From nobody Sat Feb 7 17:55:41 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74FBC205E3B for ; Fri, 31 Oct 2025 14:00:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761919214; cv=none; b=PeKwnF/GTmzjCnQ4vQX/sDmkde0uSZ7zDqMUUHbqJNKWGGRu01yHO1Y+ddU28q/N2LUs8pzYhIoPESWYVm5Sw/XxGY9zfVjwOR3kbNkldSxtHPXG9hAFJprnMA7SOZCSDYejtm9SGcDRoVhXeb35b7TEBvMJ6rMuXEvD2Cedyig= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761919214; c=relaxed/simple; bh=b/+6iLvF/xFmhsioNKUMrHdZw4gUJHtWntWQ72dbIGw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JgDnzydbekx9zi862aWTOTuuNceg7ltmRYlVUuQ4+hmhi5OT+BI5q9/YXLPW0dnT5TjRYtl7z/yIOrwCTHSFhOtF7CSnjBH7Lrl1bO+XBGH46prak3ceBLOiXi1Oj9T2f/aVE27c+wTdakD7knps6dO1j6u1I8QCTQCNsyVTVEc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=AdMDm/y4; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="AdMDm/y4" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761919211; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=m8zwbPPmLrFrZtU+xz/xV/xP5qAIayjYYUoX61WmiF4=; b=AdMDm/y4DqPp4clTG8otNAhzF4xxSD2bvD2sLyQVeOSpLuBmvUyTHn9UMGdm083kGMgnn3 912Oy6NmUseZ48q+wuFgGwBEpUfYQKttq/zVWzoI5/7vyyoQTVrXZvGfKqzn5jpf8zrPH4 tGFfD3ROi6QcFzk2p/3yDA3LAuwCggg= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-694-5czu_u3DO5e7ocy96NwzhQ-1; Fri, 31 Oct 2025 10:00:08 -0400 X-MC-Unique: 5czu_u3DO5e7ocy96NwzhQ-1 X-Mimecast-MFC-AGG-ID: 5czu_u3DO5e7ocy96NwzhQ_1761919206 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 57478195D027; Fri, 31 Oct 2025 14:00:05 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.34]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 3DF5730001A1; Fri, 31 Oct 2025 14:00:00 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org Cc: paul@paul-moore.com, eparis@redhat.com, fw@strlen.de, pablo@netfilter.org, kadlec@netfilter.org, Ricardo Robaina Subject: [PATCH v4 1/2] audit: add audit_log_packet_ip4 and audit_log_packet_ip6 helper functions Date: Fri, 31 Oct 2025 10:59:48 -0300 Message-ID: In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" Netfilter code (net/netfilter/nft_log.c and net/netfilter/xt_AUDIT.c) have to be kept in sync. Both source files had duplicated versions of audit_ip4() and audit_ip6() functions, which can result in lack of consistency and/or duplicated work. This patch adds two helper functions in audit.c that can be called by netfilter code commonly, aiming to improve maintainability and consistency. Signed-off-by: Ricardo Robaina --- include/linux/audit.h | 2 ++ kernel/audit.c | 39 ++++++++++++++++++++++++++++++++++++ net/netfilter/nft_log.c | 43 ++++------------------------------------ net/netfilter/xt_AUDIT.c | 43 ++++------------------------------------ 4 files changed, 49 insertions(+), 78 deletions(-) diff --git a/include/linux/audit.h b/include/linux/audit.h index 536f8ee8da81..5edb83ea63fd 100644 --- a/include/linux/audit.h +++ b/include/linux/audit.h @@ -195,6 +195,8 @@ extern int audit_log_subj_ctx(struct audit_buffer *ab, = struct lsm_prop *prop); extern int audit_log_obj_ctx(struct audit_buffer *ab, struct lsm_prop *pro= p); extern int audit_log_task_context(struct audit_buffer *ab); extern void audit_log_task_info(struct audit_buffer *ab); +extern bool audit_log_packet_ip4(struct audit_buffer *ab, struct sk_buff *= skb); +extern bool audit_log_packet_ip6(struct audit_buffer *ab, struct sk_buff *= skb); =20 extern int audit_update_lsm_rules(void); =20 diff --git a/kernel/audit.c b/kernel/audit.c index 26a332ffb1b8..09764003db74 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -58,6 +58,8 @@ #include #include #include +#include +#include =20 #include "audit.h" =20 @@ -2538,6 +2540,43 @@ static void