From mboxrd@z Thu Jan 1 00:00:00 1970 From: "PedroRibeiro \(B\)" Subject: Patch to avoid MAC header logging Date: Mon, 5 Jul 2004 10:12:41 +0100 Sender: netfilter-devel-admin@lists.netfilter.org Message-ID: <658614730.20040705101241@net.ipl.pt> Reply-To: "PedroRibeiro \(B\)" Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Return-path: To: netfilter development Errors-To: netfilter-devel-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Unsubscribe: , List-Archive: List-Id: netfilter-devel.vger.kernel.org I hope this is the right place to post this patch I'v made ... My problem was that logs generated by "-j LOG" being full of mac headers that didn't have any information to me (the machine is after a router, so the MAC source is always from the router). Excess of redundant information is misinformation to me ... So I'v decided to make this small (tiny) modifications to the LOG module, adding a flag to disable MAC headers logging. I'm sure this will make other people happy too. Fallows the patch to the kernel and to userland iptables command. ################## This one is for the Iptables 1.2.9 ########### diff -wurNbB iptables-1.2.9/extensions/libipt_LOG.c iptables-1.2.9-IPLNet-2/extensions/libipt_LOG.c --- iptables-1.2.9/extensions/libipt_LOG.c 2003-08-23 12:09:22.000000000 +0100 +++ iptables-1.2.9-IPLNet-2/extensions/libipt_LOG.c 2003-11-12 22:33:52.000000000 +0000 @@ -21,7 +21,8 @@ " --log-prefix prefix Prefix log messages with this prefix.\n\n" " --log-tcp-sequence Log TCP sequence numbers.\n\n" " --log-tcp-options Log TCP options.\n\n" -" --log-ip-options Log IP options.\n\n", +" --log-ip-options Log IP options.\n\n" +" --log-mac-header Log MAC header.\n\n", IPTABLES_VERSION); } @@ -31,6 +32,7 @@ { .name = "log-tcp-sequence", .has_arg = 0, .flag = 0, .val = '1' }, { .name = "log-tcp-options", .has_arg = 0, .flag = 0, .val = '2' }, { .name = "log-ip-options", .has_arg = 0, .flag = 0, .val = '3' }, + { .name = "log-mac-header", .has_arg = 0, .flag = 0, .val = '4' }, { .name = 0 } }; @@ -168,6 +170,15 @@ *flags |= IPT_LOG_OPT_IPOPT; break; + case '4': + if (*flags & IPT_LOG_MAC) + exit_error(PARAMETER_PROBLEM, + "Can't specify --log-mac-header twice"); + + loginfo->logflags |= IPT_LOG_MAC; + *flags |= IPT_LOG_MAC; + break; + default: return 0; } @@ -211,6 +222,8 @@ printf("tcp-options "); if (loginfo->logflags & IPT_LOG_IPOPT) printf("ip-options "); + if (loginfo->logflags & IPT_LOG_MAC) + printf("mac-header "); if (loginfo->logflags & ~(IPT_LOG_MASK)) printf("unknown-flags "); } @@ -238,6 +251,8 @@ printf("--log-tcp-options "); if (loginfo->logflags & IPT_LOG_IPOPT) printf("--log-ip-options "); + if (loginfo->logflags & IPT_LOG_MAC) + printf("--log-mac-header "); } ################## This one is for the Linux kernel 2.4.x ########### diff -wurNbB linux-2.4.22/include/linux/netfilter_ipv4/ipt_LOG.h linux-2.4.22pr1/include/linux/netfilter_ipv4/ipt_LOG.h --- linux-2.4.22/include/linux/netfilter_ipv4/ipt_LOG.h 2000-03-17 18:56:20.000000000 +0000 +++ linux-2.4.22pr1/include/linux/netfilter_ipv4/ipt_LOG.h 2003-11-12 22:22:02.000000000 +0000 @@ -4,7 +4,8 @@ #define IPT_LOG_TCPSEQ 0x01 /* Log TCP sequence numbers */ #define IPT_LOG_TCPOPT 0x02 /* Log TCP options */ #define IPT_LOG_IPOPT 0x04 /* Log IP options */ -#define IPT_LOG_MASK 0x07 +#define IPT_LOG_MAC 0x08 /* Log MAC header */ +#define IPT_LOG_MASK 0x0F struct ipt_log_info { unsigned char level; diff -wurNbB linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c --- linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c 2002-02-25 19:38:14.000000000 +0000 +++ linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c 2003-11-12 22:37:27.000000000 +0000 @@ -289,7 +289,7 @@ loginfo->prefix, in ? in->name : "", out ? out->name : ""); - if (in && !out) { + if (in && !out && (loginfo->logflags & IPT_LOG_MAC)) { /* MAC logging for input chain only. */ printk("MAC="); if ((*pskb)->dev && (*pskb)->dev->hard_header_len && (*pskb)->mac.raw != (void*)iph) { -- Best regards, PedroRibeiro mailto:pribeiro-bulk@net.ipl.pt