[PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[Ricardo Robaina]

NETFILTER_PKT records show both source and destination
addresses, in addition to the associated networking protocol.
However, it lacks the ports information, which is often
valuable for troubleshooting.

This patch adds both source and destination port numbers,
'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
SCTP-related NETFILTER_PKT records.

 type=NETFILTER_PKT ... saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp
 type=NETFILTER_PKT ... saddr=::1 daddr=::1 proto=ipv6-icmp
 type=NETFILTER_PKT ... daddr=127.0.0.1 proto=udp sport=38173 dport=42424
 type=NETFILTER_PKT ... daddr=::1 proto=udp sport=56852 dport=42424
 type=NETFILTER_PKT ... daddr=127.0.0.1 proto=tcp sport=57022 dport=42424
 type=NETFILTER_PKT ... daddr=::1 proto=tcp sport=50810 dport=42424
 type=NETFILTER_PKT ... daddr=127.0.0.1 proto=sctp sport=54944 dport=42424
 type=NETFILTER_PKT ... daddr=::1 proto=sctp sport=57963 dport=42424

Link: https://github.com/linux-audit/audit-kernel/issues/162
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
 net/netfilter/xt_AUDIT.c | 47 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index b6a015aee0ce..fb16f20cfb1b 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -19,6 +19,7 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <net/ipv6.h>
 #include <net/ip.h>
+#include <linux/sctp.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>");
@@ -37,8 +38,27 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
 	if (!ih)
 		return false;
 
-	audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
-			 &ih->saddr, &ih->daddr, ih->protocol);
+	switch (ih->protocol) {
+	case IPPROTO_TCP:
+		audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+				 &ih->saddr, &ih->daddr, ih->protocol,
+				 ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest));
+		break;
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+		audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+				 &ih->saddr, &ih->daddr, ih->protocol,
+				 ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest));
+		break;
+	case IPPROTO_SCTP:
+		audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+				 &ih->saddr, &ih->daddr, ih->protocol,
+				 ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest));
+		break;
+	default:
+		audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
+				 &ih->saddr, &ih->daddr, ih->protocol);
+	}
 
 	return true;
 }
@@ -57,8 +77,27 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
 	nexthdr = ih->nexthdr;
 	ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
 
-	audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
-			 &ih->saddr, &ih->daddr, nexthdr);
+	switch (nexthdr) {
+	case IPPROTO_TCP:
+		audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+				 &ih->saddr, &ih->daddr, nexthdr,
+				 ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest));
+		break;
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+		audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+				 &ih->saddr, &ih->daddr, nexthdr,
+				 ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest));
+		break;
+	case IPPROTO_SCTP:
+		audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+				 &ih->saddr, &ih->daddr, nexthdr,
+				 ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest));
+		break;
+	default:
+		audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
+				 &ih->saddr, &ih->daddr, nexthdr);
+	}
 
 	return true;
 }
-- 
2.51.0

Re: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[Florian Westphal]

Ricardo Robaina <rrobaina@redhat.com> wrote:
> +	case IPPROTO_TCP:
> +		audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
> +				 &ih->saddr, &ih->daddr, ih->protocol,
> +				 ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest));

You need to use skb_header_pointer() like elsewhere in netfilter to
access the transport protocol header.

You can have a look at nf_log_dump_tcp_header() in nf_log_syslog.c for
a template.

Also please have a look at net/netfilter/nft_log.c, in particular
nft_log_eval_audit(): xt_AUDIT and nft audit should be kept in sync wrt.
their formatting.

Maybe Paul would be open to adding something like audit_log_packet() to
kernel/audit.c and then have xt_AUDIT.c and nft_log.c just call the
common helper.

Re: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[Ricardo Robaina]

On Sat, Sep 27, 2025 at 7:45 AM Florian Westphal <fw@strlen.de> wrote:
>
> Ricardo Robaina <rrobaina@redhat.com> wrote:
> > +     case IPPROTO_TCP:
> > +             audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
> > +                              &ih->saddr, &ih->daddr, ih->protocol,
> > +                              ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest));
>
> You need to use skb_header_pointer() like elsewhere in netfilter to
> access the transport protocol header.
>
> You can have a look at nf_log_dump_tcp_header() in nf_log_syslog.c for
> a template.
>
> Also please have a look at net/netfilter/nft_log.c, in particular
> nft_log_eval_audit(): xt_AUDIT and nft audit should be kept in sync wrt.
> their formatting.
>
Thanks for reviewing this patch, Florian!
I’ll work on a newer version addressing your suggestions.

