1 /*
2 * Xtables module to match the process control group.
3 *
4 * Might be used to implement individual "per-application" firewall
5 * policies in contrast to global policies based on control groups.
6 * Matching is based upon processes tagged to net_cls' classid marker.
7 *
8 * (C) 2013 Daniel Borkmann <dborkman@redhat.com>
9 *
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
13 */
14
15 #include <linux/skbuff.h>
16 #include <linux/module.h>
17 #include <linux/netfilter/x_tables.h>
18 #include <linux/netfilter/xt_cgroup.h>
19 #include <net/sock.h>
20
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>");
23 MODULE_DESCRIPTION("Xtables: process control group matching");
24 MODULE_ALIAS("ipt_cgroup");
25 MODULE_ALIAS("ip6t_cgroup");
26
cgroup_mt_check_v0(const struct xt_mtchk_param * par)27 static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
28 {
29 struct xt_cgroup_info_v0 *info = par->matchinfo;
30
31 if (info->invert & ~1)
32 return -EINVAL;
33
34 return 0;
35 }
36
cgroup_mt_check_v1(const struct xt_mtchk_param * par)37 static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
38 {
39 struct xt_cgroup_info_v1 *info = par->matchinfo;
40 struct cgroup *cgrp;
41
42 if ((info->invert_path & ~1) || (info->invert_classid & ~1))
43 return -EINVAL;
44
45 if (!info->has_path && !info->has_classid) {
46 pr_info("xt_cgroup: no path or classid specified\n");
47 return -EINVAL;
48 }
49
50 if (info->has_path && info->has_classid) {
51 pr_info("xt_cgroup: both path and classid specified\n");
52 return -EINVAL;
53 }
54
55 info->priv = NULL;
56 if (info->has_path) {
57 cgrp = cgroup_get_from_path(info->path);
58 if (IS_ERR(cgrp)) {
59 pr_info("xt_cgroup: invalid path, errno=%ld\n",
60 PTR_ERR(cgrp));
61 return -EINVAL;
62 }
63 info->priv = cgrp;
64 }
65
66 return 0;
67 }
68
cgroup_mt_check_v2(const struct xt_mtchk_param * par)69 static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
70 {
71 struct xt_cgroup_info_v2 *info = par->matchinfo;
72 struct cgroup *cgrp;
73
74 if ((info->invert_path & ~1) || (info->invert_classid & ~1))
75 return -EINVAL;
76
77 if (!info->has_path && !info->has_classid) {
78 pr_info("xt_cgroup: no path or classid specified\n");
79 return -EINVAL;
80 }
81
82 if (info->has_path && info->has_classid) {
83 pr_info_ratelimited("path and classid specified\n");
84 return -EINVAL;
85 }
86
87 info->priv = NULL;
88 if (info->has_path) {
89 cgrp = cgroup_get_from_path(info->path);
90 if (IS_ERR(cgrp)) {
91 pr_info_ratelimited("invalid path, errno=%ld\n",
92 PTR_ERR(cgrp));
93 return -EINVAL;
94 }
95 info->priv = cgrp;
96 }
97
98 return 0;
99 }
100
101 static bool
cgroup_mt_v0(const struct sk_buff * skb,struct xt_action_param * par)102 cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
103 {
104 const struct xt_cgroup_info_v0 *info = par->matchinfo;
105
106 if (skb->sk == NULL || !sk_fullsock(skb->sk))
107 return false;
108
109 return (info->id == sock_cgroup_classid(&skb->sk->sk_cgrp_data)) ^
110 info->invert;
111 }
112
cgroup_mt_v1(const struct sk_buff * skb,struct xt_action_param * par)113 static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
114 {
115 const struct xt_cgroup_info_v1 *info = par->matchinfo;
116 struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
117 struct cgroup *ancestor = info->priv;
118
119 if (!skb->sk || !sk_fullsock(skb->sk))
120 return false;
121
122 if (ancestor)
123 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
124 info->invert_path;
125 else
126 return (info->classid == sock_cgroup_classid(skcd)) ^
127 info->invert_classid;
128 }
129
cgroup_mt_v2(const struct sk_buff * skb,struct xt_action_param * par)130 static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
131 {
132 const struct xt_cgroup_info_v2 *info = par->matchinfo;
133 struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
134 struct cgroup *ancestor = info->priv;
135 struct sock *sk = skb->sk;
136
137 if (!sk || !sk_fullsock(sk) || !net_eq(xt_net(par), sock_net(sk)))
138 return false;
139
140 if (ancestor)
141 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
142 info->invert_path;
143 else
144 return (info->classid == sock_cgroup_classid(skcd)) ^
145 info->invert_classid;
146 }
147
cgroup_mt_destroy_v1(const struct xt_mtdtor_param * par)148 static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
149 {
150 struct xt_cgroup_info_v1 *info = par->matchinfo;
151
152 if (info->priv)
153 cgroup_put(info->priv);
154 }
155
cgroup_mt_destroy_v2(const struct xt_mtdtor_param * par)156 static void cgroup_mt_destroy_v2(const struct xt_mtdtor_param *par)
157 {
158 struct xt_cgroup_info_v2 *info = par->matchinfo;
159
160 if (info->priv)
161 cgroup_put(info->priv);
162 }
163
164 static struct xt_match cgroup_mt_reg[] __read_mostly = {
165 {
166 .name = "cgroup",
167 .revision = 0,
168 .family = NFPROTO_UNSPEC,
169 .checkentry = cgroup_mt_check_v0,
170 .match = cgroup_mt_v0,
171 .matchsize = sizeof(struct xt_cgroup_info_v0),
172 .me = THIS_MODULE,
173 .hooks = (1 << NF_INET_LOCAL_OUT) |
174 (1 << NF_INET_POST_ROUTING) |
175 (1 << NF_INET_LOCAL_IN),
176 },
177 {
178 .name = "cgroup",
179 .revision = 1,
180 .family = NFPROTO_UNSPEC,
181 .checkentry = cgroup_mt_check_v1,
182 .match = cgroup_mt_v1,
183 .matchsize = sizeof(struct xt_cgroup_info_v1),
184 .usersize = offsetof(struct xt_cgroup_info_v1, priv),
185 .destroy = cgroup_mt_destroy_v1,
186 .me = THIS_MODULE,
187 .hooks = (1 << NF_INET_LOCAL_OUT) |
188 (1 << NF_INET_POST_ROUTING) |
189 (1 << NF_INET_LOCAL_IN),
190 },
191 {
192 .name = "cgroup",
193 .revision = 2,
194 .family = NFPROTO_UNSPEC,
195 .checkentry = cgroup_mt_check_v2,
196 .match = cgroup_mt_v2,
197 .matchsize = sizeof(struct xt_cgroup_info_v2),
198 .usersize = offsetof(struct xt_cgroup_info_v2, priv),
199 .destroy = cgroup_mt_destroy_v2,
200 .me = THIS_MODULE,
201 .hooks = (1 << NF_INET_LOCAL_OUT) |
202 (1 << NF_INET_POST_ROUTING) |
203 (1 << NF_INET_LOCAL_IN),
204 },
205 };
206
cgroup_mt_init(void)207 static int __init cgroup_mt_init(void)
208 {
209 return xt_register_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
210 }
211
cgroup_mt_exit(void)212 static void __exit cgroup_mt_exit(void)
213 {
214 xt_unregister_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
215 }
216
217 module_init(cgroup_mt_init);
218 module_exit(cgroup_mt_exit);
219