Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1a893b44 authored by Phil Sutter's avatar Phil Sutter Committed by Pablo Neira Ayuso
Browse files

netfilter: nf_tables: Add audit support to log statement 



This extends log statement to support the behaviour achieved with
AUDIT target in iptables.

Audit logging is enabled via a pseudo log level 8. In this case any
other settings like log prefix are ignored since audit log format is
fixed.

Signed-off-by: default avatarPhil Sutter <phil@nwl.cc>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 554ced0a

include/uapi/linux/netfilter/nf_tables.h

+5 −0
Original line number Diff line number Diff line
@@ -1080,6 +1080,11 @@ enum nft_log_attributes { 
};

#define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)



/**

 * LOGLEVEL_AUDIT - a pseudo log level enabling audit logging

 */

#define LOGLEVEL_AUDIT		8



/**

 * enum nft_queue_attributes - nf_tables queue expression netlink attributes

 *

net/netfilter/nft_log.c

+91 −1
Original line number Diff line number Diff line
@@ -9,12 +9,15 @@ 
 * Development of this code funded by Astaro AG (http://www.astaro.com/)

 */



#include <linux/audit.h>

#include <linux/kernel.h>

#include <linux/init.h>

#include <linux/module.h>

#include <linux/netlink.h>

#include <linux/netfilter.h>

#include <linux/netfilter/nf_tables.h>

#include <net/ipv6.h>

#include <net/ip.h>

#include <net/netfilter/nf_tables.h>

#include <net/netfilter/nf_log.h>

#include <linux/netdevice.h>
@@ -26,12 +29,93 @@ struct nft_log { 
	char			*prefix;

};



static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)

{

	struct iphdr _iph;

	const struct iphdr *ih;



	ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);

	if (!ih)

		return false;



	audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",

			 &ih->saddr, &ih->daddr, ih->protocol);



	return true;

}



static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)

{

	struct ipv6hdr _ip6h;

	const struct ipv6hdr *ih;

	u8 nexthdr;

	__be16 frag_off;



	ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);

	if (!ih)

		return false;



	nexthdr = ih->nexthdr;

	ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);



	audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",

			 &ih->saddr, &ih->daddr, nexthdr);



	return true;

}



static void nft_log_eval_audit(const struct nft_pktinfo *pkt)

{

	struct sk_buff *skb = pkt->skb;

	struct audit_buffer *ab;

	int fam = -1;



	if (!audit_enabled)

		return;



	ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);

	if (!ab)

		return;



	audit_log_format(ab, "mark=%#x", skb->mark);



	switch (nft_pf(pkt)) {

	case NFPROTO_BRIDGE:

		switch (eth_hdr(skb)->h_proto) {

		case htons(ETH_P_IP):

			fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;

			break;

		case htons(ETH_P_IPV6):

			fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;

			break;

		}

		break;

	case NFPROTO_IPV4:

		fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;

		break;

	case NFPROTO_IPV6:

		fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;

		break;

	}



	if (fam == -1)

		audit_log_format(ab, " saddr=? daddr=? proto=-1");



	audit_log_end(ab);

}



static void nft_log_eval(const struct nft_expr *expr,

			 struct nft_regs *regs,

			 const struct nft_pktinfo *pkt)

{

	const struct nft_log *priv = nft_expr_priv(expr);



	if (priv->loginfo.type == NF_LOG_TYPE_LOG &&

	    priv->loginfo.u.log.level == LOGLEVEL_AUDIT) {

		nft_log_eval_audit(pkt);

		return;

	}



	nf_log_packet(nft_net(pkt), nft_pf(pkt), nft_hook(pkt), pkt->skb,

		      nft_in(pkt), nft_out(pkt), &priv->loginfo, "%s",

		      priv->prefix);
@@ -84,7 +168,7 @@ static int nft_log_init(const struct nft_ctx *ctx, 
		} else {

			li->u.log.level = LOGLEVEL_WARNING;

		}

		if (li->u.log.level > LOGLEVEL_DEBUG) {

		if (li->u.log.level > LOGLEVEL_AUDIT) {

			err = -EINVAL;

			goto err1;

		}
@@ -112,6 +196,9 @@ static int nft_log_init(const struct nft_ctx *ctx, 
		break;

	}



	if (li->u.log.level == LOGLEVEL_AUDIT)

		return 0;



	err = nf_logger_find_get(ctx->family, li->type);

	if (err < 0)

		goto err1;
@@ -133,6 +220,9 @@ static void nft_log_destroy(const struct nft_ctx *ctx, 
	if (priv->prefix != nft_log_null_prefix)

		kfree(priv->prefix);



	if (li->u.log.level == LOGLEVEL_AUDIT)

		return;



	nf_logger_put(ctx->family, li->type);

}