> Maybe Paul would be open to adding something like audit_log_packet() to
> kernel/audit.c and then have xt_AUDIT.c and nft_log.c just call the
> common helper.
>
It sounds like a good idea to me. What do you think, Paul?

Re: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[Paul Moore]

On Fri, Oct 3, 2025 at 11:43 AM Ricardo Robaina <rrobaina@redhat.com> wrote:
> On Sat, Sep 27, 2025 at 7:45 AM Florian Westphal <fw@strlen.de> wrote:
> > Ricardo Robaina <rrobaina@redhat.com> wrote:

...

> > Maybe Paul would be open to adding something like audit_log_packet() to
> > kernel/audit.c and then have xt_AUDIT.c and nft_log.c just call the
> > common helper.
>
> It sounds like a good idea to me. What do you think, Paul?

Seems like a good idea to me too.

-- 
paul-moore.com

Re: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[Paul Moore]

On Mon, Oct 13, 2025 at 2:48 PM Paul Moore <paul@paul-moore.com> wrote:
> On Fri, Oct 3, 2025 at 11:43 AM Ricardo Robaina <rrobaina@redhat.com> wrote:
> > On Sat, Sep 27, 2025 at 7:45 AM Florian Westphal <fw@strlen.de> wrote:
> > > Ricardo Robaina <rrobaina@redhat.com> wrote:
>
> ...
>
> > > Maybe Paul would be open to adding something like audit_log_packet() to
> > > kernel/audit.c and then have xt_AUDIT.c and nft_log.c just call the
> > > common helper.
> >
> > It sounds like a good idea to me. What do you think, Paul?
>
> Seems like a good idea to me too.

A quick follow-up to this ... when you are doing the work Ricardo,
please do this as a two patch patchset; the first patch should
introduce a new common function called by both audit_tg() and
nft_log_eval_audit(), and the second patch should add new port
information to the audit record.

-- 
paul-moore.com

Re: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[Ricardo Robaina]

On Mon, Oct 13, 2025 at 3:51 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Mon, Oct 13, 2025 at 2:48 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Fri, Oct 3, 2025 at 11:43 AM Ricardo Robaina <rrobaina@redhat.com> wrote:
> > > On Sat, Sep 27, 2025 at 7:45 AM Florian Westphal <fw@strlen.de> wrote:
> > > > Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > ...
> >
> > > > Maybe Paul would be open to adding something like audit_log_packet() to
> > > > kernel/audit.c and then have xt_AUDIT.c and nft_log.c just call the
> > > > common helper.
> > >
> > > It sounds like a good idea to me. What do you think, Paul?
> >
> > Seems like a good idea to me too.
>
> A quick follow-up to this ... when you are doing the work Ricardo,
> please do this as a two patch patchset; the first patch should
> introduce a new common function called by both audit_tg() and
> nft_log_eval_audit(), and the second patch should add new port
> information to the audit record.
>
> --
> paul-moore.com
>

Thanks for the tip, Paul! I'll work on it next week.

Re: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT

[Paul Moore]

On Mon, Oct 13, 2025 at 3:11 PM Ricardo Robaina <rrobaina@redhat.com> wrote:
> On Mon, Oct 13, 2025 at 3:51 PM Paul Moore <paul@paul-moore.com> wrote:
> > On Mon, Oct 13, 2025 at 2:48 PM Paul Moore <paul@paul-moore.com> wrote:
> > > On Fri, Oct 3, 2025 at 11:43 AM Ricardo Robaina <rrobaina@redhat.com> wrote:
> > > > On Sat, Sep 27, 2025 at 7:45 AM Florian Westphal <fw@strlen.de> wrote:
> > > > > Ricardo Robaina <rrobaina@redhat.com> wrote:
> > >
> > > ...
> > >
> > > > > Maybe Paul would be open to adding something like audit_log_packet() to
> > > > > kernel/audit.c and then have xt_AUDIT.c and nft_log.c just call the
> > > > > common helper.
> > > >
> > > > It sounds like a good idea to me. What do you think, Paul?
> > >
> > > Seems like a good idea to me too.
> >
> > A quick follow-up to this ... when you are doing the work Ricardo,
> > please do this as a two patch patchset; the first patch should
> > introduce a new common function called by both audit_tg() and
> > nft_log_eval_audit(), and the second patch should add new port
> > information to the audit record.
>
> Thanks for the tip, Paul! I'll work on it next week.

Great, thanks :)

-- 
paul-moore.com