Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1271621 > unrolled thread

[PATCH iptables] libxt_cgroup2: add support for cgroup2 path matching

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH iptables] libxt_cgroup2: add support for cgroup2 path matching Tejun Heo <tj@kernel.org> - 2015-11-17 20:50 +0100
    Re: [PATCH iptables] libxt_cgroup2: add support for cgroup2 path  matching Jan Engelhardt <jengelh@inai.de> - 2015-11-18 00:10 +0100
      Re: [PATCH iptables] libxt_cgroup2: add support for cgroup2 path  matching Tejun Heo <tj@kernel.org> - 2015-11-18 00:20 +0100

#1271621 — [PATCH iptables] libxt_cgroup2: add support for cgroup2 path matching

This patch adds the extension for the xt_cgroup2 which matches packets
based on the v2 cgroup path of the associated socket.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Daniel Borkmann <dborkman@redhat.com>
---
 extensions/libxt_cgroup2.c           |   70 +++++++++++++++++++++++++++++++++++
 extensions/libxt_cgroup2.man         |   24 ++++++++++++
 include/linux/netfilter/xt_cgroup2.h |   14 +++++++
 3 files changed, 108 insertions(+)

--- /dev/null
+++ b/extensions/libxt_cgroup2.c
@@ -0,0 +1,70 @@
+#include <stdio.h>
+#include <mntent.h>
+#include <xtables.h>
+#include <linux/netfilter/xt_cgroup2.h>
+#include <linux/limits.h>
+
+enum {
+	O_CGROUP2_PATH,
+};
+
+static void cgroup2_help(void)
+{
+	printf(
+"cgroup2 match options:\n"
+"[!] --path path                 path relative to cgroup2 root, recursive match\n");
+}
+
+static const struct xt_option_entry cgroup2_opts[] = {
+	{
+		.name = "path",
+		.id = O_CGROUP2_PATH,
+		.type = XTTYPE_STRING,
+		.flags = XTOPT_INVERT | XTOPT_MAND | XTOPT_PUT,
+		XTOPT_POINTER(struct xt_cgroup2_info, path)
+	},
+	XTOPT_TABLEEND,
+};
+
+static void cgroup2_parse(struct xt_option_call *cb)
+{
+	struct xt_cgroup2_info *info = cb->data;
+
+	xtables_option_parse(cb);
+
+	if (cb->invert)
+		info->invert = true;
+}
+
+static void cgroup2_print(const void *ip, const struct xt_entry_match *match,
+			  int numeric)
+{
+	const struct xt_cgroup2_info *info = (void *)match->data;
+
+	printf(" cgroup2 %s%s", info->invert ? "! ":"", info->path);
+}
+
+static void cgroup2_save(const void *ip, const struct xt_entry_match *match)
+{
+	const struct xt_cgroup2_info *info = (void *)match->data;
+
+	printf("%s --path %s", info->invert ? " !" : "", info->path);
+}
+
+static struct xtables_match cgroup2_match = {
+	.family		= NFPROTO_UNSPEC,
+	.name		= "cgroup2",
+	.version	= XTABLES_VERSION,
+	.size		= XT_ALIGN(sizeof(struct xt_cgroup2_info)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_cgroup2_info)),
+	.help		= cgroup2_help,
+	.print		= cgroup2_print,
+	.save		= cgroup2_save,
+	.x6_parse	= cgroup2_parse,
+	.x6_options	= cgroup2_opts,
+};
+
+void _init(void)
+{
+	xtables_register_match(&cgroup2_match);
+}
--- /dev/null
+++ b/extensions/libxt_cgroup2.man
@@ -0,0 +1,24 @@
+.TP
+[\fB!\fP] \fB\-\-path\fP \fIpath\fP
+Match cgroup2 membership.
+
+Each socket is associated with the v2 cgroup of the creating process.
+This matches packets coming from or going to all sockets in the
+sub-hierarchy of the specified path.  The path should be relative to
+the root of the cgroup2 hierarchy.  Can be used in the OUTPUT and
+INPUT chains to assign particular firewall policies for aggregated
+processes on the system. This allows for more fine-grained firewall
+policies that only match for a subset of the system's processes.
+
+\fBIMPORTANT\fP: when being used in the INPUT chain, the cgroup2
+matcher is currently only of limited functionality, meaning it
+will only match on packets that are processed for local sockets
+through early socket demuxing. Therefore, general usage on the
+INPUT chain is disadviced unless the implications are well
+understood.
+.PP
+Example:
+.IP
+iptables \-A OUTPUT \-p tcp \-\-sport 80 \-m cgroup2 ! \-\-path service/http-server \-j DROP
+.PP
+Available since Linux 4.5.
--- /dev/null
+++ b/include/linux/netfilter/xt_cgroup2.h
@@ -0,0 +1,14 @@
+#ifndef _XT_CGROUP2_H
+#define _XT_CGROUP2_H
+
+#include <linux/types.h>
+
+struct xt_cgroup2_info {
+	char				path[PATH_MAX];
+	__u8				invert;
+
+	/* kernel internal data */
+	void				*priv;
+};
+
+#endif /* _XT_CGROUP2_H */
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1271723 — Re: [PATCH iptables] libxt_cgroup2: add support for cgroup2 path matching

