TCP window tracking: nf-log

PATCH In review Roberto Nibali 3 participants 5 messages Nov 21, 2005 – Dec 4, 2005

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Roberto Nibali

author

2005-11-21 10:15 UTC #0 lore raw

PATCH 1/1 TCP window tracking: nf-log

Hello,

This is the rediffed nf-log patch against 2.4.32, which is needed in order to have the core tcp window tracking patch working in 2.4.x kernels.

Cheers,
Roberto Nibali, ratz

Signature · 6 lines

-------------------------------------------------------------
addr://Kasinostrasse 30, CH-5001 Aarau tel://++41 62 823 9355
http://www.terreactive.com             fax://++41 62 823 9356
-------------------------------------------------------------
terreActive AG                       Wir sichern Ihren Erfolg
-------------------------------------------------------------

include/linux/netfilter_ipv4/ip_logging.h +20 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_ipv4/ip_logging.h linux-2.4.32-pab2/include/linux/netfilter_ipv4/ip_logging.h
@@ -0,0 +1,20 @@
+/* IPv4 macros for the internal logging interface. */
+#ifndef __IP_LOGGING_H
+#define __IP_LOGGING_H
+
+#ifdef __KERNEL__
+#include <linux/socket.h>
+#include <linux/netfilter_logging.h>
+
+#define nf_log_ip_packet(pskb,hooknum,in,out,fmt,args...) \
+	nf_log_packet(AF_INET,pskb,hooknum,in,out,fmt,##args)
+
+#define nf_log_ip(pfh,len,fmt,args...) \
+	nf_log(AF_INET,pfh,len,fmt,##args)
+
+#define nf_ip_log_register(logging) nf_log_register(AF_INET,logging)
+#define nf_ip_log_unregister(logging) nf_log_unregister(AF_INET,logging)
+	
+#endif /*__KERNEL__*/
+
+#endif /*__IP_LOGGING_H*/

include/linux/netfilter_ipv4/ipt_ULOG.h +3 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.4.32-pab2/include/linux/netfilter_ipv4/ipt_ULOG.h
@@ -11,6 +11,9 @@
 #define NETLINK_NFLOG 	5
 #endif
 
+#define NFLOG_DEFAULT_NLGROUP	1
+#define NFLOG_DEFAULT_QTHRESHOLD	1
+
 #define ULOG_MAC_LEN	80
 #define ULOG_PREFIX_LEN	32

include/linux/netfilter_ipv6/ip6_logging.h +20 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_ipv6/ip6_logging.h linux-2.4.32-pab2/include/linux/netfilter_ipv6/ip6_logging.h
@@ -0,0 +1,20 @@
+/* IPv6 macros for the nternal logging interface. */
+#ifndef __IP6_LOGGING_H
+#define __IP6_LOGGING_H
+
+#ifdef __KERNEL__
+#include <linux/socket.h>
+#include <linux/netfilter_logging.h>
+
+#define nf_log_ip6_packet(pskb,hooknum,in,out,fmt,args...) \
+	nf_log_packet(AF_INET6,pskb,hooknum,in,out,fmt,##args)
+
+#define nf_log_ip6(pfh,len,fmt,args...) \
+	nf_log(AF_INET6,pfh,len,fmt,##args)
+
+#define nf_ip6_log_register(logging) nf_log_register(AF_INET6,logging)
+#define nf_ip6_log_unregister(logging) nf_log_unregister(AF_INET6,logging)
+	
+#endif /*__KERNEL__*/
+
+#endif /*__IP6_LOGGING_H*/

include/linux/netfilter_logging.h +33 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_logging.h linux-2.4.32-pab2/include/linux/netfilter_logging.h
@@ -0,0 +1,33 @@
+/* Internal logging interface, which relies on the real 
+   LOG target modules */
+#ifndef __LINUX_NETFILTER_LOGGING_H
+#define __LINUX_NETFILTER_LOGGING_H
+
+#ifdef __KERNEL__
+#include <asm/atomic.h>
+
+struct nf_logging_t {
+	void (*nf_log_packet)(struct sk_buff **pskb,
+			      unsigned int hooknum,
+			      const struct net_device *in,
+			      const struct net_device *out,
+			      const char *prefix);
+	void (*nf_log)(char *pfh, size_t len,
+		       const char *prefix);
+};
+
+extern void nf_log_register(int pf, const struct nf_logging_t *logging);
+extern void nf_log_unregister(int pf, const struct nf_logging_t *logging);
+
+extern void nf_log_packet(int pf,
+			  struct sk_buff **pskb,
+			  unsigned int hooknum,
+			  const struct net_device *in,
+			  const struct net_device *out,
+			  const char *fmt, ...);
+extern void nf_log(int pf,
+		   char *pfh, size_t len,
+		   const char *fmt, ...);
+#endif /*__KERNEL__*/
+
+#endif /*__LINUX_NETFILTER_LOGGING_H*/

