xt_LOGMARK: dump CLASSIFY mark, ctstate and ctstatus

Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>

diff --git a/extensions/libxt_LOGMARK.c b/extensions/libxt_LOGMARK.c
index b074c5962315120053dade1ee39c926fd2ea6163..98379b178704208ca6356470b64e4ba0fe0e50b0 100644 (file)
--- a/extensions/libxt_LOGMARK.c
+++ b/extensions/libxt_LOGMARK.c
@@ -6,19 +6,13 @@
 #include "xt_LOGMARK.h"
 
 enum {
-       F_LEVEL   = 1 << 0,
-       F_PREFIX  = 1 << 1,
-       F_NFMARK  = 1 << 2,
-       F_CTMARK  = 1 << 3,
-       F_SECMARK = 1 << 4,
+       F_LEVEL  = 1 << 0,
+       F_PREFIX = 1 << 1,
 };
 
 static const struct option logmark_tg_opts[] = {
        {.name = "log-level",   .has_arg = true,  .val = 'l'},
        {.name = "log-prefix",  .has_arg = true,  .val = 'p'},
-       {.name = "log-nfmark",  .has_arg = false, .val = 'n'},
-       {.name = "log-ctmark",  .has_arg = false, .val = 'c'},
-       {.name = "log-secmark", .has_arg = false, .val = 's'},
        {},
 };
 
@@ -28,9 +22,6 @@ static void logmark_tg_help(void)
 "LOGMARK target options:\n"
 "  --log-level level      Level of logging (numeric, 0-8)\n"
 "  --log-prefix prefix    Prefix log messages with this string\n"
-"  --log-nfmark           Log the packet mark\n"
-"  --log-ctmark           Log the connection mark\n"
-"  --log-secmark          Log the security mark of the packet\n"
 );
 }
 
@@ -72,27 +63,6 @@ logmark_tg_parse(int c, char **argv, int invert, unsigned int *flags,
                strncpy(info->prefix, optarg, sizeof(info->prefix));
                *flags |= F_PREFIX;
                return true;
-
-       case 'n': /* --log-nfmark */
-               param_act(P_ONLY_ONCE, "LOGMARK", "--log-nfmark", *flags & F_NFMARK);
-               param_act(P_NO_INVERT, "LOGMARK", "--log-nfmark", invert);
-               info->flags |= XT_LOGMARK_NFMARK;
-               *flags |= F_NFMARK;
-               return true;
-
-       case 'c': /* --log-ctmark */
-               param_act(P_ONLY_ONCE, "LOGMARK", "--log-ctmark", *flags & F_CTMARK);
-               param_act(P_NO_INVERT, "LOGMARK", "--log-ctmark", invert);
-               info->flags |= XT_LOGMARK_CTMARK;
-               *flags |= F_CTMARK;
-               return true;
-
-       case 's': /* --log-secmark */
-               param_act(P_ONLY_ONCE, "LOGMARK", "--log-secmark", *flags & F_SECMARK);
-               param_act(P_NO_INVERT, "LOGMARK", "--log-secmark", invert);
-               info->flags |= XT_LOGMARK_SECMARK;
-               *flags |= F_SECMARK;
-               return true;
        }
        return false;
 }
@@ -103,14 +73,7 @@ logmark_tg_print(const void *ip, const struct xt_entry_target *target,
 {
        const struct xt_logmark_tginfo *info = (void *)target->data;
 
-       printf("LOGMARK level %u prefix \"%s\"", info->level, info->prefix);
-       if (info->flags & XT_LOGMARK_NFMARK)
-               printf(" nfmark");
-       if (info->flags & XT_LOGMARK_CTMARK)
-               printf(" ctmark");
-       if (info->flags & XT_LOGMARK_SECMARK)
-               printf(" secmark");
-       printf("; ");
+       printf("LOGMARK level %u prefix \"%s\" ", info->level, info->prefix);
 }
 
 static void
@@ -122,12 +85,6 @@ logmark_tg_save(const void *ip, const struct xt_entry_target *target)
                printf("--log-level %u ", info->level);
        if (*info->prefix != '\0')
                printf("--log-prefix \"%s\" ", info->prefix);
-       if (info->flags & XT_LOGMARK_NFMARK)
-               printf("--log-nfmark ");
-       if (info->flags & XT_LOGMARK_CTMARK)
-               printf("--log-ctmark ");
-       if (info->flags & XT_LOGMARK_SECMARK)
-               printf("--log-secmark ");
 }
 
