cregit-Linux how code gets into the kernel

Release 4.11 net/netfilter/xt_AUDIT.c

Directory: net/netfilter
/*
 * Creates audit record for dropped/accepted packets
 *
 * (C) 2010-2011 Thomas Graf <tgraf@redhat.com>
 * (C) 2010-2011 Red Hat, Inc.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
*/


#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/audit.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/if_arp.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_AUDIT.h>
#include <linux/netfilter_bridge/ebtables.h>
#include <net/ipv6.h>
#include <net/ip.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>");
MODULE_DESCRIPTION("Xtables: creates audit records for dropped/accepted packets");
MODULE_ALIAS("ipt_AUDIT");
MODULE_ALIAS("ip6t_AUDIT");
MODULE_ALIAS("ebt_AUDIT");
MODULE_ALIAS("arpt_AUDIT");


static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb, unsigned int proto, unsigned int offset) { switch (proto) { case IPPROTO_TCP: case IPPROTO_UDP: case IPPROTO_UDPLITE: { const __be16 *pptr; __be16 _ports[2]; pptr = skb_header_pointer(skb, offset, sizeof(_ports), _ports); if (pptr == NULL) { audit_log_format(ab, " truncated=1"); return; } audit_log_format(ab, " sport=%hu dport=%hu", ntohs(pptr[0]), ntohs(pptr[1])); } break; case IPPROTO_ICMP: case IPPROTO_ICMPV6: { const u8 *iptr; u8 _ih[2]; iptr = skb_header_pointer(skb, offset, sizeof(_ih), &_ih); if (iptr == NULL) { audit_log_format(ab, " truncated=1"); return; } audit_log_format(ab, " icmptype=%hhu icmpcode=%hhu", iptr[0], iptr[1]); } break; } }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf178100.00%1100.00%
Total178100.00%1100.00%


static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) { struct iphdr _iph; const struct iphdr *ih; ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); if (!ih) { audit_log_format(ab, " truncated=1"); return; } audit_log_format(ab, " saddr=%pI4 daddr=%pI4 ipid=%hu proto=%hhu", &ih->saddr, &ih->daddr, ntohs(ih->id), ih->protocol); if (ntohs(ih->frag_off) & IP_OFFSET) { audit_log_format(ab, " frag=1"); return; } audit_proto(ab, skb, ih->protocol, ih->ihl * 4); }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf124100.00%1100.00%
Total124100.00%1100.00%


static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) { struct ipv6hdr _ip6h; const struct ipv6hdr *ih; u8 nexthdr; __be16 frag_off; int offset; ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h); if (!ih) { audit_log_format(ab, " truncated=1"); return; } nexthdr = ih->nexthdr; offset = ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off); audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", &ih->saddr, &ih->daddr, nexthdr); if (offset) audit_proto(ab, skb, nexthdr, offset); }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf12795.49%150.00%
Jesse Gross64.51%150.00%
Total133100.00%2100.00%


static unsigned int audit_tg(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_audit_info *info = par->targinfo; struct audit_buffer *ab; if (audit_enabled == 0) goto errout; ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT); if (ab == NULL) goto errout; audit_log_format(ab, "action=%hhu hook=%u len=%u inif=%s outif=%s", info->type, xt_hooknum(par), skb->len, xt_in(par) ? xt_inname(par) : "?", xt_out(par) ? xt_outname(par) : "?"); if (skb->mark) audit_log_format(ab, " mark=%#x", skb->mark); if (skb->dev && skb->dev->type == ARPHRD_ETHER) { audit_log_format(ab, " smac=%pM dmac=%pM macproto=0x%04x", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, ntohs(eth_hdr(skb)->h_proto)); if (xt_family(par) == NFPROTO_BRIDGE) { switch (eth_hdr(skb)->h_proto) { case htons(ETH_P_IP): audit_ip4(ab, skb); break; case htons(ETH_P_IPV6): audit_ip6(ab, skb); break; } } } switch (xt_family(par)) { case NFPROTO_IPV4: audit_ip4(ab, skb); break; case NFPROTO_IPV6: audit_ip6(ab, skb); break; } #ifdef CONFIG_NETWORK_SECMARK if (skb->secmark) audit_log_secctx(ab, skb->secmark); #endif audit_log_end(ab); errout: return XT_CONTINUE; }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf22981.49%120.00%
Pablo Neira Ayuso217.47%120.00%
Mr Dash Four207.12%120.00%
Gao Feng93.20%120.00%
Joe Perches20.71%120.00%
Total281100.00%5100.00%


static unsigned int audit_tg_ebt(struct sk_buff *skb, const struct xt_action_param *par) { audit_tg(skb, par); return EBT_CONTINUE; }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf28100.00%1100.00%
Total28100.00%1100.00%


static int audit_tg_check(const struct xt_tgchk_param *par) { const struct xt_audit_info *info = par->targinfo; if (info->type > XT_AUDIT_TYPE_MAX) { pr_info("Audit type out of range (valid range: 0..%hhu)\n", XT_AUDIT_TYPE_MAX); return -ERANGE; } return 0; }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf46100.00%1100.00%
Total46100.00%1100.00%

static struct xt_target audit_tg_reg[] __read_mostly = { { .name = "AUDIT", .family = NFPROTO_UNSPEC, .target = audit_tg, .targetsize = sizeof(struct xt_audit_info), .checkentry = audit_tg_check, .me = THIS_MODULE, }, { .name = "AUDIT", .family = NFPROTO_BRIDGE, .target = audit_tg_ebt, .targetsize = sizeof(struct xt_audit_info), .checkentry = audit_tg_check, .me = THIS_MODULE, }, };
static int __init audit_tg_init(void) { return xt_register_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf20100.00%2100.00%
Total20100.00%2100.00%


static void __exit audit_tg_exit(void) { xt_unregister_targets(audit_tg_reg, ARRAY_SIZE(audit_tg_reg)); }

Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf19100.00%2100.00%
Total19100.00%2100.00%

module_init(audit_tg_init); module_exit(audit_tg_exit);

Overall Contributors

PersonTokensPropCommitsCommitProp
Thomas Graf93894.18%228.57%
Pablo Neira Ayuso212.11%114.29%
Mr Dash Four202.01%114.29%
Gao Feng90.90%114.29%
Jesse Gross60.60%114.29%
Joe Perches20.20%114.29%
Total996100.00%7100.00%
Directory: net/netfilter
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
Created with cregit.