From: Tejun Heo <tj@kernel.org>
To: davem@davemloft.net, pablo@netfilter.org, kaber@trash.net,
kadlec@blackhole.kfki.hu, daniel@iogearbox.net,
daniel.wagner@bmw-carit.de, nhorman@tuxdriver.com
Cc: lizefan@huawei.com, hannes@cmpxchg.org, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org, coreteam@netfilter.org,
cgroups@vger.kernel.org, linux-kernel@vger.kernel.org,
kernel-team@fb.com, ninasc@fb.com, Tejun Heo <tj@kernel.org>,
Jan Engelhardt <jengelh@inai.de>
Subject: [PATCH 8/8] netfilter: implement xt_cgroup cgroup2 path match
Date: Mon, 7 Dec 2015 17:38:55 -0500 [thread overview]
Message-ID: <1449527935-27056-9-git-send-email-tj@kernel.org> (raw)
In-Reply-To: <1449527935-27056-1-git-send-email-tj@kernel.org>
This patch implements xt_cgroup path match which matches cgroup2
membership of the associated socket. The match is recursive and
invertible.
For rationales on introducing another cgroup based match, please refer
to a preceding commit "sock, cgroup: add sock->sk_cgroup".
v3: Folded into xt_cgroup as a new revision interface as suggested by
Pablo.
v2: Included linux/limits.h from xt_cgroup2.h for PATH_MAX. Added
explicit alignment to the priv field. Both suggested by Jan.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Daniel Wagner <daniel.wagner@bmw-carit.de>
CC: Neil Horman <nhorman@tuxdriver.com>
Cc: Jan Engelhardt <jengelh@inai.de>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
---
include/uapi/linux/netfilter/xt_cgroup.h | 13 ++++++
net/netfilter/xt_cgroup.c | 69 ++++++++++++++++++++++++++++++++
2 files changed, 82 insertions(+)
diff --git a/include/uapi/linux/netfilter/xt_cgroup.h b/include/uapi/linux/netfilter/xt_cgroup.h
index 577c9e0..1e4b37b 100644
--- a/include/uapi/linux/netfilter/xt_cgroup.h
+++ b/include/uapi/linux/netfilter/xt_cgroup.h
@@ -2,10 +2,23 @@
#define _UAPI_XT_CGROUP_H
#include <linux/types.h>
+#include <linux/limits.h>
struct xt_cgroup_info_v0 {
__u32 id;
__u32 invert;
};
+struct xt_cgroup_info_v1 {
+ __u8 has_path;
+ __u8 has_classid;
+ __u8 invert_path;
+ __u8 invert_classid;
+ char path[PATH_MAX];
+ __u32 classid;
+
+ /* kernel internal data */
+ void *priv __attribute__((aligned(8)));
+};
+
#endif /* _UAPI_XT_CGROUP_H */
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 1730025..a086a91 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -34,6 +34,37 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
return 0;
}
+static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
+{
+ struct xt_cgroup_info_v1 *info = par->matchinfo;
+ struct cgroup *cgrp;
+
+ if ((info->invert_path & ~1) || (info->invert_classid & ~1))
+ return -EINVAL;
+
+ if (!info->has_path && !info->has_classid) {
+ pr_info("xt_cgroup: no path or classid specified\n");
+ return -EINVAL;
+ }
+
+ if (info->has_path && info->has_classid) {
+ pr_info("xt_cgroup: both path and classid specified\n");
+ return -EINVAL;
+ }
+
+ if (info->has_path) {
+ cgrp = cgroup_get_from_path(info->path);
+ if (IS_ERR(cgrp)) {
+ pr_info("xt_cgroup: invalid path, errno=%ld\n",
+ PTR_ERR(cgrp));
+ return -EINVAL;
+ }
+ info->priv = cgrp;
+ }
+
+ return 0;
+}
+
static bool
cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
{
@@ -46,6 +77,31 @@ cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
info->invert;
}
+static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
+{
+ const struct xt_cgroup_info_v1 *info = par->matchinfo;
+ struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
+ struct cgroup *ancestor = info->priv;
+
+ if (!skb->sk || !sk_fullsock(skb->sk))
+ return false;
+
+ if (ancestor)
+ return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
+ info->invert_path;
+ else
+ return (info->classid == sock_cgroup_classid(skcd)) ^
+ info->invert_classid;
+}
+