net/core/netfilter.c +72 -0

87 lines not on this page · raw message

net/ipv4/ipvs/ip_vs_conn.c +1 -1

diff -Nur linux-2.4.32-orig/net/ipv4/ipvs/ip_vs_conn.c linux-2.4.32-pab2/net/ipv4/ipvs/ip_vs_conn.c
@@ -246,7 +246,7 @@
 struct ip_vs_conn *ip_vs_ct_in_get
 (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
 {
-	unsigned hash:
+	unsigned hash;
 	struct ip_vs_conn *cp;
 
 	hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);

net/ipv4/netfilter/ipt_LOG.c +67 -9

126 lines not on this page · raw message

net/ipv4/netfilter/ipt_ULOG.c +143 ~~-11~~

214 lines not on this page · raw message

net/ipv6/netfilter/ip6t_LOG.c +41 -8

96 lines not on this page · raw message

net/netsyms.c +5 -0

diff -Nur linux-2.4.32-orig/net/netsyms.c linux-2.4.32-pab2/net/netsyms.c
@@ -594,6 +594,7 @@
 #endif
 #ifdef CONFIG_NETFILTER
 #include <linux/netfilter.h>
+#include <linux/netfilter_logging.h>
 EXPORT_SYMBOL(nf_register_hook);
 EXPORT_SYMBOL(nf_unregister_hook);
 EXPORT_SYMBOL(nf_register_sockopt);

@@ -607,6 +608,10 @@
 EXPORT_SYMBOL(nf_getsockopt);
 EXPORT_SYMBOL(ip_ct_attach);
 EXPORT_SYMBOL(nf_ct_attach);
+EXPORT_SYMBOL(nf_log_register);
+EXPORT_SYMBOL(nf_log_unregister);
+EXPORT_SYMBOL(nf_log_packet);
+EXPORT_SYMBOL(nf_log);
 #ifdef CONFIG_INET
 #include <linux/netfilter_ipv4.h>
 EXPORT_SYMBOL(ip_route_me_harder);

Willy Tarreau

2005-12-04 13:51 UTC #1 lore raw

Hi Roberto,

Quoted 4 lines · Roberto Nibali

Hello,
This is the rediffed nf-log patch against 2.4.32, which is needed in order to have the core tcp window tracking patch working in 2.4.x kernels.

I've fixed two things which prevented it from compiling :
- removed a space change in ip_vs_conn.c which might have been caused

    by a change in your reference 2.4.32 tree ;

- ip6t_log_target() was not properly renamed as ip6t_log_packet(), so build was broken with IPv6 enabled.

Please use the attached one as an update.
I'm still in the process of building a new kernel with all this, I'll keep you informed.

Quoted 3 lines

Cheers,
Roberto Nibali, ratz

Cheers,
Willy

include/linux/netfilter_ipv4/ip_logging.h +20 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_ipv4/ip_logging.h linux-2.4.32-pab2/include/linux/netfilter_ipv4/ip_logging.h
@@ -0,0 +1,20 @@
+/* IPv4 macros for the internal logging interface. */
+#ifndef __IP_LOGGING_H
+#define __IP_LOGGING_H
+
+#ifdef __KERNEL__
+#include <linux/socket.h>
+#include <linux/netfilter_logging.h>
+
+#define nf_log_ip_packet(pskb,hooknum,in,out,fmt,args...) \
+	nf_log_packet(AF_INET,pskb,hooknum,in,out,fmt,##args)
+
+#define nf_log_ip(pfh,len,fmt,args...) \
+	nf_log(AF_INET,pfh,len,fmt,##args)
+
+#define nf_ip_log_register(logging) nf_log_register(AF_INET,logging)
+#define nf_ip_log_unregister(logging) nf_log_unregister(AF_INET,logging)
+	
+#endif /*__KERNEL__*/
+
+#endif /*__IP_LOGGING_H*/

include/linux/netfilter_ipv4/ipt_ULOG.h +3 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_ipv4/ipt_ULOG.h linux-2.4.32-pab2/include/linux/netfilter_ipv4/ipt_ULOG.h
@@ -11,6 +11,9 @@
 #define NETLINK_NFLOG 	5
 #endif
 
