NETFILTER_PKT records show both source and destination
addresses, in addition to the associated networking protocol.
However, it lacks the ports information, which is often
valuable for troubleshooting.
This patch adds both source and destination port numbers,
'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
SCTP-related NETFILTER_PKT records.
$ TESTS="netfilter_pkt" make -e test &> /dev/null
$ ausearch -i -ts recent |grep NETFILTER_PKT
type=NETFILTER_PKT ... proto=icmp
type=NETFILTER_PKT ... proto=ipv6-icmp
type=NETFILTER_PKT ... proto=udp sport=46333 dport=42424
type=NETFILTER_PKT ... proto=udp sport=35953 dport=42424
type=NETFILTER_PKT ... proto=tcp sport=50314 dport=42424
type=NETFILTER_PKT ... proto=tcp sport=57346 dport=42424
Link: https://github.com/linux-audit/audit-kernel/issues/162
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
kernel/audit.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 79 insertions(+), 4 deletions(-)
diff --git a/kernel/audit.c b/kernel/audit.c
index 09764003db74..71dcadf12c99 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -60,6 +60,7 @@
#include <net/netns/generic.h>
#include <net/ip.h>
#include <net/ipv6.h>
+#include <linux/sctp.h>
#include "audit.h"
@@ -2544,13 +2545,50 @@ bool audit_log_packet_ip4(struct audit_buffer *ab, struct sk_buff *skb)
{
struct iphdr _iph;
const struct iphdr *ih;
+ struct tcphdr _tcph;
+ const struct tcphdr *th;
+ struct udphdr _udph;
+ const struct udphdr *uh;
+ struct sctphdr _sctph;
+ const struct sctphdr *sh;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
if (!ih)
return false;
- audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
- &ih->saddr, &ih->daddr, ih->protocol);
+ switch (ih->protocol) {
+ case IPPROTO_TCP:
+ th = skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_tcph), &_tcph);
+ if (!th)
+ return false;
+
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, ih->protocol,
+ ntohs(th->source), ntohs(th->dest));
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
+ uh = skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_udph), &_udph);
+ if (!uh)
+ return false;
+
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, ih->protocol,
+ ntohs(uh->source), ntohs(uh->dest));
+ break;
+ case IPPROTO_SCTP:
+ sh = skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_sctph), &_sctph);
+ if (!sh)
+ return false;
+
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, ih->protocol,
+ ntohs(sh->source), ntohs(sh->dest));
+ break;
+ default:
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
+ &ih->saddr, &ih->daddr, ih->protocol);
+ }
return true;
}
@@ -2562,6 +2600,12 @@ bool audit_log_packet_ip6(struct audit_buffer *ab, struct sk_buff *skb)
const struct ipv6hdr *ih;
u8 nexthdr;
__be16 frag_off;
+ struct tcphdr _tcph;
+ const struct tcphdr *th;
+ struct udphdr _udph;
+ const struct udphdr *uh;
+ struct sctphdr _sctph;
+ const struct sctphdr *sh;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
if (!ih)
@@ -2570,8 +2614,39 @@ bool audit_log_packet_ip6(struct audit_buffer *ab, struct sk_buff *skb)
nexthdr = ih->nexthdr;
ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
- audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
- &ih->saddr, &ih->daddr, nexthdr);
+ switch (nexthdr) {
+ case IPPROTO_TCP:
+ th = skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_tcph), &_tcph);
+ if (!th)
+ return false;
+
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, nexthdr,
+ ntohs(th->source), ntohs(th->dest));
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
+ uh = skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_udph), &_udph);
+ if (!uh)
+ return false;
+
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, nexthdr,
+ ntohs(uh->source), ntohs(uh->dest));
+ break;
+ case IPPROTO_SCTP:
+ sh = skb_header_pointer(skb, skb_transport_offset(skb), sizeof(_sctph), &_sctph);
+ if (!sh)
+ return false;
+
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, nexthdr,
+ ntohs(sh->source), ntohs(sh->dest));
+ break;
+ default:
