[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

[PATCH]: 2nd revision of make xfrm_audit_log more generic



This is 2nd revision of patch to modify xfrm_audit_log() such
that it can accomodate auditing other ipsec events
besides add/delete of an SA or SPD entry.

2nd revision includes new define for all IPsec
events in audit.h and introduces "op=" entry
in logfile as well as add a hyphen in description
for report parsing. 

This is a small change to accomodate updating
ipsec protocol to RFCs 4301, 4302 and 4303 which
require auditing some ipsec events if auditing
is available. Please let me know if ok.

Regards,
Joy

Signed-off-by: Joy Latten <latten austin ibm com>

diff -urpN linux-2.6.22/include/linux/audit.h linux-2.6.22.patch/include/linux/audit.h
--- linux-2.6.22/include/linux/audit.h	2007-07-23 14:35:28.000000000 -0500
+++ linux-2.6.22.patch/include/linux/audit.h	2007-07-23 14:38:51.000000000 -0500
@@ -112,6 +112,7 @@
 #define AUDIT_MAC_IPSEC_DELSA	1412	/* Delete a XFRM state */
 #define AUDIT_MAC_IPSEC_ADDSPD	1413	/* Add a XFRM policy */
 #define AUDIT_MAC_IPSEC_DELSPD	1414	/* Delete a XFRM policy */
+#define AUDIT_MAC_IPSEC_EVENT	1415	/* Audit IPSec events */
 
 #define AUDIT_FIRST_KERN_ANOM_MSG   1700
 #define AUDIT_LAST_KERN_ANOM_MSG    1799
diff -urpN linux-2.6.22/include/net/xfrm.h linux-2.6.22.patch/include/net/xfrm.h
--- linux-2.6.22/include/net/xfrm.h	2007-07-23 14:35:28.000000000 -0500
+++ linux-2.6.22.patch/include/net/xfrm.h	2007-07-23 14:38:51.000000000 -0500
@@ -427,9 +427,11 @@ struct xfrm_audit
 
 #ifdef CONFIG_AUDITSYSCALL
 extern void xfrm_audit_log(uid_t auid, u32 secid, int type, int result,
-		    struct xfrm_policy *xp, struct xfrm_state *x);
+			   u16 family, xfrm_address_t saddr, 
+			   xfrm_address_t daddr, __be32 spi, __be32 flowid, 
+			   struct xfrm_sec_ctx *sctx, char *buf);
 #else
-#define xfrm_audit_log(a,s,t,r,p,x) do { ; } while (0)
+#define xfrm_audit_log(a,i,t,r,f,s,d,p,l,c,b) do { ; } while (0)
 #endif /* CONFIG_AUDITSYSCALL */
 
 static inline void xfrm_pol_hold(struct xfrm_policy *policy)
diff -urpN linux-2.6.22/net/key/af_key.c linux-2.6.22.patch/net/key/af_key.c
--- linux-2.6.22/net/key/af_key.c	2007-07-08 18:32:17.000000000 -0500
+++ linux-2.6.22.patch/net/key/af_key.c	2007-07-24 11:50:35.000000000 -0500
@@ -1459,7 +1459,9 @@ static int pfkey_add(struct sock *sk, st
 		err = xfrm_state_update(x);
 
 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-		       AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+		       x->props.family, x->props.saddr, x->id.daddr, 
+		       x->id.spi, 0, x->security, "SAD-add");
 
 	if (err < 0) {
 		x->km.state = XFRM_STATE_DEAD;
@@ -1513,7 +1515,10 @@ static int pfkey_delete(struct sock *sk,
 	km_state_notify(x, &c);
 out:
 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-		       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, x->props.family,
+		       x->props.saddr, x->id.daddr, x->id.spi, 0,
+		       x->security, "SAD-delete");
+
 	xfrm_state_put(x);
 
 	return err;
@@ -2266,7 +2271,9 @@ static int pfkey_spdadd(struct sock *sk,
 				 hdr->sadb_msg_type != SADB_X_SPDUPDATE);
 
 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-		       AUDIT_MAC_IPSEC_ADDSPD, err ? 0 : 1, xp, NULL);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+		       xp->selector.family, xp->selector.saddr,
+		       xp->selector.daddr, 0, 0, xp->security, "SPD-add");
 
 	if (err)
 		goto out;
@@ -2350,7 +2357,9 @@ static int pfkey_spddelete(struct sock *
 		return -ENOENT;
 
