audit: add audit_log_nf_skb helper function

Netfilter code (net/netfilter/nft_log.c and net/netfilter/xt_AUDIT.c)
have to be kept in sync. Both source files had duplicated versions of
audit_ip4() and audit_ip6() functions, which can result in lack of
consistency and/or duplicated work.

This patch adds a helper function in audit.c that can be called by
netfilter code commonly, aiming to improve maintainability and
consistency.

Suggested-by: Florian Westphal <fw@strlen.de>
Suggested-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/include/linux/audit.h b/include/linux/audit.h
index 536f8ee8da818c642aff343618ac45ed15314c0a..d8173af498bae1be50aacb84e22f36c75c4a0f94 100644 (file)
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -195,6 +195,8 @@ extern int audit_log_subj_ctx(struct audit_buffer *ab, struct lsm_prop *prop);
 extern int audit_log_obj_ctx(struct audit_buffer *ab, struct lsm_prop *prop);
 extern int audit_log_task_context(struct audit_buffer *ab);
 extern void audit_log_task_info(struct audit_buffer *ab);
+extern int audit_log_nf_skb(struct audit_buffer *ab,
+                           const struct sk_buff *skb, u8 nfproto);
 
 extern int                 audit_update_lsm_rules(void);
 
@@ -272,6 +274,12 @@ static inline int audit_log_task_context(struct audit_buffer *ab)
 static inline void audit_log_task_info(struct audit_buffer *ab)
 { }
 
+static inline int audit_log_nf_skb(struct audit_buffer *ab,
+                                  const struct sk_buff *skb, u8 nfproto)
+{
+       return 0;
+}
+
 static inline kuid_t audit_get_loginuid(struct task_struct *tsk)
 {
        return INVALID_UID;

diff --git a/kernel/audit.c b/kernel/audit.c
index 26a332ffb1b8d9db63d844c8dfebd69dddf6e270..5c302c4592dbc7cd4ff92cd2d0443bf7c825dc40 100644 (file)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -58,6 +58,8 @@
 #include <linux/freezer.h>
 #include <linux/pid_namespace.h>
 #include <net/netns/generic.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
 
 #include "audit.h"
 
@@ -2488,6 +2490,68 @@ void audit_log_path_denied(int type, const char *operation)
        audit_log_end(ab);
 }
 
+int audit_log_nf_skb(struct audit_buffer *ab,
+                    const struct sk_buff *skb, u8 nfproto)
+{
+       /* find the IP protocol in the case of NFPROTO_BRIDGE */
+       if (nfproto == NFPROTO_BRIDGE) {
+               switch (eth_hdr(skb)->h_proto) {
+               case htons(ETH_P_IP):
+                       nfproto = NFPROTO_IPV4;
+                       break;
+               case htons(ETH_P_IPV6):
+                       nfproto = NFPROTO_IPV6;
+                       break;
+               default:
+                       goto unknown_proto;
+               }
+       }
+
+       switch (nfproto) {
+       case NFPROTO_IPV4: {
+               struct iphdr iph;
+               const struct iphdr *ih;
+
+               ih = skb_header_pointer(skb, skb_network_offset(skb),
+                                       sizeof(iph), &iph);
+               if (!ih)
+                       return -ENOMEM;
+
+               audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
+                                &ih->saddr, &ih->daddr, ih->protocol);
+               break;
+       }
+       case NFPROTO_IPV6: {
+               struct ipv6hdr iph;
+               const struct ipv6hdr *ih;
+               u8 nexthdr;
+               __be16 frag_off;
+
+               ih = skb_header_pointer(skb, skb_network_offset(skb),
+                                       sizeof(iph), &iph);
+               if (!ih)
+                       return -ENOMEM;
+
+               nexthdr = ih->nexthdr;
+               ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(iph),
+                                &nexthdr, &frag_off);
+
+               audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
+                                &ih->saddr, &ih->daddr, nexthdr);
+               break;
+       }
+       default:
+               goto unknown_proto;
+       }
+
+       return 0;
+
+unknown_proto:
+       audit_log_format(ab, " saddr=? daddr=? proto=?");
+       return -EPFNOSUPPORT;
+}
+EXPORT_SYMBOL(audit_log_nf_skb);
+
 /* global counter which is incremented every time something logs in */
 static atomic_t session_id = ATOMIC_INIT(0);
 

diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c
index e355881379957932c29dae968b25a3a4d935d753..bf01cf8a8907b5281f39948a1c14d576accf085c 100644 (file)
--- a/net/netfilter/nft_log.c
+++ b/net/netfilter/nft_log.c
@@ -26,46 +26,10 @@ struct nft_log {
        char                    *prefix;
 };
 
