Re: [RFC PATCH] audit: normalize NETFILTER_PKT

On Fri, 27 Jan 2017 08:11:06 -0500 Richard Guy Briggs <rgb(a)redhat.com&gt; wrote: > Eliminate flipping in and out of message fields. > > https://github.com/linux-audit/audit-kernel/issues/11 Do you have sample events that shows how this changes the record format? I like to review how the event looks when a patch changes or adds a record.

-Steve > Signed-off-by: Richard Guy Briggs <rgb(a)redhat.com&gt; > --- > net/netfilter/xt_AUDIT.c | 92 > +++++++++++++++++++++++++++++++++------------- 1 files changed, 66 > insertions(+), 26 deletions(-) > > diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c > index 4973cbd..8089ec2 100644 > --- a/net/netfilter/xt_AUDIT.c > +++ b/net/netfilter/xt_AUDIT.c > @@ -31,24 +31,41 @@ MODULE_ALIAS("ip6t_AUDIT"); > MODULE_ALIAS("ebt_AUDIT"); > MODULE_ALIAS("arpt_AUDIT"); > > +struct nfpkt_par { > + int ipv; > + int iptrunc; > + const void *saddr; > + const void *daddr; > + u16 ipid; > + u8 proto; > + u8 frag; > + int ptrunc; > + u16 sport; > + u16 dport; > + u8 icmpt; > + u8 icmpc; > +}; > + > static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb, > - unsigned int proto, unsigned int offset) > + unsigned int proto, unsigned int offset, > struct nfpkt_par *apar) { > switch (proto) { > case IPPROTO_TCP: > case IPPROTO_UDP: > - case IPPROTO_UDPLITE: { > + case IPPROTO_UDPLITE: > + case IPPROTO_DCCP: > + case IPPROTO_SCTP: { > const __be16 *pptr; > __be16 _ports[2]; > > pptr = skb_header_pointer(skb, offset, > sizeof(_ports), _ports); if (pptr == NULL) { > - audit_log_format(ab, " truncated=1"); > + apar->ptrunc = 1; > return; > } > + apar->sport = ntohs(pptr[0]); > + apar->dport = ntohs(pptr[1]); > > - audit_log_format(ab, " sport=%hu dport=%hu", > - ntohs(pptr[0]), ntohs(pptr[1])); > } > break; > > @@ -59,41 +76,43 @@ static void audit_proto(struct audit_buffer *ab, > struct sk_buff *skb, > iptr = skb_header_pointer(skb, offset, sizeof(_ih), > &_ih); if (iptr == NULL) { > - audit_log_format(ab, " truncated=1"); > + apar->ptrunc = 1; > return; > } > - > - audit_log_format(ab, " icmptype=%hhu icmpcode=%hhu", > - iptr[0], iptr[1]); > + apar->icmpt = iptr[0]; > + apar->icmpc = iptr[1]; > > } > break; > } > } > > -static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) > +static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb, > struct nfpkt_par *apar) { > struct iphdr _iph; > const struct iphdr *ih; > > + apar->ipv = 4; > ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph); > if (!ih) { > - audit_log_format(ab, " truncated=1"); > + apar->iptrunc = 1; > return; > } > > - audit_log_format(ab, " saddr=%pI4 daddr=%pI4 ipid=%hu > proto=%hhu", > - &ih->saddr, &ih->daddr, ntohs(ih->id), ih->protocol); > + apar->saddr = &ih->saddr; > + apar->daddr = &ih->daddr; > + apar->ipid = ntohs(ih->id); > + apar->proto = ih->protocol; > > if (ntohs(ih->frag_off) & IP_OFFSET) { > - audit_log_format(ab, " frag=1"); > + apar->frag = 1; > return; > } > > - audit_proto(ab, skb, ih->protocol, ih->ihl * 4); > + audit_proto(ab, skb, ih->protocol, ih->ihl * 