2 * Kernel module to match various things tied to sockets associated with
3 * locally generated outgoing packets.
5 * (C) 2000 Marc Boucher <marc@mbsi.ca>
7 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
8 * <jengelh@computergmbh.de>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
14 #include <linux/module.h>
15 #include <linux/skbuff.h>
16 #include <linux/file.h>
18 #include <linux/netfilter/x_tables.h>
19 #include <linux/netfilter/xt_owner.h>
20 #include <linux/netfilter_ipv4/ipt_owner.h>
21 #include <linux/netfilter_ipv6/ip6t_owner.h>
24 owner_mt_v0(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
26 const struct ipt_owner_info
*info
= par
->matchinfo
;
27 const struct file
*filp
;
29 if (skb
->sk
== NULL
|| skb
->sk
->sk_socket
== NULL
)
32 filp
= skb
->sk
->sk_socket
->file
;
36 if (info
->match
& IPT_OWNER_UID
)
37 if ((filp
->f_uid
!= info
->uid
) ^
38 !!(info
->invert
& IPT_OWNER_UID
))
41 if (info
->match
& IPT_OWNER_GID
)
42 if ((filp
->f_gid
!= info
->gid
) ^
43 !!(info
->invert
& IPT_OWNER_GID
))
50 owner_mt6_v0(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
52 const struct ip6t_owner_info
*info
= par
->matchinfo
;
53 const struct file
*filp
;
55 if (skb
->sk
== NULL
|| skb
->sk
->sk_socket
== NULL
)
58 filp
= skb
->sk
->sk_socket
->file
;
62 if (info
->match
& IP6T_OWNER_UID
)
63 if ((filp
->f_uid
!= info
->uid
) ^
64 !!(info
->invert
& IP6T_OWNER_UID
))
67 if (info
->match
& IP6T_OWNER_GID
)
68 if ((filp
->f_gid
!= info
->gid
) ^
69 !!(info
->invert
& IP6T_OWNER_GID
))
76 owner_mt(const struct sk_buff
*skb
, const struct xt_match_param
*par
)
78 const struct xt_owner_match_info
*info
= par
->matchinfo
;
79 const struct file
*filp
;
81 if (skb
->sk
== NULL
|| skb
->sk
->sk_socket
== NULL
)
82 return (info
->match
^ info
->invert
) == 0;
83 else if (info
->match
& info
->invert
& XT_OWNER_SOCKET
)
85 * Socket exists but user wanted ! --socket-exists.
86 * (Single ampersands intended.)
90 filp
= skb
->sk
->sk_socket
->file
;
92 return ((info
->match
^ info
->invert
) &
93 (XT_OWNER_UID
| XT_OWNER_GID
)) == 0;
95 if (info
->match
& XT_OWNER_UID
)
96 if ((filp
->f_uid
>= info
->uid_min
&&
97 filp
->f_uid
<= info
->uid_max
) ^
98 !(info
->invert
& XT_OWNER_UID
))
101 if (info
->match
& XT_OWNER_GID
)
102 if ((filp
->f_gid
>= info
->gid_min
&&
103 filp
->f_gid
<= info
->gid_max
) ^
104 !(info
->invert
& XT_OWNER_GID
))
111 owner_mt_check_v0(const char *tablename
, const void *ip
,
112 const struct xt_match
*match
, void *matchinfo
,
113 unsigned int hook_mask
)
115 const struct ipt_owner_info
*info
= matchinfo
;
117 if (info
->match
& (IPT_OWNER_PID
| IPT_OWNER_SID
| IPT_OWNER_COMM
)) {
118 printk(KERN_WARNING KBUILD_MODNAME
119 ": PID, SID and command matching is not "
120 "supported anymore\n");
128 owner_mt6_check_v0(const char *tablename
, const void *ip
,
129 const struct xt_match
*match
, void *matchinfo
,
130 unsigned int hook_mask
)
132 const struct ip6t_owner_info
*info
= matchinfo
;
134 if (info
->match
& (IP6T_OWNER_PID
| IP6T_OWNER_SID
)) {
135 printk(KERN_WARNING KBUILD_MODNAME
136 ": PID and SID matching is not supported anymore\n");
143 static struct xt_match owner_mt_reg
[] __read_mostly
= {
147 .family
= NFPROTO_IPV4
,
148 .match
= owner_mt_v0
,
149 .matchsize
= sizeof(struct ipt_owner_info
),
150 .checkentry
= owner_mt_check_v0
,
151 .hooks
= (1 << NF_INET_LOCAL_OUT
) |
152 (1 << NF_INET_POST_ROUTING
),
158 .family
= NFPROTO_IPV6
,
159 .match
= owner_mt6_v0
,
160 .matchsize
= sizeof(struct ip6t_owner_info
),
161 .checkentry
= owner_mt6_check_v0
,
162 .hooks
= (1 << NF_INET_LOCAL_OUT
) |
163 (1 << NF_INET_POST_ROUTING
),
169 .family
= NFPROTO_IPV4
,
171 .matchsize
= sizeof(struct xt_owner_match_info
),
172 .hooks
= (1 << NF_INET_LOCAL_OUT
) |
173 (1 << NF_INET_POST_ROUTING
),
179 .family
= NFPROTO_IPV6
,
181 .matchsize
= sizeof(struct xt_owner_match_info
),
182 .hooks
= (1 << NF_INET_LOCAL_OUT
) |
183 (1 << NF_INET_POST_ROUTING
),
188 static int __init
owner_mt_init(void)
190 return xt_register_matches(owner_mt_reg
, ARRAY_SIZE(owner_mt_reg
));
193 static void __exit
owner_mt_exit(void)
195 xt_unregister_matches(owner_mt_reg
, ARRAY_SIZE(owner_mt_reg
));
198 module_init(owner_mt_init
);
199 module_exit(owner_mt_exit
);
200 MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
201 MODULE_DESCRIPTION("Xtables: socket owner matching");
202 MODULE_LICENSE("GPL");
203 MODULE_ALIAS("ipt_owner");
204 MODULE_ALIAS("ip6t_owner");