From: Valentina Giusti <valentina.giusti@bmw-carit•de>
To: Pablo Neira Ayuso <pablo@netfilter•org>
Cc: netfilter-devel@vger•kernel.org, netdev@vger•kernel.org,
fw@strlen•de, eric.dumazet@gmail•com, tgraf@redhat•com,
jpa@google•com, davem@davemloft•net, daniel.wagner@bmw-carit•de
Subject: Re: [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval
Date: Fri, 20 Dec 2013 10:45:31 +0100 [thread overview]
Message-ID: <52B411BB.3040801@bmw-carit.de> (raw)
In-Reply-To: <20131220092926.GA9275@localhost>
Hi,
On 12/20/2013 10:29 AM, Pablo Neira Ayuso wrote:
> On Fri, Dec 20, 2013 at 10:26:38AM +0100, Pablo Neira Ayuso wrote:
>> Hi,
>>
>> On Thu, Dec 19, 2013 at 12:03:26PM +0100, valentina.giusti@bmw-carit•de wrote:
>>> From: Valentina Giusti <valentina.giusti@oss•bmw-carit.de>
>>>
>>> Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4:
>>> Add udp early demux) it is now possible to parse UID and GID socket info
>>> also for incoming TCP and UDP connections. Having this info available, it
>>> is convenient to let NFQUEUE parse it in order to improve and refine the
>>> traffic analysis in userspace.
>>>
>>> Signed-off-by: Valentina Giusti <valentina.giusti@bmw-carit•de>
>>> ---
>>> include/uapi/linux/netfilter/nfnetlink_queue.h | 5 ++++-
>>> net/netfilter/nfnetlink_queue_core.c | 31 ++++++++++++++++++++++++++
>>> 2 files changed, 35 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h
>>> index 0132bad..8dd819e 100644
>>> --- a/include/uapi/linux/netfilter/nfnetlink_queue.h
>>> +++ b/include/uapi/linux/netfilter/nfnetlink_queue.h
>>> @@ -47,6 +47,8 @@ enum nfqnl_attr_type {
>>> NFQA_CAP_LEN, /* __u32 length of captured packet */
>>> NFQA_SKB_INFO, /* __u32 skb meta information */
>>> NFQA_EXP, /* nf_conntrack_netlink.h */
>>> + NFQA_UID, /* __u32 sk uid */
>>> + NFQA_GID, /* __u32 sk gid */
>>>
>>> __NFQA_MAX
>>> };
>>> @@ -99,7 +101,8 @@ enum nfqnl_attr_config {
>>> #define NFQA_CFG_F_FAIL_OPEN (1 << 0)
>>> #define NFQA_CFG_F_CONNTRACK (1 << 1)
>>> #define NFQA_CFG_F_GSO (1 << 2)
>>> -#define NFQA_CFG_F_MAX (1 << 3)
>>> +#define NFQA_CFG_F_UID_GID (1 << 3)
>>> +#define NFQA_CFG_F_MAX (1 << 4)
>>>
>>> /* flags for NFQA_SKB_INFO */
>>> /* packet appears to have wrong checksums, but they are ok */
>>> diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
>>> index 21258cf..2cdef07 100644
>>> --- a/net/netfilter/nfnetlink_queue_core.c
>>> +++ b/net/netfilter/nfnetlink_queue_core.c
>>> @@ -297,6 +297,29 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet,
>>> return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0;
>>> }
>>>
>>> +static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk)
>>> +{
>>> + const struct cred *cred;
>>> +
>>> + if (sk && sk->sk_state != TCP_TIME_WAIT) {
>>> + read_lock_bh(&sk->sk_callback_lock);
>>> + if (sk->sk_socket && sk->sk_socket->file) {
>>> + cred = sk->sk_socket->file->f_cred;
>>> + if (nla_put_u32(skb, NFQA_UID, htonl(cred->fsuid)))
>> I'm hitting this compilation error here:
>>
>> net/netfilter/nfnetlink_queue_core.c: In function ‘nfqnl_put_sk_uidgid’:
>> net/netfilter/nfnetlink_queue_core.c:308:4: error: aggregate value used where an integer was expected
>>
>> It seems that in recent kernels you have to use:
>>
>> from_kuid_munged(&init_user_ns, cred->fsuid);
>>
>> to retrieve the integer that represents the uid.
>>
>> Please,
> sorry, I left this sentence incomplete, I was telling... Please, test
> your patches with current git trees :-). Thanks.
Thank you for reviewing the patches, I'll send a new version soon :)
--
Cheers,
Val
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger•kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger•kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2013-12-20 9:45 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-19 11:03 [PATCH v2 0/2] Add UID/GID info to NFQUEUE valentina.giusti
2013-12-19 11:03 ` [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval valentina.giusti
2013-12-19 11:43 ` Florian Westphal
2013-12-20 9:26 ` Pablo Neira Ayuso
2013-12-20 9:29 ` Pablo Neira Ayuso
2013-12-20 9:45 ` Valentina Giusti [this message]
2013-12-20 11:18 ` Valentina Giusti
2013-12-20 12:06 ` Florian Westphal
2013-12-19 11:03 ` [PATCH v2 2/2] libnetfilter_queue: add support for UID/GID socket info valentina.giusti
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=52B411BB.3040801@bmw-carit.de \
--to=valentina.giusti@bmw-carit$(echo .)de \
--cc=daniel.wagner@bmw-carit$(echo .)de \
--cc=davem@davemloft$(echo .)net \
--cc=eric.dumazet@gmail$(echo .)com \
--cc=fw@strlen$(echo .)de \
--cc=jpa@google$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
--cc=tgraf@redhat$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox