xt_LOGMARK: dump CLASSIFY mark, ctstate and ctstatus

Signed-off-by: Jan Engelhardt <jengelh@computergmbh.de>

extensions/libxt_LOGMARK.c

@@ -6,19 +6,13 @@
 #include "xt_LOGMARK.h"
 
 enum {
-	F_LEVEL   = 1 << 0,
+	F_LEVEL  = 1 << 0,
-	F_PREFIX  = 1 << 1,
+	F_PREFIX = 1 << 1,
-	F_NFMARK  = 1 << 2,
-	F_CTMARK  = 1 << 3,
-	F_SECMARK = 1 << 4,
 };
 
 static const struct option logmark_tg_opts[] = {
 	{.name = "log-level",   .has_arg = true,  .val = 'l'},
 	{.name = "log-prefix",  .has_arg = true,  .val = 'p'},
-	{.name = "log-nfmark",  .has_arg = false, .val = 'n'},
-	{.name = "log-ctmark",  .has_arg = false, .val = 'c'},
-	{.name = "log-secmark", .has_arg = false, .val = 's'},
 	{},
 };
 
@@ -28,9 +22,6 @@ static void logmark_tg_help(void)
 "LOGMARK target options:\n"
 "  --log-level level      Level of logging (numeric, 0-8)\n"
 "  --log-prefix prefix    Prefix log messages with this string\n"
-"  --log-nfmark           Log the packet mark\n"
-"  --log-ctmark           Log the connection mark\n"
-"  --log-secmark          Log the security mark of the packet\n"
 );
 }
 
@@ -72,27 +63,6 @@ logmark_tg_parse(int c, char **argv, int invert, unsigned int *flags,
 		strncpy(info->prefix, optarg, sizeof(info->prefix));
 		*flags |= F_PREFIX;
 		return true;
-
-	case 'n': /* --log-nfmark */
-		param_act(P_ONLY_ONCE, "LOGMARK", "--log-nfmark", *flags & F_NFMARK);
-		param_act(P_NO_INVERT, "LOGMARK", "--log-nfmark", invert);
-		info->flags |= XT_LOGMARK_NFMARK;
-		*flags |= F_NFMARK;
-		return true;
-
-	case 'c': /* --log-ctmark */
-		param_act(P_ONLY_ONCE, "LOGMARK", "--log-ctmark", *flags & F_CTMARK);
-		param_act(P_NO_INVERT, "LOGMARK", "--log-ctmark", invert);
-		info->flags |= XT_LOGMARK_CTMARK;
-		*flags |= F_CTMARK;
-		return true;
-
-	case 's': /* --log-secmark */
-		param_act(P_ONLY_ONCE, "LOGMARK", "--log-secmark", *flags & F_SECMARK);
-		param_act(P_NO_INVERT, "LOGMARK", "--log-secmark", invert);
-		info->flags |= XT_LOGMARK_SECMARK;
-		*flags |= F_SECMARK;
-		return true;
 	}
 	return false;
 }
@@ -103,14 +73,7 @@ logmark_tg_print(const void *ip, const struct xt_entry_target *target,
 {
 	const struct xt_logmark_tginfo *info = (void *)target->data;
 
-	printf("LOGMARK level %u prefix \"%s\"", info->level, info->prefix);
+	printf("LOGMARK level %u prefix \"%s\" ", info->level, info->prefix);
-	if (info->flags & XT_LOGMARK_NFMARK)
-		printf(" nfmark");
-	if (info->flags & XT_LOGMARK_CTMARK)
-		printf(" ctmark");
-	if (info->flags & XT_LOGMARK_SECMARK)
-		printf(" secmark");
-	printf("; ");
 }
 
