Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 74f7a655 authored by Patrick McHardy's avatar Patrick McHardy
Browse files

netfilter: nf_conntrack: log packets dropped by helpers 



Log packets dropped by helpers using the netfilter logging API. This
is useful in combination with nfnetlink_log to analyze those packets
in userspace for debugging.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
parent f3abc9b9

net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c

+5 −1
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <net/netfilter/ipv4/nf_conntrack_ipv4.h>

#include <net/netfilter/nf_nat_helper.h>

#include <net/netfilter/ipv4/nf_defrag_ipv4.h>

#include <net/netfilter/nf_log.h>



int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,

			      struct nf_conn *ct,
@@ -113,8 +114,11 @@ static unsigned int ipv4_confirm(unsigned int hooknum, 


	ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),

			   ct, ctinfo);

	if (ret != NF_ACCEPT)

	if (ret != NF_ACCEPT) {

		nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,

			      "nf_ct_%s: dropping packet", helper->name);

		return ret;

	}



	if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {

		typeof(nf_nat_seq_adjust_hook) seq_adjust;

net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c

+5 −1
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#include <net/netfilter/nf_conntrack_l3proto.h>

#include <net/netfilter/nf_conntrack_core.h>

#include <net/netfilter/ipv6/nf_conntrack_ipv6.h>

#include <net/netfilter/nf_log.h>



static bool ipv6_pkt_to_tuple(const struct sk_buff *skb, unsigned int nhoff,

			      struct nf_conntrack_tuple *tuple)
@@ -176,8 +177,11 @@ static unsigned int ipv6_confirm(unsigned int hooknum, 
	}



	ret = helper->help(skb, protoff, ct, ctinfo);

	if (ret != NF_ACCEPT)

	if (ret != NF_ACCEPT) {

		nf_log_packet(NFPROTO_IPV6, hooknum, skb, in, out, NULL,

			      "nf_ct_%s: dropping packet", helper->name);

		return ret;

	}

out:

	/* We've seen it coming out the other side: confirm it */

	return nf_conntrack_confirm(skb);