1 /* Kernel module to match various things tied to sockets associated with
2 locally generated outgoing packets. */
4 /* (C) 2000 Marc Boucher <marc@mbsi.ca>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/file.h>
16 #include <linux/netfilter_ipv4/ipt_owner.h>
17 #include <linux/netfilter_ipv4/ip_tables.h>
19 MODULE_LICENSE("GPL");
20 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
21 MODULE_DESCRIPTION("iptables owner match");
24 match_comm(const struct sk_buff *skb, const char *comm)
26 struct task_struct *g, *p;
27 struct files_struct *files;
30 read_lock(&tasklist_lock);
31 do_each_thread(g, p) {
32 if(strncmp(p->comm, comm, sizeof(p->comm)))
38 spin_lock(&files->file_lock);
39 for (i=0; i < files->max_fds; i++) {
40 if (fcheck_files(files, i) ==
41 skb->sk->sk_socket->file) {
42 spin_unlock(&files->file_lock);
44 read_unlock(&tasklist_lock);
48 spin_unlock(&files->file_lock);
51 } while_each_thread(g, p);
52 read_unlock(&tasklist_lock);
57 match_pid(const struct sk_buff *skb, pid_t pid)
59 struct task_struct *p;
60 struct files_struct *files;
63 read_lock(&tasklist_lock);
64 p = find_task_by_real_pid(pid);
70 spin_lock(&files->file_lock);
71 for (i=0; i < files->max_fds; i++) {
72 if (fcheck_files(files, i) ==
73 skb->sk->sk_socket->file) {
74 spin_unlock(&files->file_lock);
76 read_unlock(&tasklist_lock);
80 spin_unlock(&files->file_lock);
84 read_unlock(&tasklist_lock);
89 match_sid(const struct sk_buff *skb, pid_t sid)
91 struct task_struct *g, *p;
92 struct file *file = skb->sk->sk_socket->file;
95 read_lock(&tasklist_lock);
96 do_each_thread(g, p) {
97 struct files_struct *files;
98 if (p->signal->session != sid)
104 spin_lock(&files->file_lock);
105 for (i=0; i < files->max_fds; i++) {
106 if (fcheck_files(files, i) == file) {
111 spin_unlock(&files->file_lock);
116 } while_each_thread(g, p);
118 read_unlock(&tasklist_lock);
124 match(const struct sk_buff *skb,
125 const struct net_device *in,
126 const struct net_device *out,
127 const void *matchinfo,
131 const struct ipt_owner_info *info = matchinfo;
133 if (!skb->sk || !skb->sk->sk_socket || !skb->sk->sk_socket->file)
136 if(info->match & IPT_OWNER_UID) {
137 if ((skb->sk->sk_socket->file->f_uid != info->uid) ^
138 !!(info->invert & IPT_OWNER_UID))
142 if(info->match & IPT_OWNER_GID) {
143 if ((skb->sk->sk_socket->file->f_gid != info->gid) ^
144 !!(info->invert & IPT_OWNER_GID))
148 if(info->match & IPT_OWNER_PID) {
149 if (!match_pid(skb, info->pid) ^
150 !!(info->invert & IPT_OWNER_PID))
154 if(info->match & IPT_OWNER_SID) {
155 if (!match_sid(skb, info->sid) ^
156 !!(info->invert & IPT_OWNER_SID))
160 if(info->match & IPT_OWNER_COMM) {
161 if (!match_comm(skb, info->comm) ^
162 !!(info->invert & IPT_OWNER_COMM))
170 checkentry(const char *tablename,
171 const struct ipt_ip *ip,
173 unsigned int matchsize,
174 unsigned int hook_mask)
177 & ~((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING))) {
178 printk("ipt_owner: only valid for LOCAL_OUT or POST_ROUTING.\n");
182 if (matchsize != IPT_ALIGN(sizeof(struct ipt_owner_info))) {
183 printk("Matchsize %u != %Zu\n", matchsize,
184 IPT_ALIGN(sizeof(struct ipt_owner_info)));
188 /* files->file_lock can not be used in a BH */
189 if (((struct ipt_owner_info *)matchinfo)->match
190 & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
191 printk("ipt_owner: pid, sid and command matching is broken "
199 static struct ipt_match owner_match = {
202 .checkentry = &checkentry,
206 static int __init init(void)
208 return ipt_register_match(&owner_match);
211 static void __exit fini(void)
213 ipt_unregister_match(&owner_match);