Log ARP headers

Log ARP headers

[Slavko]

Hi,

i want to log ARP headers, thus i create arp family table
with one chain with only one rule, somethong as:

    arp operation request limit ... countef log group 2 prefix ...

It basically works, counter grows and packets are logged
via ulogd2 stack::

    stack=log2a:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,gp1:GPRINT

Except that the log entries has not any ARP headers.

Then i found this article [1], which mentions the ARP as
sysctlt key:

    net.netfilter.nf_log.3

Thus i set it to "nfnetlink_log", but that doesn't help. It
is hard to find what these numbers are, but i guess that
family constants, as 2, 7 and 10 (from ulogd2 start log)
coresponds to inet, inet6 and bridge family, but i am not
aware of arp family...

I guess that ulogd2 is able to log ARP headers as i found
them in BASE plugin's info output, but please what i have
to do to get them into log? Or problem is, that i play with
it inside LXC container (other logging works in it)?

regards

[1] <https://fedoramagazine.org/network-address-translation-part-4-conntrack-troubleshooting/

-- 
Slavko
https://www.slavino.sk/

Re: Log ARP headers

[Florian Westphal]

Slavko <linux@slavino.sk> wrote:
> i want to log ARP headers, thus i create arp family table
> with one chain with only one rule, somethong as:
> 
>     arp operation request limit ... countef log group 2 prefix ...
> 
> It basically works, counter grows and packets are logged
> via ulogd2 stack::
> 
>     stack=log2a:NFLOG,base1:BASE,ifi1:IFINDEX,ip2str1:IP2STR,mac2str1:HWHDR,gp1:GPRINT
> 
> Except that the log entries has not any ARP headers.
> 
> Then i found this article [1], which mentions the ARP as
> sysctlt key:
> 
>     net.netfilter.nf_log.3

This is only required for logging that is triggered
internally, e.g. for nf_conntrack.log_Invalid.

Its not needed when using LOG or NFLOG targets or
the nftables equivalents, when rule gets triggered
its crytal clear which backend should be used.

> Thus i set it to "nfnetlink_log", but that doesn't help. It
> is hard to find what these numbers are, but i guess that
> family constants, as 2, 7 and 10 (from ulogd2 start log)
> coresponds to inet, inet6 and bridge family, but i am not
> aware of arp family...
> 
> I guess that ulogd2 is able to log ARP headers as i found
> them in BASE plugin's info output, but please what i have
> to do to get them into log? Or problem is, that i play with
> it inside LXC container (other logging works in it)?

I think this is missing support in ulogd2.

Untested, to give you some starting point:
(3 is NFPROTO_ARP).

--- a/filter/raw2packet/ulogd_raw2packet_BASE.c
+++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
@@ -959,6 +959,8 @@ static int _interp_pkt(struct ulogd_pluginstance *pi)
                return _interp_ipv6hdr(pi, len);
        case AF_BRIDGE:
                return _interp_bridge(pi, len);
+       case 3:
+               return _interp_arp(pi, len);
        }
        return ULOGD_IRET_OK;
 }

Re: Log ARP headers

[Slavko]

On 3. marca 2025 19:35:33 UTC, Florian Westphal <fw@strlen.de> wrote:

>This is only required for logging that is triggered
>internally, e.g. for nf_conntrack.log_Invalid.

Oh, many thanks, that was not clear for me from any
related article.

>I think this is missing support in ulogd2.
>
>Untested, to give you some starting point:
>(3 is NFPROTO_ARP).
>
>--- a/filter/raw2packet/ulogd_raw2packet_BASE.c
>+++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
>@@ -959,6 +959,8 @@ static int _interp_pkt(struct ulogd_pluginstance *pi)
>                return _interp_ipv6hdr(pi, len);
>        case AF_BRIDGE:
>                return _interp_bridge(pi, len);
>+       case 3:
>+               return _interp_arp(pi, len);
>        }
>        return ULOGD_IRET_OK;
> }

