1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
4 * Copyright (c) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org>
6 * Development of this code funded by Astaro AG (http://www.astaro.com/)
9 #include <linux/audit.h>
10 #include <linux/kernel.h>
11 #include <linux/init.h>
12 #include <linux/module.h>
13 #include <linux/netlink.h>
14 #include <linux/netfilter.h>
15 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_log.h>
20 #include <linux/netdevice.h>
22 static const char *nft_log_null_prefix
= "";
25 struct nf_loginfo loginfo
;
29 static bool audit_ip4(struct audit_buffer
*ab
, struct sk_buff
*skb
)
32 const struct iphdr
*ih
;
34 ih
= skb_header_pointer(skb
, skb_network_offset(skb
), sizeof(_iph
), &_iph
);
38 audit_log_format(ab
, " saddr=%pI4 daddr=%pI4 proto=%hhu",
39 &ih
->saddr
, &ih
->daddr
, ih
->protocol
);
44 static bool audit_ip6(struct audit_buffer
*ab
, struct sk_buff
*skb
)
47 const struct ipv6hdr
*ih
;
51 ih
= skb_header_pointer(skb
, skb_network_offset(skb
), sizeof(_ip6h
), &_ip6h
);
55 nexthdr
= ih
->nexthdr
;
56 ipv6_skip_exthdr(skb
, skb_network_offset(skb
) + sizeof(_ip6h
), &nexthdr
, &frag_off
);
58 audit_log_format(ab
, " saddr=%pI6c daddr=%pI6c proto=%hhu",
59 &ih
->saddr
, &ih
->daddr
, nexthdr
);
64 static void nft_log_eval_audit(const struct nft_pktinfo
*pkt
)
66 struct sk_buff
*skb
= pkt
->skb
;
67 struct audit_buffer
*ab
;
73 ab
= audit_log_start(NULL
, GFP_ATOMIC
, AUDIT_NETFILTER_PKT
);
77 audit_log_format(ab
, "mark=%#x", skb
->mark
);
79 switch (nft_pf(pkt
)) {
81 switch (eth_hdr(skb
)->h_proto
) {
83 fam
= audit_ip4(ab
, skb
) ? NFPROTO_IPV4
: -1;
85 case htons(ETH_P_IPV6
):
86 fam
= audit_ip6(ab
, skb
) ? NFPROTO_IPV6
: -1;
91 fam
= audit_ip4(ab
, skb
) ? NFPROTO_IPV4
: -1;
94 fam
= audit_ip6(ab
, skb
) ? NFPROTO_IPV6
: -1;
99 audit_log_format(ab
, " saddr=? daddr=? proto=-1");
104 static void nft_log_eval(const struct nft_expr
*expr
,
105 struct nft_regs
*regs
,
106 const struct nft_pktinfo
*pkt
)
108 const struct nft_log
*priv
= nft_expr_priv(expr
);
110 if (priv
->loginfo
.type
== NF_LOG_TYPE_LOG
&&
111 priv
->loginfo
.u
.log
.level
== NFT_LOGLEVEL_AUDIT
) {
112 nft_log_eval_audit(pkt
);
116 nf_log_packet(nft_net(pkt
), nft_pf(pkt
), nft_hook(pkt
), pkt
->skb
,
117 nft_in(pkt
), nft_out(pkt
), &priv
->loginfo
, "%s",
121 static const struct nla_policy nft_log_policy
[NFTA_LOG_MAX
+ 1] = {
122 [NFTA_LOG_GROUP
] = { .type
= NLA_U16
},
123 [NFTA_LOG_PREFIX
] = { .type
= NLA_STRING
,
124 .len
= NF_LOG_PREFIXLEN
- 1 },
125 [NFTA_LOG_SNAPLEN
] = { .type
= NLA_U32
},
126 [NFTA_LOG_QTHRESHOLD
] = { .type
= NLA_U16
},
127 [NFTA_LOG_LEVEL
] = { .type
= NLA_U32
},
128 [NFTA_LOG_FLAGS
] = { .type
= NLA_U32
},
131 static int nft_log_modprobe(struct net
*net
, enum nf_log_type t
)
134 case NF_LOG_TYPE_LOG
:
135 return nft_request_module(net
, "%s", "nf_log_syslog");
136 case NF_LOG_TYPE_ULOG
:
137 return nft_request_module(net
, "%s", "nfnetlink_log");
138 case NF_LOG_TYPE_MAX
:
145 static int nft_log_init(const struct nft_ctx
*ctx
,
146 const struct nft_expr
*expr
,
147 const struct nlattr
* const tb
[])
149 struct nft_log
*priv
= nft_expr_priv(expr
);
150 struct nf_loginfo
*li
= &priv
->loginfo
;
151 const struct nlattr
*nla
;
154 li
->type
= NF_LOG_TYPE_LOG
;
155 if (tb
[NFTA_LOG_LEVEL
] != NULL
&&
156 tb
[NFTA_LOG_GROUP
] != NULL
)
158 if (tb
[NFTA_LOG_GROUP
] != NULL
) {
159 li
->type
= NF_LOG_TYPE_ULOG
;
160 if (tb
[NFTA_LOG_FLAGS
] != NULL
)
164 nla
= tb
[NFTA_LOG_PREFIX
