UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

netfilter: nfnetlink_queue: enable classid socket info retrieval 

This enables associating a socket with a v1 net_cls cgroup. Useful for
applying a per-cgroup policy when processing packets in userspace.

Signed-off-by: Eric Sage <eric_sage@apple.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
This commit is contained in:
Eric Sage 2023-03-27 13:44:49 -04:00 committed by Florian Westphal
parent 356e2adb3f
commit 28c1b6df43
2 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
include/uapi/linux/netfilter/nfnetlink_queue.h
View File

@ -62,6 +62,7 @@ enum nfqnl_attr_type {
NFQA_VLAN, /* nested attribute: packet vlan info */
NFQA_L2HDR, /* full L2 header */
NFQA_PRIORITY, /* skb->priority */
NFQA_CGROUP_CLASSID, /* __u32 cgroup classid */
__NFQA_MAX
};

20
net/netfilter/nfnetlink_queue.c
View File

@ -29,6 +29,7 @@
#include <linux/netfilter/nfnetlink_queue.h>
#include <linux/netfilter/nf_conntrack_common.h>
#include <linux/list.h>
#include <linux/cgroup-defs.h>
#include <net/sock.h>
#include <net/tcp_states.h>
#include <net/netfilter/nf_queue.h>
@ -301,6 +302,19 @@ nla_put_failure:
return -1;
}
static int nfqnl_put_sk_classid(struct sk_buff *skb, struct sock *sk)
{
#if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)
if (sk && sk_fullsock(sk)) {
u32 classid = sock_cgroup_classid(&sk->sk_cgrp_data);
if (classid && nla_put_be32(skb, NFQA_CGROUP_CLASSID, htonl(classid)))
return -1;
}
#endif
return 0;
}
static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata)
{
u32 seclen = 0;
@ -406,6 +420,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ nla_total_size(sizeof(u_int32_t)) /* priority */
+ nla_total_size(sizeof(struct nfqnl_msg_packet_hw))
+ nla_total_size(sizeof(u_int32_t)) /* skbinfo */
#if IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)
+ nla_total_size(sizeof(u_int32_t)) /* classid */
#endif
+ nla_total_size(sizeof(u_int32_t)); /* cap_len */
tstamp = skb_tstamp_cond(entskb, false);
@ -599,6 +616,9 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
nfqnl_put_sk_uidgid(skb, entskb->sk) < 0)
goto nla_put_failure;
if (nfqnl_put_sk_classid(skb, entskb->sk) < 0)
goto nla_put_failure;
if (seclen && nla_put(skb, NFQA_SECCTX, seclen, secdata))
goto nla_put_failure;