Commit | Line | Data |
---|---|---|
43f393ca TG |
1 | /* |
2 | * Creates audit record for dropped/accepted packets | |
3 | * | |
4 | * (C) 2010-2011 Thomas Graf <tgraf@redhat.com> | |
5 | * (C) 2010-2011 Red Hat, Inc. | |
6 | * | |
7 | * This program is free software; you can redistribute it and/or modify | |
8 | * it under the terms of the GNU General Public License version 2 as | |
9 | * published by the Free Software Foundation. | |
10 | */ | |
11 | ||
12 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
13 | ||
14 | #include <linux/audit.h> | |
15 | #include <linux/module.h> | |
16 | #include <linux/skbuff.h> | |
17 | #include <linux/tcp.h> | |
18 | #include <linux/udp.h> | |
19 | #include <linux/if_arp.h> | |
20 | #include <linux/netfilter/x_tables.h> | |
21 | #include <linux/netfilter/xt_AUDIT.h> | |
22 | #include <net/ipv6.h> | |
23 | #include <net/ip.h> | |
24 | ||
25 | MODULE_LICENSE("GPL"); | |
26 | MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>"); | |
27 | MODULE_DESCRIPTION("Xtables: creates audit records for dropped/accepted packets"); | |
28 | MODULE_ALIAS("ipt_AUDIT"); | |
29 | MODULE_ALIAS("ip6t_AUDIT"); | |
30 | MODULE_ALIAS("ebt_AUDIT"); | |
31 | MODULE_ALIAS("arpt_AUDIT"); | |
32 | ||
33 | static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb, | |
34 | unsigned int proto, unsigned int offset) | |
35 | { | |
36 | switch (proto) { | |
37 | case IPPROTO_TCP: | |
38 | case IPPROTO_UDP: | |
39 | case IPPROTO_UDPLITE: { | |
40 | const __be16 *pptr; | |
41 | __be16 _ports[2]; | |
42 | ||
43 | pptr = skb_header_pointer(skb, offset, sizeof(_ports), _ports); | |
44 | if (pptr == NULL) { | |
45 | audit_log_format(ab, " truncated=1"); | |
46 | return; | |
47 | } | |
48 | ||
49 | audit_log_format(ab, " sport=%hu dport=%hu", | |
50 | ntohs(pptr[0]), ntohs(pptr[1])); | |
51 | } | |
52 | break; | |
53 | ||
54 | case IPPROTO_ICMP: | |
55 | case IPPROTO_ICMPV6: { | |
56 | const u8 *iptr; | |
57 | u8 _ih[2]; | |
58 | ||
59 | iptr = skb_header_pointer(skb, offset, sizeof(_ih), &_ih); | |
60 | if (iptr == NULL) { | |
61 | audit_log_format(ab, " truncated=1"); | |
62 | return; | |
63 | } | |
64 | ||
65 | audit_log_format(ab, " icmptype=%hhu icmpcode=%hhu", | |
66 | iptr[0], iptr[1]); | |
67 | ||
68 | } | |
69 | break; | |
70 | } | |
71 | } | |
72 | ||
73 | static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) | |
74 | { | |
75 | struct iphdr _iph; | |
76 | const struct iphdr *ih; | |
77 | ||
78 | ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); | |
79 | if (!ih) { | |
80 | audit_log_format(ab, " truncated=1"); | |
81 | return; | |
82 | } | |
83 | ||
84 | audit_log_format(ab, " saddr=%pI4 daddr=%pI4 ipid=%hu proto=%hhu", | |
85 | &ih->saddr, &ih->daddr, ntohs(ih->id), ih->protocol); | |
86 | ||
87 | if (ntohs(ih->frag_off) & IP_OFFSET) { | |
88 | audit_log_format(ab, " frag=1"); | |
89 | return; | |
90 | } | |
91 | ||
92 | audit_proto(ab, skb, ih->protocol, ih->ihl * 4); | |
93 | } | |
94 | ||
95 | static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) | |
96 | { | |
97 | struct ipv6hdr _ip6h; | |
98 | const struct ipv6hdr *ih; | |
99 | u8 nexthdr; | |
