diff --git a/extensions/libxt_LOGMARK.c b/extensions/libxt_LOGMARK.c index b074c59..98379b1 100644 --- a/extensions/libxt_LOGMARK.c +++ b/extensions/libxt_LOGMARK.c @@ -6,19 +6,13 @@ #include "xt_LOGMARK.h" enum { - F_LEVEL = 1 << 0, - F_PREFIX = 1 << 1, - F_NFMARK = 1 << 2, - F_CTMARK = 1 << 3, - F_SECMARK = 1 << 4, + F_LEVEL = 1 << 0, + F_PREFIX = 1 << 1, }; static const struct option logmark_tg_opts[] = { {.name = "log-level", .has_arg = true, .val = 'l'}, {.name = "log-prefix", .has_arg = true, .val = 'p'}, - {.name = "log-nfmark", .has_arg = false, .val = 'n'}, - {.name = "log-ctmark", .has_arg = false, .val = 'c'}, - {.name = "log-secmark", .has_arg = false, .val = 's'}, {}, }; @@ -28,9 +22,6 @@ static void logmark_tg_help(void) "LOGMARK target options:\n" " --log-level level Level of logging (numeric, 0-8)\n" " --log-prefix prefix Prefix log messages with this string\n" -" --log-nfmark Log the packet mark\n" -" --log-ctmark Log the connection mark\n" -" --log-secmark Log the security mark of the packet\n" ); } @@ -72,27 +63,6 @@ logmark_tg_parse(int c, char **argv, int invert, unsigned int *flags, strncpy(info->prefix, optarg, sizeof(info->prefix)); *flags |= F_PREFIX; return true; - - case 'n': /* --log-nfmark */ - param_act(P_ONLY_ONCE, "LOGMARK", "--log-nfmark", *flags & F_NFMARK); - param_act(P_NO_INVERT, "LOGMARK", "--log-nfmark", invert); - info->flags |= XT_LOGMARK_NFMARK; - *flags |= F_NFMARK; - return true; - - case 'c': /* --log-ctmark */ - param_act(P_ONLY_ONCE, "LOGMARK", "--log-ctmark", *flags & F_CTMARK); - param_act(P_NO_INVERT, "LOGMARK", "--log-ctmark", invert); - info->flags |= XT_LOGMARK_CTMARK; - *flags |= F_CTMARK; - return true; - - case 's': /* --log-secmark */ - param_act(P_ONLY_ONCE, "LOGMARK", "--log-secmark", *flags & F_SECMARK); - param_act(P_NO_INVERT, "LOGMARK", "--log-secmark", invert); - info->flags |= XT_LOGMARK_SECMARK; - *flags |= F_SECMARK; - return true; } return false; } @@ -103,14 +73,7 @@ logmark_tg_print(const void *ip, const struct xt_entry_target *target, { const struct xt_logmark_tginfo *info = (void *)target->data; - printf("LOGMARK level %u prefix \"%s\"", info->level, info->prefix); - if (info->flags & XT_LOGMARK_NFMARK) - printf(" nfmark"); - if (info->flags & XT_LOGMARK_CTMARK) - printf(" ctmark"); - if (info->flags & XT_LOGMARK_SECMARK) - printf(" secmark"); - printf("; "); + printf("LOGMARK level %u prefix \"%s\" ", info->level, info->prefix); } static void @@ -122,12 +85,6 @@ logmark_tg_save(const void *ip, const struct xt_entry_target *target) printf("--log-level %u ", info->level); if (*info->prefix != '\0') printf("--log-prefix \"%s\" ", info->prefix); - if (info->flags & XT_LOGMARK_NFMARK) - printf("--log-nfmark "); - if (info->flags & XT_LOGMARK_CTMARK) - printf("--log-ctmark "); - if (info->flags & XT_LOGMARK_SECMARK) - printf("--log-secmark "); } static struct xtables_target logmark_tg_reg = { diff --git a/extensions/xt_LOGMARK.c b/extensions/xt_LOGMARK.c index d6c05c7..3b12747 100644 --- a/extensions/xt_LOGMARK.c +++ b/extensions/xt_LOGMARK.c @@ -22,25 +22,44 @@ logmark_tg(struct sk_buff *skb, const struct net_device *in, const struct xt_target *target, const void *targinfo) { const struct xt_logmark_tginfo *info = targinfo; + const struct nf_conn *ct; + enum ip_conntrack_info ctinfo; - printk("<%u>%.*s", info->level, sizeof(info->prefix), info->prefix); + printk("<%u>%.*s""nfmark=0x%x secmark=0x%x classify=0x%x", + info->level, (unsigned int)sizeof(info->prefix), info->prefix, + skb->mark, skb->secmark, skb->priority); - if (info->flags & XT_LOGMARK_NFMARK) - printk(" nfmark=0x%x", skb->mark); - if (info->flags & XT_LOGMARK_CTMARK) { - const struct nf_conn *ct; - enum ip_conntrack_info ctinfo; + ct = nf_ct_get(skb, &ctinfo); + if (ct == NULL) { + printk(" ct=NULL ctmark=NULL ctstate=INVALID ctstatus=NONE"); + } else if (ct == &nf_conntrack_untracked) { + printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE"); + } else { + printk(" ct=0x%p ctmark=0x%x ctstate=", ct, ct->mark); + ctinfo %= IP_CT_IS_REPLY; + if (ctinfo == IP_CT_NEW) + printk("NEW"); + else if (ctinfo == IP_CT_ESTABLISHED) + printk("ESTABLISHED"); + else if (ctinfo == IP_CT_RELATED) + printk("RELATED"); + if (test_bit(IPS_SRC_NAT_BIT, &ct->status)) + printk(",SNAT"); + if (test_bit(IPS_DST_NAT_BIT, &ct->status)) + printk(",DNAT"); - ct = nf_ct_get(skb, &ctinfo); - if (ct == NULL) - printk(" ctmark=X"); - else - printk(" ctmark=0x%x", ct->mark); + printk(" ctstatus="); + if (ct->status & IPS_EXPECTED) + printk("EXPECTED"); + if (ct->status & IPS_SEEN_REPLY) + printk(",SEEN_REPLY"); + if (ct->status & IPS_ASSURED) + printk(",ASSURED"); + if (ct->status & IPS_CONFIRMED) + printk(",CONFIRMED"); } - if (info->flags & XT_LOGMARK_SECMARK) - printk(" secmark=0x%x", skb->secmark); - printk("\n"); + printk("\n"); return XT_CONTINUE; } diff --git a/extensions/xt_LOGMARK.h b/extensions/xt_LOGMARK.h index 0f1ed52..46ccfd0 100644 --- a/extensions/xt_LOGMARK.h +++ b/extensions/xt_LOGMARK.h @@ -1,16 +1,9 @@ #ifndef _LINUX_NETFILTER_XT_LOGMARK_TARGET_H #define _LINUX_NETFILTER_XT_LOGMARK_TARGET_H 1 -enum { - XT_LOGMARK_NFMARK = 1 << 0, - XT_LOGMARK_CTMARK = 1 << 1, - XT_LOGMARK_SECMARK = 1 << 2, -}; - struct xt_logmark_tginfo { char prefix[14]; u_int8_t level; - u_int8_t flags; }; #endif /* _LINUX_NETFILTER_XT_LOGMARK_TARGET_H */