1 /* 2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net> 3 * Copyright (c) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Development of this code funded by Astaro AG (http://www.astaro.com/) 10 */ 11 12 #include <linux/audit.h> 13 #include <linux/kernel.h> 14 #include <linux/init.h> 15 #include <linux/module.h> 16 #include <linux/netlink.h> 17 #include <linux/netfilter.h> 18 #include <linux/netfilter/nf_tables.h> 19 #include <net/ipv6.h> 20 #include <net/ip.h> 21 #include <net/netfilter/nf_tables.h> 22 #include <net/netfilter/nf_log.h> 23 #include <linux/netdevice.h> 24 25 static const char *nft_log_null_prefix = ""; 26 27 struct nft_log { 28 struct nf_loginfo loginfo; 29 char *prefix; 30 }; 31 32 static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) 33 { 34 struct iphdr _iph; 35 const struct iphdr *ih; 36 37 ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph); 38 if (!ih) 39 return false; 40 41 audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu", 42 &ih->saddr, &ih->daddr, ih->protocol); 43 44 return true; 45 } 46 47 static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) 48 { 49 struct ipv6hdr _ip6h; 50 const struct ipv6hdr *ih; 51 u8 nexthdr; 52 __be16 frag_off; 53 54 ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h); 55 if (!ih) 56 return false; 57 58 nexthdr = ih->nexthdr; 59 ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off); 60 61 audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", 62 &ih->saddr, &ih->daddr, nexthdr); 63 64 return true; 65 } 66 67 static void nft_log_eval_audit(const struct nft_pktinfo *pkt) 68 { 69 struct sk_buff *skb = pkt->skb; 70 struct audit_buffer *ab; 71 int fam = -1; 72 73 if (!audit_enabled) 74 return; 75 76 ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); 77 if (!ab) 78 return; 79 80 audit_log_format(ab, "mark=%#x", skb->mark); 81 82 switch (nft_pf(pkt)) { 83 case NFPROTO_BRIDGE: 84 switch (eth_hdr(skb)->h_proto) { 85 case htons(ETH_P_IP): 86 fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; 87 break; 88 case htons(ETH_P_IPV6): 89 fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; 90 break; 91 } 92 break; 93 case NFPROTO_IPV4: 94 fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; 95 break; 96 case NFPROTO_IPV6: 97 fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; 98 break; 99 } 100 101 if (fam == -1) 102 audit_log_format(ab, " saddr=? daddr=? proto=-1"); 103 104 audit_log_end(ab); 105 } 106 107 static void nft_log_eval(const struct nft_expr *expr, 108 struct nft_regs *regs, 109 const struct nft_pktinfo *pkt) 110 { 111 const struct nft_log *priv = nft_expr_priv(expr); 112 113 if (priv->loginfo.type == NF_LOG_TYPE_LOG && 114 priv->loginfo.u.log.level == NFT_LOGLEVEL_AUDIT) { 115 nft_log_eval_audit(pkt); 116 return; 117 } 118 119 nf_log_packet(nft_net(pkt), nft_pf(pkt), nft_hook(pkt), pkt->skb, 120 nft_in(pkt), nft_out(pkt), &priv->loginfo, "%s", 121 priv->prefix); 122 } 123 124 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = { 125 [NFTA_LOG_GROUP] = { .type = NLA_U16 }, 126 [NFTA_LOG_PREFIX] = { .type = NLA_STRING, 127 .len = NF_LOG_PREFIXLEN - 1 }, 128 [NFTA_LOG_SNAPLEN] = { .type = NLA_U32 }, 129 [NFTA_LOG_QTHRESHOLD] = { .type = NLA_U16 }, 130 [NFTA_LOG_LEVEL] = { .type = NLA_U32 }, 131 [NFTA_LOG_FLAGS] = { .type = NLA_U32 }, 132 }; 133 134 static int nft_log_init(const struct nft_ctx *ctx, 135 const struct nft_expr *expr, 136 const struct nlattr * const tb[]) 137 { 138 struct nft_log *priv = nft_expr_priv(expr); 139 struct nf_loginfo *li = &priv->loginfo; 140 const struct nlattr *nla; 141 int err; 142 143 li->type = NF_LOG_TYPE_LOG; 144 if (tb[NFTA_LOG_LEVEL] != NULL && 145 tb[NFTA_LOG_GROUP] != NULL) 146 return -EINVAL; 147 if (tb[NFTA_LOG_GROUP] != NULL) { 148 li->type = NF_LOG_TYPE_ULOG; 149 if (tb[NFTA_LOG_FLAGS] != NULL) 150 return -EINVAL; 151 } 152 153 nla = tb[NFTA_LOG_PREFIX]; 