2 * Xtables module to match the process control group.
4 * Might be used to implement individual "per-application" firewall
5 * policies in contrast to global policies based on control groups.
6 * Matching is based upon processes tagged to net_cls' classid marker.
8 * (C) 2013 Daniel Borkmann <dborkman@redhat.com>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
15 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
17 #include <linux/skbuff.h>
18 #include <linux/module.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter/xt_cgroup.h>
23 MODULE_LICENSE("GPL");
24 MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>");
25 MODULE_DESCRIPTION("Xtables: process control group matching");
26 MODULE_ALIAS("ipt_cgroup");
27 MODULE_ALIAS("ip6t_cgroup");
29 static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
31 struct xt_cgroup_info_v0 *info = par->matchinfo;
33 if (info->invert & ~1)
39 static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
41 struct xt_cgroup_info_v1 *info = par->matchinfo;
44 if ((info->invert_path & ~1) || (info->invert_classid & ~1))
47 if (!info->has_path && !info->has_classid) {
48 pr_info("xt_cgroup: no path or classid specified\n");
52 if (info->has_path && info->has_classid) {
53 pr_info_ratelimited("path and classid specified\n");
59 cgrp = cgroup_get_from_path(info->path);
61 pr_info_ratelimited("invalid path, errno=%ld\n",
71 static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
73 struct xt_cgroup_info_v2 *info = par->matchinfo;
76 if ((info->invert_path & ~1) || (info->invert_classid & ~1))
79 if (!info->has_path && !info->has_classid) {
80 pr_info("xt_cgroup: no path or classid specified\n");
84 if (info->has_path && info->has_classid) {
85 pr_info_ratelimited("path and classid specified\n");
91 cgrp = cgroup_get_from_path(info->path);
93 pr_info_ratelimited("invalid path, errno=%ld\n",
104 cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
106 const struct xt_cgroup_info_v0 *info = par->matchinfo;
107 struct sock *sk = skb->sk;
109 if (!sk || !sk_fullsock(sk) || !net_eq(xt_net(par), sock_net(sk)))
112 return (info->id == sock_cgroup_classid(&skb->sk->sk_cgrp_data)) ^
116 static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
118 const struct xt_cgroup_info_v1 *info = par->matchinfo;
119 struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
120 struct cgroup *ancestor = info->priv;
121 struct sock *sk = skb->sk;
123 if (!sk || !sk_fullsock(sk) || !net_eq(xt_net(par), sock_net(sk)))
127 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
130 return (info->classid == sock_cgroup_classid(skcd)) ^
131 info->invert_classid;
134 static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
136 const struct xt_cgroup_info_v2 *info = par->matchinfo;
137 struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
138 struct cgroup *ancestor = info->priv;
139 struct sock *sk = skb->sk;
141 if (!sk || !sk_fullsock(sk) || !net_eq(xt_net(par), sock_net(sk)))
145 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
148 return (info->classid == sock_cgroup_classid(skcd)) ^
149 info->invert_classid;
152 static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
154 struct xt_cgroup_info_v1 *info = par->matchinfo;
157 cgroup_put(info->priv);
160 static void cgroup_mt_destroy_v2(const struct xt_mtdtor_param *par)
162 struct xt_cgroup_info_v2 *info = par->matchinfo;
165 cgroup_put(info->priv);
168 static struct xt_match cgroup_mt_reg[] __read_mostly = {
172 .family = NFPROTO_UNSPEC,
173 .checkentry = cgroup_mt_check_v0,
174 .match = cgroup_mt_v0,
175 .matchsize = sizeof(struct xt_cgroup_info_v0),
177 .hooks = (1 << NF_INET_LOCAL_OUT) |
178 (1 << NF_INET_POST_ROUTING) |
179 (1 << NF_INET_LOCAL_IN),
184 .family = NFPROTO_UNSPEC,
185 .checkentry = cgroup_mt_check_v1,
186 .match = cgroup_mt_v1,
187 .matchsize = sizeof(struct xt_cgroup_info_v1),
188 .usersize = offsetof(struct xt_cgroup_info_v1, priv),
189 .destroy = cgroup_mt_destroy_v1,
191 .hooks = (1 << NF_INET_LOCAL_OUT) |
192 (1 << NF_INET_POST_ROUTING) |
193 (1 << NF_INET_LOCAL_IN),
198 .family = NFPROTO_UNSPEC,
199 .checkentry = cgroup_mt_check_v2,
200 .match = cgroup_mt_v2,
201 .matchsize = sizeof(struct xt_cgroup_info_v2),
202 .usersize = offsetof(struct xt_cgroup_info_v2, priv),
203 .destroy = cgroup_mt_destroy_v2,
205 .hooks = (1 << NF_INET_LOCAL_OUT) |
206 (1 << NF_INET_POST_ROUTING) |
207 (1 << NF_INET_LOCAL_IN),
211 static int __init cgroup_mt_init(void)
213 return xt_register_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
216 static void __exit cgroup_mt_exit(void)
218 xt_unregister_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
221 module_init(cgroup_mt_init);
222 module_exit(cgroup_mt_exit);