Thanks to commits 41063e9 (ipv4: Early TCP socket demux) and 421b388 (udp: ipv4: Add udp early demux) it is now possible to parse UID and GID socket info also for incoming TCP and UDP connections. Having this info available, it is convenient to let NFQUEUE parse it in order to improve and refine the traffic analysis in userspace.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -47,6 +47,8 @@ enum nfqnl_attr_type { · 46 unmodified lines | ||
| 47 | 47 | NFQA_CAP_LEN, /* __u32 length of captured packet */ |
| 48 | 48 | NFQA_SKB_INFO, /* __u32 skb meta information */ |
| 49 | 49 | NFQA_EXP, /* nf_conntrack_netlink.h */ |
| 50 | + NFQA_UID, /* __u32 sk uid */ | |
| 51 | + NFQA_GID, /* __u32 sk gid */ | |
| 50 | 52 | |
| 51 | 53 | __NFQA_MAX |
| 52 | 54 | }; |
| @@ -99,7 +101,8 @@ enum nfqnl_attr_config { · 46 unmodified lines | ||
| 99 | 101 | #define NFQA_CFG_F_FAIL_OPEN (1 << 0) |
| 100 | 102 | #define NFQA_CFG_F_CONNTRACK (1 << 1) |
| 101 | 103 | #define NFQA_CFG_F_GSO (1 << 2) |
| 102 | −#define NFQA_CFG_F_MAX (1 << 3) | |
| 104 | +#define NFQA_CFG_F_UID_GID (1 << 3) | |
| 105 | +#define NFQA_CFG_F_MAX (1 << 4) | |
| 103 | 106 | |
| 104 | 107 | /* flags for NFQA_SKB_INFO */ |
| 105 | 108 | /* packet appears to have wrong checksums, but they are ok */ |