];
166 priv
->prefix
= kmalloc(nla_len(nla
) + 1, GFP_KERNEL_ACCOUNT
);
167 if (priv
->prefix
== NULL
)
169 nla_strscpy(priv
->prefix
, nla
, nla_len(nla
) + 1);
171 priv
->prefix
= (char *)nft_log_null_prefix
;
175 case NF_LOG_TYPE_LOG
:
176 if (tb
[NFTA_LOG_LEVEL
] != NULL
) {
178 ntohl(nla_get_be32(tb
[NFTA_LOG_LEVEL
]));
180 li
->u
.log
.level
= NFT_LOGLEVEL_WARNING
;
182 if (li
->u
.log
.level
> NFT_LOGLEVEL_AUDIT
) {
187 if (tb
[NFTA_LOG_FLAGS
] != NULL
) {
189 ntohl(nla_get_be32(tb
[NFTA_LOG_FLAGS
]));
190 if (li
->u
.log
.logflags
& ~NF_LOG_MASK
) {
196 case NF_LOG_TYPE_ULOG
:
197 li
->u
.ulog
.group
= ntohs(nla_get_be16(tb
[NFTA_LOG_GROUP
]));
198 if (tb
[NFTA_LOG_SNAPLEN
] != NULL
) {
199 li
->u
.ulog
.flags
|= NF_LOG_F_COPY_LEN
;
200 li
->u
.ulog
.copy_len
=
201 ntohl(nla_get_be32(tb
[NFTA_LOG_SNAPLEN
]));
203 if (tb
[NFTA_LOG_QTHRESHOLD
] != NULL
) {
204 li
->u
.ulog
.qthreshold
=
205 ntohs(nla_get_be16(tb
[NFTA_LOG_QTHRESHOLD
]));
210 if (li
->u
.log
.level
== NFT_LOGLEVEL_AUDIT
)
213 err
= nf_logger_find_get(ctx
->family
, li
->type
);
215 if (nft_log_modprobe(ctx
->net
, li
->type
) == -EAGAIN
)
224 if (priv
->prefix
!= nft_log_null_prefix
)
229 static void nft_log_destroy(const struct nft_ctx
*ctx
,
230 const struct nft_expr
*expr
)
232 struct nft_log
*priv
= nft_expr_priv(expr
);
233 struct nf_loginfo
*li
= &priv
->loginfo
;
235 if (priv
->prefix
!= nft_log_null_prefix
)
238 if (li
->u
.log
.level
== NFT_LOGLEVEL_AUDIT
)
241 nf_logger_put(ctx
->family
, li
->type
);
244 static int nft_log_dump(struct sk_buff
*skb
,
245 const struct nft_expr
*expr
, bool reset
)
247 const struct nft_log
*priv
= nft_expr_priv(expr
);
248 const struct nf_loginfo
*li
= &priv
->loginfo
;
250 if (priv
->prefix
!= nft_log_null_prefix
)
251 if (nla_put_string(skb
, NFTA_LOG_PREFIX
, priv
->prefix
))
252 goto nla_put_failure
;
254 case NF_LOG_TYPE_LOG
:
255 if (nla_put_be32(skb
, NFTA_LOG_LEVEL
, htonl(li
->u
.log
.level
)))
256 goto nla_put_failure
;
258 if (li
->u
.log
.logflags
) {
259 if (nla_put_be32(skb
, NFTA_LOG_FLAGS
,
260 htonl(li
->u
.log
.logflags
)))
261 goto nla_put_failure
;
264 case NF_LOG_TYPE_ULOG
:
265 if (nla_put_be16(skb
, NFTA_LOG_GROUP
, htons(li
->u
.ulog
.group
)))
266 goto nla_put_failure
;
268 if (li
->u
.ulog
.flags
& NF_LOG_F_COPY_LEN
) {
269 if (nla_put_be32(skb
, NFTA_LOG_SNAPLEN
,
270 htonl(li
->u
.ulog
.copy_len
)))
271 goto nla_put_failure
;
273 if (li
->u
.ulog
.qthreshold
) {
274 if (nla_put_be16(skb
, NFTA_LOG_QTHRESHOLD
,
275 htons(li
->u
.ulog
.qthreshold
)))
276 goto nla_put_failure
;
286 static struct nft_expr_type nft_log_type
;
287 static const struct nft_expr_ops nft_log_ops
= {
288 .type
= &nft_log_type
,
289 .size
= NFT_EXPR_SIZE(sizeof(struct nft_log
)),
290 .eval
= nft_log_eval
,
291 .init
= nft_log_init
,
292 .destroy
= nft_log_destroy
,
293 .dump
= nft_log_dump
,
294 .reduce
= NFT_REDUCE_READONLY
,
297 static struct nft_expr_type nft_log_type __read_mostly
= {
300 .policy
= nft_log_policy
,
301 .maxattr
= NFTA_LOG_MAX
,
302 .owner
= THIS_MODULE
,
305 static int __init
nft_log_module_init(void)
307 return nft_register_expr(&nft_log_type
);
310 static void __exit
nft_log_module_exit(void)
312 nft_unregister_expr(&nft_log_type
);
315 module_init(nft_log_module_init
);
316 module_exit(nft_log_module_exit
);
318 MODULE_LICENSE("GPL");
319 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
320 MODULE_ALIAS_NFT_EXPR("log");
321 MODULE_DESCRIPTION("Netfilter nf_tables log module");