Eliminate flipping in and out of message fields.
https://github.com/linux-audit/audit-kernel/issues/11
Signed-off-by: Richard Guy Briggs <r...@redhat.com>
---
net/netfilter/xt_AUDIT.c | 92 +++++++++++++++++++++++++++++++++-------------
1 files changed, 66 insertions(+), 26 deletions(-)
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index 4973cbd..8089ec2 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -31,24 +31,41 @@ MODULE_ALIAS("ip6t_AUDIT");
MODULE_ALIAS("ebt_AUDIT");
MODULE_ALIAS("arpt_AUDIT");
+struct nfpkt_par {
+ int ipv;
+ int iptrunc;
+ const void *saddr;
+ const void *daddr;
+ u16 ipid;
+ u8 proto;
+ u8 frag;
+ int ptrunc;
+ u16 sport;
+ u16 dport;
+ u8 icmpt;
+ u8 icmpc;
+};
+
static void audit_proto(struct audit_buffer *ab, struct sk_buff *skb,
- unsigned int proto, unsigned int offset)
+ unsigned int proto, unsigned int offset, struct
nfpkt_par *apar)
{
switch (proto) {
case IPPROTO_TCP:
case IPPROTO_UDP:
- case IPPROTO_UDPLITE: {
+ case IPPROTO_UDPLITE:
+ case IPPROTO_DCCP:
+ case IPPROTO_SCTP: {
const __be16 *pptr;
__be16 _ports[2];
pptr = skb_header_pointer(skb, offset, sizeof(_ports), _ports);
if (pptr == NULL) {
- audit_log_format(ab, " truncated=1");
+ apar->ptrunc = 1;
return;
}
+ apar->sport = ntohs(pptr[0]);
+ apar->dport = ntohs(pptr[1]);
- audit_log_format(ab, " sport=%hu dport=%hu",
- ntohs(pptr[0]), ntohs(pptr[1]));
}
break;
@@ -59,41 +76,43 @@ static void audit_proto(struct audit_buffer *ab, struct
sk_buff *skb,
iptr = skb_header_pointer(skb, offset, sizeof(_ih), &_ih);
if (iptr == NULL) {
- audit_log_format(ab, " truncated=1");
+ apar->ptrunc = 1;
return;
}
-
- audit_log_format(ab, " icmptype=%hhu icmpcode=%hhu",
- iptr[0], iptr[1]);
+ apar->icmpt = iptr[0];
+ apar->icmpc = iptr[1];
}
break;
}
}
-static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
+static void audit_ip4(struct audit_buffer *ab, struct sk_buff *skb, struct
nfpkt_par *apar)
{
struct iphdr _iph;
const struct iphdr *ih;
+ apar->ipv = 4;
ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
if (!ih) {
- audit_log_format(ab, " truncated=1");
+ apar->iptrunc = 1;
return;
}
- audit_log_format(ab, " saddr=%pI4 daddr=%pI4 ipid=%hu proto=%hhu",
- &ih->saddr, &ih->daddr, ntohs(ih->id), ih->protocol);
+ apar->saddr = &ih->saddr;
+ apar->daddr = &ih->daddr;
+ apar->ipid = ntohs(ih->id);
+ apar->proto = ih->protocol;
if (ntohs(ih->frag_off) & IP_OFFSET) {
- audit_log_format(ab, " frag=1");
+ apar->frag = 1;
return;
}
- audit_proto(ab, skb, ih->protocol, ih->ihl * 4);
+ audit_proto(ab, skb, ih->protocol, ih->ihl * 4, apar);
}
-static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
+static void audit_ip6(struct audit_buffer *ab, struct sk_buff *skb, struct
nfpkt_par *apar)
{
struct ipv6hdr _ip6h;
const struct ipv6hdr *ih;
@@ -101,9 +120,10 @@ static void audit_ip6(struct audit_buffer *ab, struct
sk_buff *skb)
__be16 frag_off;
int offset;
+ apar->ipv = 6;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h),
&_ip6h);
if (!ih) {
- audit_log_format(ab, " truncated=1");
+ apar->iptrunc = 1;
return;
}
@@ -111,11 +131,12 @@ static void audit_ip6(struct audit_buffer *ab, struct
sk_buff *skb)
offset = ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h),
&nexthdr, &frag_off);
- audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
- &ih->saddr, &ih->daddr, nexthdr);
+ apar->saddr = &ih->saddr;
+ apar->daddr = &ih->daddr;
+ apar->proto = nexthdr;
if (offset)
- audit_proto(ab, skb, nexthdr, offset);
+ audit_proto(ab, skb, nexthdr, offset, apar);
}
static unsigned int
@@ -123,6 +144,9 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param
*par)
{
const struct xt_audit_info *info = par->targinfo;
struct audit_buffer *ab;
+ struct nfpkt_par apar = {
+ -1, -1, NULL, NULL, -1, -1, -1, -1, -1, -1, -1, -1
+ };
if (audit_enabled == 0)
goto errout;
@@ -136,8 +160,7 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param
*par)
par->in ? par->in->name : "?",
par->out ? par->out->name : "?");
- if (skb->mark)
- audit_log_format(ab, " mark=%#x", skb->mark);
+ audit_log_format(ab, " mark=%#x", skb->mark ?: -1);
if (skb->dev && skb->dev->type == ARPHRD_ETHER) {
audit_log_format(ab, " smac=%pM dmac=%pM macproto=0x%04x",
@@ -147,25 +170,42 @@ audit_tg(struct sk_buff *skb, const struct
xt_action_param *par)
if (par->family == NFPROTO_BRIDGE) {
switch (eth_hdr(skb)->h_proto) {
case htons(ETH_P_IP):
- audit_ip4(ab, skb);
+ audit_ip4(ab, skb, &apar);
break;
case htons(ETH_P_IPV6):
- audit_ip6(ab, skb);
+ audit_ip6(ab, skb, &apar);
break;
}
}
+ } else {
+ audit_log_format(ab, " smac=? dmac=? macproto=0xffff");
}
switch (par->family) {
case NFPROTO_IPV4:
- audit_ip4(ab, skb);
+ audit_ip4(ab, skb, &apar);
break;
case NFPROTO_IPV6:
- audit_ip6(ab, skb);
+ audit_ip6(ab, skb, &apar);
+ break;
+ }
+
+ switch (apar.ipv) {
+ case 4:
+ audit_log_format(ab, " trunc=%d saddr=%pI4 daddr=%pI4 ipid=%hu
proto=%hhu frag=%d",
+ apar.iptrunc, apar.saddr, apar.daddr, apar.ipid,
apar.proto, apar.frag);
+ break;
+ case 6:
+ audit_log_format(ab, " trunc=%d saddr=%pI6c daddr=%pI6c ipid=-1
proto=%hhu frag=-1",
+ apar.iptrunc, apar.saddr, apar.daddr, apar.proto);
break;
+ default:
+ audit_log_format(ab, " trunc=-1 saddr=? daddr=? ipid=-1
proto=-1 frag=-1");
}
+ audit_log_format(ab, " trunc=%d sport=%hu dport=%hu icmptype=%hhu
icmpcode=%hhu",
+ apar.ptrunc, apar.sport, apar.dport, apar.icmpt, apar.icmpc);
#ifdef CONFIG_NETWORK_SECMARK
if (skb->secmark)
--
1.7.1
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
