Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-only
0002 /*
0003  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
0004  * Copyright (c) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org>
0005  *
0006  * Development of this code funded by Astaro AG (http://www.astaro.com/)
0007  */
0008 
0009 #include <linux/audit.h>
0010 #include <linux/kernel.h>
0011 #include <linux/init.h>
0012 #include <linux/module.h>
0013 #include <linux/netlink.h>
0014 #include <linux/netfilter.h>
0015 #include <linux/netfilter/nf_tables.h>
0016 #include <net/ipv6.h>
0017 #include <net/ip.h>
0018 #include <net/netfilter/nf_tables.h>
0019 #include <net/netfilter/nf_log.h>
0020 #include <linux/netdevice.h>
0021 
0022 static const char *nft_log_null_prefix = "";
0023 
0024 struct nft_log {
0025     struct nf_loginfo   loginfo;
0026     char            *prefix;
0027 };
0028 
0029 static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
0030 {
0031     struct iphdr _iph;
0032     const struct iphdr *ih;
0033 
0034     ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
0035     if (!ih)
0036         return false;
0037 
0038     audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
0039              &ih->saddr, &ih->daddr, ih->protocol);
0040 
0041     return true;
0042 }
0043 
0044 static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
0045 {
0046     struct ipv6hdr _ip6h;
0047     const struct ipv6hdr *ih;
0048     u8 nexthdr;
0049     __be16 frag_off;
0050 
0051     ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
0052     if (!ih)
0053         return false;
0054 
0055     nexthdr = ih->nexthdr;
0056     ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
0057 
0058     audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
0059              &ih->saddr, &ih->daddr, nexthdr);
0060 
0061     return true;
0062 }
0063 
0064 static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
0065 {
0066     struct sk_buff *skb = pkt->skb;
0067     struct audit_buffer *ab;
0068     int fam = -1;
0069 
0070     if (!audit_enabled)
0071         return;
0072 
0073     ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
0074     if (!ab)
0075         return;
0076 
0077     audit_log_format(ab, "mark=%#x", skb->mark);
0078 
0079     switch (nft_pf(pkt)) {
0080     case NFPROTO_BRIDGE:
0081         switch (eth_hdr(skb)->h_proto) {
0082         case htons(ETH_P_IP):
0083             fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
0084             break;
0085         case htons(ETH_P_IPV6):
0086             fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
0087             break;
0088         }
0089         break;
0090     case NFPROTO_IPV4:
0091         fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
0092         break;
0093     case NFPROTO_IPV6:
0094         fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
0095         break;
0096     }
0097 
0098     if (fam == -1)
0099         audit_log_format(ab, " saddr=? daddr=? proto=-1");
0100 
0101     audit_log_end(ab);
0102 }
0103 
0104 static void nft_log_eval(const struct nft_expr *expr,
0105              struct nft_regs *regs,
0106              const struct nft_pktinfo *pkt)
0107 {
0108     const struct nft_log *priv = nft_expr_priv(expr);
0109 
0110     if (priv->loginfo.type == NF_LOG_TYPE_LOG &&
0111         priv->loginfo.u.log.level == NFT_LOGLEVEL_AUDIT) {
0112         nft_log_eval_audit(pkt);
0113         return;
0114     }
0115 