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
+ &ih->saddr, &ih->daddr, nexthdr);
+ }
return true;
}
--
2.51.1On Nov 6, 2025 Ricardo Robaina <rrobaina@redhat.com> wrote: > > NETFILTER_PKT records show both source and destination > addresses, in addition to the associated networking protocol. > However, it lacks the ports information, which is often > valuable for troubleshooting. > > This patch adds both source and destination port numbers, > 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and > SCTP-related NETFILTER_PKT records. > > $ TESTS="netfilter_pkt" make -e test &> /dev/null > $ ausearch -i -ts recent |grep NETFILTER_PKT > type=NETFILTER_PKT ... proto=icmp > type=NETFILTER_PKT ... proto=ipv6-icmp > type=NETFILTER_PKT ... proto=udp sport=46333 dport=42424 > type=NETFILTER_PKT ... proto=udp sport=35953 dport=42424 > type=NETFILTER_PKT ... proto=tcp sport=50314 dport=42424 > type=NETFILTER_PKT ... proto=tcp sport=57346 dport=42424 > > Link: https://github.com/linux-audit/audit-kernel/issues/162 > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> > Acked-by: Florian Westphal <fw@strlen.de> > --- > kernel/audit.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++--- > 1 file changed, 79 insertions(+), 4 deletions(-) This looks fine to me, although it may change a bit based on the discussion around patch 1/2. However, two things I wanted to comment on in this patch: - Please try to stick to an 80 char line width for audit code. There are obvious exceptions like printf-esque strings, etc. but the skb_header_pointer() calls in this patch could be easily split into multiple lines, each under 80 chars. - This isn't a general comment, but in this particular case it would be nice to move the protocol header variables into their associated switch case (see what I did in patch 1/2). -- paul-moore.com
On Fri, Nov 7, 2025 at 7:46 PM Paul Moore <paul@paul-moore.com> wrote: > > On Nov 6, 2025 Ricardo Robaina <rrobaina@redhat.com> wrote: > > > > NETFILTER_PKT records show both source and destination > > addresses, in addition to the associated networking protocol. > > However, it lacks the ports information, which is often > > valuable for troubleshooting. > > > > This patch adds both source and destination port numbers, > > 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and > > SCTP-related NETFILTER_PKT records. > > > > $ TESTS="netfilter_pkt" make -e test &> /dev/null > > $ ausearch -i -ts recent |grep NETFILTER_PKT > > type=NETFILTER_PKT ... proto=icmp > > type=NETFILTER_PKT ... proto=ipv6-icmp > > type=NETFILTER_PKT ... proto=udp sport=46333 dport=42424 > > type=NETFILTER_PKT ... proto=udp sport=35953 dport=42424 > > type=NETFILTER_PKT ... proto=tcp sport=50314 dport=42424 > > type=NETFILTER_PKT ... proto=tcp sport=57346 dport=42424 > > > > Link: https://github.com/linux-audit/audit-kernel/issues/162 > > > > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> > > Acked-by: Florian Westphal <fw@strlen.de> > > --- > > kernel/audit.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++--- > > 1 file changed, 79 insertions(+), 4 deletions(-) > > This looks fine to me, although it may change a bit based on the > discussion around patch 1/2. However, two things I wanted to comment > on in this patch: > > - Please try to stick to an 80 char line width for audit code. There are > obvious exceptions like printf-esque strings, etc. but the > skb_header_pointer() calls in this patch could be easily split into > multiple lines, each under 80 chars. > Thanks for the feedback! I'll make sure to follow this guideline from now on. > - This isn't a general comment, but in this particular case it would be > nice to move the protocol header variables into their associated switch > case (see what I did in patch 1/2). > Nice, thanks for the tip! I wasn't sure which style to use, so I decided to use the classic one. However, I do prefer having the protocol header variables within their associated switch case, too. > -- > paul-moore.com >
© 2016 - 2025 Red Hat, Inc.