]>
git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/netfilter/xt_cgroup.c
2 * Xtables module to match the process control group.
4 * Might be used to implement individual "per-application" firewall
5 * policies in contrast to global policies based on control groups.
6 * Matching is based upon processes tagged to net_cls' classid marker.
8 * (C) 2013 Daniel Borkmann <dborkman@redhat.com>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
15 #include <linux/skbuff.h>
16 #include <linux/module.h>
17 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter/xt_cgroup.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>");
23 MODULE_DESCRIPTION("Xtables: process control group matching");
24 MODULE_ALIAS("ipt_cgroup");
25 MODULE_ALIAS("ip6t_cgroup");
27 static int cgroup_mt_check_v0(const struct xt_mtchk_param
*par
)
29 struct xt_cgroup_info_v0
*info
= par
->matchinfo
;
31 if (info
->invert
& ~1)
37 static int cgroup_mt_check_v1(const struct xt_mtchk_param
*par
)
39 struct xt_cgroup_info_v1
*info
= par
->matchinfo
;
42 if ((info
->invert_path
& ~1) || (info
->invert_classid
& ~1))
45 if (!info
->has_path
&& !info
->has_classid
) {
46 pr_info("xt_cgroup: no path or classid specified\n");
50 if (info
->has_path
&& info
->has_classid
) {
51 pr_info("xt_cgroup: both path and classid specified\n");
57 cgrp
= cgroup_get_from_path(info
->path
);
59 pr_info("xt_cgroup: invalid path, errno=%ld\n",
69 static int cgroup_mt_check_v2(const struct xt_mtchk_param
*par
)
71 struct xt_cgroup_info_v2
*info
= par
->matchinfo
;
74 if ((info
->invert_path
& ~1) || (info
->invert_classid
& ~1))
77 if (!info
->has_path
&& !info
->has_classid
) {
78 pr_info("xt_cgroup: no path or classid specified\n");
82 if (info
->has_path
&& info
->has_classid
) {
83 pr_info_ratelimited("path and classid specified\n");
89 cgrp
= cgroup_get_from_path(info
->path
);
91 pr_info_ratelimited("invalid path, errno=%ld\n",
102 cgroup_mt_v0(const struct sk_buff
*skb
, struct xt_action_param
*par
)
104 const struct xt_cgroup_info_v0
*info
= par
->matchinfo
;
106 if (skb
->sk
== NULL
|| !sk_fullsock(skb
->sk
))
109 return (info
->id
== sock_cgroup_classid(&skb
->sk
->sk_cgrp_data
)) ^
113 static bool cgroup_mt_v1(const struct sk_buff
*skb
, struct xt_action_param
*par
)
115 const struct xt_cgroup_info_v1
*info
= par
->matchinfo
;
116 struct sock_cgroup_data
*skcd
= &skb
->sk
->sk_cgrp_data
;
117 struct cgroup
*ancestor
= info
->priv
;
119 if (!skb
->sk
|| !sk_fullsock(skb
->sk
))
123 return cgroup_is_descendant(sock_cgroup_ptr(skcd
), ancestor
) ^
126 return (info
->classid
== sock_cgroup_classid(skcd
)) ^
127 info
->invert_classid
;
130 static bool cgroup_mt_v2(const struct sk_buff
*skb
, struct xt_action_param
*par
)
132 const struct xt_cgroup_info_v2
*info
= par
->matchinfo
;
133 struct sock_cgroup_data
*skcd
= &skb
->sk
->sk_cgrp_data
;
134 struct cgroup
*ancestor
= info
->priv
;
135 struct sock
*sk
= skb
->sk
;
137 if (!sk
|| !sk_fullsock(sk
) || !net_eq(xt_net(par
), sock_net(sk
)))
141 return cgroup_is_descendant(sock_cgroup_ptr(skcd
), ancestor
) ^
144 return (info
->classid
== sock_cgroup_classid(skcd
)) ^
145 info
->invert_classid
;
148 static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param
*par
)
150 struct xt_cgroup_info_v1
*info
= par
->matchinfo
;
153 cgroup_put(info
->priv
);
156 static void cgroup_mt_destroy_v2(const struct xt_mtdtor_param
*par
)
158 struct xt_cgroup_info_v2
*info
= par
->matchinfo
;
161 cgroup_put(info
->priv
);
164 static struct xt_match cgroup_mt_reg
[] __read_mostly
= {
168 .family
= NFPROTO_UNSPEC
,
169 .checkentry
= cgroup_mt_check_v0
,
170 .match
= cgroup_mt_v0
,
171 .matchsize
= sizeof(struct xt_cgroup_info_v0
),
173 .hooks
= (1 << NF_INET_LOCAL_OUT
) |
174 (1 << NF_INET_POST_ROUTING
) |
175 (1 << NF_INET_LOCAL_IN
),
180 .family
= NFPROTO_UNSPEC
,
181 .checkentry
= cgroup_mt_check_v1
,
182 .match
= cgroup_mt_v1
,
183 .matchsize
= sizeof(struct xt_cgroup_info_v1
),
184 .usersize
= offsetof(struct xt_cgroup_info_v1
, priv
),
185 .destroy
= cgroup_mt_destroy_v1
,
187 .hooks
= (1 << NF_INET_LOCAL_OUT
) |
188 (1 << NF_INET_POST_ROUTING
) |
189 (1 << NF_INET_LOCAL_IN
),
194 .family
= NFPROTO_UNSPEC
,
195 .checkentry
= cgroup_mt_check_v2
,
196 .match
= cgroup_mt_v2
,
197 .matchsize
= sizeof(struct xt_cgroup_info_v2
),
198 .usersize
= offsetof(struct xt_cgroup_info_v2
, priv
),
199 .destroy
= cgroup_mt_destroy_v2
,
201 .hooks
= (1 << NF_INET_LOCAL_OUT
) |
202 (1 << NF_INET_POST_ROUTING
) |
203 (1 << NF_INET_LOCAL_IN
),
207 static int __init
cgroup_mt_init(void)
209 return xt_register_matches(cgroup_mt_reg
, ARRAY_SIZE(cgroup_mt_reg
));
212 static void __exit
cgroup_mt_exit(void)
214 xt_unregister_matches(cgroup_mt_reg
, ARRAY_SIZE(cgroup_mt_reg
));
217 module_init(cgroup_mt_init
);
218 module_exit(cgroup_mt_exit
);