Skip to contentSkip to conversation

libnetfitler_queue: receive security context info

PATCH In review Roman Kubiak 3 participants 4 messages May 25, 2015 – May 27, 2015 netfilter

lore
Share & tools
lore

Roman Kubiak

author
#0 lore raw

PATCH 1/1 libnetfitler_queue: receive security context info

From: RomanKubiak <[email protected]>
Date: Mon, 25 May 2015 12:24:34 +0200
Subject: [PATCH] libnetfitler_queue: receive security context info

This will allow userspace to find the security context of each packet (if it exists) and make decisions based on that. It should work for SELinux and SMACK.

---
 include/libnetfilter_queue/libnetfilter_queue.h    |  2 ++
 include/libnetfilter_queue/linux_nfnetlink_queue.h |  4 +++-
 include/linux/netfilter/nfnetlink_queue.h          |  4 +++-
 src/libnetfilter_queue.c                           | 18 ++++++++++++++++++
 utils/nfqnl_test.c                                 | 11 ++++++++++-
 5 files changed, 36 insertions(+), 3 deletions(-)
include/libnetfilter_queue/libnetfilter_queue.h +2 -0
index 122cd10..489e76d 100644
@@ -105,6 +105,7 @@ extern u_int32_t nfq_get_outdev(struct nfq_data *nfad);
 extern u_int32_t nfq_get_physoutdev(struct nfq_data *nfad);
 extern int nfq_get_uid(struct nfq_data *nfad, u_int32_t *uid);
 extern int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid);
+extern int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata);
 
 extern int nfq_get_indev_name(struct nlif_handle *nlif_handle,
 			      struct nfq_data *nfad, char *name);

@@ -129,6 +130,7 @@ enum {
 	NFQ_XML_TIME	= (1 << 5),
 	NFQ_XML_UID	= (1 << 6),
 	NFQ_XML_GID	= (1 << 7),
+	NFQ_XML_SECCTX  = (1 << 8),
 	NFQ_XML_ALL	= ~0U,
 };
include/libnetfilter_queue/linux_nfnetlink_queue.h +3 -1
index f732201..479faa3 100644
@@ -52,6 +52,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -105,7 +106,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK		(1 << 1)
 #define NFQA_CFG_F_GSO			(1 << 2)
 #define NFQA_CFG_F_UID_GID		(1 << 3)
-#define NFQA_CFG_F_MAX			(1 << 4)
+#define NFQA_CFG_F_SECCTX		(1 << 4)
+#define NFQA_CFG_F_MAX			(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
include/linux/netfilter/nfnetlink_queue.h +3 -1
index 22f5d45..030672d 100644
@@ -49,6 +49,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -102,7 +103,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK			(1 << 1)
 #define NFQA_CFG_F_GSO				(1 << 2)
 #define NFQA_CFG_F_UID_GID			(1 << 3)
-#define NFQA_CFG_F_MAX				(1 << 4)
+#define NFQA_CFG_F_SECCTX			(1 << 4)
+#define NFQA_CFG_F_MAX				(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
src/libnetfilter_queue.c +18 -0
index 740b340..9356e3d 100644
@@ -1219,6 +1219,24 @@ int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid)
 EXPORT_SYMBOL(nfq_get_gid);
 
 /**
+ * nfq_get_secctx - get the security context for this packet
+ * \param nfad Netlink packet data handle passed to callback function
+ * \param secdata data to write the security context to
+ *
+ * \return 1 if there is a security context available, 0 otherwise
+ */
+int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata)
+{
+	if (!nfnl_attr_present(nfad->data, NFQA_SECCTX))
+		return 0;
+
+	*secdata = (unsigned char *)nfnl_get_pointer_to_data(nfad->data, NFQA_SECCTX, char);
+
+	return 1;
+}
+EXPORT_SYMBOL(nfq_get_secctx);
+
+/**
  * nfq_get_payload - get payload 
  * \param nfad Netlink packet data handle passed to callback function
  * \param data Pointer of pointer that will be pointed to the payload
utils/nfqnl_test.c +10 -1
index 2176a61..9538fee 100644
@@ -17,7 +17,7 @@ static u_int32_t print_pkt (struct nfq_data *tb)
 	struct nfqnl_msg_packet_hw *hwph;
 	u_int32_t mark, ifi, uid, gid;
 	int ret;
-	unsigned char *data;
+	unsigned char *data, *secdata;
 
