NETFILTER_PKT records show both source and destination addresses, in addition to the associated networking protocol. However, it lacks the ports information, which is often valuable for troubleshooting.
This patch adds both source and destination port numbers, 'sport' and 'dport' respectively, to TCP, UDP, UDP-Lite and SCTP-related NETFILTER_PKT records. type=NETFILTER_PKT ... saddr=127.0.0.1 daddr=127.0.0.1 proto=icmp type=NETFILTER_PKT ... saddr=::1 daddr=::1 proto=ipv6-icmp type=NETFILTER_PKT ... daddr=127.0.0.1 proto=udp sport=38173 dport=42424 type=NETFILTER_PKT ... daddr=::1 proto=udp sport=56852 dport=42424 type=NETFILTER_PKT ... daddr=127.0.0.1 proto=tcp sport=57022 dport=42424 type=NETFILTER_PKT ... daddr=::1 proto=tcp sport=50810 dport=42424 type=NETFILTER_PKT ... daddr=127.0.0.1 proto=sctp sport=54944 dport=42424 type=NETFILTER_PKT ... daddr=::1 proto=sctp sport=57963 dport=42424 Link: https://github.com/linux-audit/audit-kernel/issues/162 Signed-off-by: Ricardo Robaina <rroba...@redhat.com> --- net/netfilter/xt_AUDIT.c | 47 ++++++++++++++++++++++++++++++++++++---- 1 file changed, 43 insertions(+), 4 deletions(-) diff --git a/net/netfilter/xt_AUDIT.c b/net/netfilter/xt_AUDIT.c index b6a015aee0ce..fb16f20cfb1b 100644 --- a/net/netfilter/xt_AUDIT.c +++ b/net/netfilter/xt_AUDIT.c @@ -19,6 +19,7 @@ #include <linux/netfilter_bridge/ebtables.h> #include <net/ipv6.h> #include <net/ip.h> +#include <linux/sctp.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("Thomas Graf <tg...@redhat.com>"); @@ -37,8 +38,27 @@ static bool audit_ip4(struct audit_buffer *ab, struct sk_buff *skb) if (!ih) return false; - audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu", - &ih->saddr, &ih->daddr, ih->protocol); + switch (ih->protocol) { + case IPPROTO_TCP: + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest)); + break; + case IPPROTO_SCTP: + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu sport=%hu dport=%hu", + &ih->saddr, &ih->daddr, ih->protocol, + ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest)); + break; + default: + audit_log_format(ab, " saddr=%pI4 daddr=%pI4 proto=%hhu", + &ih->saddr, &ih->daddr, ih->protocol); + } return true; } @@ -57,8 +77,27 @@ static bool audit_ip6(struct audit_buffer *ab, struct sk_buff *skb) nexthdr = ih->nexthdr; ipv6_skip_exthdr(skb, skb_network_offset(skb) + sizeof(_ip6h), &nexthdr, &frag_off); - audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", - &ih->saddr, &ih->daddr, nexthdr); + switch (nexthdr) { + case IPPROTO_TCP: + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(tcp_hdr(skb)->source), ntohs(tcp_hdr(skb)->dest)); + break; + case IPPROTO_UDP: + case IPPROTO_UDPLITE: + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(udp_hdr(skb)->source), ntohs(udp_hdr(skb)->dest)); + break; + case IPPROTO_SCTP: + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu sport=%hu dport=%hu", + &ih->saddr, &ih->daddr, nexthdr, + ntohs(sctp_hdr(skb)->source), ntohs(sctp_hdr(skb)->dest)); + break; + default: + audit_log_format(ab, " saddr=%pI6c daddr=%pI6c proto=%hhu", + &ih->saddr, &ih->daddr, nexthdr); + } return true; } -- 2.51.0
