From nobody Fri Dec 19 18:44:25 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 503D532B997 for ; Thu, 6 Nov 2025 16:53:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762448011; cv=none; b=YkFyy8ExMAWD2XMGxfAMhl8jYMiJRvzRIdMV8EY0H3DZaXRIYqXhC1Xc7t3C8mkLYBCapqS3R5QVsvdzbWSAgzLc7WoHW9maIbiPstVtGftBkThsAYW9S8CGZURPT9B8lCDj6TNV4g7+1LLQiYijqXQsmSsdccNoal/h43M1jpU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762448011; c=relaxed/simple; bh=xcI3fxWr3wsaBdkMdmkh8A2alUjJf+s4H+Q9lIEQ9jg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Cs6dJkvBDtcILA8nfdBZOy/YJAinGC+XuK36+cHveJV531Miv86IEQ2tPBReiOaZ1Yj5aXIDT61GvBpJAa/VX37O8VWmwjrPOuswrfIBJ9OFWcEXnC+ykv8m/CiTcprj2/rHtwXa4Z8UMRUQvnutLyib2dckjl038OpGdmHFb94= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=IDwIMILt; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="IDwIMILt" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1762448008; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=so0OXNKYddzfc7/g5QVtuwqh5H9GBtOvc8rrxcPEA+U=; b=IDwIMILtCo+FTlm83MRQEnAVW1RFLA541xJXRqqEklw3bQnsAac3fPeSFJOQo7XjrKtoma q5B0bOczeDUoqhBGa+pv7nNLUlcdFDfLNXlgoMMI/3vXREDu0ccgsW6gzDkyXpMiae+cvI 2V6eNMSd3wCfSnIjXq1wIOtCuQKyl2w= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-639-aE-lWsyyMai9jL-XEYDmLg-1; Thu, 06 Nov 2025 11:53:25 -0500 X-MC-Unique: aE-lWsyyMai9jL-XEYDmLg-1 X-Mimecast-MFC-AGG-ID: aE-lWsyyMai9jL-XEYDmLg_1762448004 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id CD50B195609F; Thu, 6 Nov 2025 16:53:23 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.113]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 746E31800584; Thu, 6 Nov 2025 16:53:20 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org Cc: paul@paul-moore.com, eparis@redhat.com, fw@strlen.de, pablo@netfilter.org, kadlec@netfilter.org, Ricardo Robaina Subject: [PATCH v5 2/2] audit: include source and destination ports to NETFILTER_PKT Date: Thu, 6 Nov 2025 13:53:05 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Content-Type: text/plain; charset="utf-8" NETFILTER_PKT records show both source and destination addresses, in addition to the associated networking protocol. However, it lacks the ports information, which is often valuable for troubleshooting. This patch adds both source and destination port numbers, 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and SCTP-related NETFILTER_PKT records. $ TESTS=3D"netfilter_pkt" make -e test &> /dev/null $ ausearch -i -ts recent |grep NETFILTER_PKT type=3DNETFILTER_PKT ... proto=3Dicmp type=3DNETFILTER_PKT ... proto=3Dipv6-icmp type=3DNETFILTER_PKT ... proto=3Dudp sport=3D46333 dport=3D42424 type=3DNETFILTER_PKT ... proto=3Dudp sport=3D35953 dport=3D42424 type=3DNETFILTER_PKT ... proto=3Dtcp sport=3D50314 dport=3D42424 type=3DNETFILTER_PKT ... proto=3Dtcp sport=3D57346 dport=3D42424 Link: https://github.com/linux-audit/audit-kernel/issues/162 Signed-off-by: Ricardo Robaina --- kernel/audit.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 79 insertions(+), 4 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 09764003db74..71dcadf12c99 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -60,6 +60,7 @@ #include #include #include +#include =20 #include "audit.h" =20 @@ -2544,13 +2545,50 @@ bool audit_log_packet_ip4(struct audit_buffer *ab, = struct sk_buff *skb) { struct iphdr _iph; const struct iphdr *ih; + struct tcphdr _tcph; + const struct tcphdr *th; + struct udphdr _udph; + const struct udphdr *uh; + struct sctphdr _sctph; + const struct sctphdr *sh; =20 ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_i= ph); if (!ih) return false; =20 - audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", - &ih->saddr, &ih->daddr, ih->protocol); + switch (ih->protocol) { + case IPPROTO_TCP: + th =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_tcph),= &_tcph); + if (!th) + return false; + + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(th->source), ntohs(th->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + uh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_udph),= &_udph); + if (!uh) + return false; + + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(uh->source), ntohs(uh->dest)); + break; + case IPPROTO_SCTP: + sh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_sctph)= , &_sctph); + if (!sh) + return false; + + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(sh->source), ntohs(sh->dest)); + break; + default: + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", + &ih->saddr, &ih->daddr, ih->protocol); + } =20 return true; } @@ -2562,6 +2600,12 @@ bool audit_log_packet_ip6(struct audit_buffer *ab, s= truct sk_buff *skb) const struct ipv6hdr *ih; u8 nexthdr; __be16 frag_off; + struct tcphdr _tcph; + const struct tcphdr *th; + struct udphdr _udph; + const struct udphdr *uh; + struct sctphdr _sctph; + const struct sctphdr *sh; =20 ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_= ip6h); if (!ih) @@ -2570,8 +2614,39 @@ bool audit_log_packet_ip6(struct audit_buffer *ab, s= truct sk_buff *skb) nexthdr =3D ih->nexthdr; ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, = &frag_off); =20 - audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", - &ih->saddr, &ih->daddr, nexthdr); + switch (nexthdr) { + case IPPROTO_TCP: + th =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_tcph),= &_tcph); + if (!th) + return false; + + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(th->source), ntohs(th->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + uh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_udph),= &_udph); + if (!uh) + return false; + + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(uh->source), ntohs(uh->dest)); + break; + case IPPROTO_SCTP: + sh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_sctph)= , &_sctph); + if (!sh) + return false; + + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(sh->source), ntohs(sh->dest)); + break; + default: + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", + &ih->saddr, &ih->daddr, nexthdr); + } =20 return true; } --=20 2.51.1