2 * Xtables module to match the process control group.
4 * Might be used to implement individual "per-application" firewall
5 * policies in contrast to global policies based on control groups.
6 * Matching is based upon processes tagged to net_cls' classid marker.
8 * (C) 2013 Daniel Borkmann <dborkman@redhat.com>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
15 #include <linux/skbuff.h>
16 #include <linux/module.h>
17 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter/xt_cgroup.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>");
23 MODULE_DESCRIPTION("Xtables: process control group matching");
24 MODULE_ALIAS("ipt_cgroup");
25 MODULE_ALIAS("ip6t_cgroup");
27 static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
29 struct xt_cgroup_info_v0 *info = par->matchinfo;
31 if (info->invert & ~1)
37 static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
39 struct xt_cgroup_info_v1 *info = par->matchinfo;
42 if ((info->invert_path & ~1) || (info->invert_classid & ~1))
45 if (!info->has_path && !info->has_classid) {
46 pr_info("xt_cgroup: no path or classid specified\n");
50 if (info->has_path && info->has_classid) {
51 pr_info("xt_cgroup: both path and classid specified\n");
57 cgrp = cgroup_get_from_path(info->path);
59 pr_info("xt_cgroup: invalid path, errno=%ld\n",
69 static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
71 struct xt_cgroup_info_v2 *info = par->matchinfo;
74 if ((info->invert_path & ~1) || (info->invert_classid & ~1))
77 if (!info->has_path && !info->has_classid) {
78 pr_info("xt_cgroup: no path or classid specified\n");
82 if (info->has_path && info->has_classid) {
83 pr_info_ratelimited("path and classid specified\n");
89 cgrp = cgroup_get_from_path(info->path);
91 pr_info_ratelimited("invalid path, errno=%ld\n",
102 cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
104 const struct xt_cgroup_info_v0 *info = par->matchinfo;
106 if (skb->sk == NULL || !sk_fullsock(skb->sk))
109 return (info->id == sock_cgroup_classid(&skb->sk->sk_cgrp_data)) ^
113 static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
115 const struct xt_cgroup_info_v1 *info = par->matchinfo;
116 struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
117 struct cgroup *ancestor = info->priv;
119 if (!skb->sk || !sk_fullsock(skb->sk))
123 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
126 return (info->classid == sock_cgroup_classid(skcd)) ^
127 info->invert_classid;
130 static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
132 const struct xt_cgroup_info_v2 *info = par->matchinfo;
133 struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
134 struct cgroup *ancestor = info->priv;
135 struct sock *sk = skb->sk;
137 if (!sk || !sk_fullsock(sk) || !net_eq(xt_net(par), sock_net(sk)))
141 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
144 return (info->classid == sock_cgroup_classid(skcd)) ^
145 info->invert_classid;
148 static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
150 struct xt_cgroup_info_v1 *info = par->matchinfo;
153 cgroup_put(info->priv);
156 static void cgroup_mt_destroy_v2(const struct xt_mtdtor_param *par)
158 struct xt_cgroup_info_v2 *info = par->matchinfo;
161 cgroup_put(info->priv);
164 static struct xt_match cgroup_mt_reg[] __read_mostly = {
168 .family = NFPROTO_UNSPEC,
169 .checkentry = cgroup_mt_check_v0,
170 .match = cgroup_mt_v0,
171 .matchsize = sizeof(struct xt_cgroup_info_v0),
173 .hooks = (1 << NF_INET_LOCAL_OUT) |
174 (1 << NF_INET_POST_ROUTING) |
175 (1 << NF_INET_LOCAL_IN),
180 .family = NFPROTO_UNSPEC,
181 .checkentry = cgroup_mt_check_v1,
182 .match = cgroup_mt_v1,
183 .matchsize = sizeof(struct xt_cgroup_info_v1),
184 .usersize = offsetof(struct xt_cgroup_info_v1, priv),
185 .destroy = cgroup_mt_destroy_v1,
187 .hooks = (1 << NF_INET_LOCAL_OUT) |
188 (1 << NF_INET_POST_ROUTING) |
189 (1 << NF_INET_LOCAL_IN),
194 .family = NFPROTO_UNSPEC,
195 .checkentry = cgroup_mt_check_v2,
196 .match = cgroup_mt_v2,
197 .matchsize = sizeof(struct xt_cgroup_info_v2),
198 .usersize = offsetof(struct xt_cgroup_info_v2, priv),
199 .destroy = cgroup_mt_destroy_v2,
201 .hooks = (1 << NF_INET_LOCAL_OUT) |
202 (1 << NF_INET_POST_ROUTING) |
203 (1 << NF_INET_LOCAL_IN),
207 static int __init cgroup_mt_init(void)
209 return xt_register_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
212 static void __exit cgroup_mt_exit(void)
214 xt_unregister_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
217 module_init(cgroup_mt_init);
218 module_exit(cgroup_mt_exit);