ipchains log will show all flags

PATCH In review Christian W. Zuckschwerdt 3 participants 5 messages Dec 5, 2000 – Dec 7, 2000

Subsystems (2)

Networking IPv4/IPv6

lore

Share & tools

lore

Christian W. Zuckschwerdt

author

2000-12-05 13:52 UTC #0 lore raw

PATCH 1/1 ipchains log will show all flags

Hi Linus,

This tiny patch extends ipchains logging. This way one can distinguish (plain) connection attempts and (Xmas, Fin,...) scans. E.g.
kernel: Packet log: input - lo PROTO=6 127.0.0.1:40326 127.0.0.1:80
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1)
vs.
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=-s--a-
and
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=fs-p-u

Please comment on the format (B=...) and implementation details (speed). The patch is against 2.2.17's /net/ipv4/ip_fw.c

ipchains log with flags Christian W. Zuckschwerdt <[email protected]>

net/ipv4/ip_fw.c renamed from net/ipv4/ip_fw.c.orig +10 -1

@@ -415,6 +415,7 @@
 {
 	__u32 *opt = (__u32 *) (ip + 1);
 	int opti;
+	struct tcphdr *tcp=(struct tcphdr *)((__u32 *)ip+ip->ihl);
 	
 	if (f)
 	{

@@ -443,7 +444,15 @@
 
 	for (opti = 0; opti < (ip->ihl - sizeof(struct iphdr) / 4); opti++)
 		printk(" O=0x%8.8X", *opt++);
-	printk(" %s(#%d)\n", syn ? "SYN " : /* "PENANCE" */ "", count);
+	printk(" %s(#%d)", syn ? "SYN " : /* "PENANCE" */ "", count);
+
+	if (ip->protocol == IPPROTO_TCP)
+		printk(" B=%c%c%c%c%c%c\n", tcp->fin ? 'f' : '-',
+		       tcp-syn ? 's' : '-', tcp->rst ? 'r' : '-',
+		       tcp->psh ? 'p' : '-', tcp->ack ? 'a' : '-',
+		       tcp->urg ? 'u' : '-');
+	else
+		printk("\n");
 }
 
 /* function for checking chain labels for user space. */

Signature · 8 lines

  cu.
    :
    Christian

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

Rusty Russell

2000-12-05 14:26 UTC #1 lore raw

In message <0012051408110.1526-100000@localhost> you write:

Quoted 11 lines

Hi Linus,
This tiny patch extends ipchains logging. This way one can distinguish (plain) connection attempts and (Xmas, Fin,...) scans. E.g.
kernel: Packet log: input - lo PROTO=6 127.0.0.1:40326 127.0.0.1:80
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1)
vs.
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=-s--a-
and
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=fs-p-u

Quoted 2 lines

Please comment on the format (B=...) and implementation details (speed). The patch is against 2.2.17's /net/ipv4/ip_fw.c

Looks OK, but CC'ing the maintainer is simple politeness.

net/ipv4/ip_fw.c line 449

Quoted 1 line

net/ipv4/ip_fw.c renamed from net/ipv4/ip_fw.c.orig +1 -0
+	if (ip->protocol == IPPROTO_TCP)

You probably want to insert `&& !(ip->frag_off & htons(IP_OFFSET))'

net/ipv4/ip_fw.c line 451

Quoted 1 line

net/ipv4/ip_fw.c renamed from net/ipv4/ip_fw.c.orig +1 -0
+		       tcp-syn ? 's' : '-', tcp->rst ? 'r' : '-',

You mean tcp->syn' not tcp-syn'.

I like the fact that it doesn't disturb the format, simply appends, and it has been a not-uncommon request.

But application is up to Alan Cox, who ruleth the 2.2 series.

Rusty.
--
Hacking time.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

Mike A. Harris

2000-12-05 16:30 UTC #2 lore raw

Quoted 27 lines · Rusty Russell

Date: Wed, 06 Dec 2000 00:55:09 +1100
From: Rusty Russell <[email protected]>
To: Christian W. Zuckschwerdt <[email protected]>
Cc: [email protected]
Subject: Re: [PATCH] ipchains log will show all flags
In message <0012051408110.1526-100000@localhost> you write:
Quoted 11 lines
Hi Linus,
This tiny patch extends ipchains logging. This way one can distinguish (plain) connection attempts and (Xmas, Fin,...) scans. E.g.
kernel: Packet log: input - lo PROTO=6 127.0.0.1:40326 127.0.0.1:80
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1)
vs.
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=-s--a-
and
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=fs-p-u
Quoted 2 lines
Please comment on the format (B=...) and implementation details (speed). The patch is against 2.2.17's /net/ipv4/ip_fw.c
Looks OK, but CC'ing the maintainer is simple politeness.
net/ipv4/ip_fw.c line 449
Quoted 1 line
net/ipv4/ip_fw.c renamed from net/ipv4/ip_fw.c.orig +1 -0
+	if (ip->protocol == IPPROTO_TCP)
You probably want to insert `&& !(ip->frag_off & htons(IP_OFFSET))'

Quoted 8 lines

net/ipv4/ip_fw.c line 451
Quoted 1 line
net/ipv4/ip_fw.c renamed from net/ipv4/ip_fw.c.orig +1 -0
+		       tcp-syn ? 's' : '-', tcp->rst ? 'r' : '-',
You mean tcp->syn' not tcp-syn'.
I like the fact that it doesn't disturb the format, simply appends, and it has been a not-uncommon request.
But application is up to Alan Cox, who ruleth the 2.2 series.

Personally, I'd like to see the rule number stay on the end,and have the new display just before it. The rule number in the middle looks messy.

----------------------------------------------------------------------
Mike A. Harris - Linux advocate - Open source advocate
This message is copyright 2000, all rights reserved.
Views expressed are my own, not necessarily shared by my employer.
----------------------------------------------------------------------

Microsoft Windows(tm). A thirty-two bit extension and graphical shell to a sixteen bit patch to an eight bit operating system originally coded for a four bit microprocessor which was written by a two-bit company that can't stand one bit of competition.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

Rusty Russell

2000-12-06 03:24 UTC #3 lore raw

In message <[email protected]> you write :

Quoted 3 lines

Personally, I'd like to see the rule number stay on the end,and have the new display just before it. The rule number in the middle looks messy.

But what will break people's perl scripts?

I think leaving the rule number at the end is probably the Right Thing from this point of view, so that would be a nice change.

But I prefer the compressed form of -----' (with the old SYN' kept there) to the "SYN FIN RST" alternative.

Cheers,
Rusty.
--
Hacking time.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/

Mike A. Harris

2000-12-07 08:27 UTC #4 lore raw

Quoted 8 lines · Rusty Russell

Date: Wed, 06 Dec 2000 11:40:12 +1100
From: Rusty Russell <[email protected]>
To: Mike A. Harris <[email protected]>
Cc: [email protected]
Subject: Re: [PATCH] ipchains log will show all flags
In message <[email protected]> you write :

Quoted 8 lines

Quoted 3 lines
Personally, I'd like to see the rule number stay on the end,and have the new display just before it. The rule number in the middle looks messy.
But what will break people's perl scripts?
I think leaving the rule number at the end is probably the Right Thing from this point of view, so that would be a nice change.

I am of the camp "do it right, and fix problems that arise" rather than doing things messy and/or kludgy in the name of compatibility.

I'd rather see such a feature not get in than to see it get in as a kludge that is permanent.

Quoted 2 lines

But I prefer the compressed form of -----' (with the old SYN' kept there) to the "SYN FIN RST" alternative.

I prefer the SYN to disappear and be replaced with the new way IMHO. It'd be nice to see netfilter do this as well if it doesn't already do similar. 2.4.0 isn't released yet, so changing it now is safe IMHO.

Just some more food for thought...

Anyone?

If it weren't for C, we'd all be programming in BASI and OBOL.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/