Page MenuHomeFreeBSD

audit: Fix logging of IPv6 addresses
Needs ReviewPublic

Authored by gallatin on Apr 18 2023, 12:22 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Jan 20, 12:36 AM
Unknown Object (File)
Nov 23 2025, 12:26 AM
Unknown Object (File)
Nov 21 2025, 4:03 PM
Unknown Object (File)
Nov 21 2025, 3:04 AM
Unknown Object (File)
Nov 20 2025, 12:36 AM
Unknown Object (File)
Nov 19 2025, 6:30 AM
Unknown Object (File)
Oct 22 2025, 3:11 PM
Unknown Object (File)
Oct 22 2025, 2:26 AM
Subscribers

Details

Summary

Our audit logging was not logging the IP/port information for IPv6 accept() syscalls. It turns out there were 2 problems

  1. kaudit_to_bsm: Log IPv6 as well as IPv4 and unix addrs
  2. au_to_sock_inet128: Treat ports the same way as au_to_sock_inet32(). Just pushing a uint16 causes byte ordering problems on little endian systems.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped