[net-next-2.6.git] / net / netfilter / xt_owner.c

/*
 * Kernel module to match various things tied to sockets associated with
 * locally generated outgoing packets.
 *
 * (C) 2000 Marc Boucher <marc@mbsi.ca>
 *
 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
 * <jengelh@computergmbh.de>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/file.h>
#include <net/sock.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_owner.h>
#include <linux/netfilter_ipv4/ipt_owner.h>
#include <linux/netfilter_ipv6/ip6t_owner.h>

static bool
owner_mt_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct ipt_owner_info *info = par->matchinfo;
	const struct file *filp;

	if (skb->sk == NULL || skb->sk->sk_socket == NULL)
		return false;

	filp = skb->sk->sk_socket->file;
	if (filp == NULL)
		return false;

	if (info->match & IPT_OWNER_UID)
		if ((filp->f_cred->fsuid != info->uid) ^
		    !!(info->invert & IPT_OWNER_UID))
			return false;

	if (info->match & IPT_OWNER_GID)
		if ((filp->f_cred->fsgid != info->gid) ^
		    !!(info->invert & IPT_OWNER_GID))
			return false;

	return true;
}

static bool
owner_mt6_v0(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct ip6t_owner_info *info = par->matchinfo;
	const struct file *filp;

	if (skb->sk == NULL || skb->sk->sk_socket == NULL)
		return false;

	filp = skb->sk->sk_socket->file;
	if (filp == NULL)
		return false;

	if (info->match & IP6T_OWNER_UID)
		if ((filp->f_cred->fsuid != info->uid) ^
		    !!(info->invert & IP6T_OWNER_UID))
			return false;

	if (info->match & IP6T_OWNER_GID)
		if ((filp->f_cred->fsgid != info->gid) ^
		    !!(info->invert & IP6T_OWNER_GID))
			return false;

	return true;
}

static bool
owner_mt(const struct sk_buff *skb, const struct xt_match_param *par)
{
	const struct xt_owner_match_info *info = par->matchinfo;
	const struct file *filp;

	if (skb->sk == NULL || skb->sk->sk_socket == NULL)
		return (info->match ^ info->invert) == 0;
	else if (info->match & info->invert & XT_OWNER_SOCKET)
		/*
		 * Socket exists but user wanted ! --socket-exists.
		 * (Single ampersands intended.)
		 */
		return false;

	filp = skb->sk->sk_socket->file;
	if (filp == NULL)
		return ((info->match ^ info->invert) &
		       (XT_OWNER_UID | XT_OWNER_GID)) == 0;

	if (info->match & XT_OWNER_UID)
		if ((filp->f_cred->fsuid >= info->uid_min &&
		    filp->f_cred->fsuid <= info->uid_max) ^
		    !(info->invert & XT_OWNER_UID))
			return false;

	if (info->match & XT_OWNER_GID)
		if ((filp->f_cred->fsgid >= info->gid_min &&
		    filp->f_cred->fsgid <= info->gid_max) ^
		    !(info->invert & XT_OWNER_GID))
			return false;

	return true;
}

static bool owner_mt_check_v0(const struct xt_mtchk_param *par)
{
	const struct ipt_owner_info *info = par->matchinfo;

	if (info->match & (IPT_OWNER_PID | IPT_OWNER_SID | IPT_OWNER_COMM)) {
		printk(KERN_WARNING KBUILD_MODNAME
		       ": PID, SID and command matching is not "
		       "supported anymore\n");
		return false;
	}

	return true;
}

static bool owner_mt6_check_v0(const struct xt_mtchk_param *par)
{
	const struct ip6t_owner_info *info = par->matchinfo;

	if (info->match & (IP6T_OWNER_PID | IP6T_OWNER_SID)) {
		printk(KERN_WARNING KBUILD_MODNAME
		       ": PID and SID matching is not supported anymore\n");
		return false;
	}

