));
         if (!tcp_valid_flags[tcpflags]) {
                 if (LOG_INVALID(IPPROTO_TCP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_tcp: invalid TCP flag combination ");
                 return -NF_ACCEPT;
         }
@@ -897,8 +897,9 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                          */
                         write_unlock_bh(&tcp_lock);
                         if (LOG_INVALID(IPPROTO_TCP))
-                                nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
-                                          "ip_ct_tcp: killing out of sync session ");
+                                nf_log_packet(PF_INET, 0, skb, NULL, NULL,
+                                              NULL, "ip_ct_tcp: "
+                                              "killing out of sync session ");
                         if (del_timer(&conntrack->timeout))
                                 conntrack->timeout.function((unsigned long)
                                                             conntrack);
@@ -912,7 +913,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                 
                 write_unlock_bh(&tcp_lock);
                 if (LOG_INVALID(IPPROTO_TCP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_tcp: invalid packet ignored ");
                 return NF_ACCEPT;
         case TCP_CONNTRACK_MAX:
@@ -922,7 +923,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                        old_state);
                 write_unlock_bh(&tcp_lock);
                 if (LOG_INVALID(IPPROTO_TCP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_tcp: invalid state ");
                 return -NF_ACCEPT;
         case TCP_CONNTRACK_SYN_SENT:
@@ -943,7 +944,7 @@ static int tcp_packet(struct ip_conntrack *conntrack,
                         write_unlock_bh(&tcp_lock);
                         if (LOG_INVALID(IPPROTO_TCP))
                                 nf_log_packet(PF_INET, 0, skb, NULL, NULL,
-                                              "ip_ct_tcp: invalid SYN");
+                                              NULL, "ip_ct_tcp: invalid SYN");
                         return -NF_ACCEPT;
                 }
         case TCP_CONNTRACK_CLOSE:
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_udp.c b/net/ipv4/netfilter/ip_conntrack_proto_udp.c
index 14130169cbfd..f2dcac7c7660 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_udp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_udp.c
@@ -98,7 +98,7 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
         hdr = skb_header_pointer(skb, iph->ihl*4, sizeof(_hdr), &_hdr);
         if (hdr == NULL) {
                 if (LOG_INVALID(IPPROTO_UDP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_udp: short packet ");
                 return -NF_ACCEPT;
         }
@@ -106,7 +106,7 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
         /* Truncated/malformed packets */
         if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) {
                 if (LOG_INVALID(IPPROTO_UDP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_udp: truncated/malformed packet ");
                 return -NF_ACCEPT;
         }
@@ -126,7 +126,7 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
                                  skb->ip_summed == CHECKSUM_HW ? skb->csum
                                  : skb_checksum(skb, iph->ihl*4, udplen, 0))) {
                 if (LOG_INVALID(IPPROTO_UDP))
-                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, 
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_udp: bad UDP checksum ");
                 return -NF_ACCEPT;
         }
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index ef08733d26da..92ed050fac69 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -27,10 +27,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 MODULE_DESCRIPTION("iptables syslog logging module");
 
-static unsigned int nflog = 1;
-module_param(nflog, int, 0400);
-MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
- 
 #if 0
 #define DEBUGP printk
 #else
@@ -41,11 +37,17 @@ MODULE_PARM_DESC(nflog, "register as internal netfilter logging module");
 static DEFINE_SPINLOCK(log_lock);
 
 /* One level of recursion won't kill us */
-static void dump_packet(const struct ipt_log_info *info,
+static void dump_packet(const struct nf_loginfo *info,
                         const struct sk_buff *skb,
                         unsigned int iphoff)
 {
         struct iphdr _iph, *ih;
+        unsigned int logflags;
+
+        if (info->type == NF_LOG_TYPE_LOG)
+                logflags = info->u.log.logflags;
+        else
+                logflags = NF_LOG_MASK;
 
         ih = skb_header_pointer(skb, iphoff, sizeof(_iph), &_iph);
         if (ih == NULL) {
@@ -76,7 +78,7 @@ static void dump_packet(const struct ipt_log_info *info,
         if (ntohs(ih->frag_off) & IP_OFFSET)
                 printk("FRAG:%u ", ntohs(ih->frag_off) & IP_OFFSET);
 
