linux-kernel - Re: [PATCH v1] audit: include source and destination ports to NETFILTER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAABTaaDaOu631q+BVa+tzDJdH62+HXO-s0FT_to6VyvyLi-JCQ@mail.gmail.com>
Date: Tue, 23 Sep 2025 14:34:42 -0300
From: Ricardo Robaina <rrobaina@...hat.com>
To: Jan Engelhardt <ej@...i.de>
Cc: audit@...r.kernel.org, linux-kernel@...r.kernel.org, 
	netfilter-devel@...r.kernel.org, coreteam@...filter.org, paul@...l-moore.com, 
	eparis@...hat.com, pablo@...filter.org, kadlec@...filter.org, fw@...len.de
Subject: Re: [PATCH v1] audit: include source and destination ports to NETFILTER_PKT

On Mon, Sep 22, 2025 at 8:29 PM Jan Engelhardt <ej@...i.de> wrote:
>
>
> On Monday 2025-09-22 22:09, Ricardo Robaina wrote:
>
> >NETFILTER_PKT records show both source and destination
> >addresses, in addition to the associated networking protocol.
> >However, it lacks the ports information, which is often
> >valuable for troubleshooting.
> >
> >+      switch (ih->protocol) {
> >+      case IPPROTO_TCP:
> >+              sport = tcp_hdr(skb)->source;
> >+              dport = tcp_hdr(skb)->dest;
> >+              break;
> >+      case IPPROTO_UDP:
> >+              sport = udp_hdr(skb)->source;
> >+              dport = udp_hdr(skb)->dest;
> >+      }
>
> Should be easy enough to add the cases for UDPLITE,
> SCTP and DCCP, right?
>

Thanks for reviewing this patch, Jan.

Yes, it should. I assume it’s safe to use udp_hdr() for the UDP-Lite
case as well, right?

It seems DCCP has been retired by commit 2a63dd0edf38 (“net: Retire
DCCP socket.”). I’ll work on a V2, adding cases for both UDP-Lite and
SCTP.