 static void
@@ -122,12 +85,6 @@ logmark_tg_save(const void *ip, const struct xt_entry_target *target)
 		printf("--log-level %u ", info->level);
 	if (*info->prefix != '\0')
 		printf("--log-prefix \"%s\" ", info->prefix);
-	if (info->flags & XT_LOGMARK_NFMARK)
-		printf("--log-nfmark ");
-	if (info->flags & XT_LOGMARK_CTMARK)
-		printf("--log-ctmark ");
-	if (info->flags & XT_LOGMARK_SECMARK)
-		printf("--log-secmark ");
 }
 
 static struct xtables_target logmark_tg_reg = {

extensions/xt_LOGMARK.c

@@ -22,25 +22,44 @@ logmark_tg(struct sk_buff *skb, const struct net_device *in,
            const struct xt_target *target, const void *targinfo)
 {
 	const struct xt_logmark_tginfo *info = targinfo;
+	const struct nf_conn *ct;
+	enum ip_conntrack_info ctinfo;
 
-	printk("<%u>%.*s", info->level, sizeof(info->prefix), info->prefix);
+	printk("<%u>%.*s""nfmark=0x%x secmark=0x%x classify=0x%x",
+	       info->level, (unsigned int)sizeof(info->prefix), info->prefix,
+	       skb->mark, skb->secmark, skb->priority);
 
-	if (info->flags & XT_LOGMARK_NFMARK)
+	ct = nf_ct_get(skb, &ctinfo);
-		printk(" nfmark=0x%x", skb->mark);
+	if (ct == NULL) {
-	if (info->flags & XT_LOGMARK_CTMARK) {
+		printk(" ct=NULL ctmark=NULL ctstate=INVALID ctstatus=NONE");
-		const struct nf_conn *ct;
+	} else if (ct == &nf_conntrack_untracked) {
-		enum ip_conntrack_info ctinfo;
+		printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE");
+	} else {
+		printk(" ct=0x%p ctmark=0x%x ctstate=", ct, ct->mark);
+		ctinfo %= IP_CT_IS_REPLY;
+		if (ctinfo == IP_CT_NEW)
+			printk("NEW");
+		else if (ctinfo == IP_CT_ESTABLISHED)
+			printk("ESTABLISHED");
+		else if (ctinfo == IP_CT_RELATED)
+			printk("RELATED");
+		if (test_bit(IPS_SRC_NAT_BIT, &ct->status))
+			printk(",SNAT");
+		if (test_bit(IPS_DST_NAT_BIT, &ct->status))
+			printk(",DNAT");
 
-		ct = nf_ct_get(skb, &ctinfo);
+		printk(" ctstatus=");
-		if (ct == NULL)
+		if (ct->status & IPS_EXPECTED)
-			printk(" ctmark=X");
+			printk("EXPECTED");
-		else
+		if (ct->status & IPS_SEEN_REPLY)
-			printk(" ctmark=0x%x", ct->mark);
+			printk(",SEEN_REPLY");
+		if (ct->status & IPS_ASSURED)
+			printk(",ASSURED");
+		if (ct->status & IPS_CONFIRMED)
+			printk(",CONFIRMED");
 	}
-	if (info->flags & XT_LOGMARK_SECMARK)
-		printk(" secmark=0x%x", skb->secmark);
-	printk("\n");
 
+	printk("\n");
 	return XT_CONTINUE;
 }
 

extensions/xt_LOGMARK.h

@@ -1,16 +1,9 @@
 #ifndef _LINUX_NETFILTER_XT_LOGMARK_TARGET_H
 #define _LINUX_NETFILTER_XT_LOGMARK_TARGET_H 1
 
-enum {
-	XT_LOGMARK_NFMARK  = 1 << 0,
-	XT_LOGMARK_CTMARK  = 1 << 1,
-	XT_LOGMARK_SECMARK = 1 << 2,
-};
-
 struct xt_logmark_tginfo {
 	char prefix[14];
 	u_int8_t level;
-	u_int8_t flags;
 };
 
 #endif /* _LINUX_NETFILTER_XT_LOGMARK_TARGET_H */