• Thomas Graf's avatar
    netfilter: audit target to record accepted/dropped packets · 43f393ca
    Thomas Graf authored
    This patch adds a new netfilter target which creates audit records
    for packets traversing a certain chain.
    
    It can be used to record packets which are rejected administraively
    as follows:
    
      -N AUDIT_DROP
      -A AUDIT_DROP -j AUDIT --type DROP
      -A AUDIT_DROP -j DROP
    
    a rule which would typically drop or reject a packet would then
    invoke the new chain to record packets before dropping them.
    
      -j AUDIT_DROP
    
    The module is protocol independant and works for iptables, ip6tables
    and ebtables.
    
    The following information is logged:
     - netfilter hook
     - packet length
     - incomming/outgoing interface
     - MAC src/dst/proto for ethernet packets
     - src/dst/protocol address for IPv4/IPv6
     - src/dst port for TCP/UDP/UDPLITE
     - icmp type/code
    
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Eric Paris <eparis@parisplace.org>
    Cc: Al Viro <viro@ZenIV.linux.org.uk>
    Signed-off-by: default avatarThomas Graf <tgraf@redhat.com>
    Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
    43f393ca
Makefile 4.85 KB