[deliverable/linux.git] / net / netfilter / xt_owner.c

/*
 * Kernel module to match various things tied to sockets associated with
 * locally generated outgoing packets.
 *
 * (C) 2000 Marc Boucher <marc@mbsi.ca>
 *
 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
 * <jengelh@computergmbh.de>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/file.h>
#include <net/sock.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_owner.h>
#include <linux/netfilter_ipv4/ipt_owner.h>
#include <linux/netfilter_ipv6/ip6t_owner.h>

static bool
owner_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct ipt_owner_info *info = par->matchinfo;
	const struct file *filp;

	if (skb->sk == NULL || skb->sk->sk_socket == NULL)
		return false;

	filp = skb->sk->sk_socket->file;
	if (filp == NULL)
		return false;

	if (info->match & IPT_OWNER_UID)
		if ((filp->f_uid != info->uid) ^
		    !!(info->invert & IPT_OWNER_UID))
			return false;

	if (info->match & IPT_OWNER_GID)
		if ((filp->f_gid != info->gid) ^
		    !!(info->invert & IPT_OWNER_GID))
			return false;

	return true;
}

static bool
owner_mt6_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct ip6t_owner_info *info = par->matchinfo;
	const struct file *filp;

	if (skb->sk == NULL || skb->sk->sk_socket == NULL)
		return false;

	filp = skb->sk->sk_socket->file;
	if (filp == NULL)
		return false;

	if (info->match & IP6T_OWNER_UID)
		if ((filp->f_uid != info->uid) ^
		    !!(info->invert & IP6T_OWNER_UID))
			return false;

	if (info->match & IP6T_OWNER_GID)
		if ((filp->f_gid != info->gid) ^
		    !!(info->invert & IP6T_OWNER_GID))
			return false;

	return true;
}

static bool
owner_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_owner_match_info *info = par->matchinfo;
	const struct file *filp;

	if (skb->sk == NULL || skb->sk->sk_socket == NULL)
		return (info->match ^ info->invert) == 0;
	else if (info->match & info->invert & XT_OWNER_SOCKET)
		/*
		 * Socket exists but user wanted ! --socket-exists.
		 * (Single ampersands intended.)
		 */
		return false;

	filp = skb->sk->sk_socket->file;
	if (filp == NULL)
		return ((info->match ^ info->invert) &
		       (XT_OWNER_UID | XT_OWNER_GID)) == 0;

	if (info->match & XT_OWNER_UID)
		if ((filp->f_uid >= info->uid_min &&
		    filp->f_uid <= info->uid_max) ^
		    !(info->invert & XT_OWNER_UID))
			return false;

	if (info->match & XT_OWNER_GID)
		if ((filp->f_gid >= info->gid_min &&
		    filp->f_gid <= info->gid_max) ^
		    !(info->invert & XT_OWNER_GID))
			return false;

	return true;
}

static bool
owner_mt_check_v0(const char *tablename, const void *ip,
                  const struct xt_match *match, void *matchinfo,
                  unsigned int hook_mask)
{
	const struct ipt_owner_info *info = matchinfo;

	if (info->match & (IPT_OWNER_PID | IPT_OWNER_SID | IPT_OWNER_COMM)) {
		printk(KERN_WARNING KBUILD_MODNAME
		       ": PID, SID and command matching is not "
		       "supported anymore\n");
		return false;
	}

	return true;
}

static bool
owner_mt6_check_v0(const char *tablename, const void *ip,
                   const struct xt_match *match, void *matchinfo,
                   unsigned int hook_mask)
{
	const struct ip6t_owner_info *info = matchinfo;

	if (info->match & (IP6T_OWNER_PID | IP6T_OWNER_SID)) {
		printk(KERN_WARNING KBUILD_MODNAME
		       ": PID and SID matching is not supported anymore\n");
		return false;
	}

