1 #include <stdio.h>
2 #include <xtables.h>
3 #include <linux/netfilter/xt_cgroup.h>
4
5 enum {
6 O_CLASSID = 0,
7 O_PATH = 1,
8 };
9
cgroup_help_v0(void)10 static void cgroup_help_v0(void)
11 {
12 printf(
13 "cgroup match options:\n"
14 "[!] --cgroup classid Match cgroup classid\n");
15 }
16
cgroup_help_v1(void)17 static void cgroup_help_v1(void)
18 {
19 printf(
20 "cgroup match options:\n"
21 "[!] --path path Recursively match path relative to cgroup2 root\n"
22 "[!] --cgroup classid Match cgroup classid, can't be used with --path\n");
23 }
24
25 static const struct xt_option_entry cgroup_opts_v0[] = {
26 {
27 .name = "cgroup",
28 .id = O_CLASSID,
29 .type = XTTYPE_UINT32,
30 .flags = XTOPT_INVERT | XTOPT_MAND | XTOPT_PUT,
31 XTOPT_POINTER(struct xt_cgroup_info_v0, id)
32 },
33 XTOPT_TABLEEND,
34 };
35
36 static const struct xt_option_entry cgroup_opts_v1[] = {
37 {
38 .name = "path",
39 .id = O_PATH,
40 .type = XTTYPE_STRING,
41 .flags = XTOPT_INVERT | XTOPT_PUT,
42 XTOPT_POINTER(struct xt_cgroup_info_v1, path)
43 },
44 {
45 .name = "cgroup",
46 .id = O_CLASSID,
47 .type = XTTYPE_UINT32,
48 .flags = XTOPT_INVERT | XTOPT_PUT,
49 XTOPT_POINTER(struct xt_cgroup_info_v1, classid)
50 },
51 XTOPT_TABLEEND,
52 };
53
cgroup_parse_v0(struct xt_option_call * cb)54 static void cgroup_parse_v0(struct xt_option_call *cb)
55 {
56 struct xt_cgroup_info_v0 *cgroupinfo = cb->data;
57
58 xtables_option_parse(cb);
59 if (cb->invert)
60 cgroupinfo->invert = true;
61 }
62
cgroup_parse_v1(struct xt_option_call * cb)63 static void cgroup_parse_v1(struct xt_option_call *cb)
64 {
65 struct xt_cgroup_info_v1 *info = cb->data;
66
67 xtables_option_parse(cb);
68
69 switch (cb->entry->id) {
70 case O_PATH:
71 info->has_path = true;
72 if (cb->invert)
73 info->invert_path = true;
74 break;
75 case O_CLASSID:
76 info->has_classid = true;
77 if (cb->invert)
78 info->invert_classid = true;
79 break;
80 }
81 }
82
83 static void
cgroup_print_v0(const void * ip,const struct xt_entry_match * match,int numeric)84 cgroup_print_v0(const void *ip, const struct xt_entry_match *match, int numeric)
85 {
86 const struct xt_cgroup_info_v0 *info = (void *) match->data;
87
88 printf(" cgroup %s%u", info->invert ? "! ":"", info->id);
89 }
90
cgroup_save_v0(const void * ip,const struct xt_entry_match * match)91 static void cgroup_save_v0(const void *ip, const struct xt_entry_match *match)
92 {
93 const struct xt_cgroup_info_v0 *info = (void *) match->data;
94
95 printf("%s --cgroup %u", info->invert ? " !" : "", info->id);
96 }
97
98 static void
cgroup_print_v1(const void * ip,const struct xt_entry_match * match,int numeric)99 cgroup_print_v1(const void *ip, const struct xt_entry_match *match, int numeric)
100 {
101 const struct xt_cgroup_info_v1 *info = (void *)match->data;
102
103 printf(" cgroup");
104 if (info->has_path)
105 printf(" %s%s", info->invert_path ? "! ":"", info->path);
106 if (info->has_classid)
107 printf(" %s%u", info->invert_classid ? "! ":"", info->classid);
108 }
109
cgroup_save_v1(const void * ip,const struct xt_entry_match * match)110 static void cgroup_save_v1(const void *ip, const struct xt_entry_match *match)
111 {
112 const struct xt_cgroup_info_v1 *info = (void *)match->data;
113
114 if (info->has_path) {
115 printf("%s --path", info->invert_path ? " !" : "");
116 xtables_save_string(info->path);
117 }
118
119 if (info->has_classid)
120 printf("%s --cgroup %u", info->invert_classid ? " !" : "",
121 info->classid);
122 }
123
cgroup_xlate_v0(struct xt_xlate * xl,const struct xt_xlate_mt_params * params)124 static int cgroup_xlate_v0(struct xt_xlate *xl,
125 const struct xt_xlate_mt_params *params)
126 {
127 const struct xt_cgroup_info_v0 *info = (void *)params->match->data;
128
129 xt_xlate_add(xl, "meta cgroup %s%u", info->invert ? "!= " : "",
130 info->id);
131 return 1;
132 }
133
cgroup_xlate_v1(struct xt_xlate * xl,const struct xt_xlate_mt_params * params)134 static int cgroup_xlate_v1(struct xt_xlate *xl,
135 const struct xt_xlate_mt_params *params)
136 {
137 const struct xt_cgroup_info_v1 *info = (void *)params->match->data;
138
139 if (info->has_path)
140 return 0;
141
142 if (info->has_classid)
143 xt_xlate_add(xl, "meta cgroup %s%u",
144 info->invert_classid ? "!= " : "",
145 info->classid);
146
147 return 1;
148 }
149
150 static struct xtables_match cgroup_match[] = {
151 {
152 .family = NFPROTO_UNSPEC,
153 .revision = 0,
154 .name = "cgroup",
155 .version = XTABLES_VERSION,
156 .size = XT_ALIGN(sizeof(struct xt_cgroup_info_v0)),
157 .userspacesize = XT_ALIGN(sizeof(struct xt_cgroup_info_v0)),
158 .help = cgroup_help_v0,
159 .print = cgroup_print_v0,
160 .save = cgroup_save_v0,
161 .x6_parse = cgroup_parse_v0,
162 .x6_options = cgroup_opts_v0,
163 .xlate = cgroup_xlate_v0,
164 },
165 {
166 .family = NFPROTO_UNSPEC,
167 .revision = 1,
168 .name = "cgroup",
169 .version = XTABLES_VERSION,
170 .size = XT_ALIGN(sizeof(struct xt_cgroup_info_v1)),
171 .userspacesize = offsetof(struct xt_cgroup_info_v1, priv),
172 .help = cgroup_help_v1,
173 .print = cgroup_print_v1,
174 .save = cgroup_save_v1,
175 .x6_parse = cgroup_parse_v1,
176 .x6_options = cgroup_opts_v1,
177 .xlate = cgroup_xlate_v1,
178 },
179 };
180
_init(void)181 void _init(void)
182 {
183 xtables_register_matches(cgroup_match, ARRAY_SIZE(cgroup_match));
184 }
185