 	ph = nfq_get_msg_packet_hdr(tb);
 	if (ph) {

@@ -61,6 +61,9 @@ static u_int32_t print_pkt (struct nfq_data *tb)
 	if (nfq_get_gid(tb, &gid))
 		printf("gid=%u ", gid);
 
+	if (nfq_get_secctx(tb, &secdata))
+		printf ("secctx=\"%s\" ", secdata);
+
 	ret = nfq_get_payload(tb, &data);
 	if (ret >= 0)
 		printf("payload_len=%d ", ret);

@@ -134,6 +137,12 @@ int main(int argc, char **argv)
 				"retrieve process UID/GID.\n");
 	}
 
+	printf("setting flags to request security context\n");
+	if (nfq_set_queue_flags(qh, NFQA_CFG_F_SECCTX, NFQA_CFG_F_SECCTX)) {
+		fprintf(stderr, "This kernel version does not allow to "
+				"retrieve security context.\n");
+	}
+
 	printf("Waiting for packets...\n");
 
 	fd = nfq_fd(h);
Signature · 1 line
1.9.1
maintainer
#1 lore raw
Quoted 92 lines · Roman Kubiak

From: RomanKubiak <[email protected]>
Date: Mon, 25 May 2015 12:24:34 +0200
Subject: [PATCH] libnetfitler_queue: receive security context info

This will allow userspace to find the security context of each packet (if it exists) and make decisions based on that. It should work for SELinux and SMACK.

---
 include/libnetfilter_queue/libnetfilter_queue.h    |  2 ++
 include/libnetfilter_queue/linux_nfnetlink_queue.h |  4 +++-
 include/linux/netfilter/nfnetlink_queue.h          |  4 +++-
 src/libnetfilter_queue.c                           | 18 ++++++++++++++++++
 utils/nfqnl_test.c                                 | 11 ++++++++++-
 5 files changed, 36 insertions(+), 3 deletions(-)
include/libnetfilter_queue/libnetfilter_queue.h +2 -0
index 122cd10..489e76d 100644
@@ -105,6 +105,7 @@ extern u_int32_t nfq_get_outdev(struct nfq_data *nfad);
 extern u_int32_t nfq_get_physoutdev(struct nfq_data *nfad);
 extern int nfq_get_uid(struct nfq_data *nfad, u_int32_t *uid);
 extern int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid);
+extern int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata);
 
 extern int nfq_get_indev_name(struct nlif_handle *nlif_handle,
 			      struct nfq_data *nfad, char *name);

@@ -129,6 +130,7 @@ enum {
 	NFQ_XML_TIME	= (1 << 5),
 	NFQ_XML_UID	= (1 << 6),
 	NFQ_XML_GID	= (1 << 7),
+	NFQ_XML_SECCTX  = (1 << 8),
 	NFQ_XML_ALL	= ~0U,
 };
include/libnetfilter_queue/linux_nfnetlink_queue.h +3 -1
index f732201..479faa3 100644
@@ -52,6 +52,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -105,7 +106,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK		(1 << 1)
 #define NFQA_CFG_F_GSO			(1 << 2)
 #define NFQA_CFG_F_UID_GID		(1 << 3)
-#define NFQA_CFG_F_MAX			(1 << 4)
+#define NFQA_CFG_F_SECCTX		(1 << 4)
+#define NFQA_CFG_F_MAX			(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
include/linux/netfilter/nfnetlink_queue.h +3 -1
index 22f5d45..030672d 100644
@@ -49,6 +49,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -102,7 +103,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK			(1 << 1)
 #define NFQA_CFG_F_GSO				(1 << 2)
 #define NFQA_CFG_F_UID_GID			(1 << 3)
-#define NFQA_CFG_F_MAX				(1 << 4)
+#define NFQA_CFG_F_SECCTX			(1 << 4)
+#define NFQA_CFG_F_MAX				(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
src/libnetfilter_queue.c +4 -0
index 740b340..9356e3d 100644
@@ -1219,6 +1219,24 @@ int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid)
 EXPORT_SYMBOL(nfq_get_gid);
 
