]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/ipv6/netfilter/ip6t_owner.c
1 /* Kernel module to match various things tied to sockets associated with
2 locally generated outgoing packets. */
4 /* (C) 2000-2001 Marc Boucher <marc@mbsi.ca>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/file.h>
16 #include <linux/netfilter_ipv6/ip6t_owner.h>
17 #include <linux/netfilter_ipv6/ip6_tables.h>
19 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
20 MODULE_DESCRIPTION("IP6 tables owner matching module");
21 MODULE_LICENSE("GPL");
24 match_pid(const struct sk_buff
*skb
, pid_t pid
)
26 struct task_struct
*p
;
27 struct files_struct
*files
;
30 read_lock(&tasklist_lock
);
31 p
= find_task_by_pid(pid
);
37 spin_lock(&files
->file_lock
);
38 for (i
=0; i
< files
->max_fds
; i
++) {
39 if (fcheck_files(files
, i
) == skb
->sk
->sk_socket
->file
) {
40 spin_unlock(&files
->file_lock
);
42 read_unlock(&tasklist_lock
);
46 spin_unlock(&files
->file_lock
);
50 read_unlock(&tasklist_lock
);
55 match_sid(const struct sk_buff
*skb
, pid_t sid
)
57 struct task_struct
*g
, *p
;
58 struct file
*file
= skb
->sk
->sk_socket
->file
;
61 read_lock(&tasklist_lock
);
62 do_each_thread(g
, p
) {
63 struct files_struct
*files
;
64 if (p
->signal
->session
!= sid
)
70 spin_lock(&files
->file_lock
);
71 for (i
=0; i
< files
->max_fds
; i
++) {
72 if (fcheck_files(files
, i
) == file
) {
77 spin_unlock(&files
->file_lock
);
82 } while_each_thread(g
, p
);
84 read_unlock(&tasklist_lock
);
90 match(const struct sk_buff
*skb
,
91 const struct net_device
*in
,
92 const struct net_device
*out
,
93 const void *matchinfo
,
98 const struct ip6t_owner_info
*info
= matchinfo
;
100 if (!skb
->sk
|| !skb
->sk
->sk_socket
|| !skb
->sk
->sk_socket
->file
)
103 if(info
->match
& IP6T_OWNER_UID
) {
104 if((skb
->sk
->sk_socket
->file
->f_uid
!= info
->uid
) ^
105 !!(info
->invert
& IP6T_OWNER_UID
))
109 if(info
->match
& IP6T_OWNER_GID
) {
110 if((skb
->sk
->sk_socket
->file
->f_gid
!= info
->gid
) ^
111 !!(info
->invert
& IP6T_OWNER_GID
))
115 if(info
->match
& IP6T_OWNER_PID
) {
116 if (!match_pid(skb
, info
->pid
) ^
117 !!(info
->invert
& IP6T_OWNER_PID
))
121 if(info
->match
& IP6T_OWNER_SID
) {
122 if (!match_sid(skb
, info
->sid
) ^
123 !!(info
->invert
& IP6T_OWNER_SID
))
131 checkentry(const char *tablename
,
132 const struct ip6t_ip6
*ip
,
134 unsigned int matchsize
,
135 unsigned int hook_mask
)
138 & ~((1 << NF_IP6_LOCAL_OUT
) | (1 << NF_IP6_POST_ROUTING
))) {
139 printk("ip6t_owner: only valid for LOCAL_OUT or POST_ROUTING.\n");
143 if (matchsize
!= IP6T_ALIGN(sizeof(struct ip6t_owner_info
)))
146 /* files->file_lock can not be used in a BH */
147 if (((struct ip6t_owner_info
*)matchinfo
)->match
148 & (IP6T_OWNER_PID
|IP6T_OWNER_SID
)) {
149 printk("ip6t_owner: pid and sid matching is broken on SMP.\n");
156 static struct ip6t_match owner_match
= {
159 .checkentry
= &checkentry
,
163 static int __init
init(void)
165 return ip6t_register_match(&owner_match
);
168 static void __exit
fini(void)
170 ip6t_unregister_match(&owner_match
);