add conntrack logging to pvefw-logger including timestamps (requires
/proc/sys/net/netfilter/nf_conntrack_timestamp to be 1).
this allows the tracking of sessions (start, end timestamps with
nf_conntrack_timestamp on [DESTROY] messages). commit includes
Build-Depends inclusion of libnetfilter-conntrack-dev and
libnetfilter_conntrack library in the Makefile.
conntrack can also be enabled by passing --contrack on the command line.
Signed-off-by: David Limbeck <***@proxmox.com>
---
debian/control | 1 +
src/Makefile | 2 +-
src/pvefw-logger.c | 75 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 77 insertions(+), 1 deletion(-)
diff --git a/debian/control b/debian/control
index a68a81c..2a92b16 100644
--- a/debian/control
+++ b/debian/control
@@ -5,6 +5,7 @@ Maintainer: Proxmox Support Team <***@proxmox.com>
Build-Depends: debhelper (>= 7.0.50~),
dh-systemd,
libglib2.0-dev,
+ libnetfilter-conntrack-dev,
libnetfilter-log-dev,
libpve-common-perl,
pve-cluster,
diff --git a/src/Makefile b/src/Makefile
index ed74393..a35e53d 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -25,7 +25,7 @@ LDFLAGS:=$(shell dpkg-buildflags --get LDFLAGS)
pvefw-logger: pvefw-logger.c
gcc -Wall -Werror pvefw-logger.c -o pvefw-logger -std=gnu99 \
$(CPPFLAGS) $(CFLAGS) $(LDFLAGS) \
- $(shell pkg-config libnetfilter_log glib-2.0 --libs --cflags)
+ $(shell pkg-config libnetfilter_log libnetfilter_conntrack glib-2.0 --libs --cflags)
.PHONY: install
install: pve-firewall pve-firewall.8 pve-firewall.bash-completion pvefw-logger
diff --git a/src/pvefw-logger.c b/src/pvefw-logger.c
index 2bd869c..bea7e5a 100644
--- a/src/pvefw-logger.c
+++ b/src/pvefw-logger.c
@@ -40,6 +40,7 @@
#include <linux/netlink.h>
#include <libnfnetlink/libnfnetlink.h>
#include <libnetfilter_log/libnetfilter_log.h>
+#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
#include <netinet/ip6.h>
@@ -53,10 +54,12 @@
static struct nflog_handle *logh = NULL;
static struct nlif_handle *nlifh = NULL;
+static struct nfct_handle *nfcth = NULL;
GMainLoop *main_loop;
gboolean foreground = FALSE;
gboolean debug = FALSE;
+gboolean conntrack = FALSE;
/*
@@ -917,6 +920,42 @@ signal_read_cb(GIOChannel *source,
return TRUE;
}
+static int
+nfct_cb(const struct nlmsghdr *nlh,
+ enum nf_conntrack_msg_type type,
+ struct nf_conntrack *ct,
+ void *data)
+{
+ struct log_entry *le = g_new0(struct log_entry, 1);
+ int len = nfct_snprintf(&le->buf[le->len], LE_MAX - le->len,
+ ct, type, NFCT_O_DEFAULT,
+ NFCT_OF_SHOW_LAYER3|NFCT_OF_TIMESTAMP);
+ le->len += len;
+
+ if (le->len == LE_MAX) {
+ le->buf[le->len-1] = '\n';
+ } else { // le->len < LE_MAX
+ le->buf[le->len++] = '\n';
+ }
+
+ queue_log_entry(le);
+
+ return NFCT_CB_STOP;
+}
+
+static gboolean
+nfct_read_cb(GIOChannel *source,
+ GIOCondition condition,
+ gpointer data)
+{
+ int res;
+ if ((res = nfct_catch(nfcth)) < 0) {
+ log_status_message(3, "error catching nfct");
+ return FALSE;
+ }
+ return TRUE;
+}
+
int
main(int argc, char *argv[])
{
@@ -932,6 +971,7 @@ main(int argc, char *argv[])
GOptionEntry entries[] = {
{ "debug", 'd', 0, G_OPTION_ARG_NONE, &debug, "Turn on debug messages", NULL },
{ "foreground", 'f', 0, G_OPTION_ARG_NONE, &foreground, "Do not daemonize server", NULL },
+ { "conntrack", 0, 0, G_OPTION_ARG_NONE, &conntrack, "Add conntrack logging", NULL },
{ NULL },
};
@@ -954,6 +994,22 @@ main(int argc, char *argv[])
g_option_context_free(context);
+ if (!conntrack) {
+ int log_nf_conntrackfd = open("/var/lib/pve-firewall/log_nf_conntrack", O_RDONLY);
+ if (log_nf_conntrackfd == -1) {
+ fprintf(stderr, "error: failed to open /var/lib/pve-firewall/log_nf_conntrack: %s\n", strerror(errno));
+ } else {
+ char c = '0';
+ ssize_t bytes = read(log_nf_conntrackfd, &c, sizeof(c));
+ if (bytes < 0) {
+ fprintf(stderr, "error: failed to read value in log_nf_conntrack: %s\n", strerror(errno));
+ } else {
+ // should be either '0' or '1' so subtract '0' for either 0 or 1
+ conntrack = c-'0';
+ }
+ }
+ }
+
if (debug) foreground = TRUE;
if ((lockfd = open(LOCKFILE, O_RDWR|O_CREAT|O_APPEND, 0644)) == -1) {
@@ -1017,6 +1073,13 @@ main(int argc, char *argv[])
exit(-1);
}
+ if (conntrack) {
+ if ((nfcth = nfct_open(CONNTRACK, NF_NETLINK_CONNTRACK_NEW|NF_NETLINK_CONNTRACK_DESTROY)) == NULL) {
+ fprintf(stderr, "unable to open netfilter conntrack\n");
+ exit(-1);
+ }
+ }
+
sigset_t mask;
sigemptyset(&mask);
sigaddset(&mask, SIGINT);
@@ -1076,6 +1139,13 @@ main(int argc, char *argv[])
g_io_add_watch(nflog_ch, G_IO_IN, nflog_read_cb, NULL);
+ if (conntrack) {
+ nfct_callback_register2(nfcth, NFCT_T_NEW|NFCT_T_DESTROY, &nfct_cb, NULL);
+ int nfctfd = nfct_fd(nfcth);
+ GIOChannel *nfct_ch = g_io_channel_unix_new(nfctfd);
+ g_io_add_watch(nfct_ch, G_IO_IN, nfct_read_cb, NULL);
+ }
+
GIOChannel *sig_ch = g_io_channel_unix_new(sigfd);
if (!g_io_add_watch(sig_ch, G_IO_IN, signal_read_cb, NULL)) {
exit(-1);
@@ -1093,6 +1163,11 @@ main(int argc, char *argv[])
close(outfd);
+ if (conntrack) {
+ nfct_callback_unregister2(nfcth);
+ nfct_close(nfcth);
+ }
+
nflog_close(logh);
if (wrote_pidfile)
--
2.11.0