-        if ((info->logflags & IPT_LOG_IPOPT)
+        if ((logflags & IPT_LOG_IPOPT)
             && ih->ihl * 4 > sizeof(struct iphdr)) {
                 unsigned char _opt[4 * 15 - sizeof(struct iphdr)], *op;
                 unsigned int i, optsize;
@@ -119,7 +121,7 @@ static void dump_packet(const struct ipt_log_info *info,
                 printk("SPT=%u DPT=%u ",
                        ntohs(th->source), ntohs(th->dest));
                 /* Max length: 30 "SEQ=4294967295 ACK=4294967295 " */
-                if (info->logflags & IPT_LOG_TCPSEQ)
+                if (logflags & IPT_LOG_TCPSEQ)
                         printk("SEQ=%u ACK=%u ",
                                ntohl(th->seq), ntohl(th->ack_seq));
                 /* Max length: 13 "WINDOW=65535 " */
@@ -146,7 +148,7 @@ static void dump_packet(const struct ipt_log_info *info,
                 /* Max length: 11 "URGP=65535 " */
                 printk("URGP=%u ", ntohs(th->urg_ptr));
 
-                if ((info->logflags & IPT_LOG_TCPOPT)
+                if ((logflags & IPT_LOG_TCPOPT)
                     && th->doff * 4 > sizeof(struct tcphdr)) {
                         unsigned char _opt[4 * 15 - sizeof(struct tcphdr)];
                         unsigned char *op;
@@ -328,7 +330,7 @@ static void dump_packet(const struct ipt_log_info *info,
         }
 
         /* Max length: 15 "UID=4294967295 " */
-        if ((info->logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
+        if ((logflags & IPT_LOG_UID) && !iphoff && skb->sk) {
                 read_lock_bh(&skb->sk->sk_callback_lock);
                 if (skb->sk->sk_socket && skb->sk->sk_socket->file)
                         printk("UID=%u ", skb->sk->sk_socket->file->f_uid);
@@ -349,19 +351,31 @@ static void dump_packet(const struct ipt_log_info *info,
         /* maxlen = 230+   91  + 230 + 252 = 803 */
 }
 
+struct nf_loginfo default_loginfo = {
+        .type   = NF_LOG_TYPE_LOG,
+        .u = {
+                .log = {
+                        .level    = 0,
+                        .logflags = NF_LOG_MASK,
+                },
+        },
+};
+
 static void
-ipt_log_packet(unsigned int hooknum,
+ipt_log_packet(unsigned int pf,
+               unsigned int hooknum,
                const struct sk_buff *skb,
                const struct net_device *in,
                const struct net_device *out,
-               const struct ipt_log_info *loginfo,
-               const char *level_string,
+               const struct nf_loginfo *loginfo,
                const char *prefix)
 {
+        if (!loginfo)
+                loginfo = &default_loginfo;
+
         spin_lock_bh(&log_lock);
-        printk(level_string);
-        printk("%sIN=%s OUT=%s ",
-               prefix == NULL ? loginfo->prefix : prefix,
+        printk("<%d>%sIN=%s OUT=%s ", loginfo->u.log.level,
+               prefix,
                in ? in->name : "",
                out ? out->name : "");
 #ifdef CONFIG_BRIDGE_NETFILTER
@@ -405,28 +419,15 @@ ipt_log_target(struct sk_buff **pskb,
                void *userinfo)
 {
         const struct ipt_log_info *loginfo = targinfo;
-        char level_string[4] = "< >";
+        struct nf_loginfo li;
 
-        level_string[1] = '0' + (loginfo->level % 8);
-        ipt_log_packet(hooknum, *pskb, in, out, loginfo, level_string, NULL);
+        li.type = NF_LOG_TYPE_LOG;
+        li.u.log.level = loginfo->level;
+        li.u.log.logflags = loginfo->logflags;
 
-        return IPT_CONTINUE;
-}
+        nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li, loginfo->prefix);
 
