Re: [PATCH v5 2/2] audit: include source and destination ports to NETFILTER_PKT

Paul Moore
2025-11-07T22:46:22Z

On Nov 6, 2025 Ricardo Robaina <rrobaina@redhat.com> wrote:
>
> NETFILTER_PKT records show both source and destination
> addresses, in addition to the associated networking protocol.
> However, it lacks the ports information, which is often
> valuable for troubleshooting.
>
> This patch adds both source and destination port numbers,
> 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
> SCTP-related NETFILTER_PKT records.
>
> $ TESTS="netfilter_pkt" make -e test &> /dev/null
> $ ausearch -i -ts recent |grep NETFILTER_PKT
> type=NETFILTER_PKT ... proto=icmp
> type=NETFILTER_PKT ... proto=ipv6-icmp
> type=NETFILTER_PKT ... proto=udp sport=46333 dport=42424
> type=NETFILTER_PKT ... proto=udp sport=35953 dport=42424
> type=NETFILTER_PKT ... proto=tcp sport=50314 dport=42424
> type=NETFILTER_PKT ... proto=tcp sport=57346 dport=42424
>
> Link: https://github.com/linux-audit/audit-kernel/issues/162
>
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> Acked-by: Florian Westphal <fw@strlen.de>
> ---
> kernel/audit.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++---
> 1 file changed, 79 insertions(+), 4 deletions(-)

This looks fine to me, although it may change a bit based on the
discussion around patch 1/2. However, two things I wanted to comment
on in this patch:

- Please try to stick to an 80 char line width for audit code. There are
obvious exceptions like printf-esque strings, etc. but the
skb_header_pointer() calls in this patch could be easily split into
multiple lines, each under 80 chars.

- This isn't a general comment, but in this particular case it would be
nice to move the protocol header variables into their associated switch
case (see what I did in patch 1/2).

--
paul-moore.com