	return true;
}

static struct xt_match owner_mt_reg[] __read_mostly = {
	{
		.name       = "owner",
		.revision   = 0,
		.family     = NFPROTO_IPV4,
		.match      = owner_mt_v0,
		.matchsize  = sizeof(struct ipt_owner_info),
		.checkentry = owner_mt_check_v0,
		.hooks      = (1 << NF_INET_LOCAL_OUT) |
		              (1 << NF_INET_POST_ROUTING),
		.me         = THIS_MODULE,
	},
	{
		.name       = "owner",
		.revision   = 0,
		.family     = NFPROTO_IPV6,
		.match      = owner_mt6_v0,
		.matchsize  = sizeof(struct ip6t_owner_info),
		.checkentry = owner_mt6_check_v0,
		.hooks      = (1 << NF_INET_LOCAL_OUT) |
		              (1 << NF_INET_POST_ROUTING),
		.me         = THIS_MODULE,
	},
	{
		.name       = "owner",
		.revision   = 1,
		.family     = NFPROTO_IPV4,
		.match      = owner_mt,
		.matchsize  = sizeof(struct xt_owner_match_info),
		.hooks      = (1 << NF_INET_LOCAL_OUT) |
		              (1 << NF_INET_POST_ROUTING),
		.me         = THIS_MODULE,
	},
	{
		.name       = "owner",
		.revision   = 1,
		.family     = NFPROTO_IPV6,
		.match      = owner_mt,
		.matchsize  = sizeof(struct xt_owner_match_info),
		.hooks      = (1 << NF_INET_LOCAL_OUT) |
		              (1 << NF_INET_POST_ROUTING),
		.me         = THIS_MODULE,
	},
};

static int __init owner_mt_init(void)
{
	return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
}

static void __exit owner_mt_exit(void)
{
	xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
}