-static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
-{
-       struct iphdr _iph;
-       const struct iphdr *ih;
-
-       ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
-       if (!ih)
-               return false;
-
-       audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
-                        &ih->saddr, &ih->daddr, ih->protocol);
-
-       return true;
-}
-
-static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
-{
-       struct ipv6hdr _ip6h;
-       const struct ipv6hdr *ih;
-       u8 nexthdr;
-       __be16 frag_off;
-
-       ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
-       if (!ih)
-               return false;
-
-       nexthdr = ih->nexthdr;
-       ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
-
-       audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
-                        &ih->saddr, &ih->daddr, nexthdr);
-
-       return true;
-}
-
 static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
 {
        struct sk_buff *skb = pkt->skb;
        struct audit_buffer *ab;
-       int fam = -1;
 
        if (!audit_enabled)
                return;
@@ -76,27 +40,7 @@ static void nft_log_eval_audit(const struct nft_pktinfo *pkt)
 
        audit_log_format(ab, "mark=%#x", skb->mark);
 
-       switch (nft_pf(pkt)) {
-       case NFPROTO_BRIDGE:
-               switch (eth_hdr(skb)->h_proto) {
-               case htons(ETH_P_IP):
-                       fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
-                       break;
-               case htons(ETH_P_IPV6):
-                       fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
-                       break;
-               }
-               break;
-       case NFPROTO_IPV4:
-               fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
-               break;
-       case NFPROTO_IPV6:
-               fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
-               break;
-       }
-
-       if (fam == -1)
-               audit_log_format(ab, " saddr=? daddr=? proto=-1");
+       audit_log_nf_skb(ab, skb, nft_pf(pkt));
 
        audit_log_end(ab);
 }

diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index b6a015aee0cecc50bc5db9e42a9426e3d2c2efc0..4c18606b8654bad220052fa4ae53052d77d6504c 100644 (file)
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -28,46 +28,10 @@ MODULE_ALIAS("ip6t_AUDIT");
 MODULE_ALIAS("ebt_AUDIT");
 MODULE_ALIAS("arpt_AUDIT");
 
-static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
-{
-       struct iphdr _iph;
-       const struct iphdr *ih;
-
-       ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
-       if (!ih)
-               return false;
-
-       audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
-                        &ih->saddr, &ih->daddr, ih->protocol);
-
-       return true;
-}
-
-static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
-{
-       struct ipv6hdr _ip6h;
-       const struct ipv6hdr *ih;
-       u8 nexthdr;
-       __be16 frag_off;
-
-       ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
-       if (!ih)
-               return false;
-
-       nexthdr = ih->nexthdr;
-       ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
-
-       audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
-                        &ih->saddr, &ih->daddr, nexthdr);
-
-       return true;
-}
-
 static unsigned int
 audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
        struct audit_buffer *ab;
-       int fam = -1;
 
        if (audit_enabled == AUDIT_OFF)
                goto errout;
@@ -77,27 +41,7 @@ audit_tg(struct sk_buff *skb, const struct xt_action_param *par)
 
        audit_log_format(ab, "mark=%#x", skb->mark);
 
-       switch (xt_family(par)) {
-       case NFPROTO_BRIDGE:
-               switch (eth_hdr(skb)->h_proto) {
-               case htons(ETH_P_IP):
-                       fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
-                       break;
-               case htons(ETH_P_IPV6):
-                       fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
-                       break;
-               }
-               break;
-       case NFPROTO_IPV4:
-               fam = audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1;
-               break;
-       case NFPROTO_IPV6:
-               fam = audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1;
-               break;
-       }
-
-       if (fam == -1)
-               audit_log_format(ab, " saddr=? daddr=? proto=-1");
+       audit_log_nf_skb(ab, skb, xt_family(par));
 
        audit_log_end(ab);