audit: Fix logging of IPv6 addresses

[gallatin]

Summary

Our audit logging was not logging the IP/port information for IPv6 accept() syscalls. It turns out there were 2 problems

1. kaudit_to_bsm: Log IPv6 as well as IPv4 and unix addrs
2. au_to_sock_inet128: Treat ports the same way as au_to_sock_inet32(). Just pushing a uint16 causes byte ordering problems on little endian systems.

[csjp]

a few years late to the party here but have you tested this?

[csjp]

Yes I see the problem.. ADD_U_INT16 calls be16enc(), which assumes the input value is in host byte order and converts it to big-endian. However, sin6_port is already stored in network byte order (big-endian). On a little-endian system (like x86 or ARM), the CPU interprets those bytes as a byte-swapped integer, and then be16enc swaps them again. We just need a memcpy here.

[csjp]

I will open a PR to fix au_to_sock_inet128() upstream as well. Thanks for catching this

[gallatin]

In D39633#1293388, @csjp wrote:

a few years late to the party here but have you tested this?

I had totally forgotten about this. Yes, I tested it years ago..

[csjp]

Cross referencing vendor PR https://github.com/openbsm/openbsm/pull/88