audit_log_set_loginuid(kuid_t koldloginu= id, kuid_t kloginuid, audit_log_end(ab); } =20 +bool audit_log_packet_ip4(struct audit_buffer *ab, struct sk_buff *skb) +{ + struct iphdr _iph; + const struct iphdr *ih; + + ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_i= ph); + if (!ih) + return false; + + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", + &ih->saddr, &ih->daddr, ih->protocol); + + return true; +} +EXPORT_SYMBOL(audit_log_packet_ip4); + +bool audit_log_packet_ip6(struct audit_buffer *ab, struct sk_buff *skb) +{ + struct ipv6hdr _ip6h; + const struct ipv6hdr *ih; + u8 nexthdr; + __be16 frag_off; + + ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_= ip6h); + if (!ih) + return false; + + nexthdr =3D ih->nexthdr; + ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, = &frag_off); + + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", + &ih->saddr, &ih->daddr, nexthdr); + + return true; +} +EXPORT_SYMBOL(audit_log_packet_ip6); + /** * audit_set_loginuid - set current task's loginuid * @loginuid: loginuid value diff --git a/net/netfilter/nft_log.c b/net/netfilter/nft_log.c index e35588137995..f53fb4222134 100644 --- a/net/netfilter/nft_log.c +++ b/net/netfilter/nft_log.c @@ -26,41 +26,6 @@ struct nft_log { char *prefix; }; =20 -static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) -{ - struct iphdr _iph; - const struct iphdr *ih; - - ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_i= ph); - if (!ih) - return false; - - audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", - &ih->saddr, &ih->daddr, ih->protocol); - - return true; -} - -static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) -{ - struct ipv6hdr _ip6h; - const struct ipv6hdr *ih; - u8 nexthdr; - __be16 frag_off; - - ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_= ip6h); - if (!ih) - return false; - - nexthdr =3D ih->nexthdr; - ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, = &frag_off); - - audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", - &ih->saddr, &ih->daddr, nexthdr); - - return true; -} - static void nft_log_eval_audit(const struct nft_pktinfo *pkt) { struct sk_buff *skb =3D pkt->skb; @@ -80,18 +45,18 @@ static void nft_log_eval_audit(const struct nft_pktinfo= *pkt) case NFPROTO_BRIDGE: switch (eth_hdr(skb)->h_proto) { case htons(ETH_P_IP): - fam =3D audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; + fam =3D audit_log_packet_ip4(ab, skb) ? NFPROTO_IPV4 : -1; break; case htons(ETH_P_IPV6): - fam =3D audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; + fam =3D audit_log_packet_ip6(ab, skb) ? NFPROTO_IPV6 : -1; break; } break; case NFPROTO_IPV4: - fam =3D audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; + fam =3D audit_log_packet_ip4(ab, skb) ? NFPROTO_IPV4 : -1; break; case NFPROTO_IPV6: - fam =3D audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; + fam =3D audit_log_packet_ip6(ab, skb) ? NFPROTO_IPV6 : -1; break; } =20 diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index b6a015aee0ce..28cdd6435d56 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -28,41 +28,6 @@ MODULE_ALIAS("ip6t_AUDIT"); MODULE_ALIAS("ebt_AUDIT"); MODULE_ALIAS("arpt_AUDIT"); =20 -static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) -{ - struct iphdr _iph; - const struct iphdr *ih; - - ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_i= ph); - if (!ih) - return false; - - audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", - &ih->saddr, &ih->daddr, ih->protocol); - - return true; -} - -static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) -{ - struct ipv6hdr _ip6h; - const struct ipv6hdr *ih; - u8 