tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

audit: include source and destination ports to NETFILTER_PKT

NETFILTER_PKT records show both source and destination
addresses, in addition to the associated networking protocol.
However, it lacks the ports information, which is often
valuable for troubleshooting.

This patch adds both source and destination port numbers,
'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and
SCTP-related NETFILTER_PKT records.

$ TESTS="netfilter_pkt" make -e test &> /dev/null
$ ausearch -i -ts recent |grep NETFILTER_PKT
type=NETFILTER_PKT ... proto=icmp
type=NETFILTER_PKT ... proto=ipv6-icmp
type=NETFILTER_PKT ... proto=udp sport=46333 dport=42424
type=NETFILTER_PKT ... proto=udp sport=35953 dport=42424
type=NETFILTER_PKT ... proto=tcp sport=50314 dport=42424
type=NETFILTER_PKT ... proto=tcp sport=57346 dport=42424

Link: https://github.com/linux-audit/audit-kernel/issues/162

Signed-off-by: Ricardo Robaina <rrobaina@redhat.com>
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>

authored by

Ricardo Robaina and committed by
Paul Moore 15b0c43a f19590b0

+99 -4
+99 -4
kernel/audit.c
··· 60 60 #include <net/netns/generic.h> 61 61 #include <net/ip.h> 62 62 #include <net/ipv6.h> 63 + #include <linux/sctp.h> 63 64 64 65 #include "audit.h" 65 66 ··· 2518 2517 if (!ih) 2519 2518 return -ENOMEM; 2520 2519 2521 - audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu", 2522 - &ih->saddr, &ih->daddr, ih->protocol); 2520 + switch (ih->protocol) { 2521 + case IPPROTO_TCP: { 2522 + struct tcphdr _tcph; 2523 + const struct tcphdr *th; 2524 + 2525 + th = skb_header_pointer(skb, skb_transport_offset(skb), 2526 + sizeof(_tcph), &_tcph); 2527 + if (!th) 2528 + return -ENOMEM; 2529 + 2530 + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu", 2531 + &ih->saddr, &ih->daddr, ih->protocol, 2532 + ntohs(th->source), ntohs(th->dest)); 2533 + break; 2534 + } 2535 + case IPPROTO_UDP: 2536 + case IPPROTO_UDPLITE: { 2537 + struct udphdr _udph; 2538 + const struct udphdr *uh; 2539 + 2540 + uh = skb_header_pointer(skb, skb_transport_offset(skb), 2541 + sizeof(_udph), &_udph); 2542 + if (!uh) 2543 + return -ENOMEM; 2544 + 2545 + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu", 2546 + &ih->saddr, &ih->daddr, ih->protocol, 2547 + ntohs(uh->source), ntohs(uh->dest)); 2548 + break; 2549 + } 2550 + case IPPROTO_SCTP: { 2551 + struct sctphdr _sctph; 2552 + const struct sctphdr *sh; 2553 + 2554 + sh = skb_header_pointer(skb, skb_transport_offset(skb), 2555 + sizeof(_sctph), &_sctph); 2556 + if (!sh) 2557 + return -ENOMEM; 2558 + 2559 + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu", 2560 + &ih->saddr, &ih->daddr, ih->protocol, 2561 + ntohs(sh->source), ntohs(sh->dest)); 2562 + break; 2563 + } 2564 + default: 2565 + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu", 2566 + &ih->saddr, &ih->daddr, ih->protocol); 2567 + } 2568 + 2523 2569 break; 2524 2570 } 2525 2571 case NFPROTO_IPV6: { ··· 2584 2536 ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(iph), 2585 2537 &nexthdr, &frag_off); 2586 2538 2587 - audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", 2588 - &ih->saddr, &ih->daddr, nexthdr); 2539 + switch (nexthdr) { 2540 + case IPPROTO_TCP: { 2541 + struct tcphdr _tcph; 2542 + const struct tcphdr *th; 2543 + 2544 + th = skb_header_pointer(skb, skb_transport_offset(skb), 2545 + sizeof(_tcph), &_tcph); 2546 + if (!th) 2547 + return -ENOMEM; 2548 + 2549 + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu", 2550 + &ih->saddr, &ih->daddr, nexthdr, 2551 + ntohs(th->source), ntohs(th->dest)); 2552 + break; 2553 + } 2554 + case IPPROTO_UDP: 2555 + case IPPROTO_UDPLITE: { 2556 + struct udphdr _udph; 2557 + const struct udphdr *uh; 2558 + 2559 + uh = skb_header_pointer(skb, skb_transport_offset(skb), 2560 + sizeof(_udph), &_udph); 2561 + if (!uh) 2562 + return -ENOMEM; 2563 + 2564 + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu", 2565 + &ih->saddr, &ih->daddr, nexthdr, 2566 + ntohs(uh->source), ntohs(uh->dest)); 2567 + break; 2568 + } 2569 + case IPPROTO_SCTP: { 2570 + struct sctphdr _sctph; 2571 + const struct sctphdr *sh; 2572 + 2573 + sh = skb_header_pointer(skb, skb_transport_offset(skb), 2574 + sizeof(_sctph), &_sctph); 2575 + if (!sh) 2576 + return -ENOMEM; 2577 + 2578 + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu", 2579 + &ih->saddr, &ih->daddr, nexthdr, 2580 + ntohs(sh->source), ntohs(sh->dest)); 2581 + break; 2582 + } 2583 + default: 2584 + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", 2585 + &ih->saddr, &ih->daddr, nexthdr); 2586 + } 2587 + 2589 2588 break; 2590 2589 } 2591 2590 default: