Netfilter

From Segfault
Jump to: navigation, search

IP Accounting

TBD

NFLOG

In the beginning, there was LOG[1]:

> Turn on kernel logging of matching packets.  When this  option  is  set
> for  a  rule,  the  Linux  kernel  will  print  some information on all
> matching packets (like most IP/IPv6 header fields) via the  kernel  log
> (where it can be read with dmesg(1) or read in the syslog).

After that came ULOG[1], but it's already deprecated:

> This is the deprecated ipv4-only predecessor of the NFLOG  target.   It
> provides  userspace  logging  of matching packets.  When this target is
> set for a rule, the Linux kernel will multicast this packet  through  a
> netlink  socket.  One or more userspace processes may then subscribe to
> various multicast groups and receive the packets.

The current way to log messages is NFLOG[1]:

> This  target  provides logging of matching packets. When this target is
> set for a rule, the Linux kernel will pass the  packet  to  the  loaded
> logging  backend to log the packet. This is usually used in combination
> with nfnetlink_log as logging backend, which will multicast the  packet
> through  a netlink socket to the specified multicast group. One or more
> userspace processes may subscribe to the group to receive the  packets.

ulogd2 will be able to receive those messages and should be available in all major distributions. But if it's too outdated, we have to build it outselves. We'll have to build the dependencies first, so this may get messy:

for r in libnfnetlink libmnl libnetfilter_log libnetfilter_conntrack libnetfilter_acct ulogd2; do 
  git clone git://git.netfilter.org/${r} ${r}-git
done
cd libnfnetlink-git
./autogen.sh && ./configure --prefix=/opt/libnfnetlink && make && sudo make install

cd ../libmnl-git/
./autogen.sh && ./configure --prefix=/opt/libmnl && make && sudo make install

cd ../libnetfilter_log-git/
./autogen.sh && LIBNFNETLINK_CFLAGS="-I/opt/libnfnetlink/include" LIBNFNETLINK_LIBS="-L/opt/libnfnetlink/lib" LIBMNL_CFLAGS="-I/opt/libmnl/include" LIBMNL_LIBS="-L/opt/libmnl/lib" ./configure --prefix=/opt/libnetfilter_log && make && sudo make install

cd ../libnetfilter_conntrack-git/
./autogen.sh && LIBNFNETLINK_CFLAGS="-I/opt/libnfnetlink/include" LIBNFNETLINK_LIBS="-L/opt/libnfnetlink/lib" LIBMNL_CFLAGS="-I/opt/libmnl/include" LIBMNL_LIBS="-L/opt/libmnl/lib" ./configure --prefix=/opt/libnetfilter_conntrack && make && sudo make install

cd ../libnetfilter_acct-git/
autoreconf -fi && LIBMNL_CFLAGS="-I/opt/libmnl/include" LIBMNL_LIBS="-L/opt/libmnl/lib" ./configure --prefix=/opt/libnetfilter_acct && make && sudo make install

Once this is done, we can finally compile ulogd:

cd ../ulogd2-git/
./autogen.sh && \
  LIBNFNETLINK_CFLAGS="-I/opt/libnfnetlink/include" \
  LIBNFNETLINK_LIBS="-L/opt/libnfnetlink/lib" 
  LIBMNL_CFLAGS="-I/opt/libmnl/include" \
  LIBMNL_LIBS="-L/opt/libmnl/lib" \
  LIBNETFILTER_LOG_CFLAGS="-I/opt/libnetfilter_log/include" \
  LIBNETFILTER_LOG_LIBS="-L/opt/libnetfilter_log/lib" \
  LIBNETFILTER_CONNTRACK_CFLAGS="-I/opt/libnetfilter_conntrack/include" \
  LIBNETFILTER_CONNTRACK_LIBS="-L/opt/libnetfilter_conntrack/lib" \
  LIBNETFILTER_ACCT_CFLAGS="-I/opt/libnetfilter_acct/include" \
  LIBNETFILTER_ACCT_LIBS="-L/opt/libnetfilter_acct/lib" \
  CFLAGS="-I/opt/libnfnetlink/include" LDFLAGS="-L/opt/libnfnetlink/lib" \
./configure --prefix=/opt/ulogd2 && make && sudo make install

Note: for some reason we have to point CFLAGS and LDFLAGS to our libnfnetlink installation, otherwise the compilation will fail:

  CC       ulogd_inppkt_NFLOG.lo
ulogd_inppkt_NFLOG.c:13:39: fatal error: libnfnetlink/libnfnetlink.h: No such file or directory

Links


References