nexthdr; - __be16 frag_off; - - ih =3D skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_= ip6h); - if (!ih) - return false; - - nexthdr =3D ih->nexthdr; - ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, = &frag_off); - - audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", - &ih->saddr, &ih->daddr, nexthdr); - - return true; -} - static unsigned int audit_tg(struct sk_buff *skb, const struct xt_action_param *par) { @@ -81,18 +46,18 @@ audit_tg(struct sk_buff *skb, const struct xt_action_pa= ram *par) case NFPROTO_BRIDGE: switch (eth_hdr(skb)->h_proto) { case htons(ETH_P_IP): - fam =3D audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; + fam =3D audit_log_packet_ip4(ab, skb) ? NFPROTO_IPV4 : -1; break; case htons(ETH_P_IPV6): - fam =3D audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; + fam =3D audit_log_packet_ip6(ab, skb) ? NFPROTO_IPV6 : -1; break; } break; case NFPROTO_IPV4: - fam =3D audit_ip4(ab, skb) ? NFPROTO_IPV4 : -1; + fam =3D audit_log_packet_ip4(ab, skb) ? NFPROTO_IPV4 : -1; break; case NFPROTO_IPV6: - fam =3D audit_ip6(ab, skb) ? NFPROTO_IPV6 : -1; + fam =3D audit_log_packet_ip6(ab, skb) ? NFPROTO_IPV6 : -1; break; } =20 --=20 2.51.0 From nobody Sat Feb 7 17:55:41 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D48C5212564 for ; Fri, 31 Oct 2025 14:00:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761919222; cv=none; b=KPLtjJ8FS29ZdXjzUXh6+kKY5nmgXg9xfsjr9tyRmg13G9O8PB+e2rlSKC8bgQECMha6lHrSqjgDUsJUKGg6sBMcxIitp1SzoFhZVxFqAx3vMaEzjFc4Chf94ws23ebXyIPaAr0lP3I1TMGWlziE1NhEiegsUqWbUpySswEyWzA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1761919222; c=relaxed/simple; bh=gTv+1XYS68MHjfM6eRnKlVdpGjF97WurU9JJNgPdgyE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ThxWtIG+c39lp5KDHN5p6Y4j9VqZtEbhsGH+rzTBvHEgdvhOEhttidWVaFd4Y1aXUg5Yx9nKMunxemrk8RFil4n5gVe2FOTKehHJdjC/t4w9d6l3FfKFGwAMfFPR3qPVpCnvsTJB4fGB35ZtAzQwJC34BYf22BjFK9D4obZBSS4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=dSEwQ2Es; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="dSEwQ2Es" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1761919218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2nsxAfyFQGcQDUzbfJSVcwzg7l0EV9eoFEzO37AiGT0=; b=dSEwQ2Es/i5GEAnCbj8C8CEsebeIEqrTRMtPlHQ+849YXM0nPsDodk7hBvD4Z7uJ/3pv43 kCTLiQVgUuBvMWpQkvmwXR69vo2l/WzsnUeVi7JjoP+7gtjKkfKXAXi3wbOe9YolfiaAI5 Comfgehb8P7ZmWZJzp2G3qEbeubOmwQ= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-148-RyMIFsNlOnyVG7oEDMfYWA-1; Fri, 31 Oct 2025 10:00:15 -0400 X-MC-Unique: RyMIFsNlOnyVG7oEDMfYWA-1 X-Mimecast-MFC-AGG-ID: RyMIFsNlOnyVG7oEDMfYWA_1761919210 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 477161954B05; Fri, 31 Oct 2025 14:00:10 +0000 (UTC) Received: from wsxc.redhat.com (unknown [10.96.134.34]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 28A5530001A8; Fri, 31 Oct 2025 14:00:05 +0000 (UTC) From: Ricardo Robaina To: audit@vger.kernel.org, linux-kernel@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org Cc: paul@paul-moore.com, eparis@redhat.com, fw@strlen.de, pablo@netfilter.org, kadlec@netfilter.org, Ricardo Robaina Subject: [PATCH v4 2/2] audit: include source and destination ports to NETFILTER_PKT Date: Fri, 31 Oct 2025 10:59:49 -0300 Message-ID: <6ac2baf0d5ae176cbd3279a4dff9e2c7750c6d45.1761918165.git.rrobaina@redhat.com> In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 Content-Type: text/plain; charset="utf-8" NETFILTER_PKT records show both source and destination addresses, in addition to the associated networking protocol. However, it lacks the ports information, which is often valuable for troubleshooting. This patch adds both source and destination port numbers, 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and SCTP-related NETFILTER_PKT records. $ TESTS=3D"netfilter_pkt" make -e test &> /dev/null $ ausearch -i -ts recent |grep NETFILTER_PKT type=3DNETFILTER_PKT ... proto=3Dicmp type=3DNETFILTER_PKT ... proto=3Dipv6-icmp type=3DNETFILTER_PKT ... proto=3Dudp sport=3D46333 dport=3D42424 type=3DNETFILTER_PKT ... proto=3Dudp sport=3D35953 dport=3D42424 type=3DNETFILTER_PKT ... proto=3Dtcp sport=3D50314 dport=3D42424 type=3DNETFILTER_PKT ... proto=3Dtcp sport=3D57346 dport=3D42424 Link: https://github.com/linux-audit/audit-kernel/issues/162 Signed-off-by: Ricardo Robaina --- kernel/audit.c | 89 +++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 85 insertions(+), 4 deletions(-) diff --git a/kernel/audit.c b/kernel/audit.c index 09764003db74..bc7217402a35 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -60,6 +60,7 @@ #include #include #include +#include =20 #include "audit.h" =20 @@ -2549,8 +2550,48 @@ bool audit_log_packet_ip4(struct audit_buffer *ab, s= truct sk_buff *skb) if (!ih) return false; =20 - audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", - &ih->saddr, &ih->daddr, ih->protocol); + switch (ih->protocol) { + case IPPROTO_TCP: + struct tcphdr _tcph; + const struct tcphdr *th; + + th =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_tcph),= &_tcph); + if (!th) + return false; + + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(th->source), ntohs(th->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + struct udphdr _udph; + const struct udphdr *uh; + + uh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_udph),= &_udph); + if (!uh) + return false; + + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(uh->source), ntohs(uh->dest)); + break; + case IPPROTO_SCTP: + struct sctphdr _sctph; + const struct sctphdr *sh; + + sh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_sctph)= , &_sctph); + if (!sh) + return false; + + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu sport=3D%h= u dport=3D%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(sh->source), ntohs(sh->dest)); + break; + default: + audit_log_format(ab, " saddr=3D%pI4 daddr=3D%pI4 proto=3D%hhu", + &ih->saddr, &ih->daddr, ih->protocol); + } =20 return true; } @@ -2570,8 +2611,48 @@ bool audit_log_packet_ip6(struct audit_buffer *ab, s= truct sk_buff *skb) nexthdr =3D ih->nexthdr; ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, = &frag_off); =20 - audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", - &ih->saddr, &ih->daddr, nexthdr); + switch (nexthdr) { + case IPPROTO_TCP: + struct tcphdr _tcph; + const struct tcphdr *th; + + th =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_tcph),= &_tcph); + if (!th) + return false; + + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(th->source), ntohs(th->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + struct udphdr _udph; + const struct udphdr *uh; + + uh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_udph),= &_udph); + if (!uh) + return false; + + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(uh->source), ntohs(uh->dest)); + break; + case IPPROTO_SCTP: + struct sctphdr _sctph; + const struct sctphdr *sh; + + sh =3D skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_sctph)= , &_sctph); + if (!sh) + return false; + + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu sport=3D= %hu dport=3D%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(sh->source), ntohs(sh->dest)); + break; + default: + audit_log_format(ab, " saddr=3D%pI6c daddr=3D%pI6c proto=3D%hhu", + &ih->saddr, &ih->daddr, nexthdr); + } =20 return true; } --=20 2.51.0