1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
25 * SUCH DAMAGE.
26 */
27
28 #include <sys/cdefs.h>
29 __FBSDID("$FreeBSD$");
30
31 /*
32 * Logging support for ipfw
33 */
34
35 #include "opt_ipfw.h"
36 #include "opt_inet.h"
37 #ifndef INET
38 #error IPFIREWALL requires INET.
39 #endif /* INET */
40 #include "opt_inet6.h"
41
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/kernel.h>
45 #include <sys/mbuf.h>
46 #include <sys/socket.h>
47 #include <sys/sysctl.h>
48 #include <sys/syslog.h>
49 #include <net/ethernet.h> /* for ETHERTYPE_IP */
50 #include <net/if.h>
51 #include <net/if_var.h>
52 #include <net/vnet.h>
53
54 #include <netinet/in.h>
55 #include <netinet/ip.h>
56 #include <netinet/ip_icmp.h>
57 #include <netinet/ip_var.h>
58 #include <netinet/ip_fw.h>
59 #include <netinet/tcp_var.h>
60 #include <netinet/udp.h>
61
62 #include <netinet/ip6.h>
63 #include <netinet/icmp6.h>
64 #ifdef INET6
65 #include <netinet6/in6_var.h> /* ip6_sprintf() */
66 #endif
67
68 #include <netpfil/ipfw/ip_fw_private.h>
69
70 #ifdef MAC
71 #include <security/mac/mac_framework.h>
72 #endif
73
74 /*
75 * L3HDR maps an ipv4 pointer into a layer3 header pointer of type T
76 * Other macros just cast void * into the appropriate type
77 */
78 #define L3HDR(T, ip) ((T *)((u_int32_t *)(ip) + (ip)->ip_hl))
79 #define TCP(p) ((struct tcphdr *)(p))
80 #define SCTP(p) ((struct sctphdr *)(p))
81 #define UDP(p) ((struct udphdr *)(p))
82 #define ICMP(p) ((struct icmphdr *)(p))
83 #define ICMP6(p) ((struct icmp6_hdr *)(p))
84
85 #ifdef __APPLE__
86 #undef snprintf
87 #define snprintf sprintf
88 #define SNPARGS(buf, len) buf + len
89 #define SNP(buf) buf
90 #else /* !__APPLE__ */
91 #define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0
92 #define SNP(buf) buf, sizeof(buf)
93 #endif /* !__APPLE__ */
94
95 #define TARG(k, f) IP_FW_ARG_TABLEARG(chain, k, f)
96 /*
97 * We enter here when we have a rule with O_LOG.
98 * XXX this function alone takes about 2Kbytes of code!
99 */
100 void
ipfw_log(struct ip_fw_chain * chain,struct ip_fw * f,u_int hlen,struct ip_fw_args * args,u_short offset,uint32_t tablearg,struct ip * ip)101 ipfw_log(struct ip_fw_chain *chain, struct ip_fw *f, u_int hlen,
102 struct ip_fw_args *args, u_short offset, uint32_t tablearg, struct ip *ip)
103 {
104 char *action;
105 int limit_reached = 0;
106 char action2[92], proto[128], fragment[32];
107
108 if (V_fw_verbose == 0) {
109 #ifndef FSTACK /* WITHOUT_BPF */
110 if (args->flags & IPFW_ARGS_LENMASK)
111 ipfw_bpf_tap(args->mem, IPFW_ARGS_LENGTH(args->flags));
112 else if (args->flags & IPFW_ARGS_ETHER)
113 /* layer2, use orig hdr */
114 ipfw_bpf_mtap(args->m);
115 else {
116 /* Add fake header. Later we will store
117 * more info in the header.
118 */
119 if (ip->ip_v == 4)
120 ipfw_bpf_mtap2("DDDDDDSSSSSS\x08\x00",
121 ETHER_HDR_LEN, args->m);
122 else if (ip->ip_v == 6)
123 ipfw_bpf_mtap2("DDDDDDSSSSSS\x86\xdd",
124 ETHER_HDR_LEN, args->m);
125 else
126 /* Obviously bogus EtherType. */
127 ipfw_bpf_mtap2("DDDDDDSSSSSS\xff\xff",
128 ETHER_HDR_LEN, args->m);
129 }
130 #endif
131 return;
132 }
133 /* the old 'log' function */
134 fragment[0] = '\0';
135 proto[0] = '\0';
136
137 if (f == NULL) { /* bogus pkt */
138 if (V_verbose_limit != 0 && V_norule_counter >= V_verbose_limit)
139 return;
140 V_norule_counter++;
141 if (V_norule_counter == V_verbose_limit)
142 limit_reached = V_verbose_limit;
143 action = "Refuse";
144 } else { /* O_LOG is the first action, find the real one */
145 ipfw_insn *cmd = ACTION_PTR(f);
146 ipfw_insn_log *l = (ipfw_insn_log *)cmd;
147
148 if (l->max_log != 0 && l->log_left == 0)
149 return;
150 l->log_left--;
151 if (l->log_left == 0)
152 limit_reached = l->max_log;
153 cmd += F_LEN(cmd); /* point to first action */
154 if (cmd->opcode == O_ALTQ) {
155 ipfw_insn_altq *altq = (ipfw_insn_altq *)cmd;
156
157 snprintf(SNPARGS(action2, 0), "Altq %d",
158 altq->qid);
159 cmd += F_LEN(cmd);
160 }
161 if (cmd->opcode == O_PROB || cmd->opcode == O_TAG ||
162 cmd->opcode == O_SETDSCP)
163 cmd += F_LEN(cmd);
164
165 action = action2;
166 switch (cmd->opcode) {
167 case O_DENY:
168 action = "Deny";
169 break;
170
171 case O_REJECT:
172 if (cmd->arg1==ICMP_REJECT_RST)
173 action = "Reset";
174 else if (cmd->arg1==ICMP_REJECT_ABORT)
175 action = "Abort";
176 else if (cmd->arg1==ICMP_UNREACH_HOST)
177 action = "Reject";
178 else
179 snprintf(SNPARGS(action2, 0), "Unreach %d",
180 cmd->arg1);
181 break;
182
183 case O_UNREACH6:
184 if (cmd->arg1==ICMP6_UNREACH_RST)
185 action = "Reset";
186 else if (cmd->arg1==ICMP6_UNREACH_ABORT)
187 action = "Abort";
188 else
189 snprintf(SNPARGS(action2, 0), "Unreach %d",
190 cmd->arg1);
191 break;
192
193 case O_ACCEPT:
194 action = "Accept";
195 break;
196 case O_COUNT:
197 action = "Count";
198 break;
199 case O_DIVERT:
200 snprintf(SNPARGS(action2, 0), "Divert %d",
201 TARG(cmd->arg1, divert));
202 break;
203 case O_TEE:
204 snprintf(SNPARGS(action2, 0), "Tee %d",
205 TARG(cmd->arg1, divert));
206 break;
207 case O_SETFIB:
208 snprintf(SNPARGS(action2, 0), "SetFib %d",
209 TARG(cmd->arg1, fib) & 0x7FFF);
210 break;
211 case O_SKIPTO:
212 snprintf(SNPARGS(action2, 0), "SkipTo %d",
213 TARG(cmd->arg1, skipto));
214 break;
215 case O_PIPE:
216 snprintf(SNPARGS(action2, 0), "Pipe %d",
217 TARG(cmd->arg1, pipe));
218 break;
219 case O_QUEUE:
220 snprintf(SNPARGS(action2, 0), "Queue %d",
221 TARG(cmd->arg1, pipe));
222 break;
223 case O_FORWARD_IP: {
224 char buf[INET_ADDRSTRLEN];
225 ipfw_insn_sa *sa = (ipfw_insn_sa *)cmd;
226 int len;
227 struct in_addr dummyaddr;
228 if (sa->sa.sin_addr.s_addr == INADDR_ANY)
229 dummyaddr.s_addr = htonl(tablearg);
230 else
231 dummyaddr.s_addr = sa->sa.sin_addr.s_addr;
232
233 len = snprintf(SNPARGS(action2, 0), "Forward to %s",
234 inet_ntoa_r(dummyaddr, buf));
235
236 if (sa->sa.sin_port)
237 snprintf(SNPARGS(action2, len), ":%d",
238 sa->sa.sin_port);
239 }
240 break;
241 #ifdef INET6
242 case O_FORWARD_IP6: {
243 char buf[INET6_ADDRSTRLEN];
244 ipfw_insn_sa6 *sa = (ipfw_insn_sa6 *)cmd;
245 int len;
246
247 len = snprintf(SNPARGS(action2, 0), "Forward to [%s]",
248 ip6_sprintf(buf, &sa->sa.sin6_addr));
249
250 if (sa->sa.sin6_port)
251 snprintf(SNPARGS(action2, len), ":%u",
252 sa->sa.sin6_port);
253 }
254 break;
255 #endif
256 case O_NETGRAPH:
257 snprintf(SNPARGS(action2, 0), "Netgraph %d",
258 cmd->arg1);
259 break;
260 case O_NGTEE:
261 snprintf(SNPARGS(action2, 0), "Ngtee %d",
262 cmd->arg1);
263 break;
264 case O_NAT:
265 action = "Nat";
266 break;
267 case O_REASS:
268 action = "Reass";
269 break;
270 case O_CALLRETURN:
271 if (cmd->len & F_NOT)
272 action = "Return";
273 else
274 snprintf(SNPARGS(action2, 0), "Call %d",
275 cmd->arg1);
276 break;
277 case O_EXTERNAL_ACTION:
278 snprintf(SNPARGS(action2, 0), "Eaction %s",
279 ((struct named_object *)SRV_OBJECT(chain,
280 cmd->arg1))->name);
281 break;
282 default:
283 action = "UNKNOWN";
284 break;
285 }
286 }
287
288 if (hlen == 0) { /* non-ip */
289 snprintf(SNPARGS(proto, 0), "MAC");
290
291 } else {
292 int len;
293 #ifdef INET6
294 char src[INET6_ADDRSTRLEN + 2], dst[INET6_ADDRSTRLEN + 2];
295 #else
296 char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
297 #endif
298 struct icmphdr *icmp;
299 struct tcphdr *tcp;
300 struct udphdr *udp;
301 #ifdef INET6
302 struct ip6_hdr *ip6 = NULL;
303 struct icmp6_hdr *icmp6;
304 u_short ip6f_mf;
305 #endif
306 src[0] = '\0';
307 dst[0] = '\0';
308 #ifdef INET6
309 ip6f_mf = offset & IP6F_MORE_FRAG;
310 offset &= IP6F_OFF_MASK;
311
312 if (IS_IP6_FLOW_ID(&(args->f_id))) {
313 char ip6buf[INET6_ADDRSTRLEN];
314 snprintf(src, sizeof(src), "[%s]",
315 ip6_sprintf(ip6buf, &args->f_id.src_ip6));
316 snprintf(dst, sizeof(dst), "[%s]",
317 ip6_sprintf(ip6buf, &args->f_id.dst_ip6));
318
319 ip6 = (struct ip6_hdr *)ip;
320 tcp = (struct tcphdr *)(((char *)ip) + hlen);
321 udp = (struct udphdr *)(((char *)ip) + hlen);
322 } else
323 #endif
324 {
325 tcp = L3HDR(struct tcphdr, ip);
326 udp = L3HDR(struct udphdr, ip);
327
328 inet_ntop(AF_INET, &ip->ip_src, src, sizeof(src));
329 inet_ntop(AF_INET, &ip->ip_dst, dst, sizeof(dst));