154 if (nla != NULL) { 155 priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL); 156 if (priv->prefix == NULL) 157 return -ENOMEM; 158 nla_strlcpy(priv->prefix, nla, nla_len(nla) + 1); 159 } else { 160 priv->prefix = (char *)nft_log_null_prefix; 161 } 162 163 switch (li->type) { 164 case NF_LOG_TYPE_LOG: 165 if (tb[NFTA_LOG_LEVEL] != NULL) { 166 li->u.log.level = 167 ntohl(nla_get_be32(tb[NFTA_LOG_LEVEL])); 168 } else { 169 li->u.log.level = NFT_LOGLEVEL_WARNING; 170 } 171 if (li->u.log.level > NFT_LOGLEVEL_AUDIT) { 172 err = -EINVAL; 173 goto err1; 174 } 175 176 if (tb[NFTA_LOG_FLAGS] != NULL) { 177 li->u.log.logflags = 178 ntohl(nla_get_be32(tb[NFTA_LOG_FLAGS])); 179 if (li->u.log.logflags & ~NF_LOG_MASK) { 180 err = -EINVAL; 181 goto err1; 182 } 183 } 184 break; 185 case NF_LOG_TYPE_ULOG: 186 li->u.ulog.group = ntohs(nla_get_be16(tb[NFTA_LOG_GROUP])); 187 if (tb[NFTA_LOG_SNAPLEN] != NULL) { 188 li->u.ulog.flags |= NF_LOG_F_COPY_LEN; 189 li->u.ulog.copy_len = 190 ntohl(nla_get_be32(tb[NFTA_LOG_SNAPLEN])); 191 } 192 if (tb[NFTA_LOG_QTHRESHOLD] != NULL) { 193 li->u.ulog.qthreshold = 194 ntohs(nla_get_be16(tb[NFTA_LOG_QTHRESHOLD])); 195 } 196 break; 197 } 198 199 if (li->u.log.level == NFT_LOGLEVEL_AUDIT) 200 return 0; 201 202 err = nf_logger_find_get(ctx->family, li->type); 203 if (err < 0) 204 goto err1; 205 206 return 0; 207 208 err1: 209 if (priv->prefix != nft_log_null_prefix) 210 kfree(priv->prefix); 211 return err; 212 } 213 214 static void nft_log_destroy(const struct nft_ctx *ctx, 215 const struct nft_expr *expr) 216 { 217 struct nft_log *priv = nft_expr_priv(expr); 218 struct nf_loginfo *li = &priv->loginfo; 219 220 if (priv->prefix != nft_log_null_prefix) 221 kfree(priv->prefix); 222 223 if (li->u.log.level == NFT_LOGLEVEL_AUDIT) 224 return; 225 226 nf_logger_put(ctx->family, li->type); 227 } 228 229 static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr) 230 { 231 const struct nft_log *priv = nft_expr_priv(expr); 232 const struct nf_loginfo *li = &priv->loginfo; 233 234 if (priv->prefix != nft_log_null_prefix) 235 if (nla_put_string(skb, NFTA_LOG_PREFIX, priv->prefix)) 236 goto nla_put_failure; 237 switch (li->type) { 238 case NF_LOG_TYPE_LOG: 239 if (nla_put_be32(skb, NFTA_LOG_LEVEL, htonl(li->u.log.level))) 240 goto nla_put_failure; 241 242 if (li->u.log.logflags) { 243 if (nla_put_be32(skb, NFTA_LOG_FLAGS, 244 htonl(li->u.log.logflags))) 245 goto nla_put_failure; 246 } 247 break; 248 case NF_LOG_TYPE_ULOG: 249 if (nla_put_be16(skb, NFTA_LOG_GROUP, htons(li->u.ulog.group))) 250 goto nla_put_failure; 251 252 if (li->u.ulog.flags & NF_LOG_F_COPY_LEN) { 253 if (nla_put_be32(skb, NFTA_LOG_SNAPLEN, 254 htonl(li->u.ulog.copy_len))) 255 goto nla_put_failure; 256 } 257 if (li->u.ulog.qthreshold) { 258 if (nla_put_be16(skb, NFTA_LOG_QTHRESHOLD, 259 htons(li->u.ulog.qthreshold))) 260 goto nla_put_failure; 261 } 262 break; 263 } 264 return 0; 265 266 nla_put_failure: 267 return -1; 268 } 269 270 static struct nft_expr_type nft_log_type; 271 static const struct nft_expr_ops nft_log_ops = { 272 .type = &nft_log_type, 273 .size = NFT_EXPR_SIZE(sizeof(struct nft_log)), 274 .eval = nft_log_eval, 275 .init = nft_log_init, 276 .destroy = nft_log_destroy, 277 .dump = nft_log_dump, 278 }; 279 280 static struct nft_expr_type nft_log_type __read_mostly = { 281 .name = "log", 282 .ops = &nft_log_ops, 283 .policy = nft_log_policy, 284 .maxattr = NFTA_LOG_MAX, 285 .owner = THIS_MODULE, 286 }; 287 288 static int __init nft_log_module_init(void) 289 { 290 return nft_register_expr(&nft_log_type); 291 } 292 293 static void __exit nft_log_module_exit(void) 294 { 295 nft_unregister_expr(&nft_log_type); 296 } 297 298 module_init(nft_log_module_init); 299 module_exit(nft_log_module_exit); 300 301 MODULE_LICENSE("GPL"); 302 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>"); 303 MODULE_ALIAS_NFT_EXPR("log"); 304