ipt_LOG: MAC address output

ipt_LOG: MAC address output

[Thomas Jarosch]

Hello,

below is an ipt_LOG output from kernel 2.6.33.2:

May  3 15:14:40 intratest kernel: REJECT IN=eth0 OUT=
MAC=02:00:00:00:00:29:00:0c:76:28:3e:6c:08:00 SRC=172.16.1.1 DST=172.16.1.145 ...

The MAC address really looks strange if you take
the original data into consideration:

Source: 172.16.1.1 (00:0C:76:28:3E:6C)
Destination: 172.16.1.145 (02:00:00:00:00:29)

The corresponding code in net/ipv4/netfilter/ipt_LOG.c:

ipt_log_packet():
        if (in && !out) {
                /* MAC logging for input chain only. */
                printk("MAC=");
                if (skb->dev && skb->dev->hard_header_len
                    && skb->mac_header != skb->network_header) {
                        int i;
                        const unsigned char *p = skb_mac_header(skb);
                        for (i = 0; i < skb->dev->hard_header_len; i++,p++)
                                printk("%02x%c", *p,
                                       i==skb->dev->hard_header_len - 1
                                       ? ' ':':');
                } else
                        printk(" ");


The current code does the following:
- Output the two MAC addresses separated by ":"
  instead of something readable like " "

- Output the destination MAC address first which
  is a bit unexpected as the first shown IP is
  the IP address of "SRC".
 
  Idea: Maybe print "MACSRC= " and "MACDST= ". Leave out
  the "MACxxx= " output if the MAC address is not known.

- Output "08:00" garbage at the end.

Could it be that "skb->dev->hard_header_len" is longer
than the MAC address header field?

Cheers,
Thomas

Re: ipt_LOG: MAC address output

[Jan Engelhardt]

On Monday 2010-05-03 15:58, Thomas Jarosch wrote:

>Hello,
>
>below is an ipt_LOG output from kernel 2.6.33.2:
>
>May  3 15:14:40 intratest kernel: REJECT IN=eth0 OUT=
>MAC=02:00:00:00:00:29:00:0c:76:28:3e:6c:08:00 SRC=172.16.1.1 DST=172.16.1.145 ...
>
>The MAC address really looks strange if you take
>the original data into consideration:


>- Output "08:00" garbage at the end.

No garbage.

It's not the MAC address, it's the (entire) MAC header that's printed.

Re: ipt_LOG: MAC address output

[Thomas Jarosch]

On Monday, 3. May 2010 17:41:47 Jan Engelhardt wrote:
> >The MAC address really looks strange if you take
> >the original data into consideration:
> >
> >
> >- Output "08:00" garbage at the end.
> 
> No garbage.
> 
> It's not the MAC address, it's the (entire) MAC header that's printed.

Thanks, Jan. So would it make sense to output a human readable
MACSRC= and MACDST=? We also don't print the raw IP header...

Cheers,
Thomas

Re: ipt_LOG: MAC address output

[Jan Engelhardt]

On Friday 2010-05-07 10:02, Thomas Jarosch wrote:

>On Monday, 3. May 2010 17:41:47 Jan Engelhardt wrote:
>> >The MAC address really looks strange if you take
>> >the original data into consideration:
>> >
>> >
>> >- Output "08:00" garbage at the end.
>> 
>> No garbage.
>> 
>> It's not the MAC address, it's the (entire) MAC header that's printed.
>
>Thanks, Jan. So would it make sense to output a human readable
>MACSRC= and MACDST=? We also don't print the raw IP header...

We do print the raw IP options... :)