netdev - PF_PACKET or nfnetlink logging of skb->priority

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 18 Feb 2009 15:51:48 -0500
From:	Jeremy Jackson <jerj@...lanar.net>
To:	netdev@...r.kernel.org
Subject: PF_PACKET or nfnetlink logging of skb->priority

It seems that there is nothing that can capture the skb->priority
outside the kernel. 

There is an iptables *target* "CLASSIFY", which can *set* skb->priority,
but there is no iptables *match* based on it.

tcpdump/pcap/PF_PACKET are oblivious to skb->priority.

netfilter netlink queue can export the skb->mark like the right
mechanism, but it doesn't touch skb->priority anywhere.   Perhaps there
needs to be a another one in include/linux/netfilter/nfnetlink_queue.h:

enum nfqnl_attr_type {
        NFQA_UNSPEC,
        NFQA_PACKET_HDR,
        NFQA_VERDICT_HDR,               /* nfqnl_msg_verdict_hrd */
        NFQA_MARK,   
... etc
	NFQA_SKBPRIORITY

The specific use I'm thinking of now, is troubleshooting priority
queueing with "tc" by being able to log or tcpdump traffic for a
specific qdisc/class.

It might also be nice to be able to tcpdump and/or log packets going
into or out of a specific qdisc/class, but I'd settle for dumping
packets based on skb->priority.

-- 
Jeremy Jackson
Coplanar Networks
(519)489-4903
http://www.coplanar.net
jerj@...lanar.net

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html