1 /* 2 * Xtables module to match the process control group. 3 * 4 * Might be used to implement individual "per-application" firewall 5 * policies in contrast to global policies based on control groups. 6 * Matching is based upon processes tagged to net_cls' classid marker. 7 * 8 * (C) 2013 Daniel Borkmann <dborkman@redhat.com> 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License version 2 as 12 * published by the Free Software Foundation. 13 */ 14 15 #include <linux/skbuff.h> 16 #include <linux/module.h> 17 #include <linux/netfilter/x_tables.h> 18 #include <linux/netfilter/xt_cgroup.h> 19 #include <net/sock.h> 20 21 MODULE_LICENSE("GPL"); 22 MODULE_AUTHOR("Daniel Borkmann <dborkman@redhat.com>"); 23 MODULE_DESCRIPTION("Xtables: process control group matching"); 24 MODULE_ALIAS("ipt_cgroup"); 25 MODULE_ALIAS("ip6t_cgroup"); 26 27 static int cgroup_mt_check(const struct xt_mtchk_param *par) 28 { 29 struct xt_cgroup_info *info = par->matchinfo; 30 31 if (info->invert & ~1) 32 return -EINVAL; 33 34 return 0; 35 } 36 37 static bool 38 cgroup_mt(const struct sk_buff *skb, struct xt_action_param *par) 39 { 40 const struct xt_cgroup_info *info = par->matchinfo; 41 42 if (skb->sk == NULL || !sk_fullsock(skb->sk)) 43 return false; 44 45 return (info->id == skb->sk->sk_classid) ^ info->invert; 46 } 47 48 static struct xt_match cgroup_mt_reg __read_mostly = { 49 .name = "cgroup", 50 .revision = 0, 51 .family = NFPROTO_UNSPEC, 52 .checkentry = cgroup_mt_check, 53 .match = cgroup_mt, 54 .matchsize = sizeof(struct xt_cgroup_info), 55 .me = THIS_MODULE, 56 .hooks = (1 << NF_INET_LOCAL_OUT) | 57 (1 << NF_INET_POST_ROUTING) | 58 (1 << NF_INET_LOCAL_IN), 59 }; 60 61 static int __init cgroup_mt_init(void) 62 { 63 return xt_register_match(&cgroup_mt_reg); 64 } 65 66 static void __exit cgroup_mt_exit(void) 67 { 68 xt_unregister_match(&cgroup_mt_reg); 69 } 70 71 module_init(cgroup_mt_init); 72 module_exit(cgroup_mt_exit); 73