|
 |
2b7d2b |
From 6465867eb48506687872b838b1ddfee61d1a0aeb Mon Sep 17 00:00:00 2001
|
|
|
2b7d2b |
From: Daniel Borkmann <dborkman@redhat.com>
|
|
|
2b7d2b |
Date: Mon, 23 Dec 2013 18:46:29 +0100
|
|
|
2b7d2b |
Subject: iptables: add libxt_cgroup frontend
|
|
|
2b7d2b |
|
|
|
2b7d2b |
This patch adds the user space extension/frontend for process matching
|
|
|
2b7d2b |
based on cgroups from the kernel patch entitled "netfilter: xtables:
|
|
|
2b7d2b |
lightweight process control group matching".
|
|
|
2b7d2b |
|
|
|
2b7d2b |
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
|
|
|
2b7d2b |
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
|
|
|
2b7d2b |
|
|
|
2b7d2b |
diff --git a/extensions/libxt_cgroup.c b/extensions/libxt_cgroup.c
|
|
|
2b7d2b |
new file mode 100644
|
|
|
2b7d2b |
index 0000000..e304e33
|
|
|
2b7d2b |
--- /dev/null
|
|
|
2b7d2b |
+++ b/extensions/libxt_cgroup.c
|
|
|
2b7d2b |
@@ -0,0 +1,67 @@
|
|
|
2b7d2b |
+#include <stdio.h>
|
|
|
2b7d2b |
+#include <xtables.h>
|
|
|
2b7d2b |
+#include <linux/netfilter/xt_cgroup.h>
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+enum {
|
|
|
2b7d2b |
+ O_CGROUP = 0,
|
|
|
2b7d2b |
+};
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+static void cgroup_help(void)
|
|
|
2b7d2b |
+{
|
|
|
2b7d2b |
+ printf(
|
|
|
2b7d2b |
+"cgroup match options:\n"
|
|
|
2b7d2b |
+"[!] --cgroup fwid Match cgroup fwid\n");
|
|
|
2b7d2b |
+}
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+static const struct xt_option_entry cgroup_opts[] = {
|
|
|
2b7d2b |
+ {
|
|
|
2b7d2b |
+ .name = "cgroup",
|
|
|
2b7d2b |
+ .id = O_CGROUP,
|
|
|
2b7d2b |
+ .type = XTTYPE_UINT32,
|
|
|
2b7d2b |
+ .flags = XTOPT_INVERT | XTOPT_MAND | XTOPT_PUT,
|
|
|
2b7d2b |
+ XTOPT_POINTER(struct xt_cgroup_info, id)
|
|
|
2b7d2b |
+ },
|
|
|
2b7d2b |
+ XTOPT_TABLEEND,
|
|
|
2b7d2b |
+};
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+static void cgroup_parse(struct xt_option_call *cb)
|
|
|
2b7d2b |
+{
|
|
|
2b7d2b |
+ struct xt_cgroup_info *cgroupinfo = cb->data;
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+ xtables_option_parse(cb);
|
|
|
2b7d2b |
+ if (cb->invert)
|
|
|
2b7d2b |
+ cgroupinfo->invert = true;
|
|
|
2b7d2b |
+}
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+static void
|
|
|
2b7d2b |
+cgroup_print(const void *ip, const struct xt_entry_match *match, int numeric)
|
|
|
2b7d2b |
+{
|
|
|
2b7d2b |
+ const struct xt_cgroup_info *info = (void *) match->data;
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+ printf(" cgroup %s%u", info->invert ? "! ":"", info->id);
|
|
|
2b7d2b |
+}
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+static void cgroup_save(const void *ip, const struct xt_entry_match *match)
|
|
|
2b7d2b |
+{
|
|
|
2b7d2b |
+ const struct xt_cgroup_info *info = (void *) match->data;
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+ printf("%s --cgroup %u", info->invert ? " !" : "", info->id);
|
|
|
2b7d2b |
+}
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+static struct xtables_match cgroup_match = {
|
|
|
2b7d2b |
+ .family = NFPROTO_UNSPEC,
|
|
|
2b7d2b |
+ .name = "cgroup",
|
|
|
2b7d2b |
+ .version = XTABLES_VERSION,
|
|
|
2b7d2b |
+ .size = XT_ALIGN(sizeof(struct xt_cgroup_info)),
|
|
|
2b7d2b |
+ .userspacesize = XT_ALIGN(sizeof(struct xt_cgroup_info)),
|
|
|
2b7d2b |
+ .help = cgroup_help,
|
|
|
2b7d2b |
+ .print = cgroup_print,
|
|
|
2b7d2b |
+ .save = cgroup_save,
|
|
|
2b7d2b |
+ .x6_parse = cgroup_parse,
|
|
|
2b7d2b |
+ .x6_options = cgroup_opts,
|
|
|
2b7d2b |
+};
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+void _init(void)
|
|
|
2b7d2b |
+{
|
|
|
2b7d2b |
+ xtables_register_match(&cgroup_match);
|
|
|
2b7d2b |
+}
|
|
|
2b7d2b |
diff --git a/extensions/libxt_cgroup.man b/extensions/libxt_cgroup.man
|
|
|
2b7d2b |
new file mode 100644
|
|
|
2b7d2b |
index 0000000..456a031
|
|
|
2b7d2b |
--- /dev/null
|
|
|
2b7d2b |
+++ b/extensions/libxt_cgroup.man
|
|
|
2b7d2b |
@@ -0,0 +1,15 @@
|
|
|
2b7d2b |
+.TP
|
|
|
2b7d2b |
+[\fB!\fP] \fB\-\-cgroup\fP \fIfwid\fP
|
|
|
2b7d2b |
+Match corresponding cgroup for this packet.
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+Can be used to assign particular firewall policies for aggregated
|
|
|
2b7d2b |
+task/jobs on the system. This allows for more fine-grained firewall
|
|
|
2b7d2b |
+policies that only match for a subset of the system's processes.
|
|
|
2b7d2b |
+fwid is the maker set through the net_cls cgroup's id.
|
|
|
2b7d2b |
+.PP
|
|
|
2b7d2b |
+Example:
|
|
|
2b7d2b |
+.PP
|
|
|
2b7d2b |
+iptables \-A OUTPUT \-p tcp \-\-sport 80 \-m cgroup ! \-\-cgroup 1
|
|
|
2b7d2b |
+\-j DROP
|
|
|
2b7d2b |
+.PP
|
|
|
2b7d2b |
+Available since Linux 3.14.
|
|
|
2b7d2b |
diff --git a/include/linux/netfilter/xt_cgroup.h b/include/linux/netfilter/xt_cgroup.h
|
|
|
2b7d2b |
new file mode 100644
|
|
|
2b7d2b |
index 0000000..943d3a0
|
|
|
2b7d2b |
--- /dev/null
|
|
|
2b7d2b |
+++ b/include/linux/netfilter/xt_cgroup.h
|
|
|
2b7d2b |
@@ -0,0 +1,11 @@
|
|
|
2b7d2b |
+#ifndef _XT_CGROUP_H
|
|
|
2b7d2b |
+#define _XT_CGROUP_H
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+#include <linux/types.h>
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+struct xt_cgroup_info {
|
|
|
2b7d2b |
+ __u32 id;
|
|
|
2b7d2b |
+ __u32 invert;
|
|
|
2b7d2b |
+};
|
|
|
2b7d2b |
+
|
|
|
2b7d2b |
+#endif /* _XT_CGROUP_H */
|
|
|
2b7d2b |
--
|
|
|
2b7d2b |
cgit v0.10.2
|
|
|
2b7d2b |
|