100 | int offset; | |
101 | ||
102 | ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h); | |
103 | if (!ih) { | |
104 | audit_log_format(ab, " truncated=1"); | |
105 | return; | |
106 | } | |
107 | ||
108 | nexthdr = ih->nexthdr; | |
109 | offset = ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), | |
110 | &nexthdr); | |
111 | ||
112 | audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", | |
113 | &ih->saddr, &ih->daddr, nexthdr); | |
114 | ||
115 | if (offset) | |
116 | audit_proto(ab, skb, nexthdr, offset); | |
117 | } | |
118 | ||
119 | static unsigned int | |
120 | audit_tg(struct sk_buff *skb, const struct xt_action_param *par) | |
121 | { | |
122 | const struct xt_audit_info *info = par->targinfo; | |
123 | struct audit_buffer *ab; | |
124 | ||
125 | ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); | |
126 | if (ab == NULL) | |
127 | goto errout; | |
128 | ||
129 | audit_log_format(ab, "action=%hhu hook=%u len=%u inif=%s outif=%s", | |
130 | info->type, par->hooknum, skb->len, | |
131 | par->in ? par->in->name : "?", | |
132 | par->out ? par->out->name : "?"); | |
133 | ||
134 | if (skb->mark) | |
135 | audit_log_format(ab, " mark=%#x", skb->mark); | |
136 | ||
137 | if (skb->dev && skb->dev->type == ARPHRD_ETHER) { | |
138 | audit_log_format(ab, " smac=%pM dmac=%pM macproto=0x%04x", | |
139 | eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, | |
140 | ntohs(eth_hdr(skb)->h_proto)); | |
141 | ||
142 | if (par->family == NFPROTO_BRIDGE) { | |
143 | switch (eth_hdr(skb)->h_proto) { | |
144 | case __constant_htons(ETH_P_IP): | |
145 | audit_ip4(ab, skb); | |
146 | break; | |
147 | ||
148 | case __constant_htons(ETH_P_IPV6): | |
149 | audit_ip6(ab, skb); | |
150 | break; | |
151 | } | |
152 | } | |
153 | } | |
154 | ||
155 | switch (par->family) { | |
156 | case NFPROTO_IPV4: | |
157 | audit_ip4(ab, skb); | |
158 | break; | |
159 | ||
160 | case NFPROTO_IPV6: | |
161 | audit_ip6(ab, skb); | |
162 | break; | |
163 | } | |
164 | ||
165 | audit_log_end(ab); | |
166 | ||
167 | errout: | |
168 | return XT_CONTINUE; | |
169 | } | |
170 | ||
171 | static int audit_tg_check(const struct xt_tgchk_param *par) | |
172 | { | |
173 | const struct xt_audit_info *info = par->targinfo; | |
174 | ||
175 | if (info->type > XT_AUDIT_TYPE_MAX) { | |
176 | pr_info("Audit type out of range (valid range: 0..%hhu)\n", | |
177 | XT_AUDIT_TYPE_MAX); | |
178 | return -ERANGE; | |
179 | } | |
180 | ||
181 | return 0; | |
182 | } | |
183 | ||
184 | static struct xt_target audit_tg_reg __read_mostly = { | |
185 | .name = "AUDIT", | |
186 | .family = NFPROTO_UNSPEC, | |
187 | .target = audit_tg, | |
188 | .targetsize = sizeof(struct xt_audit_info), | |
189 | .checkentry = audit_tg_check, | |
190 | .me = THIS_MODULE, | |
191 | }; | |
192 | ||
193 | static int __init audit_tg_init(void) | |
194 | { | |
195 | return xt_register_target(&audit_tg_reg); | |
196 | } | |
197 | ||
198 | static void __exit audit_tg_exit(void) | |
199 | { | |
200 | xt_unregister_target(&audit_tg_reg); | |
201 | } | |
202 | ||
203 | module_init(audit_tg_init); | |
204 | module_exit(audit_tg_exit); |