net/netfilter/xt_cgroup.c

   1 /*
   2  * Xtables module to match the process control group.
   3  *
   4  * Might be used to implement individual "per-application" firewall
   5  * policies in contrast to global policies based on control groups.
   6  * Matching is based upon processes tagged to net_cls' classid marker.
   7  *
   8  * (C) 2013 Daniel Borkmann <dborkman@redhat.com>
   9  *
  10  * This program is free software; you can redistribute it and/or modify
  11  * it under the terms of the GNU General Public License version 2 as
  12  * published by the Free Software Foundation.
  13  */
  14
  15 #include <linux/skbuff.h>
  16 #include <linux/module.h>
  17 #include <linux/netfilter/x_tables.h>
  18 #include <linux/netfilter/xt_cgroup.h>
  19 #include <net/sock.h>
  20
  21 MODULE_LICENSE("GPL");
  22 MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>");
  23 MODULE_DESCRIPTION("Xtables: process control group matching");
  24 MODULE_ALIAS("ipt_cgroup");
  25 MODULE_ALIAS("ip6t_cgroup");
  26
  27 static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
  28 {
  29         struct xt_cgroup_info_v0 *info = par->matchinfo;
  30
  31         if (info->invert & ~1)
  32                 return -EINVAL;
  33
  34         return 0;
  35 }
  36
  37 static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
  38 {
  39         struct xt_cgroup_info_v1 *info = par->matchinfo;
  40         struct cgroup *cgrp;
  41
  42         if ((info->invert_path & ~1) || (info->invert_classid & ~1))
  43                 return -EINVAL;
  44
  45         if (!info->has_path && !info->has_classid) {
  46                 pr_info("xt_cgroup: no path or classid specified\n");
  47                 return -EINVAL;
  48         }
  49
  50         if (info->has_path && info->has_classid) {
  51                 pr_info("xt_cgroup: both path and classid specified\n");
  52                 return -EINVAL;
  53         }
  54
  55         info->priv = NULL;
  56         if (info->has_path) {
  57                 cgrp = cgroup_get_from_path(info->path);
  58                 if (IS_ERR(cgrp)) {
  59                         pr_info("xt_cgroup: invalid path, errno=%ld\n",
  60                                 PTR_ERR(cgrp));
  61                         return -EINVAL;
  62                 }
  63                 info->priv = cgrp;
  64         }
  65
  66         return 0;
  67 }
  68
  69 static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
  70 {
  71         struct xt_cgroup_info_v2 *info = par->matchinfo;
  72         struct cgroup *cgrp;
  73
  74         if ((info->invert_path & ~1) || (info->invert_classid & ~1))
  75                 return -EINVAL;
  76
  77         if (!info->has_path && !info->has_classid) {
  78                 pr_info("xt_cgroup: no path or classid specified\n");
  79                 return -EINVAL;
  80         }
  81
  82         if (info->has_path && info->has_classid) {
  83                 pr_info_ratelimited("path and classid specified\n");
  84                 return -EINVAL;
  85         }
  86
  87         info->priv = NULL;
  88         if (info->has_path) {
  89                 cgrp = cgroup_get_from_path(info->path);
  90                 if (IS_ERR(cgrp)) {
  91                         pr_info_ratelimited("invalid path, errno=%ld\n",
  92                                             PTR_ERR(cgrp));
  93                         return -EINVAL;
  94                 }
  95                 info->priv = cgrp;
  96         }
  97
  98         return 0;
  99 }
 100
 101 static bool
 102 cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
 103 {
 104         const struct xt_cgroup_info_v0 *info = par->matchinfo;
 105
 106         if (skb->sk == NULL || !sk_fullsock(skb->sk))
 107                 return false;
 108
 109         return (info->id == sock_cgroup_classid(&skb->sk->sk_cgrp_data)) ^
 110                 info->invert;
 111 }
 112
 113 static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
 114 {
 115         const struct xt_cgroup_info_v1 *info = par->matchinfo;
 116         struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
 117         struct cgroup *ancestor = info->priv;
 118
 119         if (!skb->sk || !sk_fullsock(skb->sk))
 120                 return false;
 121
 122         if (ancestor)
 123                 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
 124                         info->invert_path;
 125         else
 126                 return (info->classid == sock_cgroup_classid(skcd)) ^
 127                         info->invert_classid;
 128 }
 129
 130 static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
 131 {
 132         const struct xt_cgroup_info_v2 *info = par->matchinfo;
 133         struct sock_cgroup_data *skcd = &skb->sk->sk_cgrp_data;
 134         struct cgroup *ancestor = info->priv;
 135         struct sock *sk = skb->sk;
 136
 137         if (!sk || !sk_fullsock(sk) || !net_eq(xt_net(par), sock_net(sk)))
 138                 return false;
 139
 140         if (ancestor)
 141                 return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
 142                         info->invert_path;
 143         else
 144                 return (info->classid == sock_cgroup_classid(skcd)) ^
 145                         info->invert_classid;
 146 }
 147
 148 static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
 149 {
 150         struct xt_cgroup_info_v1 *info = par->matchinfo;
 151
 152         if (info->priv)
 153                 cgroup_put(info->priv);
 154 }
 155
 156 static void cgroup_mt_destroy_v2(const struct xt_mtdtor_param *par)
 157 {
 158         struct xt_cgroup_info_v2 *info = par->matchinfo;
 159
 160         if (info->priv)
 161                 cgroup_put(info->priv);
 162 }
 163
 164 static struct xt_match cgroup_mt_reg[] __read_mostly = {
 165         {
 166                 .name           = "cgroup",
 167                 .revision       = 0,
 168                 .family         = NFPROTO_UNSPEC,
 169                 .checkentry     = cgroup_mt_check_v0,
 170                 .match          = cgroup_mt_v0,
 171                 .matchsize      = sizeof(struct xt_cgroup_info_v0),
 172                 .me             = THIS_MODULE,
 173                 .hooks          = (1 << NF_INET_LOCAL_OUT) |
 174                                   (1 << NF_INET_POST_ROUTING) |
 175                                   (1 << NF_INET_LOCAL_IN),
 176         },
 177         {
 178                 .name           = "cgroup",
 179                 .revision       = 1,
 180                 .family         = NFPROTO_UNSPEC,
 181                 .checkentry     = cgroup_mt_check_v1,
 182                 .match          = cgroup_mt_v1,
 183                 .matchsize      = sizeof(struct xt_cgroup_info_v1),
 184                 .usersize       = offsetof(struct xt_cgroup_info_v1, priv),
 185                 .destroy        = cgroup_mt_destroy_v1,
 186                 .me             = THIS_MODULE,
 187                 .hooks          = (1 << NF_INET_LOCAL_OUT) |
 188                                   (1 << NF_INET_POST_ROUTING) |
 189                                   (1 << NF_INET_LOCAL_IN),
 190         },
 191         {
 192                 .name           = "cgroup",
 193                 .revision       = 2,
 194                 .family         = NFPROTO_UNSPEC,
 195                 .checkentry     = cgroup_mt_check_v2,
 196                 .match          = cgroup_mt_v2,
 197                 .matchsize      = sizeof(struct xt_cgroup_info_v2),
 198                 .usersize       = offsetof(struct xt_cgroup_info_v2, priv),
 199                 .destroy        = cgroup_mt_destroy_v2,
 200                 .me             = THIS_MODULE,
 201                 .hooks          = (1 << NF_INET_LOCAL_OUT) |
 202                                   (1 << NF_INET_POST_ROUTING) |
 203                                   (1 << NF_INET_LOCAL_IN),
 204         },
 205 };
 206
 207 static int __init cgroup_mt_init(void)
 208 {
 209         return xt_register_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
 210 }
 211
 212 static void __exit cgroup_mt_exit(void)
 213 {
 214         xt_unregister_matches(cgroup_mt_reg, ARRAY_SIZE(cgroup_mt_reg));
 215 }
 216
 217 module_init(cgroup_mt_init);
 218 module_exit(cgroup_mt_exit);