+#define NFLOG_DEFAULT_NLGROUP	1
+#define NFLOG_DEFAULT_QTHRESHOLD	1
+
 #define ULOG_MAC_LEN	80
 #define ULOG_PREFIX_LEN	32

include/linux/netfilter_ipv6/ip6_logging.h +20 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_ipv6/ip6_logging.h linux-2.4.32-pab2/include/linux/netfilter_ipv6/ip6_logging.h
@@ -0,0 +1,20 @@
+/* IPv6 macros for the nternal logging interface. */
+#ifndef __IP6_LOGGING_H
+#define __IP6_LOGGING_H
+
+#ifdef __KERNEL__
+#include <linux/socket.h>
+#include <linux/netfilter_logging.h>
+
+#define nf_log_ip6_packet(pskb,hooknum,in,out,fmt,args...) \
+	nf_log_packet(AF_INET6,pskb,hooknum,in,out,fmt,##args)
+
+#define nf_log_ip6(pfh,len,fmt,args...) \
+	nf_log(AF_INET6,pfh,len,fmt,##args)
+
+#define nf_ip6_log_register(logging) nf_log_register(AF_INET6,logging)
+#define nf_ip6_log_unregister(logging) nf_log_unregister(AF_INET6,logging)
+	
+#endif /*__KERNEL__*/
+
+#endif /*__IP6_LOGGING_H*/

include/linux/netfilter_logging.h +33 -0

diff -Nur linux-2.4.32-orig/include/linux/netfilter_logging.h linux-2.4.32-pab2/include/linux/netfilter_logging.h
@@ -0,0 +1,33 @@
+/* Internal logging interface, which relies on the real 
+   LOG target modules */
+#ifndef __LINUX_NETFILTER_LOGGING_H
+#define __LINUX_NETFILTER_LOGGING_H
+
+#ifdef __KERNEL__
+#include <asm/atomic.h>
+
+struct nf_logging_t {
+	void (*nf_log_packet)(struct sk_buff **pskb,
+			      unsigned int hooknum,
+			      const struct net_device *in,
+			      const struct net_device *out,
+			      const char *prefix);
+	void (*nf_log)(char *pfh, size_t len,
+		       const char *prefix);
+};
+
+extern void nf_log_register(int pf, const struct nf_logging_t *logging);
+extern void nf_log_unregister(int pf, const struct nf_logging_t *logging);
+
+extern void nf_log_packet(int pf,
+			  struct sk_buff **pskb,
+			  unsigned int hooknum,
+			  const struct net_device *in,
+			  const struct net_device *out,
+			  const char *fmt, ...);
+extern void nf_log(int pf,
+		   char *pfh, size_t len,
+		   const char *fmt, ...);
+#endif /*__KERNEL__*/
+
+#endif /*__LINUX_NETFILTER_LOGGING_H*/

net/core/netfilter.c +72 -0

87 lines not on this page · raw message

net/ipv4/netfilter/ipt_LOG.c +67 -9

126 lines not on this page · raw message

net/ipv4/netfilter/ipt_ULOG.c +143 ~~-11~~

214 lines not on this page · raw message

net/ipv6/netfilter/ip6t_LOG.c +42 -9

97 lines not on this page · raw message

net/netsyms.c +5 -0

diff -Nur linux-2.4.32-orig/net/netsyms.c linux-2.4.32-pab2/net/netsyms.c
@@ -594,6 +594,7 @@
 #endif
 #ifdef CONFIG_NETFILTER
 #include <linux/netfilter.h>
+#include <linux/netfilter_logging.h>
 EXPORT_SYMBOL(nf_register_hook);
 EXPORT_SYMBOL(nf_unregister_hook);
 EXPORT_SYMBOL(nf_register_sockopt);

@@ -607,6 +608,10 @@
 EXPORT_SYMBOL(nf_getsockopt);
 EXPORT_SYMBOL(ip_ct_attach);
 EXPORT_SYMBOL(nf_ct_attach);
+EXPORT_SYMBOL(nf_log_register);
+EXPORT_SYMBOL(nf_log_unregister);
+EXPORT_SYMBOL(nf_log_packet);
+EXPORT_SYMBOL(nf_log);
 #ifdef CONFIG_INET
 #include <linux/netfilter_ipv4.h>
 EXPORT_SYMBOL(ip_route_me_harder);

Roberto Nibali

2005-12-04 18:07 UTC #2 lore raw

Hi Willy,

Thanks for your review.

Quoted 9 lines · Roberto Nibali

Quoted 4 lines
Hello,
This is the rediffed nf-log patch against 2.4.32, which is needed in order to have the core tcp window tracking patch working in 2.4.x kernels.
I've fixed two things which prevented it from compiling :
- removed a space change in ip_vs_conn.c which might have been caused
    by a change in your reference 2.4.32 tree ;

Hmm, I hopefully haven't included IPVS stuff into the nf-log patch, have I? I don't seem to be able to find this change in your proposal.

Quoted 2 lines

- ip6t_log_target() was not properly renamed as ip6t_log_packet(), so build was broken with IPv6 enabled.