+static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
+{
+ struct xt_cgroup_info_v1 *info = par->matchinfo;
+
+ if (info->priv)
+ cgroup_put(info->priv);
+}
+
static struct xt_match cgroup_mt_reg[] __read_mostly = {
{
.name = "cgroup",
@@ -59,6 +115,19 @@ static struct xt_match cgroup_mt_reg[] __read_mostly = {
(1 << NF_INET_POST_ROUTING) |
(1 << NF_INET_LOCAL_IN),
},
+ {
+ .name = "cgroup",
+ .revision = 1,
+ .family = NFPROTO_UNSPEC,
+ .checkentry = cgroup_mt_check_v1,
+ .match = cgroup_mt_v1,
+ .matchsize = sizeof(struct xt_cgroup_info_v1),
+ .destroy = cgroup_mt_destroy_v1,
+ .me = THIS_MODULE,
+ .hooks = (1 << NF_INET_LOCAL_OUT) |
+ (1 << NF_INET_POST_ROUTING) |
+ (1 << NF_INET_LOCAL_IN),
+ },
};
static int __init cgroup_mt_init(void)
--
2.5.0
next prev parent reply other threads:[~2015-12-07 22:38 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-12-07 22:38 [PATCHSET v4] netfilter, cgroup: implement cgroup2 path match in xt_cgroup Tejun Heo
2015-12-07 22:38 ` [PATCH 1/8] cgroup: record ancestor IDs and reimplement cgroup_is_descendant() using it Tejun Heo
2015-12-07 22:38 ` [PATCH 2/8] kernfs: implement kernfs_walk_and_get() Tejun Heo
[not found] ` <1449527935-27056-3-git-send-email-tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2016-01-15 12:29 ` Geert Uytterhoeven
2016-01-15 17:30 ` [PATCH] kernfs: make kernfs_walk_ns() use kernfs_pr_cont_buf[] Tejun Heo
[not found] ` <20160115173014.GI3520-qYNAdHglDFBN0TnZuCh8vA@public.gmane.org>
2016-01-15 22:05 ` Greg Kroah-Hartman
[not found] ` <1449527935-27056-1-git-send-email-tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2015-12-07 22:38 ` [PATCH 3/8] cgroup: implement cgroup_get_from_path() and expose cgroup_put() Tejun Heo
[not found] ` <1449527935-27056-4-git-send-email-tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2015-12-22 0:22 ` Serge E. Hallyn
2015-12-22 18:13 ` Tejun Heo
2015-12-07 22:38 ` [PATCH 4/8] netprio_cgroup: limit the maximum css->id to USHRT_MAX Tejun Heo
2015-12-09 3:03 ` [PATCHSET v4] netfilter, cgroup: implement cgroup2 path match in xt_cgroup David Miller
2015-12-07 22:38 ` [PATCH 5/8] net: wrap sock->sk_cgrp_prioidx and ->sk_classid inside a struct Tejun Heo
2015-12-07 22:38 ` [PATCH 6/8] sock, cgroup: add sock->sk_cgroup Tejun Heo
2015-12-07 22:38 ` [PATCH 7/8] netfilter: prepare xt_cgroup for multi revisions Tejun Heo
2015-12-14 19:35 ` Pablo Neira Ayuso
2015-12-07 22:38 ` Tejun Heo [this message]
2015-12-14 19:37 ` [PATCH 8/8] netfilter: implement xt_cgroup cgroup2 path match Pablo Neira Ayuso
[not found] ` <1449527935-27056-9-git-send-email-tj-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2016-02-12 0:10 ` Alban Crequy
[not found] ` <CAMXgnP7Eue2NQrUcRSNgM8NJT5XOscPWwqVkuh7LnwQn-1oQ_A-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2016-02-12 16:05 ` Tejun Heo
2015-12-14 11:54 ` [PATCHSET v4] netfilter, cgroup: implement cgroup2 path match in xt_cgroup Dexuan Cui
2015-12-14 16:24 ` [PATCH net-next] net, cgroup: cgroup_sk_updat_lock was missing initializer Tejun Heo
2015-12-14 19:20 ` David Miller
[not found] ` <20151214.142043.1185024338854399910.davem-fT/PcQaiUtIeIZ0/mPfg9Q@public.gmane.org>
2015-12-15 2:11 ` Dexuan Cui
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1449527935-27056-9-git-send-email-tj@kernel.org \
--to=tj@kernel.org \
--cc=cgroups@vger.kernel.org \
--cc=coreteam@netfilter.org \
--cc=daniel.wagner@bmw-carit.de \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=hannes@cmpxchg.org \
--cc=jengelh@inai.de \
--cc=kaber@trash.net \
--cc=kadlec@blackhole.kfki.hu \
--cc=kernel-team@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lizefan@huawei.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=ninasc@fb.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).