~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netfilter/nft_log.c

Version: ~ [ linux-5.12-rc7 ] ~ [ linux-5.11.13 ] ~ [ linux-5.10.29 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.111 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.186 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.230 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.266 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.266 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
  3  * Copyright (c) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org>
  4  *
  5  * This program is free software; you can redistribute it and/or modify
  6  * it under the terms of the GNU General Public License version 2 as
  7  * published by the Free Software Foundation.
  8  *
  9  * Development of this code funded by Astaro AG (http://www.astaro.com/)
 10  */
 11 
 12 #include <linux/audit.h>
 13 #include <linux/kernel.h>
 14 #include <linux/init.h>
 15 #include <linux/module.h>
 16 #include <linux/netlink.h>
 17 #include <linux/netfilter.h>
 18 #include <linux/netfilter/nf_tables.h>
 19 #include <net/ipv6.h>
 20 #include <net/ip.h>
 21 #include <net/netfilter/nf_tables.h>
 22 #include <net/netfilter/nf_log.h>
 23 #include <linux/netdevice.h>
 24 
 25 static const char *nft_log_null_prefix = "";
 26 
 27 struct nft_log {
 28         struct nf_loginfo       loginfo;
 29         char                    *prefix;
 30 };
 31 
 32 static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
 33 {
 34         struct iphdr _iph;
 35         const struct iphdr *ih;
 36 
 37         ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
 38         if (!ih)
 39                 return false;
 40 
 41         audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
 42                          &ih->saddr, &ih->daddr, ih->protocol);
 43 
 44         return true;
 45 }
 46 
 47 static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 48 {
 49         struct ipv6hdr _ip6h;
 50         const struct ipv6hdr *ih;
 51         u8 nexthdr;
 52         __be16 frag_off;
 53 
 54         ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
 55         if (!ih)
 56                 return false;
 57 
 58         nexthdr = ih->nexthdr;
 59         ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
 60 
 61         audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
 62                          &ih->saddr, &ih->daddr, nexthdr);
 63 
 64         return true;
 65 }
 66 
 67 static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
 68 {
 69         struct sk_buff *skb = pkt->skb;
 70         struct audit_buffer *ab;
 71         int fam = -1;
 72 
 73         if (!audit_enabled)
 74                 return;
 75 
 76         ab = audit_log_start(NULL, GFP_ATOMIC, AUDIT_NETFILTER_PKT);
 77         if (!ab)
 78                 return;
 79 
 80         audit_log_format(ab, "mark=%#x", skb->mark);
 81 
 82         switch (nft_pf(pkt)) {
 83         case NFPROTO_BRIDGE:
 84                 switch (eth_hdr(skb)->h_proto) {
 85                 case htons(ETH_P_IP):
 86                         fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
 87                         break;
 88                 case htons(ETH_P_IPV6):
 89                         fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
 90                         break;
 91                 }
 92                 break;
 93         case NFPROTO_IPV4:
 94                 fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
 95                 break;
 96         case NFPROTO_IPV6:
 97                 fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
 98                 break;
 99         }
100 
101         if (fam == -1)
102                 audit_log_format(ab, " saddr=? daddr=? proto=-1");
103 
104         audit_log_end(ab);
105 }
106 
107 static void nft_log_eval(const struct nft_expr *expr,
108                          struct nft_regs *regs,
109                          const struct nft_pktinfo *pkt)
110 {
111         const struct nft_log *priv = nft_expr_priv(expr);
112 
113         if (priv->loginfo.type == NF_LOG_TYPE_LOG &&
114             priv->loginfo.u.log.level == NFT_LOGLEVEL_AUDIT) {
115                 nft_log_eval_audit(pkt);
116                 return;
117         }
118 
119         nf_log_packet(nft_net(pkt), nft_pf(pkt), nft_hook(pkt), pkt->skb,
120                       nft_in(pkt), nft_out(pkt), &priv->loginfo, "%s",
121                       priv->prefix);
122 }
123 
124 static const struct nla_policy nft_log_policy[NFTA_LOG_MAX + 1] = {
125         [NFTA_LOG_GROUP]        = { .type = NLA_U16 },
126         [NFTA_LOG_PREFIX]       = { .type = NLA_STRING,
127                                     .len = NF_LOG_PREFIXLEN - 1 },
128         [NFTA_LOG_SNAPLEN]      = { .type = NLA_U32 },
129         [NFTA_LOG_QTHRESHOLD]   = { .type = NLA_U16 },
130         [NFTA_LOG_LEVEL]        = { .type = NLA_U32 },
131         [NFTA_LOG_FLAGS]        = { .type = NLA_U32 },
132 };
133 
134 static int nft_log_init(const struct nft_ctx *ctx,
135                         const struct nft_expr *expr,
136                         const struct nlattr * const tb[])
137 {
138         struct nft_log *priv = nft_expr_priv(expr);
139         struct nf_loginfo *li = &priv->loginfo;
140         const struct nlattr *nla;
141         int err;
142 
143         li->type = NF_LOG_TYPE_LOG;
144         if (tb[NFTA_LOG_LEVEL] != NULL &&
145             tb[NFTA_LOG_GROUP] != NULL)
146                 return -EINVAL;
147         if (tb[NFTA_LOG_GROUP] != NULL) {
148                 li->type = NF_LOG_TYPE_ULOG;
149                 if (tb[NFTA_LOG_FLAGS] != NULL)
150                         return -EINVAL;
151         }
152 
153         nla = tb[NFTA_LOG_PREFIX];