	return true;
}

static struct xt_match owner_mt_reg[] __read_mostly = {
	{
		.name       = "owner",
		.revision   = 0,
		.family     = NFPROTO_IPV4,
		.match      = owner_mt_v0,
		.matchsize  = sizeof(struct ipt_owner_info),
		.checkentry = owner_mt_check_v0,
		.hooks      = (1 << NF_INET_LOCAL_OUT) |
		              (1 << NF_INET_POST_ROUTING),
		.me         = THIS_MODULE,
	},
	{
		.name       = "owner",
		.revision   = 0,
		.family     = NFPROTO_IPV6,
		.match      = owner_mt6_v0,
		.matchsize  = sizeof(struct ip6t_owner_info),
		.checkentry = owner_mt6_check_v0,
		.hooks      = (1 << NF_INET_LOCAL_OUT) |
		              (1 << NF_INET_POST_ROUTING),
		.me         = THIS_MODULE,
	},
	{
		.name       = "owner",
		.revision   = 1,
		.family     = NFPROTO_UNSPEC,
		.match      = owner_mt,
		.matchsize  = sizeof(struct xt_owner_match_info),
		.hooks      = (1 << NF_INET_LOCAL_OUT) |
		              (1 << NF_INET_POST_ROUTING),
		.me         = THIS_MODULE,
	},
};

static int __init owner_mt_init(void)
{
	return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
}

static void __exit owner_mt_exit(void)
{
	xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
}

