* [PATCH v2 0/2] Add UID/GID info to NFQUEUE @ 2013-12-19 11:03 valentina.giusti 2013-12-19 11:03 ` [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval valentina.giusti 2013-12-19 11:03 ` [PATCH v2 2/2] libnetfilter_queue: add support for UID/GID socket info valentina.giusti 0 siblings, 2 replies; 9+ messages in thread From: valentina.giusti @ 2013-12-19 11:03 UTC (permalink / raw) To: netfilter-devel Cc: netdev, fw, eric.dumazet, tgraf, jpa, pablo, davem, daniel.wagner, Valentina Giusti From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de> Hi, here is the second version of this patchset, modified in accordance with Florian Westphal's comments to the first version. I hope this one looks better :) -- Best Regards, Val ^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval 2013-12-19 11:03 [PATCH v2 0/2] Add UID/GID info to NFQUEUE valentina.giusti @ 2013-12-19 11:03 ` valentina.giusti 2013-12-19 11:43 ` Florian Westphal 2013-12-20 9:26 ` Pablo Neira Ayuso 2013-12-19 11:03 ` [PATCH v2 2/2] libnetfilter_queue: add support for UID/GID socket info valentina.giusti 1 sibling, 2 replies; 9+ messages in thread From: valentina.giusti @ 2013-12-19 11:03 UTC (permalink / raw) To: netfilter-devel Cc: netdev, fw, eric.dumazet, tgraf, jpa, pablo, davem, daniel.wagner, Valentina Giusti From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de> Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4: Add udp early demux) it is now possible to parse UID and GID socket info also for incoming TCP and UDP connections. Having this info available, it is convenient to let NFQUEUE parse it in order to improve and refine the traffic analysis in userspace. Signed-off-by: Valentina Giusti <valentina.giusti@bmw-carit.de> --- include/uapi/linux/netfilter/nfnetlink_queue.h | 5 ++++- net/netfilter/nfnetlink_queue_core.c | 31 ++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h index 0132bad..8dd819e 100644 --- a/include/uapi/linux/netfilter/nfnetlink_queue.h +++ b/include/uapi/linux/netfilter/nfnetlink_queue.h @@ -47,6 +47,8 @@ enum nfqnl_attr_type { NFQA_CAP_LEN, /* __u32 length of captured packet */ NFQA_SKB_INFO, /* __u32 skb meta information */ NFQA_EXP, /* nf_conntrack_netlink.h */ + NFQA_UID, /* __u32 sk uid */ + NFQA_GID, /* __u32 sk gid */ __NFQA_MAX }; @@ -99,7 +101,8 @@ enum nfqnl_attr_config { #define NFQA_CFG_F_FAIL_OPEN (1 << 0) #define NFQA_CFG_F_CONNTRACK (1 << 1) #define NFQA_CFG_F_GSO (1 << 2) -#define NFQA_CFG_F_MAX (1 << 3) +#define NFQA_CFG_F_UID_GID (1 << 3) +#define NFQA_CFG_F_MAX (1 << 4) /* flags for NFQA_SKB_INFO */ /* packet appears to have wrong checksums, but they are ok */ diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c index 21258cf..2cdef07 100644 --- a/net/netfilter/nfnetlink_queue_core.c +++ b/net/netfilter/nfnetlink_queue_core.c @@ -297,6 +297,29 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; } +static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) +{ + const struct cred *cred; + + if (sk && sk->sk_state != TCP_TIME_WAIT) { + read_lock_bh(&sk->sk_callback_lock); + if (sk->sk_socket && sk->sk_socket->file) { + cred = sk->sk_socket->file->f_cred; + if (nla_put_u32(skb, NFQA_UID, htonl(cred->fsuid))) + goto nla_put_failure; + if (nla_put_u32(skb, NFQA_GID, htonl(cred->fsgid))) + goto nla_put_failure; + } + read_unlock_bh(&sk->sk_callback_lock); + } + + return 0; + +nla_put_failure: + read_unlock_bh(&sk->sk_callback_lock); + return -1; +} + static struct sk_buff * nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, struct nf_queue_entry *entry, @@ -372,6 +395,10 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, if (queue->flags & NFQA_CFG_F_CONNTRACK) ct = nfqnl_ct_get(entskb, &size, &ctinfo); + if (queue->flags & NFQA_CFG_F_UID_GID) + size += (nla_total_size(sizeof(u_int32_t)) /* uid */ + + nla_total_size(sizeof(u_int32_t))); /* gid */ + skb = nfnetlink_alloc_skb(net, size, queue->peer_portid, GFP_ATOMIC); if (!skb) @@ -484,6 +511,10 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, goto nla_put_failure; } + if ((queue->flags & NFQA_CFG_F_UID_GID) && entskb->sk) + if (nfqnl_put_sk_uidgid(skb, entskb->sk)) + goto nla_put_failure; + if (ct && nfqnl_ct_put(skb, ct, ctinfo) < 0) goto nla_put_failure; -- 1.8.5.1 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval 2013-12-19 11:03 ` [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval valentina.giusti @ 2013-12-19 11:43 ` Florian Westphal 2013-12-20 9:26 ` Pablo Neira Ayuso 1 sibling, 0 replies; 9+ messages in thread From: Florian Westphal @ 2013-12-19 11:43 UTC (permalink / raw) To: valentina.giusti Cc: netfilter-devel, netdev, fw, eric.dumazet, tgraf, jpa, pablo, davem, daniel.wagner, Valentina Giusti valentina.giusti@bmw-carit.de <valentina.giusti@bmw-carit.de> wrote: > From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de> > > Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4: > Add udp early demux) it is now possible to parse UID and GID socket info > also for incoming TCP and UDP connections. Having this info available, it > is convenient to let NFQUEUE parse it in order to improve and refine the > traffic analysis in userspace. > diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c > index 21258cf..2cdef07 100644 > --- a/net/netfilter/nfnetlink_queue_core.c > +++ b/net/netfilter/nfnetlink_queue_core.c > @@ -297,6 +297,29 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, > return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; > } > > +static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) > +{ > + const struct cred *cred; > + > + if (sk && sk->sk_state != TCP_TIME_WAIT) { [..] > + if ((queue->flags & NFQA_CFG_F_UID_GID) && entskb->sk) > + if (nfqnl_put_sk_uidgid(skb, entskb->sk)) > + goto nla_put_failure; Minor nit: sk is tested for non-null twice. Suggestion: if ((queue->flags & NFQA_CFG_F_UID_GID) && nfqnl_put_sk_uidgid(skb, entskb->sk)) goto nla_put_failure; I don't think its necessary to resubmit the patch though, thus: Reviewed-by: Florian Westphal <fw@strlen.de> ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval 2013-12-19 11:03 ` [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval valentina.giusti 2013-12-19 11:43 ` Florian Westphal @ 2013-12-20 9:26 ` Pablo Neira Ayuso 2013-12-20 9:29 ` Pablo Neira Ayuso 1 sibling, 1 reply; 9+ messages in thread From: Pablo Neira Ayuso @ 2013-12-20 9:26 UTC (permalink / raw) To: valentina.giusti Cc: netfilter-devel, netdev, fw, eric.dumazet, tgraf, jpa, davem, daniel.wagner, Valentina Giusti Hi, On Thu, Dec 19, 2013 at 12:03:26PM +0100, valentina.giusti@bmw-carit.de wrote: > From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de> > > Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4: > Add udp early demux) it is now possible