From: Ricardo Robaina <rrobaina@redhat.com>
To: audit@vger.kernel.org, linux-kernel@vger.kernel.org,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org
Cc: paul@paul-moore.com, eparis@redhat.com, pablo@netfilter.org,
kadlec@netfilter.org, fw@strlen.de, ej@inai.de,
Ricardo Robaina <rrobaina@redhat.com>
Subject: [PATCH v3] audit: include source and destination ports to NETFILTER_PKT
Date: Fri, 26 Sep 2025 16:30:35 -0300 [thread overview]
Message-ID: <20250926193035.2158860-1-rrobaina@redhat.com> (raw)
NETFILTER_PKT records show both source and destination
addresses, in addition to the associated networking protocol.
However, it lacks the ports information, which is often
valuable for troubleshooting.
This patch adds both source and destination port numbers,
'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
SCTP-related NETFILTER_PKT records.
type=NETFILTER_PKT ... saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp
type=NETFILTER_PKT ... saddr=::1 daddr=::1 proto=ipv6-icmp
type=NETFILTER_PKT ... daddr=127.0.0.1 proto=udp sport=38173 dport=42424
type=NETFILTER_PKT ... daddr=::1 proto=udp sport=56852 dport=42424
type=NETFILTER_PKT ... daddr=127.0.0.1 proto=tcp sport=57022 dport=42424
type=NETFILTER_PKT ... daddr=::1 proto=tcp sport=50810 dport=42424
type=NETFILTER_PKT ... daddr=127.0.0.1 proto=sctp sport=54944 dport=42424
type=NETFILTER_PKT ... daddr=::1 proto=sctp sport=57963 dport=42424
Link: https://github.com/linux-audit/audit-kernel/issues/162
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
net/netfilter/xt_AUDIT.c | 47 ++++++++++++++++++++++++++++++++++++----
1 file changed, 43 insertions(+), 4 deletions(-)
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index b6a015aee0ce..fb16f20cfb1b 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -19,6 +19,7 @@
#include <linux/netfilter_bridge/ebtables.h>
#include <net/ipv6.h>
#include <net/ip.h>
+#include <linux/sctp.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>");
@@ -37,8 +38,27 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
if (!ih)
return false;
- audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
- &ih->saddr, &ih->daddr, ih->protocol);
+ switch (ih->protocol) {
+ case IPPROTO_TCP:
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, ih->protocol,
+ ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest));
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, ih->protocol,
+ ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest));
+ break;
+ case IPPROTO_SCTP:
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, ih->protocol,
+ ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest));
+ break;
+ default:
+ audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
+ &ih->saddr, &ih->daddr, ih->protocol);
+ }
return true;
}
@@ -57,8 +77,27 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
nexthdr = ih->nexthdr;
ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off);
- audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
- &ih->saddr, &ih->daddr, nexthdr);
+ switch (nexthdr) {
+ case IPPROTO_TCP:
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, nexthdr,
+ ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest));
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, nexthdr,
+ ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest));
+ break;
+ case IPPROTO_SCTP:
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu",
+ &ih->saddr, &ih->daddr, nexthdr,
+ ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest));
+ break;
+ default:
+ audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
+ &ih->saddr, &ih->daddr, nexthdr);
+ }
return true;
}
--
2.51.0
next reply other threads:[~2025-09-26 19:30 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-26 19:30 Ricardo Robaina [this message]
2025-09-27 10:44 ` [PATCH v3] audit: include source and destination ports to NETFILTER_PKT Florian Westphal
2025-10-03 15:43 ` Ricardo Robaina
2025-10-13 18:48 ` Paul Moore
2025-10-13 18:51 ` Paul Moore
2025-10-13 19:11 ` Ricardo Robaina
2025-10-13 20:26 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250926193035.2158860-1-rrobaina@redhat.com \
--to=rrobaina@redhat.com \
--cc=audit@vger.kernel.org \
--cc=coreteam@netfilter.org \
--cc=ej@inai.de \
--cc=eparis@redhat.com \
--cc=fw@strlen.de \
--cc=kadlec@netfilter.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=paul@paul-moore.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).