From nobody Thu Oct 2 03:28:42 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E2EC262D14 for ; Mon, 22 Sep 2025 20:09:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758571797; cv=none; b=aHmYzMgt5z3EFKBiehEc2QOO/7fG6EfCmm3P05Y2G74w1Rx5LWXZ+ZHMOm/lO1AucekhoWALlpi0Fyy3fuFB3Hpgx4kspXpE1It73stngNLw+SPxKMK953h1t8q08Rk8EGO7lH7pm0c2on6BH06ZORFJDgt9GcqHumST5IInxJM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758571797; c=relaxed/simple; bh=96yc8lr8zpTTnNLo+57UwK0ZN6gWSNcoPPMe554q/80=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RmO7Xk0D14ZjdmtwWimCPrSWSNstJUxbj+q6QzNGX+MJ3/LAdvNNFhCsicQHN9weT93PZCMQg6w6An+x0gOYFn4AwHhWlxZE3KtqsvXq8APhbTPs2wzPE0+WAGpXlbOPKtvUZhBtpvp1Aun+CLxJ2pGNNfToprfrQkLVpYu4qeE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=YSqx2Cgd; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="YSqx2Cgd" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1758571794; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=xMy9+5cJFf4QAOot9A0fSaZyvFYitQlYRC/JRAHzUU8=; b=YSqx2CgdZIeGvKQ+SFy4Atc/XfFdo9CM5eD2+OnHEA50R/MaWWheLtPvhLJddZ6U91e52P TbPVIOkatgkNHjDAd3AmQLEkjI6OdhYqFB8jmlvA9SKnycRfu6TLXqvIGqtUKfUCMSRTlj MMI/LabI+leqUIr+28jgI2l/51VIPbs= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-673-RCZSE8ExNDun-yru0aRLLA-1; Mon, 22 Sep 2025 16:09:53 -0400 X-MC-Unique: RCZSE8ExNDun-yru0aRLLA-1 X-Mimecast-MFC-AGG-ID: RCZSE8ExNDun-yru0aRLLA_1758571791 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 131E119560AE; Mon, 22 Sep 2025 20:09:51 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.33]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 9F8A41956045; Mon, 22 Sep 2025 20:09:46 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org Cc: paul@paul-moore.com, eparis@redhat.com, pablo@netfilter.org, kadlec@netfilter.org, fw@strlen.de, Ricardo Robaina Subject: [PATCH v1] audit: include source and destination ports to NETFILTER_PKT Date: Mon, 22 Sep 2025 17:09:42 -0300 Message-ID: <20250922200942.1534414-1-rrobaina@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" NETFILTER_PKT records show both source and destination addresses, in addition to the associated networking protocol. However, it lacks the ports information, which is often valuable for troubleshooting. This patch adds both source and destination port numbers, 'sport' and 'dport' respectively, only to tcp/udp-related NETFILTER_PKT records. # ./audit-testsuite/tests/netfilter_pkt/test &> /dev/null # ausearch -i -m netfilter_pkt |tail -n12 type=3DNETFILTER_PKT ... saddr=3D127.0.0.1 daddr=3D127.0.0.1 proto=3Dicmp ---- type=3DNETFILTER_PKT ... saddr=3D::1 daddr=3D::1 proto=3Dipv6-icmp ---- type=3DNETFILTER_PKT ... daddr=3D127.0.0.1 proto=3Dudp sport=3D38173 dport= =3D42424 ---- type=3DNETFILTER_PKT ... daddr=3D::1 proto=3Dudp sport=3D56852 dport=3D424= 24 ---- type=3DNETFILTER_PKT ... daddr=3D127.0.0.1 proto=3Dtcp sport=3D57022 dport= =3D42424 ---- type=3DNETFILTER_PKT ... daddr=3D::1 proto=3Dtcp sport=3D50810 dport=3D424= 24 Link: https://github.com/linux-audit/audit-kernel/issues/162 Signed-off-by: Ricardo Robaina --- net/netfilter/xt_AUDIT.c | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index b6a015aee0ce..96a18675d468 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -32,6 +32,7 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_= buff *skb) { struct iphdr _iph; const struct iphdr *ih; + __be16 dport, sport; =20 ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_i= ph); if (!ih) @@ -40,6 +41,19 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk= _buff *skb) audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", &ih->saddr, &ih->daddr, ih->protocol); =20 + switch (ih->protocol) { + case IPPROTO_TCP: + sport =3D tcp_hdr(skb)->source; + dport =3D tcp_hdr(skb)->dest; + break; + case IPPROTO_UDP: + sport =3D udp_hdr(skb)->source; + dport =3D udp_hdr(skb)->dest; + } + + if (ih->protocol =3D=3D IPPROTO_TCP || ih->protocol =3D=3D IPPROTO_UDP) + audit_log_format(ab, " sport=3D%hu dport=3D%hu", ntohs(sport), ntohs(dpo= rt)); + return true; } =20 @@ -48,7 +62,7 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_= buff *skb) struct ipv6hdr _ip6h; const struct ipv6hdr *ih; u8 nexthdr; - __be16 frag_off; + __be16 frag_off, dport, sport; =20 ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_= ip6h); if (!ih) @@ -60,6 +74,19 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk= _buff *skb) audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", &ih->saddr, &ih->daddr, nexthdr); =20 + switch (ih->nexthdr) { + case IPPROTO_TCP: + sport =3D tcp_hdr(skb)->source; + dport =3D tcp_hdr(skb)->dest; + break; + case IPPROTO_UDP: + sport =3D udp_hdr(skb)->source; + dport =3D udp_hdr(skb)->dest; + } + + if (ih->nexthdr =3D=3D IPPROTO_TCP || ih->nexthdr =3D=3D IPPROTO_UDP) + audit_log_format(ab, " sport=3D%hu dport=3D%hu", ntohs(sport), ntohs(dpo= rt)); + return true; } =20 --=20 2.51.0