linux-kernel - LSM hooks: which to use? .socket_sock_rcv_skb or .socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sat, 5 Mar 2011 16:25:35 +0200
From:	Igor 'Lo' (И.L.) <bombsiteunrested@...il.com>
To:	linux-kernel@...r.kernel.org
Subject: LSM hooks: which to use? .socket_sock_rcv_skb or .socket_sendmsg?

Hi all.

I need to capture outgoing TCP packet and modify it using LSM
framework (and not Netfilter).

First, which hooks will work for outgoing packets, preferably before
Netfilter comes in play (actually there was a note that some LSM hooks
reuse Netfilter's, but don't know the right order)?

Second, can .socket_sendmsg provide the access to structures
containing both packet payload and TCP header? Does even
.socket_sock_rcv_skb provide those structures via some skb?

/* It's the old story about trying to modify packet size so they got
larger that IP fragmentation limit and get another set of SEQ/ACK,
that is almost broken behind documentation in default NFQUEUE target
and makes me to successfully lurk with tcp_output.c hacks rather than
wishing to write NF modules. (TCPOPTSTRIP target is next to explore,
but first want to get the best joy of System.map and LSM tricks) */
-- 
cheers,
Igor
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/