Commit 28c1b6df authored by Eric Sage's avatar Eric Sage Committed by Florian Westphal
Browse files

netfilter: nfnetlink_queue: enable classid socket info retrieval 



This enables associating a socket with a v1 net_cls cgroup. Useful for
applying a per-cgroup policy when processing packets in userspace.

Signed-off-by: default avatarEric Sage <eric_sage@apple.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
parent 356e2adb

include/uapi/linux/netfilter/nfnetlink_queue.h

+1 −0
Original line number Diff line number Diff line
@@ -62,6 +62,7 @@ enum nfqnl_attr_type { 
	NFQA_VLAN,			/* nested attribute: packet vlan info */

	NFQA_L2HDR,			/* full L2 header */

	NFQA_PRIORITY,			/* skb->priority */

	NFQA_CGROUP_CLASSID,		/* __u32 cgroup classid */



	__NFQA_MAX

};

net/netfilter/nfnetlink_queue.c

+20 −0
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ 
#include <linux/netfilter/nfnetlink_queue.h>

#include <linux/netfilter/nf_conntrack_common.h>

#include <linux/list.h>

#include <linux/cgroup-defs.h>

#include <net/sock.h>

#include <net/tcp_states.h>

#include <net/netfilter/nf_queue.h>
@@ -301,6 +302,19 @@ static int nfqnl_put_sk_uidgid(struct sk_buff *skb, struct sock *sk) 
	return -1;

}



static int nfqnl_put_sk_classid(struct sk_buff *skb, struct sock *sk)

{

#if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)

	if (sk && sk_fullsock(sk)) {

		u32 classid = sock_cgroup_classid(&sk->sk_cgrp_data);



		if (classid && nla_put_be32(skb, NFQA_CGROUP_CLASSID, htonl(classid)))

			return -1;

	}

#endif

	return 0;

}



static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)

{

	u32 seclen = 0;
@@ -406,6 +420,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, 
		+ nla_total_size(sizeof(u_int32_t))	/* priority */

		+ nla_total_size(sizeof(struct nfqnl_msg_packet_hw))

		+ nla_total_size(sizeof(u_int32_t))	/* skbinfo */

#if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)

		+ nla_total_size(sizeof(u_int32_t))	/* classid */

#endif

		+ nla_total_size(sizeof(u_int32_t));	/* cap_len */



	tstamp = skb_tstamp_cond(entskb, false);
@@ -599,6 +616,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, 
	    nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)

		goto nla_put_failure;



	if (nfqnl_put_sk_classid(skb, entskb->sk) < 0)

		goto nla_put_failure;



	if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))

		goto nla_put_failure;