]>
Commit | Line | Data |
---|---|---|
43f393ca TG |
1 | /* |
2 | * Creates audit record for dropped/accepted packets | |
3 | * | |
4 | * (C) 2010-2011 Thomas Graf <tgraf@redhat.com> | |
5 | * (C) 2010-2011 Red Hat, Inc. | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
10 | */ | |
11 | ||
12 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
13 | ||
14 | #include <linux/audit.h> | |
15 | #include <linux/module.h> | |
16 | #include <linux/skbuff.h> | |
17 | #include <linux/tcp.h> | |
18 | #include <linux/udp.h> | |
19 | #include <linux/if_arp.h> | |
20 | #include <linux/netfilter/x_tables.h> | |
21 | #include <linux/netfilter/xt_AUDIT.h> | |
400b871b | 22 | #include <linux/netfilter_bridge/ebtables.h> |
43f393ca TG |
23 | #include <net/ipv6.h> |
24 | #include <net/ip.h> | |
25 | ||
26 | MODULE_LICENSE("GPL"); | |
27 | MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>"); | |
28 | MODULE_DESCRIPTION("Xtables: creates audit records for dropped/accepted packets"); | |
29 | MODULE_ALIAS("ipt_AUDIT"); | |
30 | MODULE_ALIAS("ip6t_AUDIT"); | |
31 | MODULE_ALIAS("ebt_AUDIT"); | |
32 | MODULE_ALIAS("arpt_AUDIT"); | |
33 | ||
34 | static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb, | |
35 | unsigned int proto, unsigned int offset) | |
36 | { | |
37 | switch (proto) { | |
38 | case IPPROTO_TCP: | |
39 | case IPPROTO_UDP: | |
40 | case IPPROTO_UDPLITE: { | |
41 | const __be16 *pptr; | |
42 | __be16 _ports[2]; | |
43 | ||
44 | pptr = skb_header_pointer(skb, offset, sizeof(_ports), _ports); | |
45 | if (pptr == NULL) { | |
46 | audit_log_format(ab, " truncated=1"); | |
47 | return; | |
48 | } | |
49 | ||
50 | audit_log_format(ab, " sport=%hu dport=%hu", | |
51 | ntohs(pptr[0]), ntohs(pptr[1])); | |
52 | } | |
53 | break; | |
54 | ||
55 | case IPPROTO_ICMP: | |
56 | case IPPROTO_ICMPV6: { | |
57 | const u8 *iptr; | |
58 | u8 _ih[2]; | |
59 | ||
60 | iptr = skb_header_pointer(skb, offset, sizeof(_ih), &_ih); | |
61 | if (iptr == NULL) { | |
62 | audit_log_format(ab, " truncated=1"); | |
63 | return; | |
64 | } | |
65 | ||
66 | audit_log_format(ab, " icmptype=%hhu icmpcode=%hhu", | |
67 | iptr[0], iptr[1]); | |
68 | ||
69 | } | |
70 | break; | |
71 | } | |
72 | } | |
73 | ||
74 | static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) | |
75 | { | |
76 | struct iphdr _iph; | |
77 | const struct iphdr *ih; | |
78 | ||
79 | ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); | |
80 | if (!ih) { | |
81 | audit_log_format(ab, " truncated=1"); | |
82 | return; | |
83 | } | |
84 | ||
85 | audit_log_format(ab, " saddr=%pI4 daddr=%pI4 ipid=%hu proto=%hhu", | |
86 | &ih->saddr, &ih->daddr, ntohs(ih->id), ih->protocol); | |
87 | ||
88 | if (ntohs(ih->frag_off) & IP_OFFSET) { | |
89 | audit_log_format(ab, " frag=1"); | |
90 | return; | |
91 | } | |
92 | ||
93 | audit_proto(ab, skb, ih->protocol, ih->ihl * 4); | |
94 | } | |
95 | ||
96 | static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) | |
97 | { | |
98 | struct ipv6hdr _ip6h; | |
99 | const struct ipv6hdr *ih; | |
100 | u8 nexthdr; | |
75f2811c | 101 | __be16 frag_off; |
43f393ca TG |
102 | int offset; |
103 | ||
104 | ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h); | |
105 | if (!ih) { | |
106 | audit_log_format(ab, " truncated=1"); | |
107 | return; | |
108 | } | |
109 | ||
110 | nexthdr = ih->nexthdr; | |
111 | offset = ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), | |
75f2811c | 112 | &nexthdr, &frag_off); |
43f393ca TG |
113 | |
114 | audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", | |
115 | &ih->saddr, &ih->daddr, nexthdr); | |
116 | ||
117 | if (offset) | |
