Eric Leblond [Mon, 20 Oct 2008 16:42:12 +0000 (18:42 +0200)]
Document group 0 usage and suppress address_family
Document the fact that group 0 is used by system logging and
update stack and plugin definition to match the suppression
of the address_family variable.
Eric Leblond [Tue, 21 Oct 2008 07:35:20 +0000 (09:35 +0200)]
Get rid of addressfamily variable in NFLOG input plugin
The addressfamily configuration variable for NFLOG is used as param
for nflog_bind_pf. This function is used to claim the fetching of
kernel message sent via nf_log_packet() function.
As all kernel messages are sent to the group 0, it is useless to
call nflog_bind_pf when nflog group of the input plugin is not 0.
Furthermore, as only one plugin can be bound to nflog group 0, it
is mandatory to call nflog_bind_pf for all pf family when the group
is 0.
To sum up, this patch suppress the adressfamily parameter (which
simplify the configuration file) and call nflog_bind_pf for all
pf family when the nflog group of the instance is 0.
Eric Leblond [Mon, 20 Oct 2008 17:05:15 +0000 (19:05 +0200)]
Modify usage of nflog_bind_pf function.
The nflog_bind_pf function was called for each NFLOG instance. This patch
modifies the behaviour to have it call if and only if the nfgroup is set
to 0. As the kernel uses only the 0 group to output subsystem messages,
this change clarify the situation.
This patch cleans up the current key assignation by introducing a
set of functions ukey_* to set the key value as Eric Leblond and
we discussed during the latest Netfilter Workshop. This patch is
based on an idea from Holger Eitzenberger.
libdbi implements a database-independent abstraction layer in C, similar to
the DBI/DBD layer in Perl.
This module brings support for all database types supported by libdbi.
Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Eric Leblond <eric@inl.fr>
When len is 0 (for ex. when the input mac is NULL), parse_mac2str tries
to calloc a 0-bytes bloc, which leads to a conditional jump based
on uninitialized value (spotted by valgrind).
Signed-off-by: Pierre Chifflier <chifflier@inl.fr> Signed-off-by: Eric Leblond <eric@inl.fr>
Eric Leblond [Thu, 11 Sep 2008 22:18:22 +0000 (00:18 +0200)]
config: remove obsolete global variables
'rmem' and 'bufsize' global variables are unherited from ulogd1
and are not used anymore. This patch suppresses them from the
example configuration file.
Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Eric Leblond [Fri, 1 Aug 2008 08:32:13 +0000 (10:32 +0200)]
compilation: set -Wno-ununused-parameter in CFLAGS
This patch adds the "-Wno-unused-parameter" option to CFLAGS. This
suppress gcc warning that can not be fixed due to the usage of generic system
like callback where function definition has to be standardized.
Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Eric Leblond [Tue, 29 Jul 2008 10:08:19 +0000 (12:08 +0200)]
MAC2STR: add support for the new RAW MAC keys
This patch modifies MAC2STR to use the new MAC keys that gives us more
accurate information to parse the link layer header. This patch also
does some probing based on the header and field size in the case of
ULOG (since we do not have enough information to perform accurate
parsing).
Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Eric Leblond [Tue, 29 Jul 2008 09:49:24 +0000 (11:49 +0200)]
NFLOG: get full link layer header (requires >= 2.6.27)
This patch modifies the key structure of NFLOG. It solves the conflict
between ULOG and NFLOG by ensuring that keys have the same meaning:
* raw.mac is the full hardware header
* raw.mac.saddr is the source hardware address
Following Patrick suggestion, it adds a new key "raw.type" which is
used to store the type of hardware.
Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Eric Leblond [Wed, 18 Jun 2008 15:39:37 +0000 (17:39 +0200)]
Fix NFCT/NFLOG plugin compilation when libraries use non-standard prefix.
Fixes compilation of NFLOG and NFCT plugin when libnetfilter libraries
are installed under a non standard prefix. Include path and libs path
for libnetfilter_conntrack and libnetfilter_log were not correctly set even
if pkg-config found them.
Pierre Chifflier [Thu, 12 Jun 2008 09:45:28 +0000 (11:45 +0200)]
Store MAC in SQL databases only once
This patch modifies the SQL schema for MySQL and PostgreSQL to store
the mac address only once (instead of duplicating the mac address for
each packet). This is done by using a shared reference to the entry
containing the tuple (mac_address,mac_protocol).
Signed-off-by: Pierre Chifflier <chifflier@inl.fr>
Eric Leblond [Thu, 12 Jun 2008 09:17:03 +0000 (11:17 +0200)]
Cleanup: fix error messages and indentation
This patch fixes some messages in the NFCT and NFLOG input
plugin (end of line before quote). It also fixes indenting by
suppressing some spaces on empty line and replacing spaces by tab.