 static struct xtables_target logmark_tg_reg = {

diff --git a/extensions/xt_LOGMARK.c b/extensions/xt_LOGMARK.c
index d6c05c7dfc6699cfe5ec48379dbdc37a1dd4ead0..3b12747c8c49fd85b2879635ef3b17542409eb97 100644 (file)
--- a/extensions/xt_LOGMARK.c
+++ b/extensions/xt_LOGMARK.c
@@ -22,25 +22,44 @@ logmark_tg(struct sk_buff *skb, const struct net_device *in,
            const struct xt_target *target, const void *targinfo)
 {
        const struct xt_logmark_tginfo *info = targinfo;
+       const struct nf_conn *ct;
+       enum ip_conntrack_info ctinfo;
 
-       printk("<%u>%.*s", info->level, sizeof(info->prefix), info->prefix);
+       printk("<%u>%.*s""nfmark=0x%x secmark=0x%x classify=0x%x",
+              info->level, (unsigned int)sizeof(info->prefix), info->prefix,
+              skb->mark, skb->secmark, skb->priority);
 
-       if (info->flags & XT_LOGMARK_NFMARK)
-               printk(" nfmark=0x%x", skb->mark);
-       if (info->flags & XT_LOGMARK_CTMARK) {
-               const struct nf_conn *ct;
-               enum ip_conntrack_info ctinfo;
+       ct = nf_ct_get(skb, &ctinfo);
+       if (ct == NULL) {
+               printk(" ct=NULL ctmark=NULL ctstate=INVALID ctstatus=NONE");
+       } else if (ct == &nf_conntrack_untracked) {
+               printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE");
+       } else {
+               printk(" ct=0x%p ctmark=0x%x ctstate=", ct, ct->mark);
+               ctinfo %= IP_CT_IS_REPLY;
+               if (ctinfo == IP_CT_NEW)
+                       printk("NEW");
+               else if (ctinfo == IP_CT_ESTABLISHED)
+                       printk("ESTABLISHED");
+               else if (ctinfo == IP_CT_RELATED)
+                       printk("RELATED");
+               if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
+                       printk(",SNAT");
+               if (test_bit(IPS_DST_NAT_BIT, &ct->status))
+                       printk(",DNAT");
 
-               ct = nf_ct_get(skb, &ctinfo);
-               if (ct == NULL)
-                       printk(" ctmark=X");
-               else
-                       printk(" ctmark=0x%x", ct->mark);
+               printk(" ctstatus=");
+               if (ct->status & IPS_EXPECTED)
+                       printk("EXPECTED");
+               if (ct->status & IPS_SEEN_REPLY)
+                       printk(",SEEN_REPLY");
+               if (ct->status & IPS_ASSURED)
+                       printk(",ASSURED");
+               if (ct->status & IPS_CONFIRMED)
+                       printk(",CONFIRMED");
        }
-       if (info->flags & XT_LOGMARK_SECMARK)
-               printk(" secmark=0x%x", skb->secmark);
-       printk("\n");
 
+       printk("\n");
        return XT_CONTINUE;
 }
 

diff --git a/extensions/xt_LOGMARK.h b/extensions/xt_LOGMARK.h
index 0f1ed5232c919237a7061002da86385468dc267e..46ccfd05b08cfadd1468fdd75287d3cce105b281 100644 (file)
--- a/extensions/xt_LOGMARK.h
+++ b/extensions/xt_LOGMARK.h
@@ -1,16 +1,9 @@
 #ifndef _LINUX_NETFILTER_XT_LOGMARK_TARGET_H
 #define _LINUX_NETFILTER_XT_LOGMARK_TARGET_H 1
 
-enum {
-       XT_LOGMARK_NFMARK  = 1 << 0,
-       XT_LOGMARK_CTMARK  = 1 << 1,
-       XT_LOGMARK_SECMARK = 1 << 2,
-};
-
 struct xt_logmark_tginfo {
        char prefix[14];
        u_int8_t level;
-       u_int8_t flags;
 };
 
 #endif /* _LINUX_NETFILTER_XT_LOGMARK_TARGET_H */