From nobody Wed Oct 1 22:33:18 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CD79F244671 for ; Fri, 26 Sep 2025 19:30:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758915053; cv=none; b=nyLsGrz5r0/CEPblb84MGfHNycZnQFy8gzFWUXpEtskWG9EnT1gCRAQcPOk8CemOkzTCpWLv7KYKg9CO6zJ3xexBCi45Ebn3FiD02iX0VZFzyCaZCP4LNno+FjXZ1PqmV676J8AC96xa8qbasxfE2F1UpMklZPl9uYOfmhJ84Ko= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758915053; c=relaxed/simple; bh=uYge2qoJeTVTxB09I1cGTmN1ssAnBlp6sQZnc7Jhs5s=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=MPE/qh0rbSIsfkpf0KKRnTaJ+NfaXb2R/EynGn7T5GqjSUnzCp8dDg4H8pWGrVrRgyxLZY80Dr4geVtyIeKy42AvgA3KQerHd/17y/th7kya+ah1+bpHxaImY3K1I6O65mgVfPk9GfrzJADsSknoTnuf5g86cIIhuxSsAaaEnfY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=cldY7FfF; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="cldY7FfF" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1758915050; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=uIPspSLX9lThfAZ+Y5dkohRcaszaIDWglOFteDGsE5E=; b=cldY7FfFnrIHglh/V1Six1uh6uEErMzoUjbyjNtf3AMMRZRMMOFIS8e8cNstAqozWJ38Mp LWsBt+Di6/mT1r+Bg8tVgAKGz0NQvZASBfS2klNh/plQja6ZuP0efVCIRPeY2E9zaoUYow VA2Y22tlofbaG0gxELX8O05ZFr03LIg= Received: from mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-266-hn6MuAqPP_m_w_IXuCNlpQ-1; Fri, 26 Sep 2025 15:30:45 -0400 X-MC-Unique: hn6MuAqPP_m_w_IXuCNlpQ-1 X-Mimecast-MFC-AGG-ID: hn6MuAqPP_m_w_IXuCNlpQ_1758915044 Received: from mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.12]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-04.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id B08A319560AE; Fri, 26 Sep 2025 19:30:42 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.97]) by mx-prod-int-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id EFED319560A2; Fri, 26 Sep 2025 19:30:37 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org Cc: paul@paul-moore.com, eparis@redhat.com, pablo@netfilter.org, kadlec@netfilter.org, fw@strlen.de, ej@inai.de, Ricardo Robaina Subject: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT Date: Fri, 26 Sep 2025 16:30:35 -0300 Message-ID: <20250926193035.2158860-1-rrobaina@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.12 Content-Type: text/plain; charset="utf-8" NETFILTER_PKT records show both source and destination addresses, in addition to the associated networking protocol. However, it lacks the ports information, which is often valuable for troubleshooting. This patch adds both source and destination port numbers, 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and SCTP-related NETFILTER_PKT records. type=3DNETFILTER_PKT ... saddr=3D127.0.0.1 daddr=3D127.0.0.1 proto=3Dicmp type=3DNETFILTER_PKT ... saddr=3D::1 daddr=3D::1 proto=3Dipv6-icmp type=3DNETFILTER_PKT ... daddr=3D127.0.0.1 proto=3Dudp sport=3D38173 dport= =3D42424 type=3DNETFILTER_PKT ... daddr=3D::1 proto=3Dudp sport=3D56852 dport=3D424= 24 type=3DNETFILTER_PKT ... daddr=3D127.0.0.1 proto=3Dtcp sport=3D57022 dport= =3D42424 type=3DNETFILTER_PKT ... daddr=3D::1 proto=3Dtcp sport=3D50810 dport=3D424= 24 type=3DNETFILTER_PKT ... daddr=3D127.0.0.1 proto=3Dsctp sport=3D54944 dpor= t=3D42424 type=3DNETFILTER_PKT ... daddr=3D::1 proto=3Dsctp sport=3D57963 dport=3D42= 424 Link: https://github.com/linux-audit/audit-kernel/issues/162 Signed-off-by: Ricardo Robaina --- net/netfilter/xt_AUDIT.c | 47 ++++++++++++++++++++++++++++++++++++---- 1 file changed, 43 insertions(+), 4 deletions(-) diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index b6a015aee0ce..fb16f20cfb1b 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -19,6 +19,7 @@ #include #include #include +#include =20 MODULE_LICENSE("GPL"); MODULE_AUTHOR("Thomas Graf "); @@ -37,8 +38,27 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk= _buff *skb) if (!ih) return false; =20 - audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", - &ih->saddr, &ih->daddr, ih->protocol); + switch (ih->protocol) { + case IPPROTO_TCP: + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest)); + break; + case IPPROTO_SCTP: + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest)); + break; + default: + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", + &ih->saddr, &ih->daddr, ih->protocol); + } =20 return true; } @@ -57,8 +77,27 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk= _buff *skb) nexthdr =3D ih->nexthdr; ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, = &frag_off); =20 - audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", - &ih->saddr, &ih->daddr, nexthdr); + switch (nexthdr) { + case IPPROTO_TCP: + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest)); + break; + case IPPROTO_SCTP: + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest)); + break; + default: + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", + &ih->saddr, &ih->daddr, nexthdr); + } =20 return true; } --=20 2.51.0