 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-		       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1,
+		       xp->selector.family, xp->selector.saddr,
+		       xp->selector.daddr, 0, 0, xp->security, "SPD-delete");
 
 	if (err)
 		goto out;
@@ -2611,7 +2620,10 @@ static int pfkey_spdget(struct sock *sk,
 
 	if (delete) {
 		xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-			       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+			       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+			       xp->selector.family, xp->selector.saddr,
+			       xp->selector.daddr, 0, 0, xp->security,
+			       "SPD-delete");
 
 		if (err)
 			goto out;
diff -urpN linux-2.6.22/net/xfrm/xfrm_policy.c linux-2.6.22.patch/net/xfrm/xfrm_policy.c
--- linux-2.6.22/net/xfrm/xfrm_policy.c	2007-07-23 14:35:29.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_policy.c	2007-07-24 11:46:24.000000000 -0500
@@ -853,8 +853,11 @@ xfrm_policy_flush_secctx_check(u8 type, 
 			if (err) {
 				xfrm_audit_log(audit_info->loginuid,
 					       audit_info->secid,
-					       AUDIT_MAC_IPSEC_DELSPD, 0,
-					       pol, NULL);
+					       AUDIT_MAC_IPSEC_EVENT, 0,
+					       pol->selector.family, 
+					       pol->selector.saddr, 
+					       pol->selector.daddr, 0, 0,
+					       pol->security, "SPD-delete");
 				return err;
 			}
 		}
@@ -868,8 +871,12 @@ xfrm_policy_flush_secctx_check(u8 type, 
 				if (err) {
 					xfrm_audit_log(audit_info->loginuid,
 						       audit_info->secid,
-						       AUDIT_MAC_IPSEC_DELSPD,
-						       0, pol, NULL);
+						       AUDIT_MAC_IPSEC_EVENT,
+						       0, pol->selector.family, 
+						       pol->selector.saddr, 
+						       pol->selector.daddr, 
+						       0, 0, pol->security, 
+						       "SPD-delete");
 					return err;
 				}
 			}
@@ -911,7 +918,11 @@ int xfrm_policy_flush(u8 type, struct xf
 			write_unlock_bh(&xfrm_policy_lock);
 
 			xfrm_audit_log(audit_info->loginuid, audit_info->secid,
-				       AUDIT_MAC_IPSEC_DELSPD, 1, pol, NULL);
+				       AUDIT_MAC_IPSEC_EVENT, 1, 
+				       pol->selector.family,
+				       pol->selector.saddr,
+				       pol->selector.daddr, 0, 0,
+				       pol->security, "SPD-delete");
 
 			xfrm_policy_kill(pol);
 			killed++;
@@ -933,8 +944,11 @@ int xfrm_policy_flush(u8 type, struct xf
 
 				xfrm_audit_log(audit_info->loginuid,
 					       audit_info->secid,
-					       AUDIT_MAC_IPSEC_DELSPD, 1,
-					       pol, NULL);
+					       AUDIT_MAC_IPSEC_EVENT, 1,
+					       pol->selector.family,
+					       pol->selector.saddr,
+					       pol->selector.daddr, 0, 0,
+					       pol->security, "SPD-delete");
 
 				xfrm_policy_kill(pol);
 				killed++;
@@ -2154,44 +2168,23 @@ EXPORT_SYMBOL(xfrm_bundle_ok);
 /* Audit addition and deletion of SAs and ipsec policy */
 
 void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
-		    struct xfrm_policy *xp, struct xfrm_state *x)
+                    u16 family, xfrm_address_t saddr, xfrm_address_t daddr,
+                    __be32 spi, __be32 flowlabel, struct xfrm_sec_ctx *sctx,
+                    char *buf)
 {
-
 	char *secctx;
 	u32 secctx_len;
-	struct xfrm_sec_ctx *sctx = NULL;
 	struct audit_buffer *audit_buf;
-	int family;
 	extern int audit_enabled;
 
 	if (audit_enabled == 0)
 		return;
 
-	BUG_ON((type == AUDIT_MAC_IPSEC_ADDSA ||
-		type == AUDIT_MAC_IPSEC_DELSA) && !x);
-	BUG_ON((type == AUDIT_MAC_IPSEC_ADDSPD ||
-		type == AUDIT_MAC_IPSEC_DELSPD) && !xp);
-
 	audit_buf = audit_log_start(current->audit_context, GFP_ATOMIC, type);
 	if (audit_buf == NULL)
 		return;
 
