1 /* Kernel module to match various things tied to sockets associated with
2 locally generated outgoing packets. */
4 /* (C) 2000-2001 Marc Boucher <marc@mbsi.ca>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
13 #include <linux/file.h>
16 #include <linux/netfilter_ipv6/ip6t_owner.h>
17 #include <linux/netfilter_ipv6/ip6_tables.h>
19 MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
20 MODULE_DESCRIPTION("IP6 tables owner matching module");
21 MODULE_LICENSE("GPL");
24 match_pid(const struct sk_buff *skb, pid_t pid)
26 struct task_struct *p;
27 struct files_struct *files;
30 read_lock(&tasklist_lock);
31 p = find_task_by_pid(pid);
37 spin_lock(&files->file_lock);
38 for (i=0; i < files->max_fds; i++) {
39 if (fcheck_files(files, i) == skb->sk->sk_socket->file) {
40 spin_unlock(&files->file_lock);
42 read_unlock(&tasklist_lock);
46 spin_unlock(&files->file_lock);
50 read_unlock(&tasklist_lock);
55 match_sid(const struct sk_buff *skb, pid_t sid)
57 struct task_struct *g, *p;
58 struct file *file = skb->sk->sk_socket->file;
61 read_lock(&tasklist_lock);
62 do_each_thread(g, p) {
63 struct files_struct *files;
64 if (p->signal->session != sid)
70 spin_lock(&files->file_lock);
71 for (i=0; i < files->max_fds; i++) {
72 if (fcheck_files(files, i) == file) {
77 spin_unlock(&files->file_lock);
82 } while_each_thread(g, p);
84 read_unlock(&tasklist_lock);
90 match(const struct sk_buff *skb,
91 const struct net_device *in,
92 const struct net_device *out,
93 const void *matchinfo,
99 const struct ip6t_owner_info *info = matchinfo;
101 if (!skb->sk || !skb->sk->sk_socket || !skb->sk->sk_socket->file)
104 if(info->match & IP6T_OWNER_UID) {
105 if((skb->sk->sk_socket->file->f_uid != info->uid) ^
106 !!(info->invert & IP6T_OWNER_UID))
110 if(info->match & IP6T_OWNER_GID) {
111 if((skb->sk->sk_socket->file->f_gid != info->gid) ^
112 !!(info->invert & IP6T_OWNER_GID))
116 if(info->match & IP6T_OWNER_PID) {
117 if (!match_pid(skb, info->pid) ^
118 !!(info->invert & IP6T_OWNER_PID))
122 if(info->match & IP6T_OWNER_SID) {
123 if (!match_sid(skb, info->sid) ^
124 !!(info->invert & IP6T_OWNER_SID))
132 checkentry(const char *tablename,
133 const struct ip6t_ip6 *ip,
135 unsigned int matchsize,
136 unsigned int hook_mask)
139 & ~((1 << NF_IP6_LOCAL_OUT) | (1 << NF_IP6_POST_ROUTING))) {
140 printk("ip6t_owner: only valid for LOCAL_OUT or POST_ROUTING.\n");
144 if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_owner_info)))
150 static struct ip6t_match owner_match = {
153 .checkentry = &checkentry,
157 static int __init init(void)
159 return ip6t_register_match(&owner_match);
162 static void __exit fini(void)
164 ip6t_unregister_match(&owner_match);