0116     nf_log_packet(nft_net(pkt), nft_pf(pkt), nft_hook(pkt), pkt->skb,
0117               nft_in(pkt), nft_out(pkt), &priv->loginfo, "%s",
0118               priv->prefix);
0119 }
0120 
0121 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
0122     [NFTA_LOG_GROUP]    = { .type = NLA_U16 },
0123     [NFTA_LOG_PREFIX]   = { .type = NLA_STRING,
0124                     .len = NF_LOG_PREFIXLEN - 1 },
0125     [NFTA_LOG_SNAPLEN]  = { .type = NLA_U32 },
0126     [NFTA_LOG_QTHRESHOLD]   = { .type = NLA_U16 },
0127     [NFTA_LOG_LEVEL]    = { .type = NLA_U32 },
0128     [NFTA_LOG_FLAGS]    = { .type = NLA_U32 },
0129 };
0130 
0131 static int nft_log_modprobe(struct net *net, enum nf_log_type t)
0132 {
0133     switch (t) {
0134     case NF_LOG_TYPE_LOG:
0135         return nft_request_module(net, "%s", "nf_log_syslog");
0136     case NF_LOG_TYPE_ULOG:
0137         return nft_request_module(net, "%s", "nfnetlink_log");
0138     case NF_LOG_TYPE_MAX:
0139         break;
0140     }
0141 
0142     return -ENOENT;
0143 }
0144 
0145 static int nft_log_init(const struct nft_ctx *ctx,
0146             const struct nft_expr *expr,
0147             const struct nlattr * const tb[])
0148 {
0149     struct nft_log *priv = nft_expr_priv(expr);
0150     struct nf_loginfo *li = &priv->loginfo;
0151     const struct nlattr *nla;
0152     int err;
0153 
0154     li->type = NF_LOG_TYPE_LOG;
0155     if (tb[NFTA_LOG_LEVEL] != NULL &&
0156         tb[NFTA_LOG_GROUP] != NULL)
0157         return -EINVAL;
0158     if (tb[NFTA_LOG_GROUP] != NULL) {
0159         li->type = NF_LOG_TYPE_ULOG;
0160         if (tb[NFTA_LOG_FLAGS] != NULL)
0161             return -EINVAL;
0162     }
0163 
0164     nla = tb[NFTA_LOG_PREFIX];
0165     if (nla != NULL) {
0166         priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
0167         if (priv->prefix == NULL)
0168             return -ENOMEM;
0169         nla_strscpy(priv->prefix, nla, nla_len(nla) + 1);
0170     } else {
0171         priv->prefix = (char *)nft_log_null_prefix;
0172     }
0173 
0174     switch (li->type) {
0175     case NF_LOG_TYPE_LOG:
0176         if (tb[NFTA_LOG_LEVEL] != NULL) {
0177             li->u.log.level =
0178                 ntohl(nla_get_be32(tb[NFTA_LOG_LEVEL]));
0179         } else {
0180             li->u.log.level = NFT_LOGLEVEL_WARNING;
0181         }
0182         if (li->u.log.level > NFT_LOGLEVEL_AUDIT) {
0183             err = -EINVAL;
0184             goto err1;
0185         }
0186 
0187         if (tb[NFTA_LOG_FLAGS] != NULL) {
0188             li->u.log.logflags =
0189                 ntohl(nla_get_be32(tb[NFTA_LOG_FLAGS]));
0190             if (li->u.log.logflags & ~NF_LOG_MASK) {
0191                 err = -EINVAL;
0192                 goto err1;
0193             }
0194         }
0195         break;
0196     case NF_LOG_TYPE_ULOG:
0197         li->u.ulog.group = ntohs(nla_get_be16(tb[NFTA_LOG_GROUP]));
0198         if (tb[NFTA_LOG_SNAPLEN] != NULL) {
0199             li->u.ulog.flags |= NF_LOG_F_COPY_LEN;
0200             li->u.ulog.copy_len =
0201                 ntohl(nla_get_be32(tb[NFTA_LOG_SNAPLEN]));
0202         }
0203         if (tb[NFTA_LOG_QTHRESHOLD] != NULL) {
0204             li->u.ulog.qthreshold =
0205                 ntohs(nla_get_be16(tb[NFTA_LOG_QTHRESHOLD]));
0206         }
0207         break;
0208     }
0209 
0210     if (li->u.log.level == NFT_LOGLEVEL_AUDIT)
0211         return 0;
0212 
0213     err = nf_logger_find_get(ctx->family, li->type);