-	switch(type) {
-	case AUDIT_MAC_IPSEC_ADDSA:
-		audit_log_format(audit_buf, "SAD add: auid=%u", auid);
-		break;
-	case AUDIT_MAC_IPSEC_DELSA:
-		audit_log_format(audit_buf, "SAD delete: auid=%u", auid);
-		break;
-	case AUDIT_MAC_IPSEC_ADDSPD:
-		audit_log_format(audit_buf, "SPD add: auid=%u", auid);
-		break;
-	case AUDIT_MAC_IPSEC_DELSPD:
-		audit_log_format(audit_buf, "SPD delete: auid=%u", auid);
-		break;
-	default:
-		return;
-	}
+	audit_log_format(audit_buf, "op=%s: auid=%u", buf, auid);
 
 	if (sid != 0 &&
 		security_secid_to_secctx(sid, &secctx, &secctx_len) == 0)
@@ -2199,16 +2192,6 @@ void xfrm_audit_log(uid_t auid, u32 sid,
 	else
 		audit_log_task_context(audit_buf);
 
-	if (xp) {
-		family = xp->selector.family;
-		if (xp->security)
-			sctx = xp->security;
-	} else {
-		family = x->props.family;
-		if (x->security)
-			sctx = x->security;
-	}
-
 	if (sctx)
 		audit_log_format(audit_buf,
 				" sec_alg=%u sec_doi=%u sec_obj=%s",
@@ -2216,48 +2199,24 @@ void xfrm_audit_log(uid_t auid, u32 sid,
 
 	switch(family) {
 	case AF_INET:
-		{
-			struct in_addr saddr, daddr;
-			if (xp) {
-				saddr.s_addr = xp->selector.saddr.a4;
-				daddr.s_addr = xp->selector.daddr.a4;
-			} else {
-				saddr.s_addr = x->props.saddr.a4;
-				daddr.s_addr = x->id.daddr.a4;
-			}
-			audit_log_format(audit_buf,
-					 " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
-					 NIPQUAD(saddr), NIPQUAD(daddr));
-		}
-			break;
+		audit_log_format(audit_buf,
+				 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
+				 NIPQUAD(saddr.a4), NIPQUAD(daddr.a4));
+		break;
 	case AF_INET6:
-		{
-			struct in6_addr saddr6, daddr6;
-			if (xp) {
-				memcpy(&saddr6, xp->selector.saddr.a6,
-					sizeof(struct in6_addr));
-				memcpy(&daddr6, xp->selector.daddr.a6,
-					sizeof(struct in6_addr));
-			} else {
-				memcpy(&saddr6, x->props.saddr.a6,
-					sizeof(struct in6_addr));
-				memcpy(&daddr6, x->id.daddr.a6,
-					sizeof(struct in6_addr));
-			}
-			audit_log_format(audit_buf,
-					 " src=" NIP6_FMT " dst=" NIP6_FMT,
-					 NIP6(saddr6), NIP6(daddr6));
-		}
+		audit_log_format(audit_buf, " src=" NIP6_FMT " dst=" NIP6_FMT,
+				 NIP6(*((struct in6_addr *)&saddr.a6)),
+				 NIP6(*((struct in6_addr *)&daddr.a6)));
 		break;
 	}
 
-	if (x)
-		audit_log_format(audit_buf, " spi=%lu(0x%lx) protocol=%s",
-				(unsigned long)ntohl(x->id.spi),
-				(unsigned long)ntohl(x->id.spi),
-				x->id.proto == IPPROTO_AH ? "AH" :
-				(x->id.proto == IPPROTO_ESP ?
-				"ESP" : "IPCOMP"));
+	if (flowlabel)
+		audit_log_format(audit_buf, " flowlabel=%u", flowlabel);
+
+	if (spi)
+		audit_log_format(audit_buf, " spi=%lu(0x%lx)",
+				(unsigned long)ntohl(spi),
+				(unsigned long)ntohl(spi));
 
 	audit_log_format(audit_buf, " res=%u", result);
 	audit_log_end(audit_buf);
diff -urpN linux-2.6.22/net/xfrm/xfrm_state.c linux-2.6.22.patch/net/xfrm/xfrm_state.c
--- linux-2.6.22/net/xfrm/xfrm_state.c	2007-07-23 14:35:29.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_state.c	2007-07-24 11:48:27.000000000 -0500
@@ -303,7 +303,9 @@ expired:
 		km_state_expired(x, 1, 0);
 
 	xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-		       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+		       x->props.family, x->props.saddr, x->id.daddr, x->id.spi,
+		       0, x->security, "SAD-delete");
 
 out:
 	spin_unlock(&x->lock);
@@ -406,9 +408,10 @@ xfrm_state_flush_secctx_check(u8 proto, 
 			   (err = security_xfrm_state_delete(x)) != 0) {
 				xfrm_audit_log(audit_info->loginuid,
 					       audit_info->secid,
-					       AUDIT_MAC_IPSEC_DELSA,
-					       0, NULL, x);
-
+					       AUDIT_MAC_IPSEC_EVENT, 0,
+					       x->props.family, x->props.saddr, 
+					       x->id.daddr, x->id.spi, 0, 
+					       x->security, "SAD-delete");
 				return err;
 			}
 		}
@@ -446,8 +449,11 @@ restart:
 				err = xfrm_state_delete(x);
 				xfrm_audit_log(audit_info->loginuid,
 					       audit_info->secid,
-					       AUDIT_MAC_IPSEC_DELSA,
-					       err ? 0 : 1, NULL, x);
+					       AUDIT_MAC_IPSEC_EVENT, 
+					       err ? 0 : 1, x->props.family,
+					       x->props.saddr, x->id.daddr,
+					       x->id.spi, 0, x->security,
+					       "SAD-delete");
 				xfrm_state_put(x);
 
 				spin_lock_bh(&xfrm_state_lock);
diff -urpN linux-2.6.22/net/xfrm/xfrm_user.c linux-2.6.22.patch/net/xfrm/xfrm_user.c
--- linux-2.6.22/net/xfrm/xfrm_user.c	2007-07-08 18:32:17.000000000 -0500
+++ linux-2.6.22.patch/net/xfrm/xfrm_user.c	2007-07-24 11:49:33.000000000 -0500
@@ -456,7 +456,9 @@ static int xfrm_add_sa(struct sk_buff *s
 		err = xfrm_state_update(x);
 
 	xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-		       AUDIT_MAC_IPSEC_ADDSA, err ? 0 : 1, NULL, x);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+		       x->props.family, x->props.saddr, x->id.daddr, 
+		       x->id.spi, 0, x->security, "SAD-add");
 
 	if (err < 0) {
 		x->km.state = XFRM_STATE_DEAD;
@@ -539,7 +541,9 @@ static int xfrm_del_sa(struct sk_buff *s
 
 out:
 	xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-		       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+		       x->props.family, x->props.saddr, x->id.daddr, 
+		       x->id.spi, 0, x->security, "SAD-delete");
 	xfrm_state_put(x);
 	return err;
 }
@@ -1149,7 +1153,9 @@ static int xfrm_add_policy(struct sk_buf
 	excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
 	err = xfrm_policy_insert(p->dir, xp, excl);
 	xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-		       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+		       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+		       xp->selector.family, xp->selector.saddr, 
+		       xp->selector.daddr, 0, 0, xp->security, "SPD-delete");
 
 	if (err) {
 		security_xfrm_policy_free(xp);
@@ -1395,7 +1401,10 @@ static int xfrm_get_policy(struct sk_buf
 		}
 	} else {
 		xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-			       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
+			       AUDIT_MAC_IPSEC_EVENT, err ? 0 : 1, 
+			       xp->selector.family, xp->selector.saddr,
+			       xp->selector.daddr, 0, 0, xp->security,
+			       "SPD-delete");
 
 		if (err != 0)
 			goto out;
@@ -1644,8 +1653,9 @@ static int xfrm_add_pol_expire(struct sk
 	if (up->hard) {
 		xfrm_policy_delete(xp, p->dir);
 		xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-				AUDIT_MAC_IPSEC_DELSPD, 1, xp, NULL);
-
+			       AUDIT_MAC_IPSEC_EVENT, 1, xp->selector.family,
+			       xp->selector.saddr, xp->selector.daddr, 0, 0,
+			       xp->security, "SPD-delete");
 	} else {
 		// reset the timers here?
 		printk("Dont know what to do with soft policy expire\n");
@@ -1680,7 +1690,9 @@ static int xfrm_add_sa_expire(struct sk_
 	if (ue->hard) {
 		__xfrm_state_delete(x);
 		xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-			       AUDIT_MAC_IPSEC_DELSA, 1, NULL, x);
+			       AUDIT_MAC_IPSEC_EVENT, 1, x->props.family,
+			       x->props.saddr, x->id.daddr, x->id.spi, 0,
+			       x->security, "SAD-delete");
 	}
 	err = 0;
 out:


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]