118 | audit_proto(ab, skb, nexthdr, offset); | |
119 | } | |
120 | ||
121 | static unsigned int | |
122 | audit_tg(struct sk_buff *skb, const struct xt_action_param *par) | |
123 | { | |
124 | const struct xt_audit_info *info = par->targinfo; | |
125 | struct audit_buffer *ab; | |
126 | ||
ed018fa4 G |
127 | if (audit_enabled == 0) |
128 | goto errout; | |
129 | ||
43f393ca TG |
130 | ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); |
131 | if (ab == NULL) | |
132 | goto errout; | |
133 | ||
134 | audit_log_format(ab, "action=%hhu hook=%u len=%u inif=%s outif=%s", | |
613dbd95 PNA |
135 | info->type, xt_hooknum(par), skb->len, |
136 | xt_in(par) ? xt_inname(par) : "?", | |
137 | xt_out(par) ? xt_outname(par) : "?"); | |
43f393ca TG |
138 | |
139 | if (skb->mark) | |
140 | audit_log_format(ab, " mark=%#x", skb->mark); | |
141 | ||
142 | if (skb->dev && skb->dev->type == ARPHRD_ETHER) { | |
143 | audit_log_format(ab, " smac=%pM dmac=%pM macproto=0x%04x", | |
144 | eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, | |
145 | ntohs(eth_hdr(skb)->h_proto)); | |
146 | ||
613dbd95 | 147 | if (xt_family(par) == NFPROTO_BRIDGE) { |
43f393ca | 148 | switch (eth_hdr(skb)->h_proto) { |
b80edf0b | 149 | case htons(ETH_P_IP): |
43f393ca TG |
150 | audit_ip4(ab, skb); |
151 | break; | |
152 | ||
b80edf0b | 153 | case htons(ETH_P_IPV6): |
43f393ca TG |
154 | audit_ip6(ab, skb); |
155 | break; | |
156 | } | |
157 | } | |
158 | } | |
159 | ||
613dbd95 | 160 | switch (xt_family(par)) { |
43f393ca TG |
161 | case NFPROTO_IPV4: |
162 | audit_ip4(ab, skb); | |
163 | break; | |
164 | ||
165 | case NFPROTO_IPV6: | |
166 | audit_ip6(ab, skb); | |
167 | break; | |
168 | } | |
169 | ||
131ad62d MDF |
170 | #ifdef CONFIG_NETWORK_SECMARK |
171 | if (skb->secmark) | |
172 | audit_log_secctx(ab, skb->secmark); | |
173 | #endif | |
174 | ||
43f393ca TG |
175 | audit_log_end(ab); |
176 | ||
177 | errout: | |
178 | return XT_CONTINUE; | |
179 | } | |
180 | ||
400b871b TG |
181 | static unsigned int |
182 | audit_tg_ebt(struct sk_buff *skb, const struct xt_action_param *par) | |
183 | { | |
184 | audit_tg(skb, par); | |
185 | return EBT_CONTINUE; | |
186 | } | |
187 | ||
43f393ca TG |
188 | static int audit_tg_check(const struct xt_tgchk_param *par) |
189 | { | |
190 | const struct xt_audit_info *info = par->targinfo; | |
191 | ||
192 | if (info->type > XT_AUDIT_TYPE_MAX) { | |
193 | pr_info("Audit type out of range (valid range: 0..%hhu)\n", | |
194 | XT_AUDIT_TYPE_MAX); | |
195 | return -ERANGE; | |
196 | } | |
197 | ||
198 | return 0; | |
199 | } | |
200 | ||
400b871b TG |
201 | static struct xt_target audit_tg_reg[] __read_mostly = { |
202 | { | |
203 | .name = "AUDIT", | |
204 | .family = NFPROTO_UNSPEC, | |
205 | .target = audit_tg, | |
206 | .targetsize = sizeof(struct xt_audit_info), | |
207 | .checkentry = audit_tg_check, | |
208 | .me = THIS_MODULE, | |
209 | }, | |
210 | { | |
211 | .name = "AUDIT", | |
212 | .family = NFPROTO_BRIDGE, | |
213 | .target = audit_tg_ebt, | |
214 | .targetsize = sizeof(struct xt_audit_info), | |
215 | .checkentry = audit_tg_check, | |
216 | .me = THIS_MODULE, | |
217 | }, | |
43f393ca TG |
218 | }; |
219 | ||
220 | static int __init audit_tg_init(void) | |
221 | { | |
400b871b | 222 | return xt_register_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); |
43f393ca TG |
223 | } |
224 | ||
225 | static void __exit audit_tg_exit(void) | |
226 | { | |
400b871b | 227 | xt_unregister_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); |
43f393ca TG |
228 | } |
229 | ||
230 | module_init(audit_tg_init); | |
231 | module_exit(audit_tg_exit); |