This patch adds an additional attribute when sending packet information via netlink in netfilter_queue module. It will send additional security context data, so that userspace applications can verify this context against their own security databases.
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -49,6 +49,7 @@ enum nfqnl_attr_type { · 48 unmodified lines | |||
| 49 | NFQA_EXP, /* nf_conntrack_netlink.h */ | 49 | NFQA_EXP, /* nf_conntrack_netlink.h */ |
| 50 | NFQA_UID, /* __u32 sk uid */ | 50 | NFQA_UID, /* __u32 sk uid */ |
| 51 | NFQA_GID, /* __u32 sk gid */ | 51 | NFQA_GID, /* __u32 sk gid */ |
| 52 | NFQA_SECCTX, /* security context string */ | ||
| 52 | 53 | ||
| 53 | __NFQA_MAX | 54 | __NFQA_MAX |
| 54 | }; | 55 | }; |
| @@ -102,7 +103,8 @@ enum nfqnl_attr_config { · 47 unmodified lines | |||
| 102 | #define NFQA_CFG_F_CONNTRACK (1 << 1) | 103 | #define NFQA_CFG_F_CONNTRACK (1 << 1) |
| 103 | #define NFQA_CFG_F_GSO (1 << 2) | 104 | #define NFQA_CFG_F_GSO (1 << 2) |
| 104 | #define NFQA_CFG_F_UID_GID (1 << 3) | 105 | #define NFQA_CFG_F_UID_GID (1 << 3) |
| 105 | #define NFQA_CFG_F_MAX (1 << 4) | 106 | #define NFQA_CFG_F_SECCTX (1 << 4) |
| 107 | #define NFQA_CFG_F_MAX (1 << 5) | ||
| 106 | 108 | ||
| 107 | /* flags for NFQA_SKB_INFO */ | 109 | /* flags for NFQA_SKB_INFO */ |
| 108 | /* packet appears to have wrong checksums, but they are ok */ | 110 | /* packet appears to have wrong checksums, but they are ok */ |