netdev - Re: [PATCH v3 1/2] netfilter_queue: enable UID/GID socket info retrieval

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 20 Dec 2013 16:03:24 +0100
From:	Florian Westphal <fw@...len.de>
To:	Valentina Giusti <valentina.giusti@...-carit.de>
Cc:	Florian Westphal <fw@...len.de>, netfilter-devel@...r.kernel.org,
	netdev@...r.kernel.org, jpa@...gle.com, pablo@...filter.org,
	daniel.wagner@...-carit.de
Subject: Re: [PATCH v3 1/2] netfilter_queue: enable UID/GID socket info
 retrieval

Valentina Giusti <valentina.giusti@...-carit.de> wrote:
> >I think this should be 'return 0'?
> I put return -1 because I think that if userspace has requested to
> receive UID and GID, then it should be dumped only packets that have
> that information available.
> Are you suggesting that it should be otherwise?

Yes, doing that doesn't make sense to me.
And it is inconsitent:
Packets without socket information are queued normally
in your patch, but suddently if its a timewait socket
its an error?

Why would we want timewait packets to NOT be queued?
vs. for example forwarded packets?

Userspace can test for presence of the attributes, i.e.
no NFQA_UID attribute -> no socket present, or lack of uid
information.

If you have a counter-example?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html