-static void
-ipt_logfn(unsigned int hooknum,
-          const struct sk_buff *skb,
-          const struct net_device *in,
-          const struct net_device *out,
-          const char *prefix)
-{
-        struct ipt_log_info loginfo = { 
-                .level = 0, 
-                .logflags = IPT_LOG_MASK, 
-                .prefix = "" 
-        };
-
-        ipt_log_packet(hooknum, skb, in, out, &loginfo, KERN_WARNING, prefix);
+        return IPT_CONTINUE;
 }
 
 static int ipt_log_checkentry(const char *tablename,
@@ -464,20 +465,29 @@ static struct ipt_target ipt_log_reg = {
         .me             = THIS_MODULE,
 };
 
+static struct nf_logger ipt_log_logger ={
+        .name           = "ipt_LOG",
+        .logfn          = &ipt_log_packet,
+        .me             = THIS_MODULE,
+};
+
 static int __init init(void)
 {
         if (ipt_register_target(&ipt_log_reg))
                 return -EINVAL;
-        if (nflog)
-                nf_log_register(PF_INET, &ipt_logfn);
+        if (nf_log_register(PF_INET, &ipt_log_logger) < 0) {
+                printk(KERN_WARNING "ipt_LOG: not logging via system console "
+                       "since somebody else already registered for PF_INET\n");
+                /* we cannot make module load fail here, since otherwise
+                 * iptables userspace would abort */
+        }
         
         return 0;
 }
 
 static void __exit fini(void)
 {
-        if (nflog)
-                nf_log_unregister(PF_INET, &ipt_logfn);
+        nf_log_unregister_logger(&ipt_log_logger);
         ipt_unregister_target(&ipt_log_reg);
 }
 
diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
index 4ea8371ab270..b86f06ec9762 100644
--- a/net/ipv4/netfilter/ipt_ULOG.c
+++ b/net/ipv4/netfilter/ipt_ULOG.c
@@ -304,18 +304,27 @@ static unsigned int ipt_ulog_target(struct sk_buff **pskb,
         return IPT_CONTINUE;
 }
  
-static void ipt_logfn(unsigned int hooknum,
+static void ipt_logfn(unsigned int pf,
+                      unsigned int hooknum,
                       const struct sk_buff *skb,
                       const struct net_device *in,
                       const struct net_device *out,
+                      const struct nf_loginfo *li,
                       const char *prefix)
 {
-        struct ipt_ulog_info loginfo = { 
-                .nl_group = ULOG_DEFAULT_NLGROUP,
-                .copy_range = 0,
-                .qthreshold = ULOG_DEFAULT_QTHRESHOLD,
-                .prefix = ""
-        };
+        struct ipt_ulog_info loginfo;
+
+        if (!li || li->type != NF_LOG_TYPE_ULOG) {
+                loginfo.nl_group = ULOG_DEFAULT_NLGROUP;
+                loginfo.copy_range = 0;
+                loginfo.qthreshold = ULOG_DEFAULT_QTHRESHOLD;
+                loginfo.prefix[0] = '\0';
+        } else {
+                loginfo.nl_group = li->u.ulog.group;
+                loginfo.copy_range = li->u.ulog.copy_len;
+                loginfo.qthreshold = li->u.ulog.qthreshold;
+                strlcpy(loginfo.prefix, prefix, sizeof(loginfo.prefix));
+        }
 
         ipt_ulog_packet(hooknum, skb, in, out, &loginfo, prefix);
 }
@@ -355,6 +364,12 @@ static struct ipt_target ipt_ulog_reg = {
         .me             = THIS_MODULE,
 };
 
+static struct nf_logger ipt_ulog_logger = {
+        .name           = "ipt_ULOG",
+        .logfn          = &ipt_logfn,
+        .me             = THIS_MODULE,
+};
+
 static int __init init(void)
 {
         int i;
@@ -382,7 +397,7 @@ static int __init init(void)
                 return -EINVAL;
         }
         if (nflog)
-                nf_log_register(PF_INET, &ipt_logfn);
+                nf_log_register(PF_INET, &ipt_ulog_logger);
         
         return 0;
 }
@@ -395,7 +410,7 @@ static void __exit fini(void)
         DEBUGP("ipt_ULOG: cleanup_module\n");
 
         if (nflog)
-                nf_log_unregister(PF_INET, &ipt_logfn);
+                nf_log_unregister_logger(&ipt_ulog_logger);
         ipt_unregister_target(&ipt_ulog_reg);
         sock_release(nflognl->sk_socket);