to parse UID and GID socket info > also for incoming TCP and UDP connections. Having this info available, it > is convenient to let NFQUEUE parse it in order to improve and refine the > traffic analysis in userspace. > > Signed-off-by: Valentina Giusti <valentina.giusti@bmw-carit.de> > --- > include/uapi/linux/netfilter/nfnetlink_queue.h | 5 ++++- > net/netfilter/nfnetlink_queue_core.c | 31 ++++++++++++++++++++++++++ > 2 files changed, 35 insertions(+), 1 deletion(-) > > diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h > index 0132bad..8dd819e 100644 > --- a/include/uapi/linux/netfilter/nfnetlink_queue.h > +++ b/include/uapi/linux/netfilter/nfnetlink_queue.h > @@ -47,6 +47,8 @@ enum nfqnl_attr_type { > NFQA_CAP_LEN, /* __u32 length of captured packet */ > NFQA_SKB_INFO, /* __u32 skb meta information */ > NFQA_EXP, /* nf_conntrack_netlink.h */ > + NFQA_UID, /* __u32 sk uid */ > + NFQA_GID, /* __u32 sk gid */ > > __NFQA_MAX > }; > @@ -99,7 +101,8 @@ enum nfqnl_attr_config { > #define NFQA_CFG_F_FAIL_OPEN (1 << 0) > #define NFQA_CFG_F_CONNTRACK (1 << 1) > #define NFQA_CFG_F_GSO (1 << 2) > -#define NFQA_CFG_F_MAX (1 << 3) > +#define NFQA_CFG_F_UID_GID (1 << 3) > +#define NFQA_CFG_F_MAX (1 << 4) > > /* flags for NFQA_SKB_INFO */ > /* packet appears to have wrong checksums, but they are ok */ > diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c > index 21258cf..2cdef07 100644 > --- a/net/netfilter/nfnetlink_queue_core.c > +++ b/net/netfilter/nfnetlink_queue_core.c > @@ -297,6 +297,29 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, > return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; > } > > +static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) > +{ > + const struct cred *cred; > + > + if (sk && sk->sk_state != TCP_TIME_WAIT) { > + read_lock_bh(&sk->sk_callback_lock); > + if (sk->sk_socket && sk->sk_socket->file) { > + cred = sk->sk_socket->file->f_cred; > + if (nla_put_u32(skb, NFQA_UID, htonl(cred->fsuid))) I'm hitting this compilation error here: net/netfilter/nfnetlink_queue_core.c: In function ‘nfqnl_put_sk_uidgid’: net/netfilter/nfnetlink_queue_core.c:308:4: error: aggregate value used where an integer was expected It seems that in recent kernels you have to use: from_kuid_munged(&init_user_ns, cred->fsuid); to retrieve the integer that represents the uid. Please, > + goto nla_put_failure; > + if (nla_put_u32(skb, NFQA_GID, htonl(cred->fsgid))) ^^^ Minor nitpick: This has to be _be32 otherwise sparse will complain (spotted by Florian Westphal). Make sure you patch is also clean when running make C=2. Also remove the extra checking for socket that Florian mentioned and resubmit. Thanks. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval 2013-12-20 9:26 ` Pablo Neira Ayuso @ 2013-12-20 9:29 ` Pablo Neira Ayuso 2013-12-20 9:45 ` Valentina Giusti 2013-12-20 11:18 ` Valentina Giusti 0 siblings, 2 replies; 9+ messages in thread From: Pablo Neira Ayuso @ 2013-12-20 9:29 UTC (permalink / raw) To: valentina.giusti Cc: netfilter-devel, netdev, fw, eric.dumazet, tgraf, jpa, davem, daniel.wagner, Valentina Giusti On Fri, Dec 20, 2013 at 10:26:38AM +0100, Pablo Neira Ayuso wrote: > Hi, > > On Thu, Dec 19, 2013 at 12:03:26PM +0100, valentina.giusti@bmw-carit.de wrote: > > From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de> > > > > Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4: > > Add udp early demux) it is now possible to parse UID and GID socket info > > also for incoming TCP and UDP connections. Having this info available, it > > is convenient to let NFQUEUE parse it in order to improve and refine the > > traffic analysis in userspace. > > > > Signed-off-by: Valentina Giusti <valentina.giusti@bmw-carit.de> > > --- > > include/uapi/linux/netfilter/nfnetlink_queue.h | 5 ++++- > > net/netfilter/nfnetlink_queue_core.c | 31 ++++++++++++++++++++++++++ > > 2 files changed, 35 insertions(+), 1 deletion(-) > > > > diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h > > index 0132bad..8dd819e 100644 > > --- a/include/uapi/linux/netfilter/nfnetlink_queue.h > > +++ b/include/uapi/linux/netfilter/nfnetlink_queue.h > > @@ -47,6 +47,8 @@ enum nfqnl_attr_type { > > NFQA_CAP_LEN, /* __u32 length of captured packet */ > > NFQA_SKB_INFO, /* __u32 skb meta information */ > > NFQA_EXP, /* nf_conntrack_netlink.h */ > > + NFQA_UID, /* __u32 sk uid */ > > + NFQA_GID, /* __u32 sk gid */ > > > > __NFQA_MAX > > }; > > @@ -99,7 +101,8 @@ enum nfqnl_attr_config { > > #define NFQA_CFG_F_FAIL_OPEN (1 << 0) > > #define NFQA_CFG_F_CONNTRACK (1 << 1) > > #define NFQA_CFG_F_GSO (1 << 2) > > -#define NFQA_CFG_F_MAX (1 << 3) > > +#define NFQA_CFG_F_UID_GID (1 << 3) > > +#define NFQA_CFG_F_MAX (1 << 4) > > > > /* flags for NFQA_SKB_INFO */ > > /* packet appears to have wrong checksums, but they are ok */ > > diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c > > index 21258cf..2cdef07 100644 > > --- a/net/netfilter/nfnetlink_queue_core.c > > +++ b/net/netfilter/nfnetlink_queue_core.c > > @@ -297,6 +297,29 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, > > return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; > > } > > > > +static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) > > +{ > > + const struct cred *cred; > > + > > + if (sk && sk->sk_state != TCP_TIME_WAIT) { > > + read_lock_bh(&sk->sk_callback_lock); > > + if (sk->sk_socket && sk->sk_socket->file) { > > + cred = sk->sk_socket->file->f_cred; > > + if (nla_put_u32(skb, NFQA_UID, htonl(cred->fsuid))) > > I'm hitting this compilation error here: > > net/netfilter/nfnetlink_queue_core.c: In function ‘nfqnl_put_sk_uidgid’: > net/netfilter/nfnetlink_queue_core.c:308:4: error: aggregate value used where an integer was expected > > It seems that in recent kernels you have to use: > > from_kuid_munged(&init_user_ns, cred->fsuid); > > to retrieve the integer that represents the uid. > > Please, sorry, I left this sentence incomplete, I was telling... Please, test your patches with current git trees :-). Thanks. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval 2013-12-20 9:29 ` Pablo Neira Ayuso @ 2013-12-20 9:45 ` Valentina Giusti 2013-12-20 11:18 ` Valentina Giusti 1 sibling, 0 replies; 9+ messages in thread From: Valentina Giusti @ 2013-12-20 9:45 UTC (permalink / raw) To: Pablo Neira Ayuso Cc: netfilter-devel, netdev, fw, eric.dumazet, tgraf, jpa, davem, daniel.wagner Hi, On 12/20/2013 10:29 AM, Pablo Neira Ayuso wrote: > On Fri, Dec 20, 2013 at 10:26:38AM +0100, Pablo Neira Ayuso wrote: >> Hi, >> >> On Thu, Dec 19, 2013 at 12:03:26PM +0100, valentina.giusti@bmw-carit.de wrote: >>> From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de> >>> >>> Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4: >>> Add udp early demux) it is now possible to parse UID and GID socket info >>> also for incoming TCP and UDP connections. Having this info available, it >>> is convenient to let NFQUEUE parse it in order to improve and refine the >>> traffic analysis in userspace. >>> >>> Signed-off-by: Valentina Giusti <valentina.giusti@bmw-carit.de> >>> --- >>> include/uapi/linux/netfilter/nfnetlink_queue.h | 5 ++++- >>> net/netfilter/nfnetlink_queue_core.c | 31 ++++++++++++++++++++++++++ >>> 2 files changed, 35 insertions(+), 1 deletion(-) >>> >>> diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h >>> index 0132bad..8dd819e 100644 >>> --- a/include/uapi/linux/netfilter/nfnetlink_queue.h >>> +++ b/include/uapi/linux/netfilter/nfnetlink_queue.h >>> @@ -47,6 +47,8 @@ enum nfqnl_attr_type { >>> NFQA_CAP_LEN, /* __u32 length of captured packet */ >>> NFQA_SKB_INFO, /* __u32 skb meta information */ >>> NFQA_EXP, /* nf_conntrack_netlink.h */ >>> + NFQA_UID, /* __u32 sk uid */ >>> + NFQA_GID, /* __u32 sk gid */ >>> >>> __NFQA_MAX >>> }; >>> @@ -99,7 +101,8 @@ enum nfqnl_attr_config { >>> #define NFQA_CFG_F_FAIL_OPEN (1 << 0) >>> #define NFQA_CFG_F_CONNTRACK (1 << 1) >>> #define NFQA_CFG_F_GSO (1 << 2) >>> -#define NFQA_CFG_F_MAX (1 << 3) >>> +#define NFQA_CFG_F_UID_GID (1 << 3) >>> +#define NFQA_CFG_F_MAX (1 << 4) >>> >>> /* flags for NFQA_SKB_INFO */ >>> /* packet appears to have wrong checksums, but they are ok */ >>> diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c >>> index 21258cf..2cdef07 100644 >>> --- a/net/netfilter/nfnetlink_queue_core.c >>> +++ b/net/netfilter/nfnetlink_queue_core.c >>> @@ -297,6 +297,29 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, >>> return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; >>> } >>> >>> +static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) >>> +{ >>> + const struct cred *cred; >>> + >>> + if (sk && sk->sk_state != TCP_TIME_WAIT) { >>> + read_lock_bh(&sk->sk_callback_lock); >>> + if (sk->sk_socket && sk->sk_socket->file) { >>> + cred = sk->sk_socket->file->f_cred; >>> + if (nla_put_u32(skb, NFQA_UID, htonl(cred->fsuid))) >> I'm hitting this compilation error here: >> >> net/netfilter/nfnetlink_queue_core.c: In function ‘nfqnl_put_sk_uidgid’: >> net/netfilter/nfnetlink_queue_core.c:308:4: error: aggregate value used where an integer was expected >> >> It seems that in recent kernels you have to use: >> >> from_kuid_munged(&init_user_ns, cred->fsuid); >> >> to retrieve the integer that represents the uid. >> >> Please, > sorry, I left this sentence incomplete, I was telling... Please, test > your patches with current git trees :-). Thanks. Thank you for reviewing the patches, I'll send a new version soon :) -- Cheers, Val > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval 2013-12-20 9:29 ` Pablo Neira Ayuso 2013-12-20 9:45 ` Valentina Giusti @ 2013-12-20 11:18 ` Valentina Giusti 2013-12-20 12:06 ` Florian Westphal 1 sibling, 1 reply; 9+ messages in thread From: Valentina Giusti @ 2013-12-20 11:18 UTC (permalink / raw) To: Pablo Neira Ayuso Cc: netfilter-devel, netdev, fw, eric.dumazet, tgraf, jpa, davem, daniel.wagner Hi, On 12/20/2013 10:29 AM, Pablo Neira Ayuso wrote: > On Fri, Dec 20, 2013 at 10:26:38AM +0100, Pablo Neira Ayuso wrote: >> Hi, >> >> On Thu, Dec 19, 2013 at 12:03:26PM +0100, valentina.giusti@bmw-carit.de wrote: >>> From: Valentina Giusti <valentina.giusti@oss.bmw-carit.de> >>> >>> Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4: >>> Add udp early demux) it is now possible to parse UID and GID socket info >>> also for incoming TCP and UDP connections. Having this info available, it >>> is convenient to let NFQUEUE parse it in order to improve and refine the >>> traffic analysis in userspace. >>> >>> Signed-off-by: Valentina Giusti <valentina.giusti@bmw-carit.de> >>> --- >>> include/uapi/linux/netfilter/nfnetlink_queue.h | 5 ++++- >>> net/netfilter/nfnetlink_queue_core.c | 31 ++++++++++++++++++++++++++ >>> 2 files changed, 35 insertions(+), 1 deletion(-) >>> >>> diff --git a/include/uapi/linux/netfilter/nfnetlink_queue.h b/include/uapi/linux/netfilter/nfnetlink_queue.h >>> index 0132bad..8dd819e 100644 >>> --- a/include/uapi/linux/netfilter/nfnetlink_queue.h >>> +++ b/include/uapi/linux/netfilter/nfnetlink_queue.h >>> @@ -47,6 +47,8 @@ enum nfqnl_attr_type { >>> NFQA_CAP_LEN, /* __u32 length of captured packet */ >>> NFQA_SKB_INFO, /* __u32 skb meta information */ >>> NFQA_EXP, /* nf_conntrack_netlink.h */ >>> + NFQA_UID, /* __u32 sk uid */ >>> + NFQA_GID, /* __u32 sk gid */ >>> >>> __NFQA_MAX >>> }; >>> @@ -99,7 +101,8 @@ enum nfqnl_attr_config { >>> #define NFQA_CFG_F_FAIL_OPEN (1 << 0) >>> #define NFQA_CFG_F_CONNTRACK (1 << 1) >>> #define NFQA_CFG_F_GSO (1 << 2) >>> -#define NFQA_CFG_F_MAX (1 << 3) >>> +#define NFQA_CFG_F_UID_GID (1 << 3) >>> +#define NFQA_CFG_F_MAX (1 << 4) >>> >>> /* flags for NFQA_SKB_INFO */ >>> /* packet appears to have wrong checksums, but they are ok */ >>> diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c >>> index 21258cf..2cdef07 100644 >>> --- a/net/netfilter/nfnetlink_queue_core.c >>> +++ b/net/netfilter/nfnetlink_queue_core.c >>> @@ -297,6 +297,29 @@ nfqnl_put_packet_info(struct sk_buff *nlskb, struct sk_buff *packet, >>> return flags ? nla_put_be32(nlskb, NFQA_SKB_INFO, htonl(flags)) : 0; >>> } >>> >>> +static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) >>> +{ >>> + const struct cred *cred; >>> + >>> + if (sk && sk->sk_state != TCP_TIME_WAIT) { >>> + read_lock_bh(&sk->sk_callback_lock); >>> + if (sk->sk_socket && sk->sk_socket->file) { >>> + cred = sk->sk_socket->file->f_cred; >>> + if (nla_put_u32(skb, NFQA_UID, htonl(cred->fsuid))) >> I'm hitting this compilation error here: >> >> net/netfilter/nfnetlink_queue_core.c: In function ‘nfqnl_put_sk_uidgid’: >> net/netfilter/nfnetlink_queue_core.c:308:4: error: aggregate value used where an integer was expected >> >> It seems that in recent kernels you have to use: >> >> from_kuid_munged(&init_user_ns, cred->fsuid); >> >> to retrieve the integer that represents the uid. >> >> Please, > sorry, I left this sentence incomplete, I was telling... Please, test > your patches with current git trees :-). Thanks. Just to be on the safe side, I am testing my patches against the nf-next tree, branch master. Is that correct? Thanks, Val ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval 2013-12-20 11:18 ` Valentina Giusti @ 2013-12-20 12:06 ` Florian Westphal 0 siblings, 0 replies; 9+ messages in thread From: Florian Westphal @ 2013-12-20 12:06 UTC (permalink / raw) To: Valentina Giusti Cc: Pablo Neira Ayuso, netfilter-devel, netdev, daniel.wagner Valentina Giusti <valentina.giusti@bmw-carit.de> wrote: > Just to be on the safe side, I am testing my patches against the > nf-next tree, branch master. Is that correct? Yes, thats correct. ^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v2 2/2] libnetfilter_queue: add support for UID/GID socket info 2013-12-19 11:03 [PATCH v2 0/2] Add UID/GID info to NFQUEUE valentina.giusti 2013-12-19 11:03 ` [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval valentina.giusti @ 2013-12-19 11:03 ` valentina.giusti 1 sibling, 0 replies; 9+ messages in thread From: valentina.giusti @ 2013-12-19 11:03 UTC (permalink / raw) To: netfilter-devel Cc: netdev, fw, eric.dumazet, tgraf, jpa, pablo, davem, daniel.wagner, Valentina Giusti From: Valentina Giusti <Valentina.Giusti@bmw-carit.de> With this patch libnetfilter_queue is able to parse UID/GID socket information. Signed-off-by: Valentina Giusti <Valentina.Giusti@bmw-carit.de> --- include/libnetfilter_queue/libnetfilter_queue.h | 4 ++++ include/libnetfilter_queue/linux_nfnetlink_queue.h | 5 +++- include/linux/netfilter/nfnetlink_queue.h | 6 ++++- src/libnetfilter_queue.c | 28 ++++++++++++++++++++++ src/nlmsg.c | 2 ++ 5 files changed, 43 insertions(+), 2 deletions(-) diff --git a/include/libnetfilter_queue/libnetfilter_queue.h b/include/libnetfilter_queue/libnetfilter_queue.h index b9f16e2..b4e2679 100644 --- a/include/libnetfilter_queue/libnetfilter_queue.h +++ b/include/libnetfilter_queue/libnetfilter_queue.h @@ -103,6 +103,8 @@ extern u_int32_t nfq_get_indev(struct nfq_data *nfad); extern u_int32_t nfq_get_physindev(struct nfq_data *nfad); extern u_int32_t nfq_get_outdev(struct nfq_data *nfad); extern u_int32_t nfq_get_physoutdev(struct nfq_data *nfad); +extern u_int32_t nfq_get_uid(struct nfq_data *nfad); +extern u_int32_t nfq_get_gid(struct nfq_data *nfad); extern int nfq_get_indev_name(struct nlif_handle *nlif_handle, struct nfq_data *nfad, char *name); @@ -125,6 +127,8 @@ enum { NFQ_XML_PHYSDEV = (1 << 3), NFQ_XML_PAYLOAD = (1 << 4), NFQ_XML_TIME = (1 << 5), + NFQ_XML_UID = (1 << 6), + NFQ_XML_GID = (1 << 7), NFQ_XML_ALL = ~0U, }; diff --git a/include/libnetfilter_queue/linux_nfnetlink_queue.h b/include/libnetfilter_queue/linux_nfnetlink_queue.h index 81a485b..884ab0e 100644 --- a/include/libnetfilter_queue/linux_nfnetlink_queue.h +++ b/include/libnetfilter_queue/linux_nfnetlink_queue.h @@ -50,6 +50,8 @@ enum nfqnl_attr_type { NFQA_CAP_LEN, /* __u32 length of captured packet */ NFQA_SKB_INFO, /* __u32 skb meta information */ + NFQA_UID, /* __u32 sk uid */ + NFQA_GID, /* __u32 sk gid */ __NFQA_MAX }; #define NFQA_MAX (__NFQA_MAX - 1) @@ -101,7 +103,8 @@ enum nfqnl_attr_config { #define NFQA_CFG_F_FAIL_OPEN (1 << 0) #define NFQA_CFG_F_CONNTRACK (1 << 1) #define NFQA_CFG_F_GSO (1 << 2) -#define NFQA_CFG_F_MAX (1 << 3) +#define NFQA_CFG_F_UID_GID (1 << 3) +#define NFQA_CFG_F_MAX (1 << 4) /* flags for NFQA_SKB_INFO */ /* packet appears to have wrong checksums, but they are ok */ diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h index a2308ae..22f5d45 100644 --- a/include/linux/netfilter/nfnetlink_queue.h +++ b/include/linux/netfilter/nfnetlink_queue.h @@ -46,6 +46,9 @@ enum nfqnl_attr_type { NFQA_CT_INFO, /* enum ip_conntrack_info */ NFQA_CAP_LEN, /* __u32 length of captured packet */ NFQA_SKB_INFO, /* __u32 skb meta information */ + NFQA_EXP, /* nf_conntrack_netlink.h */ + NFQA_UID, /* __u32 sk uid */ + NFQA_GID, /* __u32 sk gid */ __NFQA_MAX }; @@ -98,7 +101,8 @@ enum nfqnl_attr_config { #define NFQA_CFG_F_FAIL_OPEN (1 << 0) #define NFQA_CFG_F_CONNTRACK (1 << 1) #define NFQA_CFG_F_GSO (1 << 2) -#define NFQA_CFG_F_MAX (1 << 3) +#define NFQA_CFG_F_UID_GID (1 << 3) +#define NFQA_CFG_F_MAX (1 << 4) /* flags for NFQA_SKB_INFO */ /* packet appears to have wrong checksums, but they are ok */ diff --git a/src/libnetfilter_queue.c b/src/libnetfilter_queue.c index fa8efe7..bf1266b 100644 --- a/src/libnetfilter_queue.c +++ b/src/libnetfilter_queue.c @@ -668,6 +668,9 @@ EXPORT_SYMBOL(nfq_set_mode); * if this bit is set, the layer 3/4 checksums of the packet appear incorrect, * but are not (because they will be corrected later by the kernel). * + * - NFQA_CFG_F_UID_GID: the kernel will dump UID and GID of the socket to + * which each packet belongs. + * * Here's a little code snippet to show how to use this API: * \verbatim uint32_t flags = NFQA_CFG_F_FAIL_OPEN; @@ -1180,6 +1183,18 @@ struct nfqnl_msg_packet_hw *nfq_get_packet_hw(struct nfq_data *nfad) } EXPORT_SYMBOL(nfq_get_packet_hw); +uint32_t nfq_get_uid(struct nfq_data *nfad) +{ + return ntohl(nfnl_get_data(nfad->data, NFQA_UID, u_int32_t)); +} +EXPORT_SYMBOL(nfq_get_uid); + +uint32_t nfq_get_gid(struct nfq_data *nfad) +{ + return ntohl(nfnl_get_data(nfad->data, NFQA_GID, u_int32_t)); +} +EXPORT_SYMBOL(nfq_get_gid); + /** * nfq_get_payload - get payload * \param nfad Netlink packet data handle passed to callback function @@ -1250,6 +1265,7 @@ int nfq_snprintf_xml(char *buf, size_t rem, struct nfq_data *tb, int flags) struct nfqnl_msg_packet_hdr *ph; struct nfqnl_msg_packet_hw *hwph; u_int32_t mark, ifi; + u_int32_t uid, gid; int size, offset = 0, len = 0, ret; unsigned char *data; @@ -1365,6 +1381,18 @@ int nfq_snprintf_xml(char *buf, size_t rem, struct nfq_data *tb, int flags) SNPRINTF_FAILURE(size, rem, offset, len); } + uid = nfq_get_uid(tb); + if (uid && (flags & NFQ_XML_UID)) { + size = snprintf(buf + offset, rem, "<uid>%u</uid>", uid); + SNPRINTF_FAILURE(size, rem, offset, len); + } + + gid = nfq_get_gid(tb); + if (gid && (flags & NFQ_XML_GID)) { + size = snprintf(buf + offset, rem, "<gid>%u</gid>", gid); + SNPRINTF_FAILURE(size, rem, offset, len); + } + ret = nfq_get_payload(tb, &data); if (ret >= 0 && (flags & NFQ_XML_PAYLOAD)) { int i; diff --git a/src/nlmsg.c b/src/nlmsg.c index e7a30e0..81e170e 100644 --- a/src/nlmsg.c +++ b/src/nlmsg.c @@ -134,6 +134,8 @@ static int nfq_pkt_parse_attr_cb(const struct nlattr *attr, void *data) case NFQA_IFINDEX_PHYSOUTDEV: case NFQA_CAP_LEN: case NFQA_SKB_INFO: + case NFQA_UID: + case NFQA_GID: if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) return MNL_CB_ERROR; break; -- 1.8.5.1 ^ permalink raw reply related [flat|nested] 9+ messages in thread
end of thread, other threads:[~2013-12-20 12:06 UTC | newest] Thread overview: 9+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2013-12-19 11:03 [PATCH v2 0/2] Add UID/GID info to NFQUEUE valentina.giusti 2013-12-19 11:03 ` [PATCH v2 1/2] netfilter_queue: enable UID/GID socket info retrieval valentina.giusti 2013-12-19 11:43 ` Florian Westphal 2013-12-20 9:26 ` Pablo Neira Ayuso 2013-12-20 9:29 ` Pablo Neira Ayuso 2013-12-20 9:45 ` Valentina Giusti 2013-12-20 11:18 ` Valentina Giusti 2013-12-20 12:06 ` Florian Westphal 2013-12-19 11:03 ` [PATCH v2 2/2] libnetfilter_queue: add support for UID/GID socket info valentina.giusti
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.