Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 | /* Kernel module to match various things tied to sockets associated with
locally generated outgoing packets.
Copyright (C) 2000 Marc Boucher
*/
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/file.h>
#include <net/sock.h>
#include <linux/netfilter_ipv4/ipt_owner.h>
#include <linux/netfilter_ipv4/ip_tables.h>
static int
match_pid(const struct sk_buff *skb, pid_t pid)
{
struct task_struct *p;
struct files_struct *files;
int i;
read_lock(&tasklist_lock);
p = find_task_by_pid(pid);
if (!p)
goto out;
task_lock(p);
files = p->files;
if(files) {
read_lock(&files->file_lock);
for (i=0; i < files->max_fds; i++) {
if (fcheck_files(files, i) == skb->sk->socket->file) {
read_unlock(&files->file_lock);
task_unlock(p);
read_unlock(&tasklist_lock);
return 1;
}
}
read_unlock(&files->file_lock);
}
task_unlock(p);
out:
read_unlock(&tasklist_lock);
return 0;
}
static int
match_sid(const struct sk_buff *skb, pid_t sid)
{
struct task_struct *p;
struct file *file = skb->sk->socket->file;
int i, found=0;
read_lock(&tasklist_lock);
for_each_task(p) {
struct files_struct *files;
if (p->session != sid)
continue;
task_lock(p);
files = p->files;
if (files) {
read_lock(&files->file_lock);
for (i=0; i < files->max_fds; i++) {
if (fcheck_files(files, i) == file) {
found = 1;
break;
}
}
read_unlock(&files->file_lock);
}
task_unlock(p);
if(found)
break;
}
read_unlock(&tasklist_lock);
return found;
}
static int
match(const struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
const void *matchinfo,
int offset,
const void *hdr,
u_int16_t datalen,
int *hotdrop)
{
const struct ipt_owner_info *info = matchinfo;
if (!skb->sk || !skb->sk->socket || !skb->sk->socket->file)
return 0;
if(info->match & IPT_OWNER_UID) {
if((skb->sk->socket->file->f_uid != info->uid) ^
!!(info->invert & IPT_OWNER_UID))
return 0;
}
if(info->match & IPT_OWNER_GID) {
if((skb->sk->socket->file->f_gid != info->gid) ^
!!(info->invert & IPT_OWNER_GID))
return 0;
}
if(info->match & IPT_OWNER_PID) {
if (!match_pid(skb, info->pid) ^
!!(info->invert & IPT_OWNER_PID))
return 0;
}
if(info->match & IPT_OWNER_SID) {
if (!match_sid(skb, info->sid) ^
!!(info->invert & IPT_OWNER_SID))
return 0;
}
return 1;
}
static int
checkentry(const char *tablename,
const struct ipt_ip *ip,
void *matchinfo,
unsigned int matchsize,
unsigned int hook_mask)
{
if (hook_mask
& ~((1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING))) {
printk("ipt_owner: only valid for LOCAL_OUT or POST_ROUTING.\n");
return 0;
}
if (matchsize != IPT_ALIGN(sizeof(struct ipt_owner_info)))
return 0;
return 1;
}
static struct ipt_match owner_match
= { { NULL, NULL }, "owner", &match, &checkentry, NULL, THIS_MODULE };
static int __init init(void)
{
return ipt_register_match(&owner_match);
}
static void __exit fini(void)
{
ipt_unregister_match(&owner_match);
}
module_init(init);
module_exit(fini);
|