4, apar); > } > > -static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) > +static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb, > struct nfpkt_par *apar) { > struct ipv6hdr _ip6h; > const struct ipv6hdr *ih; > @@ -101,9 +120,10 @@ static void audit_ip6(struct audit_buffer *ab, > struct sk_buff *skb) __be16 frag_off; > int offset; > > + apar->ipv = 6; > ih = skb_header_pointer(skb, skb_network_offset(skb), > sizeof(_ip6h), &_ip6h); if (!ih) { > - audit_log_format(ab, " truncated=1"); > + apar->iptrunc = 1; > return; > } > > @@ -111,11 +131,12 @@ static void audit_ip6(struct audit_buffer *ab, > struct sk_buff *skb) offset = ipv6_skip_exthdr(skb, > skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off); > > - audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", > - &ih->saddr, &ih->daddr, nexthdr); > + apar->saddr = &ih->saddr; > + apar->daddr = &ih->daddr; > + apar->proto = nexthdr; > > if (offset) > - audit_proto(ab, skb, nexthdr, offset); > + audit_proto(ab, skb, nexthdr, offset, apar); > } > > static unsigned int > @@ -123,6 +144,9 @@ audit_tg(struct sk_buff *skb, const struct > xt_action_param *par) { > const struct xt_audit_info *info = par->targinfo; > struct audit_buffer *ab; > + struct nfpkt_par apar = { > + -1, -1, NULL, NULL, -1, -1, -1, -1, -1, -1, -1, -1 > + }; > > if (audit_enabled == 0) > goto errout; > @@ -136,8 +160,7 @@ audit_tg(struct sk_buff *skb, const struct > xt_action_param *par) par->in ? par->in->name : "?", > par->out ? par->out->name : "?"); > > - if (skb->mark) > - audit_log_format(ab, " mark=%#x", skb->mark); > + audit_log_format(ab, " mark=%#x", skb->mark ?: -1); > > if (skb->dev && skb->dev->type == ARPHRD_ETHER) { > audit_log_format(ab, " smac=%pM dmac=%pM > macproto=0x%04x", @@ -147,25 +170,42 @@ audit_tg(struct sk_buff *skb, > const struct xt_action_param *par) if (par->family == NFPROTO_BRIDGE) > { switch (eth_hdr(skb)->h_proto) { > case htons(ETH_P_IP): > - audit_ip4(ab, skb); > + audit_ip4(ab, skb, &apar); > break; > > case htons(ETH_P_IPV6): > - audit_ip6(ab, skb); > + audit_ip6(ab, skb, &apar); > break; > } > } > + } else { > + audit_log_format(ab, " smac=? dmac=? > macproto=0xffff"); } > > switch (par->family) { > case NFPROTO_IPV4: > - audit_ip4(ab, skb); > + audit_ip4(ab, skb, &apar); > break; > > case NFPROTO_IPV6: > - audit_ip6(ab, skb); > + audit_ip6(ab, skb, &apar); > + break; > + } > + > + switch (apar.ipv) { > + case 4: > + audit_log_format(ab, " trunc=%d saddr=%pI4 > daddr=%pI4 ipid=%hu proto=%hhu frag=%d", > + apar.iptrunc, apar.saddr, apar.daddr, > apar.ipid, apar.proto, apar.frag); > + break; > + case 6: > + audit_log_format(ab, " trunc=%d saddr=%pI6c > daddr=%pI6c ipid=-1 proto=%hhu frag=-1", > + apar.iptrunc, apar.saddr, apar.daddr, > apar.proto); break; > + default: > + audit_log_format(ab, " trunc=-1 saddr=? daddr=? > ipid=-1 proto=-1 frag=-1"); } > + audit_log_format(ab, " trunc=%d sport=%hu dport=%hu > icmptype=%hhu icmpcode=%hhu", > + apar.ptrunc, apar.sport, apar.dport, apar.icmpt, > apar.icmpc); > #ifdef CONFIG_NETWORK_SECMARK > if (skb->secmark)