 /**
+ * nfq_get_secctx - get the security context for this packet
+ * \param nfad Netlink packet data handle passed to callback function
+ * \param secdata data to write the security context to
+ *

src/libnetfilter_queue.c int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid) · line 1235

Quoted 10 lines
src/libnetfilter_queue.c +10 -0
+ * \return 1 if there is a security context available, 0 otherwise
+ */
+int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata)
+{
+	if (!nfnl_attr_present(nfad->data, NFQA_SECCTX))
+		return 0;
+
+	*secdata = (unsigned char *)nfnl_get_pointer_to_data(nfad->data, NFQA_SECCTX, char);
+
+	return 1;

This should return the attr size, see nfq_get_payload() below on how to do this.

It would be nice if you could add libmnl based version too (src/nlmsg.c contains libmnl api of libnetfilter_queue).

The short version is that libnfnetlink has problems wrt. extensibility/flexibility since it hides netlink details.

libmnl exposes all of the netlink data so its more flexible to add functionality on top of libmnl than on top of libnfnetlink.

And on top of that, libnetfilter_queue libnfnetlink api exposes/leaks implementation details of libnfnetlink so we can't replace libnfnetlink with libmnl in the higer level libraries :-(

author
#2 lore raw

Ok so I updated the libnetfilter_queue and the example, i'll try to get to the libmnl asap but it looks a bit more challenging.

This will allow userspace to find the security context of each packet (if it exists) and make decisions based on that. It should work for SELinux and SMACK.

Signed-off-by Roman Kubiak <[email protected]>

---
v2:
- returning the size of security context
- updated the test program

---
 include/libnetfilter_queue/libnetfilter_queue.h    |  2 ++
 include/libnetfilter_queue/linux_nfnetlink_queue.h |  4 +++-
 include/linux/netfilter/nfnetlink_queue.h          |  4 +++-
 src/libnetfilter_queue.c                           | 21 +++++++++++++++++++++
 utils/nfqnl_test.c                                 | 12 +++++++++++-
 5 files changed, 40 insertions(+), 3 deletions(-)
include/libnetfilter_queue/libnetfilter_queue.h +2 -0
index 122cd10..489e76d 100644
@@ -105,6 +105,7 @@ extern u_int32_t nfq_get_outdev(struct nfq_data *nfad);
 extern u_int32_t nfq_get_physoutdev(struct nfq_data *nfad);
 extern int nfq_get_uid(struct nfq_data *nfad, u_int32_t *uid);
 extern int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid);
+extern int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata);
 
 extern int nfq_get_indev_name(struct nlif_handle *nlif_handle,
 			      struct nfq_data *nfad, char *name);

@@ -129,6 +130,7 @@ enum {
 	NFQ_XML_TIME	= (1 << 5),
 	NFQ_XML_UID	= (1 << 6),
 	NFQ_XML_GID	= (1 << 7),
+	NFQ_XML_SECCTX  = (1 << 8),
 	NFQ_XML_ALL	= ~0U,
 };
include/libnetfilter_queue/linux_nfnetlink_queue.h +3 -1
index f732201..479faa3 100644
@@ -52,6 +52,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -105,7 +106,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK		(1 << 1)
 #define NFQA_CFG_F_GSO			(1 << 2)
 #define NFQA_CFG_F_UID_GID		(1 << 3)
-#define NFQA_CFG_F_MAX			(1 << 4)
+#define NFQA_CFG_F_SECCTX		(1 << 4)
+#define NFQA_CFG_F_MAX			(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
include/linux/netfilter/nfnetlink_queue.h +3 -1
index 22f5d45..030672d 100644
@@ -49,6 +49,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -102,7 +103,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK			(1 << 1)
 #define NFQA_CFG_F_GSO				(1 << 2)
 #define NFQA_CFG_F_UID_GID			(1 << 3)
-#define NFQA_CFG_F_MAX				(1 << 4)
+#define NFQA_CFG_F_SECCTX			(1 << 4)
+#define NFQA_CFG_F_MAX				(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
src/libnetfilter_queue.c +21 -0
index 740b340..530df06 100644
@@ -1219,6 +1219,27 @@ int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid)
 EXPORT_SYMBOL(nfq_get_gid);
 
