Skip to contentSkip to conversation

ipchains log will show all flags

PATCH Tony Gale 1 participant 1 message Dec 5, 2000

lore
Share & tools
lore

Tony Gale

author
#0 lore raw
Quoted 13 lines · On 05-Dec-2000 Christian W. Zuckschwerdt wrote:

Hi Linus,

This tiny patch extends ipchains logging. This way one can distinguish
(plain) connection attempts and (Xmas, Fin,...) scans. E.g.
kernel: Packet log: input - lo PROTO=6 127.0.0.1:40326
127.0.0.1:80
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1)
vs.
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=-s--a-
and
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1) B=fs-p-u

Quoted 3 lines

Please comment on the format (B=...) and implementation details (speed).
The patch is against 2.2.17's /net/ipv4/ip_fw.c

Here's my version, which I have previously sent to Alan, but he hasn't incorporated it - don't know why.

The format is slightly less obtuse, and more likely to be compatible with existing tools.

-tony

PS: Rusty, putting "RR" in the header doesn't exactly flag you as the maintainer.

ip_fw.c renamed from ip_fw.c.orig +12 -1
@@ -41,6 +41,7 @@
  *              John McDonald <[email protected]>
  *              Thomas Lopatic <[email protected]>
  * 21-Oct-1999: Applied count fix by Emanuele Caratti <[email protected]> --RR
+ * 13-Jul-2000: Log all TCP flags. Tony Gale <[email protected]>
  */
 
 /*

@@ -443,7 +444,17 @@
 
 	for (opti = 0; opti < (ip->ihl - sizeof(struct iphdr) / 4); opti++)
 		printk(" O=0x%8.8X", *opt++);
-	printk(" %s(#%d)\n", syn ? "SYN " : /* "PENANCE" */ "", count);
+	if (ip->protocol == IPPROTO_TCP) {
+		struct tcphdr *tcp=(struct tcphdr *)((__u32 *)ip+ip->ihl);		
+	        printk("%s%s%s%s%s%s",
+			syn ? " SYN" : "",
+			tcp->fin ? " FIN" : "",
+			tcp->rst ? " RST" : "",
+			tcp->psh ? " PSH" : "",
+			tcp->ack ? " ACK" : "",
+			tcp->urg ? " URG" : "");
+	}
+	printk(" (#%d)\n", count);
 }
 
 /* function for checking chain labels for user space. */
Signature · 9 lines
E-Mail: Tony Gale <[email protected]>
The views expressed above are entirely those of the writer
and do not represent the views, policy or understanding of
any other person or official body.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
Please read the FAQ at http://www.tux.org/lkml/