Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
43f393ca TG |
2 | /* |
3 | * Creates audit record for dropped/accepted packets | |
4 | * | |
5 | * (C) 2010-2011 Thomas Graf <tgraf@redhat.com> | |
6 | * (C) 2010-2011 Red Hat, Inc. | |
43f393ca TG |
7 | */ |
8 | ||
9 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt | |
10 | ||
11 | #include <linux/audit.h> | |
12 | #include <linux/module.h> | |
13 | #include <linux/skbuff.h> | |
14 | #include <linux/tcp.h> | |
15 | #include <linux/udp.h> | |
16 | #include <linux/if_arp.h> | |
17 | #include <linux/netfilter/x_tables.h> | |
18 | #include <linux/netfilter/xt_AUDIT.h> | |
400b871b | 19 | #include <linux/netfilter_bridge/ebtables.h> |
43f393ca TG |
20 | #include <net/ipv6.h> |
21 | #include <net/ip.h> | |
22 | ||
23 | MODULE_LICENSE("GPL"); | |
24 | MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>"); | |
25 | MODULE_DESCRIPTION("Xtables: creates audit records for dropped/accepted packets"); | |
26 | MODULE_ALIAS("ipt_AUDIT"); | |
27 | MODULE_ALIAS("ip6t_AUDIT"); | |
28 | MODULE_ALIAS("ebt_AUDIT"); | |
29 | MODULE_ALIAS("arpt_AUDIT"); | |
30 | ||
2173c519 | 31 | static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) |
43f393ca TG |
32 | { |
33 | struct iphdr _iph; | |
34 | const struct iphdr *ih; | |
35 | ||
0cb88b6f | 36 | ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph); |
2173c519 RGB |
37 | if (!ih) |
38 | return false; | |
43f393ca | 39 | |
2173c519 RGB |
40 | audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu", |
41 | &ih->saddr, &ih->daddr, ih->protocol); | |
43f393ca | 42 | |
2173c519 | 43 | return true; |
43f393ca TG |
44 | } |
45 | ||
2173c519 | 46 | static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) |
43f393ca TG |
47 | { |
48 | struct ipv6hdr _ip6h; | |
49 | const struct ipv6hdr *ih; | |
50 | u8 nexthdr; | |
75f2811c | 51 | __be16 frag_off; |
43f393ca TG |
52 | |
53 | ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h); | |
2173c519 RGB |
54 | if (!ih) |
55 | return false; | |
43f393ca TG |
56 | |
57 | nexthdr = ih->nexthdr; | |
2173c519 | 58 | ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off); |
43f393ca TG |
59 | |
60 | audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", | |
61 | &ih->saddr, &ih->daddr, nexthdr); | |
62 | ||
2173c519 | 63 | return true; |
43f393ca TG |
64 | } |
65 | ||
66 | static unsigned int | |
67 | audit_tg(struct sk_buff *skb, const struct xt_action_param *par) | |
68 | { | |
43f393ca | 69 | struct audit_buffer *ab; |
2173c519 | 70 | int fam = -1; |
43f393ca | 71 | |
f7859590 | 72 | if (audit_enabled == AUDIT_OFF) |
ed018fa4 | 73 | goto errout; |
43f393ca TG |
74 | ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); |
75 | if (ab == NULL) | |
76 | goto errout; | |
77 | ||
2173c519 | 78 | audit_log_format(ab, "mark=%#x", skb->mark); |
43f393ca | 79 | |
613dbd95 | 80 | switch (xt_family(par)) { |
2173c519 RGB |
81 | case NFPROTO_BRIDGE: |
82 | switch (eth_hdr(skb)->h_proto) { | |
83 | case htons(ETH_P_IP): | |
84 | fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; | |
85 | break; | |
86 | case htons(ETH_P_IPV6): | |
87 | fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; | |
88 | break; | |
89 | } | |
90 | break; | |
43f393ca | 91 | case NFPROTO_IPV4: |
2173c519 | 92 | fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; |
43f393ca | 93 | break; |
43f393ca | 94 | case NFPROTO_IPV6: |
2173c519 | 95 | fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; |
43f393ca TG |
96 | break; |
97 | } | |
98 | ||
2173c519 RGB |
99 | if (fam == -1) |
100 | audit_log_format(ab, " saddr=? daddr=? proto=-1"); | |
131ad62d | 101 | |
43f393ca TG |
102 | audit_log_end(ab); |
103 | ||
104 | errout: | |
105 | return XT_CONTINUE; | |
106 | } | |
107 | ||
400b871b TG |
108 | static unsigned int |
109 | audit_tg_ebt(struct sk_buff *skb, const struct xt_action_param *par) | |
110 | { | |
111 | audit_tg(skb, par); | |
112 | return EBT_CONTINUE; | |
113 | } | |
114 | ||
43f393ca TG |
115 | static int audit_tg_check(const struct xt_tgchk_param *par) |
116 | { | |
117 | const struct xt_audit_info *info = par->targinfo; | |
118 | ||
119 | if (info->type > XT_AUDIT_TYPE_MAX) { | |
b2606644 FW |
120 | pr_info_ratelimited("Audit type out of range (valid range: 0..%hhu)\n", |
121 | XT_AUDIT_TYPE_MAX); | |
43f393ca TG |
122 | return -ERANGE; |
123 | } | |
124 | ||
125 | return 0; | |
126 | } | |
127 | ||
400b871b TG |
128 | static struct xt_target audit_tg_reg[] __read_mostly = { |
129 | { | |
130 | .name = "AUDIT", | |
131 | .family = NFPROTO_UNSPEC, | |
132 | .target = audit_tg, | |
133 | .targetsize = sizeof(struct xt_audit_info), | |
134 | .checkentry = audit_tg_check, | |
135 | .me = THIS_MODULE, | |
136 | }, | |
137 | { | |
138 | .name = "AUDIT", | |
139 | .family = NFPROTO_BRIDGE, | |
140 | .target = audit_tg_ebt, | |
141 | .targetsize = sizeof(struct xt_audit_info), | |
142 | .checkentry = audit_tg_check, | |
143 | .me = THIS_MODULE, | |
144 | }, | |
43f393ca TG |
145 | }; |
146 | ||
147 | static int __init audit_tg_init(void) | |
148 | { | |
400b871b | 149 | return xt_register_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); |
43f393ca TG |
150 | } |
151 | ||
152 | static void __exit audit_tg_exit(void) | |
153 | { | |
400b871b | 154 | xt_unregister_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); |
43f393ca TG |
155 | } |
156 | ||
157 | module_init(audit_tg_init); | |
158 | module_exit(audit_tg_exit); |