 /**
+ * nfq_get_secctx - get the security context for this packet
+ * \param nfad Netlink packet data handle passed to callback function
+ * \param secdata data to write the security context to
+ *
+ * \return -1 on error, otherwise > 0
+ */
+int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata)
+{
+	if (!nfnl_attr_present(nfad->data, NFQA_SECCTX))
+		return -1;
+
+	*secdata = (unsigned char *)nfnl_get_pointer_to_data(nfad->data, NFQA_SECCTX, char);
+
+	if (*secdata)
+		return NFA_PAYLOAD(nfad->data[NFQA_SECCTX-1]);
+		
+	return 0;
+}
+EXPORT_SYMBOL(nfq_get_secctx);
+
+/**
  * nfq_get_payload - get payload 
  * \param nfad Netlink packet data handle passed to callback function
  * \param data Pointer of pointer that will be pointed to the payload
utils/nfqnl_test.c +11 -1
index 2176a61..bee325b 100644
@@ -17,7 +17,7 @@ static u_int32_t print_pkt (struct nfq_data *tb)
 	struct nfqnl_msg_packet_hw *hwph;
 	u_int32_t mark, ifi, uid, gid;
 	int ret;
-	unsigned char *data;
+	unsigned char *data, *secdata;
 
 	ph = nfq_get_msg_packet_hdr(tb);
 	if (ph) {

@@ -61,6 +61,10 @@ static u_int32_t print_pkt (struct nfq_data *tb)
 	if (nfq_get_gid(tb, &gid))
 		printf("gid=%u ", gid);
 
+	ret = nfq_get_secctx(tb, &secdata);
+	if (ret > 0)
+		printf ("secctx=\"%.*s\" ", ret, secdata);
+
 	ret = nfq_get_payload(tb, &data);
 	if (ret >= 0)
 		printf("payload_len=%d ", ret);

@@ -134,6 +138,12 @@ int main(int argc, char **argv)
 				"retrieve process UID/GID.\n");
 	}
 
+	printf("setting flags to request security context\n");
+	if (nfq_set_queue_flags(qh, NFQA_CFG_F_SECCTX, NFQA_CFG_F_SECCTX)) {
+		fprintf(stderr, "This kernel version does not allow to "
+				"retrieve security context.\n");
+	}
+
 	printf("Waiting for packets...\n");
 
 	fd = nfq_fd(h);
Signature · 1 line
1.9.1
Quoted 121 lines · Florian Westphal
Quoted 92 lines · Roman Kubiak

From: RomanKubiak <[email protected]>
Date: Mon, 25 May 2015 12:24:34 +0200
Subject: [PATCH] libnetfitler_queue: receive security context info

This will allow userspace to find the security context of each packet (if it exists) and make decisions based on that. It should work for SELinux and SMACK.

---
 include/libnetfilter_queue/libnetfilter_queue.h    |  2 ++
 include/libnetfilter_queue/linux_nfnetlink_queue.h |  4 +++-
 include/linux/netfilter/nfnetlink_queue.h          |  4 +++-
 src/libnetfilter_queue.c                           | 18 ++++++++++++++++++
 utils/nfqnl_test.c                                 | 11 ++++++++++-
 5 files changed, 36 insertions(+), 3 deletions(-)
include/libnetfilter_queue/libnetfilter_queue.h +2 -0
index 122cd10..489e76d 100644
@@ -105,6 +105,7 @@ extern u_int32_t nfq_get_outdev(struct nfq_data *nfad);
 extern u_int32_t nfq_get_physoutdev(struct nfq_data *nfad);
 extern int nfq_get_uid(struct nfq_data *nfad, u_int32_t *uid);
 extern int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid);
+extern int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata);
 
 extern int nfq_get_indev_name(struct nlif_handle *nlif_handle,
 			      struct nfq_data *nfad, char *name);