On Tuesday 2015-11-17 20:42, Tejun Heo wrote:
>+static void cgroup2_save(const void *ip, const struct xt_entry_match *match)
>+{
>+	const struct xt_cgroup2_info *info = (void *)match->data;
>+
>+	printf("%s --path %s", info->invert ? " !" : "", info->path);
>+}

Can cgroup path names contain anything fancy, like spaces, backslashes, etc.?
If so, xtables_save_string() will be needed here.

>+static struct xtables_match cgroup2_match = {
>+	.family		= NFPROTO_UNSPEC,
>+	.name		= "cgroup2",
>+	.version	= XTABLES_VERSION,
>+	.size		= XT_ALIGN(sizeof(struct xt_cgroup2_info)),
>+	.userspacesize	= XT_ALIGN(sizeof(struct xt_cgroup2_info)),

userspacesize must not include xt_cgroup2_info.priv.
Change to offsetof(...), cf. other .c modules which do this.


>+++ b/extensions/libxt_cgroup2.man
>@@ -0,0 +1,24 @@
>+.TP
>+[\fB!\fP] \fB\-\-path\fP \fIpath\fP
>+Match cgroup2 membership.
>+
>+Each socket is associated with the v2 cgroup of the creating process.
>+This matches packets coming from or going to all sockets in the
>+sub-hierarchy of the specified path.  The path should be relative to
>+the root of the cgroup2 hierarchy.  Can be used in the OUTPUT and
>+INPUT chains to assign particular firewall policies for aggregated
>+processes on the system. This allows for more fine-grained firewall
>+policies that only match for a subset of the system's processes.
>+
>+\fBIMPORTANT\fP: when being used in the INPUT chain, the cgroup2
>+matcher is currently only of limited functionality, meaning it
>+will only match on packets that are processed for local sockets
>+through early socket demuxing. Therefore, general usage on the
>+INPUT chain is disadviced unless the implications are well

is disadviced (sic)  -> is not advised
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1271736 — Re: [PATCH iptables] libxt_cgroup2: add support for cgroup2 path matching

Hello,

On Wed, Nov 18, 2015 at 12:02:01AM +0100, Jan Engelhardt wrote:
> On Tuesday 2015-11-17 20:42, Tejun Heo wrote:
> >+static void cgroup2_save(const void *ip, const struct xt_entry_match *match)
> >+{
> >+	const struct xt_cgroup2_info *info = (void *)match->data;
> >+
> >+	printf("%s --path %s", info->invert ? " !" : "", info->path);
> >+}
> 
> Can cgroup path names contain anything fancy, like spaces, backslashes, etc.?
> If so, xtables_save_string() will be needed here.

Will update.

> >+static struct xtables_match cgroup2_match = {
> >+	.family		= NFPROTO_UNSPEC,
> >+	.name		= "cgroup2",
> >+	.version	= XTABLES_VERSION,
> >+	.size		= XT_ALIGN(sizeof(struct xt_cgroup2_info)),
> >+	.userspacesize	= XT_ALIGN(sizeof(struct xt_cgroup2_info)),
> 
> userspacesize must not include xt_cgroup2_info.priv.
> Change to offsetof(...), cf. other .c modules which do this.

Ah, okay.

...
> >+\fBIMPORTANT\fP: when being used in the INPUT chain, the cgroup2
> >+matcher is currently only of limited functionality, meaning it
> >+will only match on packets that are processed for local sockets
> >+through early socket demuxing. Therefore, general usage on the
> >+INPUT chain is disadviced unless the implications are well
> 
> is disadviced (sic)  -> is not advised

Will update.  That's copied verbatim from xt_cgroup tho.  Will create
a patch to update that too.

Thanks.

-- 
tejun
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web