Patch to avoid MAC header logging

["PedroRibeiro \(B\)" <pribeiro-bulk@net.ipl.pt>]

I hope this is the right place to post this patch I'v made ...

My problem was that logs generated by "-j LOG" being full of mac
headers that didn't have any information to me (the machine is after a
router, so the MAC source is always from the router).

Excess of redundant information is misinformation to me ...

So I'v decided to make this small (tiny) modifications to the LOG
module, adding a flag to disable MAC headers logging.
I'm sure this will make other people happy too.

Fallows the patch to the kernel and to userland iptables command.

################## This one is for the Iptables 1.2.9 ###########

diff -wurNbB iptables-1.2.9/extensions/libipt_LOG.c iptables-1.2.9-IPLNet-2/extensions/libipt_LOG.c
--- iptables-1.2.9/extensions/libipt_LOG.c      2003-08-23 12:09:22.000000000 +0100
+++ iptables-1.2.9-IPLNet-2/extensions/libipt_LOG.c     2003-11-12 22:33:52.000000000 +0000
@@ -21,7 +21,8 @@
 " --log-prefix prefix          Prefix log messages with this prefix.\n\n"
 " --log-tcp-sequence           Log TCP sequence numbers.\n\n"
 " --log-tcp-options            Log TCP options.\n\n"
-" --log-ip-options             Log IP options.\n\n",
+" --log-ip-options             Log IP options.\n\n"
+" --log-mac-header             Log MAC header.\n\n",
 IPTABLES_VERSION);
 }
 
@@ -31,6 +32,7 @@
        { .name = "log-tcp-sequence", .has_arg = 0, .flag = 0, .val = '1' },
        { .name = "log-tcp-options",  .has_arg = 0, .flag = 0, .val = '2' },
        { .name = "log-ip-options",   .has_arg = 0, .flag = 0, .val = '3' },
+       { .name = "log-mac-header",   .has_arg = 0, .flag = 0, .val = '4' },
        { .name = 0 }
 };
 
@@ -168,6 +170,15 @@
                *flags |= IPT_LOG_OPT_IPOPT;
                break;
 
+       case '4':
+               if (*flags & IPT_LOG_MAC)
+                       exit_error(PARAMETER_PROBLEM,
+                                  "Can't specify --log-mac-header twice");
+
+               loginfo->logflags |= IPT_LOG_MAC;
+               *flags |= IPT_LOG_MAC;
+               break;
+
        default:
                return 0;
        }
@@ -211,6 +222,8 @@
                        printf("tcp-options ");
                if (loginfo->logflags & IPT_LOG_IPOPT)
                        printf("ip-options ");
+               if (loginfo->logflags & IPT_LOG_MAC)
+                       printf("mac-header ");
                if (loginfo->logflags & ~(IPT_LOG_MASK))
                        printf("unknown-flags ");
        }
@@ -238,6 +251,8 @@
                printf("--log-tcp-options ");
        if (loginfo->logflags & IPT_LOG_IPOPT)
                printf("--log-ip-options ");
+       if (loginfo->logflags & IPT_LOG_MAC)
+               printf("--log-mac-header ");
 }

################## This one is for the Linux kernel 2.4.x ###########
 
diff -wurNbB linux-2.4.22/include/linux/netfilter_ipv4/ipt_LOG.h linux-2.4.22pr1/include/linux/netfilter_ipv4/ipt_LOG.h
--- linux-2.4.22/include/linux/netfilter_ipv4/ipt_LOG.h 2000-03-17 18:56:20.000000000 +0000
+++ linux-2.4.22pr1/include/linux/netfilter_ipv4/ipt_LOG.h      2003-11-12 22:22:02.000000000 +0000
@@ -4,7 +4,8 @@
 #define IPT_LOG_TCPSEQ         0x01    /* Log TCP sequence numbers */
 #define IPT_LOG_TCPOPT         0x02    /* Log TCP options */
 #define IPT_LOG_IPOPT          0x04    /* Log IP options */
-#define IPT_LOG_MASK           0x07
+#define IPT_LOG_MAC            0x08    /* Log MAC header */
+#define IPT_LOG_MASK           0x0F
 
 struct ipt_log_info {
        unsigned char level;

diff -wurNbB linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c
--- linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c   2002-02-25 19:38:14.000000000 +0000
+++ linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c        2003-11-12 22:37:27.000000000 +0000
@@ -289,7 +289,7 @@
               loginfo->prefix,
               in ? in->name : "",
               out ? out->name : "");
-       if (in && !out) {
+       if (in && !out && (loginfo->logflags & IPT_LOG_MAC)) {
                /* MAC logging for input chain only. */
                printk("MAC=");
                if ((*pskb)->dev && (*pskb)->dev->hard_header_len && (*pskb)->mac.raw != (void*)iph) {
 
-- 
Best regards,
 PedroRibeiro                          mailto:pribeiro-bulk@net.ipl.pt