Unfortunately, i don't speak C ;-) I understand this change,
but i cannot see all consequence,

Any chance that it will go to ulogd itself? Or i have to maintain
this patch locally only? (I mean for future versions)

regards


-- 
Slavko
https://www.slavino.sk/

Re: Log ARP headers

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 1146 bytes --]

On 2025-03-03, at 21:52:07 +0000, Slavko wrote:
> On 3. marca 2025 19:35:33 UTC, Florian Westphal <fw@strlen.de> wrote:
> > This is only required for logging that is triggered internally,
> > e.g. for nf_conntrack.log_Invalid.
>
> Oh, many thanks, that was not clear for me from any related article.
>
> > I think this is missing support in ulogd2.
> >
> > Untested, to give you some starting point:
> > (3 is NFPROTO_ARP).
> >
> > --- a/filter/raw2packet/ulogd_raw2packet_BASE.c
> > +++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
> > @@ -959,6 +959,8 @@ static int _interp_pkt(struct ulogd_pluginstance *pi)
> >                 return _interp_ipv6hdr(pi, len);
> >         case AF_BRIDGE:
> >                 return _interp_bridge(pi, len);
> > +       case 3:
> > +               return _interp_arp(pi, len);
> >         }
> >         return ULOGD_IRET_OK;
> >  }
>
> Unfortunately, i don't speak C ;-)

I do.

> I understand this change, but i cannot see all consequence,
>
> Any chance that it will go to ulogd itself? Or i have to maintain
> this patch locally only? (I mean for future versions)

I'll look at this when I get a moment.

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]

Re: Log ARP headers

[Florian Westphal]

Slavko <linux@slavino.sk> wrote:
> >I think this is missing support in ulogd2.
> >
> >Untested, to give you some starting point:
> >(3 is NFPROTO_ARP).
> >
> >--- a/filter/raw2packet/ulogd_raw2packet_BASE.c
> >+++ b/filter/raw2packet/ulogd_raw2packet_BASE.c
> >@@ -959,6 +959,8 @@ static int _interp_pkt(struct ulogd_pluginstance *pi)
> >                return _interp_ipv6hdr(pi, len);
> >        case AF_BRIDGE:
> >                return _interp_bridge(pi, len);
> >+       case 3:
> >+               return _interp_arp(pi, len);
> >        }
> >        return ULOGD_IRET_OK;
> > }
> 
> Unfortunately, i don't speak C ;-) I understand this change,
> but i cannot see all consequence,
> 
> Any chance that it will go to ulogd itself? Or i have to maintain
> this patch locally only? (I mean for future versions)

Can you test and report back if this works?
I have no idea what I am doing as I don't use ulogd.

Re: Log ARP headers

[Slavko]

On 3. marca 2025 22:03:34 UTC, Florian Westphal <fw@strlen.de> wrote:

>Can you test and report back if this works?

I have that in my plan, with a little luck i will patch
and test debian stable's package at weekend, with
more luck even sooner :-)

regards


-- 
Slavko
https://www.slavino.sk/

Re: Log ARP headers

[Slavko]

Ahoj,

Dňa Mon, 3 Mar 2025 23:03:34 +0100 Florian Westphal <fw@strlen.de>
napísal:

> Can you test and report back if this works?
> I have no idea what I am doing as I don't use ulogd.

I had more luck ;-)

Basically it works. At first attempt i got nothing in GPRINT file, and
in journal i found:

    ulogd[2879765]: Unknown protocol family
    ulogd[2879765]: error during propagate_results

Then i found, that this error comes from IP2STR, thus i shrink stack to
(IMO it has to silently skip it to i don't need separate stack for ARP):

    stack=log2a:NFLOG,base1:BASE,ifi1:IFINDEX,mac2str1:HWHDR,gp1:GPRINT

That "solves" the "Unknown protocol family" problem and packets are
logged with ARP entries (beside others):

    arp.hwtype=1,
    arp.protocoltype=2048,
    arp.operation=1,
    arp.saddr=158.160.47.125,
    arp.daddr=168.160.47.125,

Big **but** is, that the values of "arp.[ds]addr" are wrong, these IPs
as captured by tcpdump:

    ARP, Request who-has 192.168.10.254 tell 192.168.10.15, length 28

Another (less important) point, the field:

    oob.protocol=2054

is three times in one log line with that stack.

That is all, what i noticed yet...

regards

-- 
Slavko
https://www.slavino.sk

Re: Log ARP headers

[Slavko]

On 5. marca 2025 13:20:16 UTC, Slavko <linux@slavino.sk> wrote:

>That "solves" the "Unknown protocol family" problem and packets are
>logged with ARP entries (beside others):
>
>    arp.hwtype=1,
>    arp.protocoltype=2048,
>    arp.operation=1,
>    arp.saddr=158.160.47.125,
>    arp.daddr=168.160.47.125,

Ah, i forget to mention, that fields "arp.[ds]hwaddr" are missing
in log.

regards


-- 
Slavko
https://www.slavino.sk/

Re: Log ARP headers

[Slavko]

Ahoj,

Dňa Mon, 3 Mar 2025 22:00:55 +0000 Jeremy Sowden <jeremy@azazel.net>
napísal:

> > I understand this change, but i cannot see all consequence,
> >
> > Any chance that it will go to ulogd itself? Or i have to maintain
> > this patch locally only? (I mean for future versions)  
> 
> I'll look at this when I get a moment.

Please, any progress in this?

-- 
Slavko
https://www.slavino.sk

Re: Log ARP headers

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 573 bytes --]

On 2025-04-05, at 11:54:45 +0200, Slavko wrote:
>Dňa Mon, 3 Mar 2025 22:00:55 +0000 Jeremy Sowden napísal:
> > > I understand this change, but i cannot see all consequence,
> > >
> > > Any chance that it will go to ulogd itself? Or i have to maintain
> > > this patch locally only? (I mean for future versions)
> >
> > I'll look at this when I get a moment.
>
> Please, any progress in this?

Apologies.  Wasn't sure after your continued conversation with Florian
whether my services would be required, and then forgot about it. :) Will
make a start.

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]

Re: Log ARP headers

[Slavko]

On 18. apríla 2025 11:00:54 UTC, Jeremy Sowden <jeremy@azazel.net> wrote:

>Apologies.  Wasn't sure after your continued conversation with Florian
>whether my services would be required, and then forgot about it. :) Will
>make a start.

No problem ;-)

Be free to contact me offlist if some testing will be needed, i have
prepared package in pbuilder already, thus applying patches to it
is simple now (even with my limited C knowledge).

regards


-- 
Slavko
https://www.slavino.sk/

Re: Log ARP headers

[Slavko]

Hi,

Dňa Mon, 3 Mar 2025 22:00:55 +0000 Jeremy Sowden <jeremy@azazel.net>
napísal:

> I'll look at this when I get a moment.

I seen series of patches, i seen some related debate about these
patches and i see some that some parts was pushed to git, then i lost
in it.

Please, is ARP logging working in 2.0.9?

-- 
Slavko
https://www.slavino.sk

Re: Log ARP headers

[Florian Westphal]

Slavko <linux@slavino.sk> wrote:
> Please, is ARP logging working in 2.0.9?

No.

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20250420172025.1994494-7-jeremy@azazel.net/

I'm waiting for Jeremy to rebase and send v2.

Re: Log ARP headers

[Jeremy Sowden]

[-- Attachment #1: Type: text/plain, Size: 301 bytes --]

On 2025-05-25, at 12:33:51 +0200, Florian Westphal wrote:
>Slavko wrote:
>> Please, is ARP logging working in 2.0.9?
>
>No.
>
>https://patchwork.ozlabs.org/project/netfilter-devel/patch/20250420172025.1994494-7-jeremy@azazel.net/
>
>I'm waiting for Jeremy to rebase and send v2.

Coming shortly.

J.


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]