0214     if (err < 0) {
0215         if (nft_log_modprobe(ctx->net, li->type) == -EAGAIN)
0216             err = -EAGAIN;
0217 
0218         goto err1;
0219     }
0220 
0221     return 0;
0222 
0223 err1:
0224     if (priv->prefix != nft_log_null_prefix)
0225         kfree(priv->prefix);
0226     return err;
0227 }
0228 
0229 static void nft_log_destroy(const struct nft_ctx *ctx,
0230                 const struct nft_expr *expr)
0231 {
0232     struct nft_log *priv = nft_expr_priv(expr);
0233     struct nf_loginfo *li = &priv->loginfo;
0234 
0235     if (priv->prefix != nft_log_null_prefix)
0236         kfree(priv->prefix);
0237 
0238     if (li->u.log.level == NFT_LOGLEVEL_AUDIT)
0239         return;
0240 
0241     nf_logger_put(ctx->family, li->type);
0242 }
0243 
0244 static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)
0245 {
0246     const struct nft_log *priv = nft_expr_priv(expr);
0247     const struct nf_loginfo *li = &priv->loginfo;
0248 
0249     if (priv->prefix != nft_log_null_prefix)
0250         if (nla_put_string(skb, NFTA_LOG_PREFIX, priv->prefix))
0251             goto nla_put_failure;
0252     switch (li->type) {
0253     case NF_LOG_TYPE_LOG:
0254         if (nla_put_be32(skb, NFTA_LOG_LEVEL, htonl(li->u.log.level)))
0255             goto nla_put_failure;
0256 
0257         if (li->u.log.logflags) {
0258             if (nla_put_be32(skb, NFTA_LOG_FLAGS,
0259                      htonl(li->u.log.logflags)))
0260                 goto nla_put_failure;
0261         }
0262         break;
0263     case NF_LOG_TYPE_ULOG:
0264         if (nla_put_be16(skb, NFTA_LOG_GROUP, htons(li->u.ulog.group)))
0265             goto nla_put_failure;
0266 
0267         if (li->u.ulog.flags & NF_LOG_F_COPY_LEN) {
0268             if (nla_put_be32(skb, NFTA_LOG_SNAPLEN,
0269                      htonl(li->u.ulog.copy_len)))
0270                 goto nla_put_failure;
0271         }
0272         if (li->u.ulog.qthreshold) {
0273             if (nla_put_be16(skb, NFTA_LOG_QTHRESHOLD,
0274                      htons(li->u.ulog.qthreshold)))
0275                 goto nla_put_failure;
0276         }
0277         break;
0278     }
0279     return 0;
0280 
0281 nla_put_failure:
0282     return -1;
0283 }
0284 
0285 static struct nft_expr_type nft_log_type;
0286 static const struct nft_expr_ops nft_log_ops = {
0287     .type       = &nft_log_type,
0288     .size       = NFT_EXPR_SIZE(sizeof(struct nft_log)),
0289     .eval       = nft_log_eval,
0290     .init       = nft_log_init,
0291     .destroy    = nft_log_destroy,
0292     .dump       = nft_log_dump,
0293     .reduce     = NFT_REDUCE_READONLY,
0294 };
0295 
0296 static struct nft_expr_type nft_log_type __read_mostly = {
0297     .name       = "log",
0298     .ops        = &nft_log_ops,
0299     .policy     = nft_log_policy,
0300     .maxattr    = NFTA_LOG_MAX,
0301     .owner      = THIS_MODULE,
0302 };
0303 
0304 static int __init nft_log_module_init(void)
0305 {
0306     return nft_register_expr(&nft_log_type);
0307 }
0308 
0309 static void __exit nft_log_module_exit(void)
0310 {
0311     nft_unregister_expr(&nft_log_type);
0312 }
0313 
0314 module_init(nft_log_module_init);
0315 module_exit(nft_log_module_exit);
0316 
0317 MODULE_LICENSE("GPL");
0318 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
0319 MODULE_ALIAS_NFT_EXPR("log");
0320 MODULE_DESCRIPTION("Netfilter nf_tables log module");
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!