* [PATCH v2] audit: include source and destination ports to NETFILTER_PKT
@ 2025-09-25 13:41 Ricardo Robaina
2025-09-25 20:41 ` Paul Moore
0 siblings, 1 reply; 3+ messages in thread
From: Ricardo Robaina @ 2025-09-25 13:41 UTC (permalink / raw)
To: audit, linux-kernel, netfilter-devel, coreteam
Cc: paul, eparis, pablo, kadlec, fw, ej, Ricardo Robaina
NETFILTER_PKT records show both source and destination
addresses, in addition to the associated networking protocol.
However, it lacks the ports information, which is often
valuable for troubleshooting.
This patch adds both source and destination port numbers,
'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
SCTP-related NETFILTER_PKT records.
type=NETFILTER_PKT ... saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp
type=NETFILTER_PKT ... saddr=::1 daddr=::1 proto=ipv6-icmp
type=NETFILTER_PKT ... daddr=127.0.0.1 proto=udp sport=38173 dport=42424
type=NETFILTER_PKT ... daddr=::1 proto=udp sport=56852 dport=42424
type=NETFILTER_PKT ... daddr=127.0.0.1 proto=tcp sport=57022 dport=42424
type=NETFILTER_PKT ... daddr=::1 proto=tcp sport=50810 dport=42424
type=NETFILTER_PKT ... daddr=127.0.0.1 proto=sctp sport=54944 dport=42424
type=NETFILTER_PKT ... daddr=::1 proto=sctp sport=57963 dport=42424
Link: https://github.com/linux-audit/audit-kernel/issues/162
Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
---
net/netfilter/xt_AUDIT.c | 42 +++++++++++++++++++++++++++++++++++++++-
1 file changed, 41 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
index b6a015aee0ce..9fc8a5429fa9 100644
--- a/net/netfilter/xt_AUDIT.c
+++ b/net/netfilter/xt_AUDIT.c
@@ -19,6 +19,7 @@
#include <linux/netfilter_bridge/ebtables.h>
#include <net/ipv6.h>
#include <net/ip.h>
+#include <linux/sctp.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>");
@@ -32,6 +33,7 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
{
struct iphdr _iph;
const struct iphdr *ih;
+ __be16 dport, sport;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
if (!ih)
@@ -40,6 +42,25 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
&ih->saddr, &ih->daddr, ih->protocol);
+ switch (ih->protocol) {
+ case IPPROTO_TCP:
+ sport = tcp_hdr(skb)->source;
+ dport = tcp_hdr(skb)->dest;
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
+ sport = udp_hdr(skb)->source;
+ dport = udp_hdr(skb)->dest;
+ break;
+ case IPPROTO_SCTP:
+ sport = sctp_hdr(skb)->source;
+ dport = sctp_hdr(skb)->dest;
+ }
+
+ if (ih->protocol == IPPROTO_TCP || ih->protocol == IPPROTO_UDP ||
+ ih->protocol == IPPROTO_UDPLITE || ih->protocol == IPPROTO_SCTP)
+ audit_log_format(ab, " sport=%hu dport=%hu", ntohs(sport), ntohs(dport));
+
return true;
}
@@ -48,7 +69,7 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
struct ipv6hdr _ip6h;
const struct ipv6hdr *ih;
u8 nexthdr;
- __be16 frag_off;
+ __be16 frag_off, dport, sport;
ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_ip6h), &_ip6h);
if (!ih)
@@ -60,6 +81,25 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb)
audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu",
&ih->saddr, &ih->daddr, nexthdr);
+ switch (ih->nexthdr) {
+ case IPPROTO_TCP:
+ sport = tcp_hdr(skb)->source;
+ dport = tcp_hdr(skb)->dest;
+ break;
+ case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
+ sport = udp_hdr(skb)->source;
+ dport = udp_hdr(skb)->dest;
+ break;
+ case IPPROTO_SCTP:
+ sport = sctp_hdr(skb)->source;
+ dport = sctp_hdr(skb)->dest;
+ }
+
+ if (ih->nexthdr == IPPROTO_TCP || ih->nexthdr == IPPROTO_UDP ||
+ ih->nexthdr == IPPROTO_UDPLITE || ih->nexthdr == IPPROTO_SCTP)
+ audit_log_format(ab, " sport=%hu dport=%hu", ntohs(sport), ntohs(dport));
+
return true;
}
--
2.51.0
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v2] audit: include source and destination ports to NETFILTER_PKT
2025-09-25 13:41 [PATCH v2] audit: include source and destination ports to NETFILTER_PKT Ricardo Robaina
@ 2025-09-25 20:41 ` Paul Moore
2025-09-26 18:28 ` Ricardo Robaina
0 siblings, 1 reply; 3+ messages in thread
From: Paul Moore @ 2025-09-25 20:41 UTC (permalink / raw)
To: Ricardo Robaina, audit, linux-kernel, netfilter-devel, coreteam
Cc: eparis, pablo, kadlec, fw, ej, Ricardo Robaina
On Sep 25, 2025 Ricardo Robaina <rrobaina@redhat.com> wrote:
>
> NETFILTER_PKT records show both source and destination
> addresses, in addition to the associated networking protocol.
