Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 74f7a6552c8d76ffc5e11eb8d9d6c07238b9ae77

Authored by Patrick McHardy
1 parent f3abc9b963
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

netfilter: nf_conntrack: log packets dropped by helpers 

Log packets dropped by helpers using the netfilter logging API. This
is useful in combination with nfnetlink_log to analyze those packets
in userspace for debugging.

Signed-off-by: Patrick McHardy <kaber@trash.net>

Showing 2 changed files with 10 additions and 2 deletions Side-by-side Diff

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
Diff comments   View file @ 74f7a65
... ... @@ -26,6 +26,7 @@
26 26 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
27 27 #include <net/netfilter/nf_nat_helper.h>
28 28 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
  29 +#include <net/netfilter/nf_log.h>
29 30  
30 31 int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
31 32 struct nf_conn *ct,
32 33  
... ... @@ -113,8 +114,11 @@
113 114  
114 115 ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
115 116 ct, ctinfo);
116   - if (ret != NF_ACCEPT)
  117 + if (ret != NF_ACCEPT) {
  118 + nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,
  119 + "nf_ct_%s: dropping packet", helper->name);
117 120 return ret;
  121 + }
118 122  
119 123 if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
120 124 typeof(nf_nat_seq_adjust_hook) seq_adjust;
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
Diff comments   View file @ 74f7a65
... ... @@ -27,6 +27,7 @@
27 27 #include <net/netfilter/nf_conntrack_l3proto.h>
28 28 #include <net/netfilter/nf_conntrack_core.h>
29 29 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
  30 +#include <net/netfilter/nf_log.h>
30 31  
31 32 static bool ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,
32 33 struct nf_conntrack_tuple *tuple)
33 34  
... ... @@ -176,8 +177,11 @@
176 177 }
177 178  
178 179 ret = helper->help(skb, protoff, ct, ctinfo);
179   - if (ret != NF_ACCEPT)
  180 + if (ret != NF_ACCEPT) {
  181 + nf_log_packet(NFPROTO_IPV6, hooknum, skb, in, out, NULL,
  182 + "nf_ct_%s: dropping packet", helper->name);
180 183 return ret;
  184 + }
181 185 out:
182 186 /* We've seen it coming out the other side: confirm it */
183 187 return nf_conntrack_confirm(skb);