From 46912f1c18e01b63660a56ea7d9c572741e06117 Mon Sep 17 00:00:00 2001 From: Roman Kubiak Date: Tue, 16 Jun 2015 18:14:47 +0200 Subject: src: add security context information This commit adds security context information structures and functions. This will allow userspace to find the security context of each packet (if it exists) and make decisions based on that. It should work for SELinux and SMACK. Signed-off-by: Roman Kubiak Signed-off-by: Pablo Neira Ayuso --- src/libnetfilter_queue.c | 23 +++++++++++++++++++++++ src/nlmsg.c | 1 + 2 files changed, 24 insertions(+) (limited to 'src') diff --git a/src/libnetfilter_queue.c b/src/libnetfilter_queue.c index c9ed865..84184ee 100644 --- a/src/libnetfilter_queue.c +++ b/src/libnetfilter_queue.c @@ -1218,6 +1218,29 @@ int nfq_get_gid(struct nfq_data *nfad, uint32_t *gid) } EXPORT_SYMBOL(nfq_get_gid); + +/** + * nfq_get_secctx - get the security context for this packet + * \param nfad Netlink packet data handle passed to callback function + * \param secdata data to write the security context to + * + * \return -1 on error, otherwise > 0 + */ +int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata) +{ + if (!nfnl_attr_present(nfad->data, NFQA_SECCTX)) + return -1; + + *secdata = (unsigned char *)nfnl_get_pointer_to_data(nfad->data, + NFQA_SECCTX, char); + + if (*secdata) + return NFA_PAYLOAD(nfad->data[NFQA_SECCTX-1]); + + return 0; +} +EXPORT_SYMBOL(nfq_get_secctx); + /** * nfq_get_payload - get payload * \param nfad Netlink packet data handle passed to callback function diff --git a/src/nlmsg.c b/src/nlmsg.c index aebdd5e..cabd8be 100644 --- a/src/nlmsg.c +++ b/src/nlmsg.c @@ -137,6 +137,7 @@ static int nfq_pkt_parse_attr_cb(const struct nlattr *attr, void *data) case NFQA_IFINDEX_PHYSOUTDEV: case NFQA_CAP_LEN: case NFQA_SKB_INFO: + case NFQA_SECCTX: case NFQA_UID: case NFQA_GID: if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) -- cgit v1.2.3