> However, it lacks the ports information, which is often
> valuable for troubleshooting.
>
> This patch adds both source and destination port numbers,
> 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
> SCTP-related NETFILTER_PKT records.
>
> type=NETFILTER_PKT ... saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp
> type=NETFILTER_PKT ... saddr=::1 daddr=::1 proto=ipv6-icmp
> type=NETFILTER_PKT ... daddr=127.0.0.1 proto=udp sport=38173 dport=42424
> type=NETFILTER_PKT ... daddr=::1 proto=udp sport=56852 dport=42424
> type=NETFILTER_PKT ... daddr=127.0.0.1 proto=tcp sport=57022 dport=42424
> type=NETFILTER_PKT ... daddr=::1 proto=tcp sport=50810 dport=42424
> type=NETFILTER_PKT ... daddr=127.0.0.1 proto=sctp sport=54944 dport=42424
> type=NETFILTER_PKT ... daddr=::1 proto=sctp sport=57963 dport=42424
>
> Link: https://github.com/linux-audit/audit-kernel/issues/162
> Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> ---
> net/netfilter/xt_AUDIT.c | 42 +++++++++++++++++++++++++++++++++++++++-
> 1 file changed, 41 insertions(+), 1 deletion(-)
>
> diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
> index b6a015aee0ce..9fc8a5429fa9 100644
> --- a/net/netfilter/xt_AUDIT.c
> +++ b/net/netfilter/xt_AUDIT.c
> @@ -19,6 +19,7 @@
> #include <linux/netfilter_bridge/ebtables.h>
> #include <net/ipv6.h>
> #include <net/ip.h>
> +#include <linux/sctp.h>
>
> MODULE_LICENSE("GPL");
> MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>");
> @@ -32,6 +33,7 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
> {
> struct iphdr _iph;
> const struct iphdr *ih;
> + __be16 dport, sport;
>
> ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
> if (!ih)
> @@ -40,6 +42,25 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
> audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
> &ih->saddr, &ih->daddr, ih->protocol);
>
> + switch (ih->protocol) {
> + case IPPROTO_TCP:
> + sport = tcp_hdr(skb)->source;
> + dport = tcp_hdr(skb)->dest;
> + break;
> + case IPPROTO_UDP:
> + case IPPROTO_UDPLITE:
> + sport = udp_hdr(skb)->source;
> + dport = udp_hdr(skb)->dest;
> + break;
> + case IPPROTO_SCTP:
> + sport = sctp_hdr(skb)->source;
> + dport = sctp_hdr(skb)->dest;
> + }
> +
> + if (ih->protocol == IPPROTO_TCP || ih->protocol == IPPROTO_UDP ||
> + ih->protocol == IPPROTO_UDPLITE || ih->protocol == IPPROTO_SCTP)
> + audit_log_format(ab, " sport=%hu dport=%hu", ntohs(sport), ntohs(dport));
> return true;
> }
Instead of having the switch statement and then doing an additional if
statement, why not fold it all into the switch statement? Yes, you
would have multiple audit_log_format() calls, but they are trivial to
cut-n-paste, and it saves the extra per-packet checking at runtime.
switch (ih->protocol) {
case IPPROTO_TCP:
audit_log_format(ab, " sport=...",
tcp_hdr(skb)->source,
tcp_hdr(skb)->dest);
break;
...
}
... considering how expensive multiple audit_log_format() calls can be,
it might even be worth considering consolidating the two calls into one:
switch (ih->protocol) {
case IPPROTO_TCP:
audit_log_format(ab, " saddr=...",
ih->saddr,
...
tcp_hdr(skb)->source,
tcp_hdr(skb)->dest);
break;
...
default:
audit_log_format(ab, " saddr=...",
ih->saddr,
...);
}
--
paul-moore.com
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v2] audit: include source and destination ports to NETFILTER_PKT
2025-09-25 20:41 ` Paul Moore
@ 2025-09-26 18:28 ` Ricardo Robaina
0 siblings, 0 replies; 3+ messages in thread
From: Ricardo Robaina @ 2025-09-26 18:28 UTC (permalink / raw)
To: Paul Moore
Cc: audit, linux-kernel, netfilter-devel, coreteam, eparis, pablo,
kadlec, fw, ej
Thanks for reviewing this patch, Paul! Sounds great, I'll work on the
v3 shortly.
