Re: [RFC PATCH] audit: normalize NETFILTER_PKT

Eliminate flipping in and out of message fields. https://github.com/linux-audit/audit-kernel/issues/11

Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; --- net/netfilter/xt_AUDIT.c | 92 +++++++++++++++++++++++++++++++++------------- 1 files changed, 66 insertions(+), 26 deletions(-) diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index 4973cbd..8089ec2 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -31,24 +31,41 @@ MODULE_ALIAS("ip6t_AUDIT"); MODULE_ALIAS("ebt_AUDIT"); MODULE_ALIAS("arpt_AUDIT"); +struct nfpkt_par { + int ipv; + int iptrunc; + const void *saddr; + const void *daddr; + u16 ipid; + u8 proto; + u8 frag; + int ptrunc; + u16 sport; + u16 dport; + u8 icmpt; + u8 icmpc; +}; + static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb, - unsigned int proto, unsigned int offset) + unsigned int proto, unsigned int offset, struct nfpkt_par *apar) { switch (proto) { case IPPROTO_TCP: case IPPROTO_UDP: - case IPPROTO_UDPLITE: { + case IPPROTO_UDPLITE: + case IPPROTO_DCCP: + case IPPROTO_SCTP: { const __be16 *pptr; __be16 _ports[2]; pptr = skb_header_pointer(skb, offset, sizeof(_ports), _ports); if (pptr == NULL) { - audit_log_format(ab, " truncated=1"); + apar->ptrunc = 1; return; } + apar->sport = ntohs(pptr[0]); + apar->dport = ntohs(pptr[1]); - audit_log_format(ab, " sport=%hu dport=%hu", - ntohs(pptr[0]), ntohs(pptr[1])); } break; @@ -59,41 +76,43 @@ static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb, iptr = skb_header_pointer(skb, offset, sizeof(_ih), &_ih); if (iptr == NULL) { - audit_log_format(ab, " truncated=1"); + apar->ptrunc = 1; return; } - - audit_log_format(ab, " icmptype=%hhu icmpcode=%hhu", - iptr[0], iptr[1]); + apar->icmpt = iptr[0]; + apar->icmpc = iptr[1]; } break; } } -static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) +static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb, struct nfpkt_par *apar) { struct iphdr _iph; const struct iphdr *ih; + apar->ipv = 4; ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); if (!ih) { - audit_log_format(ab, " truncated=1"); + apar->iptrunc = 1; return; } - audit_log_format(ab, " saddr=%pI4 daddr=%pI4 ipid=%hu proto=%hhu", - &ih->saddr, &ih->daddr, ntohs(ih->id), ih->protocol); + apar->saddr = &ih->saddr; + apar->daddr = &ih->daddr; + apar->ipid = ntohs(ih->id); + apar->proto = ih->protocol; if (ntohs(ih->frag_off) & IP_OFFSET) { - audit_log_format(ab, " frag=1"); + apar->frag = 1; return; } - audit_proto(ab, skb, ih->protocol, ih->ihl * 4); + audit_proto(ab, skb, ih->protocol, ih->ihl * 4, apar); } -static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) +static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb, struct nfpkt_par *apar) { struct ipv6hdr _ip6h; const struct ipv6hdr *ih; @@ -101,9 +120,10 @@ static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) __be16 frag_off; int offset; + apar->ipv = 6; ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h); if (!ih) { - audit_log_format(ab, " truncated=1"); + apar->iptrunc = 1; return; } @@ -111,11 +131,12 @@ static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) offset = ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off); - audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", - &ih->saddr, &ih->daddr, nexthdr); + apar->saddr = &ih->saddr; + apar->daddr = &ih->daddr; + apar->proto = nexthdr; if (offset) - audit_proto(ab, skb, nexthdr, offset); + audit_proto(ab, skb, nexthdr, offset, apar); } static unsigned int @@ -123,6 +144,9 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_audit_info *info = par->targinfo; struct audit_buffer *ab; + struct nfpkt_par apar = { + -1, -1, NULL, NULL, -1, -1, -1, -1, -1, -1, -1, -1 + }; if (audit_enabled == 0) goto errout; @@ -136,8 +160,7 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) par->in ? par->in->name : "?", par->out ? par->out->name : "?"); - if (skb->mark) - audit_log_format(ab, " mark=%#x", skb->mark); + audit_log_format(ab, " mark=%#x", skb->mark ?: -1); if (skb->dev && skb->dev->type == ARPHRD_ETHER) { audit_log_format(ab, " smac=%pM dmac=%pM macproto=0x%04x", @@ -147,25 +170,42 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par) if (par->family == NFPROTO_BRIDGE) { switch (eth_hdr(skb)->h_proto) { case htons(ETH_P_IP): - audit_ip4(ab, skb); + audit_ip4(ab, skb, &apar); break; case htons(ETH_P_IPV6): - audit_ip6(ab, skb); + audit_ip6(ab, skb, &apar); break; } } + } else { + audit_log_format(ab, " smac=? dmac=? macproto=0xffff"); } switch (par->family) { case NFPROTO_IPV4: - audit_ip4(ab, skb); + audit_ip4(ab, skb, &apar); break; case NFPROTO_IPV6: - audit_ip6(ab, skb); + audit_ip6(ab, skb, &apar); + break; + } + + switch (apar.ipv) { + case 4: + audit_log_format(ab, " trunc=%d saddr=%pI4 daddr=%pI4 ipid=%hu proto=%hhu frag=%d", + apar.iptrunc, apar.saddr, apar.daddr, apar.ipid, apar.proto, apar.frag); + break; + case 6: + audit_log_format(ab, " trunc=%d saddr=%pI6c daddr=%pI6c ipid=-1 proto=%hhu frag=-1", + apar.iptrunc, apar.saddr, apar.daddr, apar.proto); break; + default: + audit_log_format(ab, " trunc=-1 saddr=? daddr=? ipid=-1 proto=-1 frag=-1"); } + audit_log_format(ab, " trunc=%d sport=%hu dport=%hu icmptype=%hhu icmpcode=%hhu", + apar.ptrunc, apar.sport, apar.dport, apar.icmpt, apar.icmpc); #ifdef CONFIG_NETWORK_SECMARK if (skb->secmark)