Hi,
This tiny patch extends ipchains logging. This way one can distinguish
(plain) connection attempts and (stealth) scans. E.g.
kernel: Packet log: input - lo PROTO=6 127.0.0.1:40326 127.0.0.1:80
L=40 S=0x00 I=5808 F=0x0000 T=51 (#1)
vs.
L=40 S=0x00 I=5808 F=0x0000 T=51 SYN ACK (#1)
and
L=40 S=0x00 I=5808 F=0x0000 T=51 URG PSH SYN FIN (#1)
Some comments on the format have been considered. I dislike
bloating my logging with "URG ACK PSH RST SYN FIN " and like to see a
compact format (eg. "B=fsrpau"). Despite that iptables does it the
former way (linux-2.4.0-test11/net/ipv4/netfilter/ipt_LOG.c).
Please note that SYN is not any longer SYN && !ACK && !RST. This will
break log parser that look for connection initiation packets.
Besides ipchains(8) man page is wrong. FIN should be RST?
[!] -y, --syn
Only match TCP packets with the SYN bit set and the
ACK and FIN bits cleared. Such packets are used to
Could you please comment on the tradeoff between multiple printk()'s and
the printk("%s", "")?
Logging the FW Mark value was suggested by Roberto Nibali <[EMAIL PROTECTED]>
Could be included as printk(" M=%d", f->ipfw.fw_mark);
The patch is against 2.2.17's /net/ipv4/ip_fw.c
ipchains logging all flags Christian W. Zuckschwerdt <[EMAIL PROTECTED]>
--- linux-2.2.17-pristine/net/ipv4/ip_fw.c.orig Mon Nov 27 00:38:36 2000
+++ linux-2.2.17/net/ipv4/ip_fw.c Mon Dec 11 15:10:51 2000
@@ -41,6 +41,9 @@
* John McDonald <[EMAIL PROTECTED]>
* Thomas Lopatic <[EMAIL PROTECTED]>
* 21-Oct-1999: Applied count fix by Emanuele Caratti <[EMAIL PROTECTED]> --RR
+ * 11-Dec-2000: Added "URG ACK PSH RST SYN FIN" in log message.
+ * Please note SYN is no longer SYN && !ACK && !RST
+ * Christian W. Zuckschwerdt <[EMAIL PROTECTED]>
*/
/*
@@ -443,7 +443,24 @@
for (opti = 0; opti < (ip->ihl - sizeof(struct iphdr) / 4); opti++)
printk(" O=0x%8.8X", *opt++);
- printk(" %s(#%d)\n", syn ? "SYN " : /* "PENANCE" */ "", count);
+
+ if ((ip->protocol == IPPROTO_TCP) && !(ip->frag_off & htons(IP_OFFSET))) {
+ struct tcphdr *tcp=(struct tcphdr *)((__u32 *)ip+ip->ihl);
+ /* Max length: 36 " URG ACK PSH RST SYN FIN" */
+ if (tcp->urg)
+ printk(" URG");
+ if (tcp->ack)
+ printk(" ACK");
+ if (tcp->psh)
+ printk(" PSH");
+ if (tcp->rst)
+ printk(" RST");
+ if (tcp->syn)
+ printk(" SYN");
+ if (tcp->fin)
+ printk(" FIN");
+ }
+ printk(" (#%d) M=%d\n", count, f->ipfw.fw_mark);
}
/* function for checking chain labels for user space. */
--
cu.
:
Christian
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
Please read the FAQ at http://www.tux.org/lkml/