I'll see to it, thanks. As you found out, I've never compiled my patches with IPv6 selected; thanks for checking it.

Quoted 1 line

Please use the attached one as an update.

I will, once I get some time again to work on the kernel.

Quoted 2 lines

I'm still in the process of building a new kernel with all this, I'll keep you informed.

Excellent.

Have a nice evening,
Roberto Nibali, ratz

Signature · 2 lines

echo
'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

Willy Tarreau

2005-12-04 18:12 UTC #3 lore raw

Hi Roberto,

Quoted 10 lines · Roberto Nibali

Hi Willy,
Thanks for your review.
Quoted 6 lines · Roberto Nibali
Quoted 4 lines
Hello,
This is the rediffed nf-log patch against 2.4.32, which is needed in order to have the core tcp window tracking patch working in 2.4.x kernels.

Quoted 6 lines

Quoted 3 lines
I've fixed two things which prevented it from compiling :
- removed a space change in ip_vs_conn.c which might have been caused
    by a change in your reference 2.4.32 tree ;
Hmm, I hopefully haven't included IPVS stuff into the nf-log patch, have I? I don't seem to be able to find this change in your proposal.

Here is the chunk I found in your patch and which I removed :

net/ipv4/ipvs/ip_vs_conn.c 2005-10-27 17:17:54 +0200 renamed from net/ipv4/ipvs/ip_vs_conn.c 2005-10-27 17:17:13 +0200 +1 -1

diff -Nur linux-2.4.32-orig/net/ipv4/ipvs/ip_vs_conn.c linux-2.4.32-pab2/net/ipv4/ipvs/ip_vs_conn.c
@@ -246,7 +246,7 @@
 struct ip_vs_conn *ip_vs_ct_in_get
 (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
 {
-       unsigned hash:
+       unsigned hash;
        struct ip_vs_conn *cp;
 
        hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);

Just white spaces, but it was rejected. That's why I believe that your reference tree has been touched.

Quoted 6 lines

Quoted 2 lines
- ip6t_log_target() was not properly renamed as ip6t_log_packet(), so build was broken with IPv6 enabled.
I'll see to it, thanks. As you found out, I've never compiled my patches with IPv6 selected; thanks for checking it.

Quoted 8 lines

Quoted 1 line
Please use the attached one as an update.
I will, once I get some time again to work on the kernel.
Quoted 2 lines
I'm still in the process of building a new kernel with all this, I'll keep you informed.
Excellent.

Nearly ready to boot it :-)

Quoted 2 lines

Have a nice evening,
Roberto Nibali, ratz

Cheers,
Willy

Roberto Nibali

2005-12-04 19:38 UTC #4 lore raw

Quoted 21 lines

Quoted 5 lines
Quoted 3 lines
I've fixed two things which prevented it from compiling :
- removed a space change in ip_vs_conn.c which might have been caused
    by a change in your reference 2.4.32 tree ;
Hmm, I hopefully haven't included IPVS stuff into the nf-log patch, have I? I don't seem to be able to find this change in your proposal.
Here is the chunk I found in your patch and which I removed :
diff -Nur linux-2.4.32-orig/net/ipv4/ipvs/ip_vs_conn.c linux-2.4.32-pab2/net/ipv4/ipvs/ip_vs_conn.c
net/ipv4/ipvs/ip_vs_conn.c 2005-10-27 17:17:54 +0200 renamed from net/ipv4/ipvs/ip_vs_conn.c 2005-10-27 17:17:13 +0200 +1 -1
@@ -246,7 +246,7 @@
 struct ip_vs_conn *ip_vs_ct_in_get
 (int protocol, __u32 s_addr, __u16 s_port, __u32 d_addr, __u16 d_port)
 {
-       unsigned hash:
+       unsigned hash;
        struct ip_vs_conn *cp;
 
        hash = ip_vs_conn_hashkey(protocol, s_addr, s_port);

Quoted 2 lines

Just white spaces, but it was rejected. That's why I believe that your reference tree has been touched.

Well, this is more than a whitespace fix, I must have put a colon at this place while working on my IPVS extension on one drop and later when compile testing I replaced the erroneous colon with a semicolon. However I didn't read my patch before sending to netfilter. My bad, thanks for updating it, Willy. Next time I will proof-read my patches for such stupid mistakes.

Quoted 1 line

Nearly ready to boot it :-)

Good luck, if you need kdb patches, I have them ready :).

http://www.drugphish.ch/patches/ratz/kernel/2.4.x/linux-2.4.32-kdb-v4.3-common-1.diff
http://www.drugphish.ch/patches/ratz/kernel/2.4.x/linux-2.4.32-kdb-v4.3-i386-1.diff

Cheers,
Roberto Nibali, ratz

Signature · 2 lines

echo
'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc