This patch adds an additional attribute when sending packet information via netlink in netfilter_queue module. It will send additional security context data, so that userspace applications can verify this context against their own security databases.
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -49,6 +49,7 @@ enum nfqnl_attr_type { · 48 unmodified lines | ||
| 49 | 49 | NFQA_EXP, /* nf_conntrack_netlink.h */ |
| 50 | 50 | NFQA_UID, /* __u32 sk uid */ |
| 51 | 51 | NFQA_GID, /* __u32 sk gid */ |
| 52 | + NFQA_SECCTX, /* security context string */ | |
| 52 | 53 | |
| 53 | 54 | __NFQA_MAX |
| 54 | 55 | }; |
| @@ -102,7 +103,8 @@ enum nfqnl_attr_config { · 47 unmodified lines | ||
| 102 | 103 | #define NFQA_CFG_F_CONNTRACK (1 << 1) |
| 103 | 104 | #define NFQA_CFG_F_GSO (1 << 2) |
| 104 | 105 | #define NFQA_CFG_F_UID_GID (1 << 3) |
| 105 | −#define NFQA_CFG_F_MAX (1 << 4) | |
| 106 | +#define NFQA_CFG_F_SECCTX (1 << 4) | |
| 107 | +#define NFQA_CFG_F_MAX (1 << 5) | |
| 106 | 108 | |
| 107 | 109 | /* flags for NFQA_SKB_INFO */ |
| 108 | 110 | /* packet appears to have wrong checksums, but they are ok */ |