lkml.org 
[lkml]   [1999]   [Apr]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subjecttcp_audit patch
Hey people,

Some time ago, in the 2.0.x kernel era, somebody submitted a patch for strobe
protection, this patch also had a tcp audit facility like tcpd does, sending
accepts and rejects to syslog. I liked this part of it, and have modified it
for 2.2.6 kernel. I haven't formally posted it anywhere yet, as I cannot
contact the orignal author for the 2.0.x kernel, and he deserves proper credit,
all I did was make it work in 2.2.x. I'll attach it here for anyone who wants
to use it, and if anyone can locate the original author, please let me know.

Thanks....

Russell


Words to live by....
Work like you don't need money,
Love like you've never been hurt,
And dance like no one's watching.
diff -ruN linuxdev/net/ipv4/af_inet.c linux/net/ipv4/af_inet.c
--- linuxdev/net/ipv4/af_inet.c Thu Mar 25 12:23:34 1999
+++ linux/net/ipv4/af_inet.c Mon Apr 26 13:07:47 1999
@@ -691,6 +691,10 @@
} else {
if((sk2 = sk1->prot->accept(sk1,flags)) == NULL)
goto do_sk1_err;
+
+ else
+ /* This code enables tcp auditing like tcpd to syslog */
+ printk ( KERN_INFO "TCP connection accepted: ip=%d.%d.%d.%d port=%d uid=%d p
rocess=%s[%d]\n",NIPQUAD(sk2->daddr), sk2->num, current->uid, current->comm, cur
rent->pid );
}

/*
diff -ruN linuxdev/net/ipv4/tcp_ipv4.c linux/net/ipv4/tcp_ipv4.c
--- linuxdev/net/ipv4/tcp_ipv4.c Mon Apr 26 12:24:10 1999
+++ linux/net/ipv4/tcp_ipv4.c Mon Apr 26 13:07:09 1999
@@ -1698,6 +1698,8 @@
return 0;

no_tcp_socket:
+ /* This code enables tcp auditing like tcpd to syslog */
+ printk( KERN_INFO "TCP connection rejected from %d.%d.%d.%d, port %d\n", NIPQU
AD(skb->nh.iph->saddr), ntohs(th->dest) );
tcp_v4_send_reset(skb);

discard_it:
\
 
 \ /
  Last update: 2005-03-22 13:51    [W:0.452 / U:0.656 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site