154         if (nla != NULL) {
155                 priv->prefix = kmalloc(nla_len(nla) + 1, GFP_KERNEL);
156                 if (priv->prefix == NULL)
157                         return -ENOMEM;
158                 nla_strlcpy(priv->prefix, nla, nla_len(nla) + 1);
159         } else {
160                 priv->prefix = (char *)nft_log_null_prefix;
161         }
162 
163         switch (li->type) {
164         case NF_LOG_TYPE_LOG:
165                 if (tb[NFTA_LOG_LEVEL] != NULL) {
166                         li->u.log.level =
167                                 ntohl(nla_get_be32(tb[NFTA_LOG_LEVEL]));
168                 } else {
169                         li->u.log.level = NFT_LOGLEVEL_WARNING;
170                 }
171                 if (li->u.log.level > NFT_LOGLEVEL_AUDIT) {
172                         err = -EINVAL;
173                         goto err1;
174                 }
175 
176                 if (tb[NFTA_LOG_FLAGS] != NULL) {
177                         li->u.log.logflags =
178                                 ntohl(nla_get_be32(tb[NFTA_LOG_FLAGS]));
179                         if (li->u.log.logflags & ~NF_LOG_MASK) {
180                                 err = -EINVAL;
181                                 goto err1;
182                         }
183                 }
184                 break;
185         case NF_LOG_TYPE_ULOG:
186                 li->u.ulog.group = ntohs(nla_get_be16(tb[NFTA_LOG_GROUP]));
187                 if (tb[NFTA_LOG_SNAPLEN] != NULL) {
188                         li->u.ulog.flags |= NF_LOG_F_COPY_LEN;
189                         li->u.ulog.copy_len =
190                                 ntohl(nla_get_be32(tb[NFTA_LOG_SNAPLEN]));
191                 }
192                 if (tb[NFTA_LOG_QTHRESHOLD] != NULL) {
193                         li->u.ulog.qthreshold =
194                                 ntohs(nla_get_be16(tb[NFTA_LOG_QTHRESHOLD]));
195                 }
196                 break;
197         }
198 
199         if (li->u.log.level == NFT_LOGLEVEL_AUDIT)
200                 return 0;
201 
202         err = nf_logger_find_get(ctx->family, li->type);
203         if (err < 0)
204                 goto err1;
205 
206         return 0;
207 
208 err1:
209         if (priv->prefix != nft_log_null_prefix)
210                 kfree(priv->prefix);
211         return err;
212 }
213 
214 static void nft_log_destroy(const struct nft_ctx *ctx,
215                             const struct nft_expr *expr)
216 {
217         struct nft_log *priv = nft_expr_priv(expr);
218         struct nf_loginfo *li = &priv->loginfo;
219 
220         if (priv->prefix != nft_log_null_prefix)
221                 kfree(priv->prefix);
222 
223         if (li->u.log.level == NFT_LOGLEVEL_AUDIT)
224                 return;
225 
226         nf_logger_put(ctx->family, li->type);
227 }
228 
229 static int nft_log_dump(struct sk_buff *skb, const struct nft_expr *expr)
230 {
231         const struct nft_log *priv = nft_expr_priv(expr);
232         const struct nf_loginfo *li = &priv->loginfo;
233 
234         if (priv->prefix != nft_log_null_prefix)
235                 if (nla_put_string(skb, NFTA_LOG_PREFIX, priv->prefix))
236                         goto nla_put_failure;
237         switch (li->type) {
238         case NF_LOG_TYPE_LOG:
239                 if (nla_put_be32(skb, NFTA_LOG_LEVEL, htonl(li->u.log.level)))
240                         goto nla_put_failure;
241 
242                 if (li->u.log.logflags) {
243                         if (nla_put_be32(skb, NFTA_LOG_FLAGS,
244                                          htonl(li->u.log.logflags)))
245                                 goto nla_put_failure;
246                 }
247                 break;
248         case NF_LOG_TYPE_ULOG:
249                 if (nla_put_be16(skb, NFTA_LOG_GROUP, htons(li->u.ulog.group)))
250                         goto nla_put_failure;
251 
252                 if (li->u.ulog.flags & NF_LOG_F_COPY_LEN) {
253                         if (nla_put_be32(skb, NFTA_LOG_SNAPLEN,
254                                          htonl(li->u.ulog.copy_len)))
255                                 goto nla_put_failure;
256                 }
257                 if (li->u.ulog.qthreshold) {
258                         if (nla_put_be16(skb, NFTA_LOG_QTHRESHOLD,
259                                          htons(li->u.ulog.qthreshold)))
260                                 goto nla_put_failure;
261                 }
262                 break;
263         }
264         return 0;
265 
266 nla_put_failure:
267         return -1;
268 }
269 
270 static struct nft_expr_type nft_log_type;
271 static const struct nft_expr_ops nft_log_ops = {
272         .type           = &nft_log_type,
273         .size           = NFT_EXPR_SIZE(sizeof(struct nft_log)),
274         .eval           = nft_log_eval,
275         .init           = nft_log_init,
276         .destroy        = nft_log_destroy,
277         .dump           = nft_log_dump,
278 };
279 
280 static struct nft_expr_type nft_log_type __read_mostly = {
281         .name           = "log",
282         .ops            = &nft_log_ops,
283         .policy         = nft_log_policy,
284         .maxattr        = NFTA_LOG_MAX,
285         .owner          = THIS_MODULE,
286 };
287 
288 static int __init nft_log_module_init(void)
289 {
290         return nft_register_expr(&nft_log_type);
291 }
292 
293 static void __exit nft_log_module_exit(void)
294 {
295         nft_unregister_expr(&nft_log_type);
296 }
297 
298 module_init(nft_log_module_init);
299 module_exit(nft_log_module_exit);
300 
301 MODULE_LICENSE("GPL");
302 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
303 MODULE_ALIAS_NFT_EXPR("log");
304 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp