From patchwork Thu Nov 19 18:57:15 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tejun Heo X-Patchwork-Id: 546621 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3447C1414A0 for ; Fri, 20 Nov 2015 05:57:53 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=iWs4NXqP; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934421AbbKSS5j (ORCPT ); Thu, 19 Nov 2015 13:57:39 -0500 Received: from mail-yk0-f170.google.com ([209.85.160.170]:36465 "EHLO mail-yk0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759047AbbKSS5T (ORCPT ); Thu, 19 Nov 2015 13:57:19 -0500 Received: by ykdr82 with SMTP id r82so120729516ykd.3; Thu, 19 Nov 2015 10:57:18 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=u6hi/k1I5IicvUudmw3GGdPLM7NKG9CuvfaExsCQhyc=; b=iWs4NXqP0oZLIQs8i8J+FN/79nrH6lezlquOOAeVVn2NABsL1rWwdFz/LlS8qfIS2Z HCijLK04dZS7xpBfRMQxlSKUs4NQ1argqwzQ65lzcIBD7Uk9I0zTE2qar47M3DyOHCpm x2nMzK47jvBMpmnJC/rkuQ+xSd4rg18WuYJ65fyWTj9KAZjd/VeM1IiBxGzHwJkDJ9+b 3Q/xdw64MLg4/+p8lgR77FcPdWdoVU/FWq2OgwO+HDOhaRmzaoYJ7QcJL6KKCOCL74YS xKKe2y5Zq3W8nkyVxuzWN3ig6fQk6OrLzi2lrM3wN2OGzl7KOr93wnpogY4Yy37JD1eJ 99VA== X-Received: by 10.129.115.67 with SMTP id o64mr8033685ywc.294.1447959438735; Thu, 19 Nov 2015 10:57:18 -0800 (PST) Received: from mtj.duckdns.org ([2620:10d:c091:200::f:9c1]) by smtp.gmail.com with ESMTPSA id m130sm8805933ywb.48.2015.11.19.10.57.16 (version=TLSv1/SSLv3 cipher=OTHER); Thu, 19 Nov 2015 10:57:17 -0800 (PST) Date: Thu, 19 Nov 2015 13:57:15 -0500 From: Tejun Heo To: davem@davemloft.net, pablo@netfilter.org, kaber@trash.net, kadlec@blackhole.kfki.hu, lizefan@huawei.com, hannes@cmpxchg.org Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@fb.com, daniel@iogearbox.net, daniel.wagner@bmw-carit.de, nhorman@tuxdriver.com Subject: [PATCH v2 iptables] libxt_cgroup2: add support for cgroup2 path matching Message-ID: <20151119185715.GB28608@mtj.duckdns.org> References: <1447959171-20749-1-git-send-email-tj@kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1447959171-20749-1-git-send-email-tj@kernel.org> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org This patch adds the extension for the xt_cgroup2 which matches packets based on the v2 cgroup path of the associated socket. v2: cgroup2_match->userspacesize and ->save and man page updated as per Jan. Signed-off-by: Tejun Heo Cc: Daniel Borkmann Cc: Jan Engelhardt --- extensions/libxt_cgroup2.c | 71 +++++++++++++++++++++++++++++++++++ extensions/libxt_cgroup2.man | 24 +++++++++++ include/linux/netfilter/xt_cgroup2.h | 15 +++++++ 3 files changed, 110 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html --- /dev/null +++ b/extensions/libxt_cgroup2.c @@ -0,0 +1,71 @@ +#include +#include +#include +#include +#include + +enum { + O_CGROUP2_PATH, +}; + +static void cgroup2_help(void) +{ + printf( +"cgroup2 match options:\n" +"[!] --path path path relative to cgroup2 root, recursive match\n"); +} + +static const struct xt_option_entry cgroup2_opts[] = { + { + .name = "path", + .id = O_CGROUP2_PATH, + .type = XTTYPE_STRING, + .flags = XTOPT_INVERT | XTOPT_MAND | XTOPT_PUT, + XTOPT_POINTER(struct xt_cgroup2_info, path) + }, + XTOPT_TABLEEND, +}; + +static void cgroup2_parse(struct xt_option_call *cb) +{ + struct xt_cgroup2_info *info = cb->data; + + xtables_option_parse(cb); + + if (cb->invert) + info->invert = true; +} + +static void cgroup2_print(const void *ip, const struct xt_entry_match *match, + int numeric) +{ + const struct xt_cgroup2_info *info = (void *)match->data; + + printf(" cgroup2 %s%s", info->invert ? "! ":"", info->path); +} + +static void cgroup2_save(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_cgroup2_info *info = (void *)match->data; + + printf("%s --path", info->invert ? " !" : ""); + xtables_save_string(info->path); +} + +static struct xtables_match cgroup2_match = { + .family = NFPROTO_UNSPEC, + .name = "cgroup2", + .version = XTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_cgroup2_info)), + .userspacesize = offsetof(struct xt_cgroup2_info, priv), + .help = cgroup2_help, + .print = cgroup2_print, + .save = cgroup2_save, + .x6_parse = cgroup2_parse, + .x6_options = cgroup2_opts, +}; + +void _init(void) +{ + xtables_register_match(&cgroup2_match); +} --- /dev/null +++ b/extensions/libxt_cgroup2.man @@ -0,0 +1,24 @@ +.TP +[\fB!\fP] \fB\-\-path\fP \fIpath\fP +Match cgroup2 membership. + +Each socket is associated with the v2 cgroup of the creating process. +This matches packets coming from or going to all sockets in the +sub-hierarchy of the specified path. The path should be relative to +the root of the cgroup2 hierarchy. Can be used in the OUTPUT and +INPUT chains to assign particular firewall policies for aggregated +processes on the system. This allows for more fine-grained firewall +policies that only match for a subset of the system's processes. + +\fBIMPORTANT\fP: when being used in the INPUT chain, the cgroup2 +matcher is currently only of limited functionality, meaning it +will only match on packets that are processed for local sockets +through early socket demuxing. Therefore, general usage on the +INPUT chain is not advised unless the implications are well +understood. +.PP +Example: +.IP +iptables \-A OUTPUT \-p tcp \-\-sport 80 \-m cgroup2 ! \-\-path service/http-server \-j DROP +.PP +Available since Linux 4.5. --- /dev/null +++ b/include/linux/netfilter/xt_cgroup2.h @@ -0,0 +1,15 @@ +#ifndef _XT_CGROUP2_H +#define _XT_CGROUP2_H + +#include +#include + +struct xt_cgroup2_info { + char path[PATH_MAX]; + __u8 invert; + + /* kernel internal data */ + void *priv __attribute__((aligned(8))); +}; + +#endif /* _XT_CGROUP2_H */