Eric Leblond [Thu, 12 Jun 2008 09:15:14 +0000 (11:15 +0200)]
Use ULOGD_IRET_* as return for all interpreters
This patch modifies plugins to use the already defined but not used
define. This also fixes some weird behaviours in error treatment (like
not stopping after OOM).
Eric Leblond [Thu, 12 Jun 2008 09:10:58 +0000 (11:10 +0200)]
Fix hexadecimal parsing in config file
The config file parsing was not able to parse integer given in hex notation.
This patch modify the parsing of configfile to be able to use different
integers notation.
Eric Leblond [Thu, 12 Jun 2008 09:08:31 +0000 (11:08 +0200)]
New MARK-based filter
This module filters message by using the mark to decide wether or not a
packet or a flow has to be logged. It takes a mark and a mask option. It
demonstrates the usage of ULOGD_IRET_STOP which can be used to abort
iteration through the stack.
Eric Leblond [Thu, 12 Jun 2008 09:06:28 +0000 (11:06 +0200)]
Fix the propagation through the stack
When a plugin returns ULOGD_IRET_STOP, the propagation should
stop. This was not the case as break was used to do so but it was called
inside a switch and thus apply to the switch instruction and not to
the llist iteration.
regit [Wed, 4 Jun 2008 13:19:05 +0000 (15:19 +0200)]
Fix crash when using NFCT with hash_enable=0.
This patch fixes NFCT when hash_enable is 0. Limitation of treatment to
NFCT_DESTROY message type causes usage of the hashtable function and
hence a crash because it is not initiated.
Signed-off-by: regit <regit@ghlodit.inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net>
Eric Leblond [Mon, 2 Jun 2008 00:02:09 +0000 (02:02 +0200)]
Source and destination addresses were put in ptr field of the target structure
instead of being put in the new type ui128. The result was an improper value
of the IPv6 source add destination addresses.
This patch improves the overrun handling. The NFLOG plugin duplicates the
netlink buffer size if the size does not goes after the upper boundary.
This patch also introduces two new clauses, the netlink_socket_buffer_size
and netlink_socket_buffer_maxsize that set the size of the netlink socket
buffer.
cleanup for key builder and fix IPv6 support and introduce 128-bits type
This patch cleans up the key building by breaking lines at 80 columns and
it fixes the IPv6 support (use of a pointer after free) by introducing a new
128 bit type.
This patch improves the overrun handling. The logic behind this patch
consists of two steps:
1) duplicate the netlink buffer size if the size does not goes after the
upper boundary.
2) scheduling a resynchronization (in two seconds) with the kernel conntrack
table if we hit ENOBUFS. During the resynchronization, the NFCT plugin dumps
the current table and purges the objects that do not exist anymore.
This patch also introduces two new clauses, the netlink_socket_buffer_size
and netlink_socket_buffer_maxsize that set the size of the netlink socket
buffer.
This patch introduces a generic hashtable to store the nf_conntrack objects.
The objects are identified by the original and reply tuples instead of the
conntrack ID which is not dumped in the event message of linux kernel < 2.6.25.
This patch also fixes the NFCT_MSG_* by NFCT_T_* which is the appropriate
message type tag.
This patchset adds support for the "numeric_label" option. For instance, it
can be used to determine if the packet has been dropped, rejected or accepted.
The meaning of label is completely user-defined.
[ULOGD PATCH, RFC] Modify NFLOG to be able to use it with older libnetfilter_log
NFLOG has been modified to support GID display. There is a problem as this
feature is only available in latest subversion of libnetfilter_log. This
patch made this feature optional:
* It detects if system support the nflog_get_gid() function
* Compilation of nflog_get_gid() related code is conditional
[ULOGD PATCH] Fix multiple usage of DB output plugin.
Due to the modifications done to be able to use multiple time the SOURCE
plugin, a single instance of database output plugin could not anymore be
used in separate stack. This patch fixes this by limiting the effect of
the previous modification on SOURCE plugin.
NACCT was IPv4 only and was heavily dependant of the order of NFCT keys.
This patch introduces a explicit list of input keys and obtains IPv6
compliance by using IP2STR output as input for IP address.
This patch is a port to the new libnetfilter_conntrack API of the NFCT
plugin. To be able to send IP addresses to the IP2STR and IP2BIN module
oob.family and oob.protocol keys have been added.
The PRINTFLOW module had its own code for string conversion of IPv6 address.
This patch change the input key of the module to use conversion made by the
IP2STR module.
An error in the type of an argument in the call to inet_ntop was causing IPv6
address to be transformed in a string not really related to the real Ipv6
address.
This patch adds MAC address handling to the postgresql output plugin. This
patch also removes mac_daddr which does not provide any interesting
logging information.
This patch introduces a new plugin MAC2STR which is in charge
of conversion to string of MAC address. It is used by database
output plugin to store MAC related information.
projects / thirdparty / ulogd2.git / log
