1 /* 2 * Creates audit record for dropped/accepted packets 3 * 4 * (C) 2010-2011 Thomas Graf <tgraf@redhat.com> 5 * (C) 2010-2011 Red Hat, Inc. 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 13 14 #include <linux/audit.h> 15 #include <linux/module.h> 16 #include <linux/skbuff.h> 17 #include <linux/tcp.h> 18 #include <linux/udp.h> 19 #include <linux/if_arp.h> 20 #include <linux/netfilter/x_tables.h> 21 #include <linux/netfilter/xt_AUDIT.h> 22 #include <linux/netfilter_bridge/ebtables.h> 23 #include <net/ipv6.h> 24 #include <net/ip.h> 25 26 MODULE_LICENSE("GPL"); 27 MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>"); 28 MODULE_DESCRIPTION("Xtables: creates audit records for dropped/accepted packets"); 29 MODULE_ALIAS("ipt_AUDIT"); 30 MODULE_ALIAS("ip6t_AUDIT"); 31 MODULE_ALIAS("ebt_AUDIT"); 32 MODULE_ALIAS("arpt_AUDIT"); 33 34 static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb, 35 unsigned int proto, unsigned int offset) 36 { 37 switch (proto) { 38 case IPPROTO_TCP: 39 case IPPROTO_UDP: 40 case IPPROTO_UDPLITE: { 41 const __be16 *pptr; 42 __be16 _ports[2]; 43 44 pptr = skb_header_pointer(skb, offset, sizeof(_ports), _ports); 45 if (pptr == NULL) { 46 audit_log_format(ab, " truncated=1"); 47 return; 48 } 49 50 audit_log_format(ab, " sport=%hu dport=%hu", 51 ntohs(pptr[0]), ntohs(pptr[1])); 52 } 53 break; 54 55 case IPPROTO_ICMP: 56 case IPPROTO_ICMPV6: { 57 const u8 *iptr; 58 u8 _ih[2]; 59 60 iptr = skb_header_pointer(skb, offset, sizeof(_ih), &_ih); 61 if (iptr == NULL) { 62 audit_log_format(ab, " truncated=1"); 63 return; 64 } 65 66 audit_log_format(ab, " icmptype=%hhu icmpcode=%hhu", 67 iptr[0], iptr[1]); 68 69 } 70 break; 71 } 72 } 73 74 static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) 75 { 76 struct iphdr _iph; 77 const struct iphdr *ih; 78 79 ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); 80 if (!ih) { 81 audit_log_format(ab, " truncated=1"); 82 return; 83 } 84 85 audit_log_format(ab, " saddr=%pI4 daddr=%pI4 ipid=%hu proto=%hhu", 86 &ih->saddr, &ih->daddr, ntohs(ih->id), ih->protocol); 87 88 if (ntohs(ih->frag_off) & IP_OFFSET) { 89 audit_log_format(ab, " frag=1"); 90 return; 91 } 92 93 audit_proto(ab, skb, ih->protocol, ih->ihl * 4); 94 } 95 96 static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) 97 { 98 struct ipv6hdr _ip6h; 99 const struct ipv6hdr *ih; 100 u8 nexthdr; 101 __be16 frag_off; 102 int offset; 103 104 ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h); 105 if (!ih) { 106 audit_log_format(ab, " truncated=1"); 107 return; 108 } 109 110 nexthdr = ih->nexthdr; 111 offset = ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), 112 &nexthdr, &frag_off); 113 114 audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", 115 &ih->saddr, &ih->daddr, nexthdr); 116 117 if (offset) 118 audit_proto(ab, skb, nexthdr, offset); 119 } 120 121 static unsigned int 122 audit_tg(struct sk_buff *skb, const struct xt_action_param *par) 123 { 124 const struct xt_audit_info *info = par->targinfo; 125 struct audit_buffer *ab; 126 127 if (audit_enabled == 0) 128 goto errout; 129 130 ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); 131 if (ab == NULL) 132 goto errout; 133 134 audit_log_format(ab, "action=%hhu hook=%u len=%u inif=%s outif=%s", 135 info->type, par->hooknum, skb->len, 136 par->in ? par->in->name : "?", 137 par->out ? par->out->name : "?"); 138 139 if (skb->mark) 140 audit_log_format(ab, " mark=%#x", skb->mark); 141 142 if (skb->dev && skb->dev->type == ARPHRD_ETHER) { 143 audit_log_format(ab, " smac=%pM dmac=%pM macproto=0x%04x", 144 eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, 145 ntohs(eth_hdr(skb)->h_proto)); 146 147 if (par->family == NFPROTO_BRIDGE) { 148 switch (eth_hdr(skb)->h_proto) { 149 case htons(ETH_P_IP): 150 audit_ip4(ab, skb); 151 break; 152 153 case htons(ETH_P_IPV6): 154 audit_ip6(ab, skb); 155 break; 156 } 157 } 158 } 159 160 switch (par->family) { 161 case NFPROTO_IPV4: 162 audit_ip4(ab, skb); 163 break; 164 165 case NFPROTO_IPV6: 166 audit_ip6(ab, skb); 167 break; 168 } 169 170 #ifdef CONFIG_NETWORK_SECMARK 171 if (skb->secmark) 172 audit_log_secctx(ab, skb->secmark); 173 #endif 174 175 audit_log_end(ab); 176 177 errout: 178 return XT_CONTINUE; 179 } 180 181 static unsigned int 182 audit_tg_ebt(struct sk_buff *skb, const struct xt_action_param *par) 183 { 184 audit_tg(skb, par); 185 return EBT_CONTINUE; 186 } 187 188 static int audit_tg_check(const struct xt_tgchk_param *par) 189 { 190 const struct xt_audit_info *info = par->targinfo; 191 192 if (info->type > XT_AUDIT_TYPE_MAX) { 193 pr_info("Audit type out of range (valid range: 0..%hhu)\n", 194 XT_AUDIT_TYPE_MAX); 195 return -ERANGE; 196 } 197 198 return 0; 199 } 200 201 static struct xt_target audit_tg_reg[] __read_mostly = { 202 { 203 .name = "AUDIT", 204 .family = NFPROTO_UNSPEC, 205 .target = audit_tg, 206 .targetsize = sizeof(struct xt_audit_info), 207 .checkentry = audit_tg_check, 208 .me = THIS_MODULE, 209 }, 210 { 211 .name = "AUDIT", 212 .family = NFPROTO_BRIDGE, 213 .target = audit_tg_ebt, 214 .targetsize = sizeof(struct xt_audit_info), 215 .checkentry = audit_tg_check, 216 .me = THIS_MODULE, 217 }, 218 }; 219 220 static int __init audit_tg_init(void) 221 { 222 return xt_register_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); 223 } 224 225 static void __exit audit_tg_exit(void) 226 { 227 xt_unregister_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); 228 } 229 230 module_init(audit_tg_init); 231 module_exit(audit_tg_exit); 232