netfilter: xt_socket: add XT_SOCKET_RESTORESKMARK flag
xt_socket is useful for matching sockets with IP_TRANSPARENT and taking some action on the matching packets. However, it lacks the ability to match only a small subset of transparent sockets. Suppose there are 2 applications, each with its own set of transparent sockets. The first application wants all matching packets dropped, while the second application wants them forwarded somewhere else. Add the ability to retore the skb->mark from the sk_mark. The mark is only restored if a matching socket is found and the transparent / nowildcard conditions are satisfied. Now the 2 hypothetical applications can differentiate their sockets based on a mark value set with SO_MARK. iptables -t mangle -I PREROUTING -m socket --transparent \ --restore-skmark -j action iptables -t mangle -A action -m mark --mark 10 -j action2 iptables -t mangle -A action -m mark --mark 11 -j action3 Change-Id: Ica30d9303ac6bb265fce4ef095a952508b4a1f0c Signed-off-by: Harout Hedeshian <harouth@codeaurora.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Git-commit: 01555e74bde51444c6898ef1800fb2bc697d479e Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git [harouth@codeaurora.org: resolve trivial merge conflicts]
This commit is contained in:
parent
0d0a39cad4
commit
0dafe9e7da
|
@ -6,6 +6,7 @@
|
|||
enum {
|
||||
XT_SOCKET_TRANSPARENT = 1 << 0,
|
||||
XT_SOCKET_NOWILDCARD = 1 << 1,
|
||||
XT_SOCKET_RESTORESKMARK = 1 << 2,
|
||||
};
|
||||
|
||||
struct xt_socket_mtinfo1 {
|
||||
|
@ -18,6 +19,13 @@ struct xt_socket_mtinfo2 {
|
|||
};
|
||||
#define XT_SOCKET_FLAGS_V2 (XT_SOCKET_TRANSPARENT | XT_SOCKET_NOWILDCARD)
|
||||
|
||||
struct xt_socket_mtinfo3 {
|
||||
__u8 flags;
|
||||
};
|
||||
#define XT_SOCKET_FLAGS_V3 (XT_SOCKET_TRANSPARENT \
|
||||
| XT_SOCKET_NOWILDCARD \
|
||||
| XT_SOCKET_RESTORESKMARK)
|
||||
|
||||
void xt_socket_put_sk(struct sock *sk);
|
||||
struct sock *xt_socket_get4_sk(const struct sk_buff *skb,
|
||||
struct xt_action_param *par);
|
||||
|
|
|
@ -172,6 +172,7 @@ static bool
|
|||
socket_match(const struct sk_buff *skb, struct xt_action_param *par,
|
||||
const struct xt_socket_mtinfo1 *info)
|
||||
{
|
||||
struct sk_buff *pskb = (struct sk_buff *)skb;
|
||||
struct sock *sk;
|
||||
|
||||
sk = xt_socket_get4_sk(skb, par);
|
||||
|
@ -194,6 +195,10 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
|
|||
(sk->sk_state == TCP_TIME_WAIT &&
|
||||
inet_twsk(sk)->tw_transparent));
|
||||
|
||||
if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
|
||||
transparent)
|
||||
pskb->mark = sk->sk_mark;
|
||||
|
||||
if (sk != skb->sk)
|
||||
xt_socket_put_sk(sk);
|
||||
|
||||
|
@ -215,7 +220,7 @@ socket_mt4_v0(const struct sk_buff *skb, struct xt_action_param *par)
|
|||
}
|
||||
|
||||
static bool
|
||||
socket_mt4_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
socket_mt4_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
{
|
||||
return socket_match(skb, par, par->matchinfo);
|
||||
}
|
||||
|
@ -325,8 +330,9 @@ xt_socket_get6_sk(const struct sk_buff *skb, struct xt_action_param *par)
|
|||
EXPORT_SYMBOL(xt_socket_get6_sk);
|
||||
|
||||
static bool
|
||||
socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
|
||||
{
|
||||
struct sk_buff *pskb = (struct sk_buff *)skb;
|
||||
struct sock *sk;
|
||||