@@ -129,6 +130,7 @@ enum {
 	NFQ_XML_TIME	= (1 << 5),
 	NFQ_XML_UID	= (1 << 6),
 	NFQ_XML_GID	= (1 << 7),
+	NFQ_XML_SECCTX  = (1 << 8),
 	NFQ_XML_ALL	= ~0U,
 };
include/libnetfilter_queue/linux_nfnetlink_queue.h +3 -1
index f732201..479faa3 100644
@@ -52,6 +52,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -105,7 +106,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK		(1 << 1)
 #define NFQA_CFG_F_GSO			(1 << 2)
 #define NFQA_CFG_F_UID_GID		(1 << 3)
-#define NFQA_CFG_F_MAX			(1 << 4)
+#define NFQA_CFG_F_SECCTX		(1 << 4)
+#define NFQA_CFG_F_MAX			(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
include/linux/netfilter/nfnetlink_queue.h +3 -1
index 22f5d45..030672d 100644
@@ -49,6 +49,7 @@ enum nfqnl_attr_type {
 	NFQA_EXP,			/* nf_conntrack_netlink.h */
 	NFQA_UID,			/* __u32 sk uid */
 	NFQA_GID,			/* __u32 sk gid */
+	NFQA_SECCTX,
 
 	__NFQA_MAX
 };

@@ -102,7 +103,8 @@ enum nfqnl_attr_config {
 #define NFQA_CFG_F_CONNTRACK			(1 << 1)
 #define NFQA_CFG_F_GSO				(1 << 2)
 #define NFQA_CFG_F_UID_GID			(1 << 3)
-#define NFQA_CFG_F_MAX				(1 << 4)
+#define NFQA_CFG_F_SECCTX			(1 << 4)
+#define NFQA_CFG_F_MAX				(1 << 5)
 
 /* flags for NFQA_SKB_INFO */
 /* packet appears to have wrong checksums, but they are ok */
src/libnetfilter_queue.c +4 -0
index 740b340..9356e3d 100644
@@ -1219,6 +1219,24 @@ int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid)
 EXPORT_SYMBOL(nfq_get_gid);
 
 /**
+ * nfq_get_secctx - get the security context for this packet
+ * \param nfad Netlink packet data handle passed to callback function
+ * \param secdata data to write the security context to
+ *

src/libnetfilter_queue.c int nfq_get_gid(struct nfq_data *nfad, u_int32_t *gid) · line 1235

Quoted 10 lines
src/libnetfilter_queue.c +10 -0
+ * \return 1 if there is a security context available, 0 otherwise
+ */
+int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata)
+{
+	if (!nfnl_attr_present(nfad->data, NFQA_SECCTX))
+		return 0;
+
+	*secdata = (unsigned char *)nfnl_get_pointer_to_data(nfad->data, NFQA_SECCTX, char);
+
+	return 1;

This should return the attr size, see nfq_get_payload() below on how to do this.

It would be nice if you could add libmnl based version too (src/nlmsg.c contains libmnl api of libnetfilter_queue).

The short version is that libnfnetlink has problems wrt. extensibility/flexibility since it hides netlink details.

libmnl exposes all of the netlink data so its more flexible to add functionality on top of libmnl than on top of libnfnetlink.

And on top of that, libnetfilter_queue libnfnetlink api exposes/leaks implementation details of libnfnetlink so we can't replace libnfnetlink with libmnl in the higer level libraries :-(

Signature · 3 lines
--------------
 Roman Kubiak
--------------
maintainer
#3 lore raw
Quoted 2 lines · Roman Kubiak

Ok so I updated the libnetfilter_queue and the example, i'll try to get to the libmnl asap but it looks a bit more challenging.

The libmnl change is a very important part of this library, so you have to send us a patch for that too.

Thanks.