330 }
331
332 switch (args->f_id.proto) {
333 case IPPROTO_TCP:
334 len = snprintf(SNPARGS(proto, 0), "TCP %s", src);
335 if (offset == 0)
336 snprintf(SNPARGS(proto, len), ":%d %s:%d",
337 ntohs(tcp->th_sport),
338 dst,
339 ntohs(tcp->th_dport));
340 else
341 snprintf(SNPARGS(proto, len), " %s", dst);
342 break;
343
344 case IPPROTO_UDP:
345 case IPPROTO_UDPLITE:
346 len = snprintf(SNPARGS(proto, 0), "UDP%s%s",
347 args->f_id.proto == IPPROTO_UDP ? " ": "Lite ",
348 src);
349 if (offset == 0)
350 snprintf(SNPARGS(proto, len), ":%d %s:%d",
351 ntohs(udp->uh_sport),
352 dst,
353 ntohs(udp->uh_dport));
354 else
355 snprintf(SNPARGS(proto, len), " %s", dst);
356 break;
357
358 case IPPROTO_ICMP:
359 icmp = L3HDR(struct icmphdr, ip);
360 if (offset == 0)
361 len = snprintf(SNPARGS(proto, 0),
362 "ICMP:%u.%u ",
363 icmp->icmp_type, icmp->icmp_code);
364 else
365 len = snprintf(SNPARGS(proto, 0), "ICMP ");
366 len += snprintf(SNPARGS(proto, len), "%s", src);
367 snprintf(SNPARGS(proto, len), " %s", dst);
368 break;
369 #ifdef INET6
370 case IPPROTO_ICMPV6:
371 icmp6 = (struct icmp6_hdr *)(((char *)ip) + hlen);
372 if (offset == 0)
373 len = snprintf(SNPARGS(proto, 0),
374 "ICMPv6:%u.%u ",
375 icmp6->icmp6_type, icmp6->icmp6_code);
376 else
377 len = snprintf(SNPARGS(proto, 0), "ICMPv6 ");
378 len += snprintf(SNPARGS(proto, len), "%s", src);
379 snprintf(SNPARGS(proto, len), " %s", dst);
380 break;
381 #endif
382 default:
383 len = snprintf(SNPARGS(proto, 0), "P:%d %s",
384 args->f_id.proto, src);
385 snprintf(SNPARGS(proto, len), " %s", dst);
386 break;
387 }
388
389 #ifdef INET6
390 if (IS_IP6_FLOW_ID(&(args->f_id))) {
391 if (offset || ip6f_mf)
392 snprintf(SNPARGS(fragment, 0),
393 " (frag %08x:%d@%d%s)",
394 args->f_id.extra,
395 ntohs(ip6->ip6_plen) - hlen,
396 ntohs(offset) << 3, ip6f_mf ? "+" : "");
397 } else
398 #endif
399 {
400 int ipoff, iplen;
401 ipoff = ntohs(ip->ip_off);
402 iplen = ntohs(ip->ip_len);
403 if (ipoff & (IP_MF | IP_OFFMASK))
404 snprintf(SNPARGS(fragment, 0),
405 " (frag %d:%d@%d%s)",
406 ntohs(ip->ip_id), iplen - (ip->ip_hl << 2),
407 offset << 3,
408 (ipoff & IP_MF) ? "+" : "");
409 }
410 }
411 #ifdef __FreeBSD__
412 log(LOG_SECURITY | LOG_INFO, "ipfw: %d %s %s %s via %s%s\n",
413 f ? f->rulenum : -1, action, proto,
414 args->flags & IPFW_ARGS_OUT ? "out" : "in", args->ifp->if_xname,
415 fragment);
416 #else
417 log(LOG_SECURITY | LOG_INFO, "ipfw: %d %s %s [no if info]%s\n",
418 f ? f->rulenum : -1, action, proto, fragment);
419 #endif
420 if (limit_reached)
421 log(LOG_SECURITY | LOG_NOTICE,
422 "ipfw: limit %d reached on entry %d\n",
423 limit_reached, f ? f->rulenum : -1);
424 }
425 /* end of file */
426