const struct xt_socket_mtinfo1 *info;
|
||||
|
||||
|
@ -352,6 +358,10 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
|
|||
(sk->sk_state == TCP_TIME_WAIT &&
|
||||
inet_twsk(sk)->tw_transparent));
|
||||
|
||||
if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
|
||||
transparent)
|
||||
pskb->mark = sk->sk_mark;
|
||||
|
||||
if (sk != skb->sk)
|
||||
xt_socket_put_sk(sk);
|
||||
|
||||
|
@ -385,6 +395,19 @@ static int socket_mt_v2_check(const struct xt_mtchk_param *par)
|
|||
return 0;
|
||||
}
|
||||
|
||||
static int socket_mt_v3_check(const struct xt_mtchk_param *par)
|
||||
{
|
||||
const struct xt_socket_mtinfo3 *info =
|
||||
(struct xt_socket_mtinfo3 *)par->matchinfo;
|
||||
|
||||
if (info->flags & ~XT_SOCKET_FLAGS_V3) {
|
||||
pr_info("unknown flags 0x%x\n",
|
||||
info->flags & ~XT_SOCKET_FLAGS_V3);
|
||||
return -EINVAL;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static struct xt_match socket_mt_reg[] __read_mostly = {
|
||||
{
|
||||
.name = "socket",
|
||||
|
@ -399,7 +422,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
|
|||
.name = "socket",
|
||||
.revision = 1,
|
||||
.family = NFPROTO_IPV4,
|
||||
.match = socket_mt4_v1_v2,
|
||||
.match = socket_mt4_v1_v2_v3,
|
||||
.checkentry = socket_mt_v1_check,
|
||||
.matchsize = sizeof(struct xt_socket_mtinfo1),
|
||||
.hooks = (1 << NF_INET_PRE_ROUTING) |
|
||||
|
@ -411,7 +434,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
|
|||
.name = "socket",
|
||||
.revision = 1,
|
||||
.family = NFPROTO_IPV6,
|
||||
.match = socket_mt6_v1_v2,
|
||||
.match = socket_mt6_v1_v2_v3,
|
||||
.checkentry = socket_mt_v1_check,
|
||||
.matchsize = sizeof(struct xt_socket_mtinfo1),
|
||||
.hooks = (1 << NF_INET_PRE_ROUTING) |
|
||||
|
@ -423,7 +446,7 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
|
|||
.name = "socket",
|
||||
.revision = 2,
|
||||
.family = NFPROTO_IPV4,
|
||||
.match = socket_mt4_v1_v2,
|
||||
.match = socket_mt4_v1_v2_v3,
|
||||
.checkentry = socket_mt_v2_check,
|
||||
.matchsize = sizeof(struct xt_socket_mtinfo1),
|
||||
.hooks = (1 << NF_INET_PRE_ROUTING) |
|
||||
|
@ -435,13 +458,37 @@ static struct xt_match socket_mt_reg[] __read_mostly = {
|
|||
.name = "socket",
|
||||
.revision = 2,
|
||||
.family = NFPROTO_IPV6,
|
||||
.match = socket_mt6_v1_v2,
|
||||
.match = socket_mt6_v1_v2_v3,
|
||||
.checkentry = socket_mt_v2_check,
|
||||
.matchsize = sizeof(struct xt_socket_mtinfo1),
|
||||
.hooks = (1 << NF_INET_PRE_ROUTING) |
|
||||
(1 << NF_INET_LOCAL_IN),
|
||||
.me = THIS_MODULE,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.name = "socket",
|
||||
.revision = 3,
|
||||
.family = NFPROTO_IPV4,
|
||||
.match = socket_mt4_v1_v2_v3,
|
||||
.checkentry = socket_mt_v3_check,
|
||||
.matchsize = sizeof(struct xt_socket_mtinfo1),
|
||||
.hooks = (1 << NF_INET_PRE_ROUTING) |
|
||||
(1 << NF_INET_LOCAL_IN),
|
||||
.me = THIS_MODULE,
|
||||
},
|
||||
#ifdef XT_SOCKET_HAVE_IPV6
|
||||
{
|
||||
.name = "socket",
|
||||
.revision = 3,
|
||||
.family = NFPROTO_IPV6,
|
||||
.match = socket_mt6_v1_v2_v3,
|
||||
.checkentry = socket_mt_v3_check,
|
||||
.matchsize = sizeof(struct xt_socket_mtinfo1),
|
||||
.hooks = (1 << NF_INET_PRE_ROUTING) |
|
||||
(1 << NF_INET_LOCAL_IN),
|
||||
.me = THIS_MODULE,
|
||||
},
|
||||
#endif
|
||||
};
|
||||
|
||||
|
|
Loading…
Reference in New Issue