module_init(owner_mt_init);
module_exit(owner_mt_exit);
MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
MODULE_DESCRIPTION("Xtables: socket owner matching");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_owner");
MODULE_ALIAS("ip6t_owner");
Commit	Line	Data
0265ab44 JE	1	/*
	2	* Kernel module to match various things tied to sockets associated with
	3	* locally generated outgoing packets.
	4	*
	5	* (C) 2000 Marc Boucher <marc@mbsi.ca>
	6	*
edc26f7a JE	7	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
edc26f7a JE	8	* <jengelh@computergmbh.de>
0265ab44 JE	9	*
	10	* This program is free software; you can redistribute it and/or modify
	11	* it under the terms of the GNU General Public License version 2 as
	12	* published by the Free Software Foundation.
	13	*/
	14	#include <linux/module.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/file.h>
	17	#include <net/sock.h>
	18	#include <linux/netfilter/x_tables.h>
	19	#include <linux/netfilter/xt_owner.h>
	20	#include <linux/netfilter_ipv4/ipt_owner.h>
	21	#include <linux/netfilter_ipv6/ip6t_owner.h>
	22
	23	static bool
f7108a20	24	owner_mt_v0(const struct sk_buff skb, const struct xt_match_param par)
0265ab44	25	{
f7108a20	26	const struct ipt_owner_info *info = par->matchinfo;
0265ab44 JE	27	const struct file *filp;
	28
	29	if (skb->sk == NULL \|\| skb->sk->sk_socket == NULL)
	30	return false;
	31
	32	filp = skb->sk->sk_socket->file;
	33	if (filp == NULL)
	34	return false;
	35
	36	if (info->match & IPT_OWNER_UID)
	37	if ((filp->f_uid != info->uid) ^
	38	!!(info->invert & IPT_OWNER_UID))
	39	return false;
	40
	41	if (info->match & IPT_OWNER_GID)
	42	if ((filp->f_gid != info->gid) ^
	43	!!(info->invert & IPT_OWNER_GID))
	44	return false;
	45
	46	return true;
	47	}
	48
	49	static bool
f7108a20	50	owner_mt6_v0(const struct sk_buff skb, const struct xt_match_param par)
0265ab44	51	{
f7108a20	52	const struct ip6t_owner_info *info = par->matchinfo;
0265ab44 JE	53	const struct file *filp;
	54
	55	if (skb->sk == NULL \|\| skb->sk->sk_socket == NULL)
	56	return false;
	57
	58	filp = skb->sk->sk_socket->file;
	59	if (filp == NULL)
	60	return false;
	61
	62	if (info->match & IP6T_OWNER_UID)
	63	if ((filp->f_uid != info->uid) ^
	64	!!(info->invert & IP6T_OWNER_UID))
	65	return false;
	66
	67	if (info->match & IP6T_OWNER_GID)
	68	if ((filp->f_gid != info->gid) ^
	69	!!(info->invert & IP6T_OWNER_GID))
	70	return false;
	71
	72	return true;
	73	}
	74
	75	static bool
f7108a20	76	owner_mt(const struct sk_buff skb, const struct xt_match_param par)
0265ab44	77	{
f7108a20	78	const struct xt_owner_match_info *info = par->matchinfo;
0265ab44 JE	79	const struct file *filp;
	80
	81	if (skb->sk == NULL \|\| skb->sk->sk_socket == NULL)
	82	return (info->match ^ info->invert) == 0;
	83	else if (info->match & info->invert & XT_OWNER_SOCKET)
	84	/*
	85	* Socket exists but user wanted ! --socket-exists.
	86	* (Single ampersands intended.)
	87	*/
	88	return false;
	89
	90	filp = skb->sk->sk_socket->file;
	91	if (filp == NULL)
	92	return ((info->match ^ info->invert) &
	93	(XT_OWNER_UID \| XT_OWNER_GID)) == 0;
	94
	95	if (info->match & XT_OWNER_UID)
edc26f7a JE	96	if ((filp->f_uid >= info->uid_min &&
	97	filp->f_uid <= info->uid_max) ^
	98	!(info->invert & XT_OWNER_UID))
0265ab44 JE	99	return false;
	100
	101	if (info->match & XT_OWNER_GID)
edc26f7a JE	102	if ((filp->f_gid >= info->gid_min &&
	103	filp->f_gid <= info->gid_max) ^
	104	!(info->invert & XT_OWNER_GID))
0265ab44 JE	105	return false;
	106
	107	return true;
	108	}
	109
	110	static bool
	111	owner_mt_check_v0(const char tablename, const void ip,
	112	const struct xt_match match, void matchinfo,
	113	unsigned int hook_mask)
	114	{
	115	const struct ipt_owner_info *info = matchinfo;
	116
	117	if (info->match & (IPT_OWNER_PID \| IPT_OWNER_SID \| IPT_OWNER_COMM)) {
	118	printk(KERN_WARNING KBUILD_MODNAME
	119	": PID, SID and command matching is not "
	120	"supported anymore\n");
	121	return false;
	122	}
	123
	124	return true;
	125	}
	126
	127	static bool
	128	owner_mt6_check_v0(const char tablename, const void ip,
	129	const struct xt_match match, void matchinfo,
	130	unsigned int hook_mask)
	131	{
	132	const struct ip6t_owner_info *info = matchinfo;
	133
	134	if (info->match & (IP6T_OWNER_PID \| IP6T_OWNER_SID)) {
	135	printk(KERN_WARNING KBUILD_MODNAME
	136	": PID and SID matching is not supported anymore\n");
	137	return false;
	138	}
	139
	140	return true;
	141	}
	142
	143	static struct xt_match owner_mt_reg[] __read_mostly = {
	144	{
	145	.name = "owner",
	146	.revision = 0,
ee999d8b	147	.family = NFPROTO_IPV4,
0265ab44 JE	148	.match = owner_mt_v0,
	149	.matchsize = sizeof(struct ipt_owner_info),
	150	.checkentry = owner_mt_check_v0,
	151	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	152	(1 << NF_INET_POST_ROUTING),
	153	.me = THIS_MODULE,
	154	},
	155	{
	156	.name = "owner",
	157	.revision = 0,
ee999d8b	158	.family = NFPROTO_IPV6,
0265ab44 JE	159	.match = owner_mt6_v0,
	160	.matchsize = sizeof(struct ip6t_owner_info),
	161	.checkentry = owner_mt6_check_v0,
	162	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	163	(1 << NF_INET_POST_ROUTING),
	164	.me = THIS_MODULE,
	165	},
	166	{
	167	.name = "owner",
	168	.revision = 1,
ee999d8b	169	.family = NFPROTO_IPV4,
0265ab44 JE	170	.match = owner_mt,
	171	.matchsize = sizeof(struct xt_owner_match_info),
	172	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	173	(1 << NF_INET_POST_ROUTING),
	174	.me = THIS_MODULE,
	175	},
	176	{
	177	.name = "owner",
	178	.revision = 1,
ee999d8b	179	.family = NFPROTO_IPV6,
0265ab44 JE	180	.match = owner_mt,
	181	.matchsize = sizeof(struct xt_owner_match_info),
	182	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	183	(1 << NF_INET_POST_ROUTING),
	184	.me = THIS_MODULE,
	185	},
	186	};
	187
	188	static int __init owner_mt_init(void)
	189	{
	190	return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
	191	}
	192
	193	static void __exit owner_mt_exit(void)
	194	{
	195	xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
	196	}
	197
	198	module_init(owner_mt_init);
	199	module_exit(owner_mt_exit);
	200	MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
2ae15b64	201	MODULE_DESCRIPTION("Xtables: socket owner matching");
0265ab44 JE	202	MODULE_LICENSE("GPL");
	203	MODULE_ALIAS("ipt_owner");
	204	MODULE_ALIAS("ip6t_owner");