On Thu, Sep 25, 2025 at 5:41 PM Paul Moore <paul@paul-moore.com> wrote:
>
> On Sep 25, 2025 Ricardo Robaina <rrobaina@redhat.com> wrote:
> >
> > NETFILTER_PKT records show both source and destination
> > addresses, in addition to the associated networking protocol.
> > However, it lacks the ports information, which is often
> > valuable for troubleshooting.
> >
> > This patch adds both source and destination port numbers,
> > 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
> > SCTP-related NETFILTER_PKT records.
> >
> > type=NETFILTER_PKT ... saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp
> > type=NETFILTER_PKT ... saddr=::1 daddr=::1 proto=ipv6-icmp
> > type=NETFILTER_PKT ... daddr=127.0.0.1 proto=udp sport=38173 dport=42424
> > type=NETFILTER_PKT ... daddr=::1 proto=udp sport=56852 dport=42424
> > type=NETFILTER_PKT ... daddr=127.0.0.1 proto=tcp sport=57022 dport=42424
> > type=NETFILTER_PKT ... daddr=::1 proto=tcp sport=50810 dport=42424
> > type=NETFILTER_PKT ... daddr=127.0.0.1 proto=sctp sport=54944 dport=42424
> > type=NETFILTER_PKT ... daddr=::1 proto=sctp sport=57963 dport=42424
> >
> > Link: https://github.com/linux-audit/audit-kernel/issues/162
> > Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
> > ---
> > net/netfilter/xt_AUDIT.c | 42 +++++++++++++++++++++++++++++++++++++++-
> > 1 file changed, 41 insertions(+), 1 deletion(-)
> >
> > diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c
> > index b6a015aee0ce..9fc8a5429fa9 100644
> > --- a/net/netfilter/xt_AUDIT.c
> > +++ b/net/netfilter/xt_AUDIT.c
> > @@ -19,6 +19,7 @@
> > #include <linux/netfilter_bridge/ebtables.h>
> > #include <net/ipv6.h>
> > #include <net/ip.h>
> > +#include <linux/sctp.h>
> >
> > MODULE_LICENSE("GPL");
> > MODULE_AUTHOR("Thomas Graf <tgraf@redhat.com>");
> > @@ -32,6 +33,7 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
> > {
> > struct iphdr _iph;
> > const struct iphdr *ih;
> > + __be16 dport, sport;
> >
> > ih = skb_header_pointer(skb, skb_network_offset(skb), sizeof(_iph), &_iph);
> > if (!ih)
> > @@ -40,6 +42,25 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb)
> > audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu",
> > &ih->saddr, &ih->daddr, ih->protocol);
> >
> > + switch (ih->protocol) {
> > + case IPPROTO_TCP:
> > + sport = tcp_hdr(skb)->source;
> > + dport = tcp_hdr(skb)->dest;
> > + break;
> > + case IPPROTO_UDP:
> > + case IPPROTO_UDPLITE:
> > + sport = udp_hdr(skb)->source;
> > + dport = udp_hdr(skb)->dest;
> > + break;
> > + case IPPROTO_SCTP:
> > + sport = sctp_hdr(skb)->source;
> > + dport = sctp_hdr(skb)->dest;
> > + }
> > +
> > + if (ih->protocol == IPPROTO_TCP || ih->protocol == IPPROTO_UDP ||
> > + ih->protocol == IPPROTO_UDPLITE || ih->protocol == IPPROTO_SCTP)
> > + audit_log_format(ab, " sport=%hu dport=%hu", ntohs(sport), ntohs(dport));
> > return true;
> > }
>
> Instead of having the switch statement and then doing an additional if
> statement, why not fold it all into the switch statement? Yes, you
> would have multiple audit_log_format() calls, but they are trivial to
> cut-n-paste, and it saves the extra per-packet checking at runtime.
>
> switch (ih->protocol) {
> case IPPROTO_TCP:
> audit_log_format(ab, " sport=...",
> tcp_hdr(skb)->source,
> tcp_hdr(skb)->dest);
> break;
> ...
> }
>
> ... considering how expensive multiple audit_log_format() calls can be,
> it might even be worth considering consolidating the two calls into one:
>
> switch (ih->protocol) {
> case IPPROTO_TCP:
> audit_log_format(ab, " saddr=...",
> ih->saddr,
> ...
> tcp_hdr(skb)->source,
> tcp_hdr(skb)->dest);
> break;
> ...
> default:
> audit_log_format(ab, " saddr=...",
> ih->saddr,
> ...);
> }
>
> --
> paul-moore.com
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-09-26 18:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-09-25 13:41 [PATCH v2] audit: include source and destination ports to NETFILTER_PKT Ricardo Robaina
2025-09-25 20:41 ` Paul Moore
2025-09-26 18:28 ` Ricardo Robaina
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®