module_init(owner_mt_init);
module_exit(owner_mt_exit);
MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
MODULE_DESCRIPTION("Xtables: socket owner matching");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_owner");
MODULE_ALIAS("ip6t_owner");
Commit	Line	Data
0265ab44 JE	1	/*
	2	* Kernel module to match various things tied to sockets associated with
	3	* locally generated outgoing packets.
	4	*
	5	* (C) 2000 Marc Boucher <marc@mbsi.ca>
	6	*
edc26f7a JE	7	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
edc26f7a JE	8	* <jengelh@computergmbh.de>
0265ab44 JE	9	*
	10	* This program is free software; you can redistribute it and/or modify
	11	* it under the terms of the GNU General Public License version 2 as
	12	* published by the Free Software Foundation.
	13	*/
	14	#include <linux/module.h>
	15	#include <linux/skbuff.h>
	16	#include <linux/file.h>
	17	#include <net/sock.h>
	18	#include <linux/netfilter/x_tables.h>
	19	#include <linux/netfilter/xt_owner.h>
	20	#include <linux/netfilter_ipv4/ipt_owner.h>
	21	#include <linux/netfilter_ipv6/ip6t_owner.h>
	22
	23	static bool
f7108a20	24	owner_mt_v0(const struct sk_buff skb, const struct xt_match_param par)
0265ab44	25	{
f7108a20	26	const struct ipt_owner_info *info = par->matchinfo;
0265ab44 JE	27	const struct file *filp;
	28
	29	if (skb->sk == NULL \|\| skb->sk->sk_socket == NULL)
	30	return false;
	31
	32	filp = skb->sk->sk_socket->file;
	33	if (filp == NULL)
	34	return false;
	35
	36	if (info->match & IPT_OWNER_UID)
d76b0d9b	37	if ((filp->f_cred->fsuid != info->uid) ^
0265ab44 JE	38	!!(info->invert & IPT_OWNER_UID))
	39	return false;
	40
	41	if (info->match & IPT_OWNER_GID)
d76b0d9b	42	if ((filp->f_cred->fsgid != info->gid) ^
0265ab44 JE	43	!!(info->invert & IPT_OWNER_GID))
	44	return false;
	45
	46	return true;
	47	}
	48
	49	static bool
f7108a20	50	owner_mt6_v0(const struct sk_buff skb, const struct xt_match_param par)
0265ab44	51	{
f7108a20	52	const struct ip6t_owner_info *info = par->matchinfo;
0265ab44 JE	53	const struct file *filp;
	54
	55	if (skb->sk == NULL \|\| skb->sk->sk_socket == NULL)
	56	return false;
	57
	58	filp = skb->sk->sk_socket->file;
	59	if (filp == NULL)
	60	return false;
	61
	62	if (info->match & IP6T_OWNER_UID)
d76b0d9b	63	if ((filp->f_cred->fsuid != info->uid) ^
0265ab44 JE	64	!!(info->invert & IP6T_OWNER_UID))
	65	return false;
	66
	67	if (info->match & IP6T_OWNER_GID)
d76b0d9b	68	if ((filp->f_cred->fsgid != info->gid) ^
0265ab44 JE	69	!!(info->invert & IP6T_OWNER_GID))
	70	return false;
	71
	72	return true;
	73	}
	74
	75	static bool
f7108a20	76	owner_mt(const struct sk_buff skb, const struct xt_match_param par)
0265ab44	77	{
f7108a20	78	const struct xt_owner_match_info *info = par->matchinfo;
0265ab44 JE	79	const struct file *filp;
	80
	81	if (skb->sk == NULL \|\| skb->sk->sk_socket == NULL)
	82	return (info->match ^ info->invert) == 0;
	83	else if (info->match & info->invert & XT_OWNER_SOCKET)
	84	/*
	85	* Socket exists but user wanted ! --socket-exists.
	86	* (Single ampersands intended.)
	87	*/
	88	return false;
	89
	90	filp = skb->sk->sk_socket->file;
	91	if (filp == NULL)
	92	return ((info->match ^ info->invert) &
	93	(XT_OWNER_UID \| XT_OWNER_GID)) == 0;
	94
	95	if (info->match & XT_OWNER_UID)
d76b0d9b DH	96	if ((filp->f_cred->fsuid >= info->uid_min &&
d76b0d9b DH	97	filp->f_cred->fsuid <= info->uid_max) ^
edc26f7a	98	!(info->invert & XT_OWNER_UID))
0265ab44 JE	99	return false;
	100
	101	if (info->match & XT_OWNER_GID)
d76b0d9b DH	102	if ((filp->f_cred->fsgid >= info->gid_min &&
d76b0d9b DH	103	filp->f_cred->fsgid <= info->gid_max) ^
edc26f7a	104	!(info->invert & XT_OWNER_GID))
0265ab44 JE	105	return false;
	106
	107	return true;
	108	}
	109
9b4fce7a	110	static bool owner_mt_check_v0(const struct xt_mtchk_param *par)
0265ab44	111	{
9b4fce7a	112	const struct ipt_owner_info *info = par->matchinfo;
0265ab44 JE	113
	114	if (info->match & (IPT_OWNER_PID \| IPT_OWNER_SID \| IPT_OWNER_COMM)) {
	115	printk(KERN_WARNING KBUILD_MODNAME
	116	": PID, SID and command matching is not "
	117	"supported anymore\n");
	118	return false;
	119	}
	120
	121	return true;
	122	}
	123
9b4fce7a	124	static bool owner_mt6_check_v0(const struct xt_mtchk_param *par)
0265ab44	125	{
9b4fce7a	126	const struct ip6t_owner_info *info = par->matchinfo;
0265ab44 JE	127
	128	if (info->match & (IP6T_OWNER_PID \| IP6T_OWNER_SID)) {
	129	printk(KERN_WARNING KBUILD_MODNAME
	130	": PID and SID matching is not supported anymore\n");
	131	return false;
	132	}
	133
	134	return true;
	135	}
	136
	137	static struct xt_match owner_mt_reg[] __read_mostly = {
	138	{
	139	.name = "owner",
	140	.revision = 0,
ee999d8b	141	.family = NFPROTO_IPV4,
0265ab44 JE	142	.match = owner_mt_v0,
	143	.matchsize = sizeof(struct ipt_owner_info),
	144	.checkentry = owner_mt_check_v0,
	145	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	146	(1 << NF_INET_POST_ROUTING),
	147	.me = THIS_MODULE,
	148	},
	149	{
	150	.name = "owner",
	151	.revision = 0,
ee999d8b	152	.family = NFPROTO_IPV6,
0265ab44 JE	153	.match = owner_mt6_v0,
	154	.matchsize = sizeof(struct ip6t_owner_info),
	155	.checkentry = owner_mt6_check_v0,
	156	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	157	(1 << NF_INET_POST_ROUTING),
	158	.me = THIS_MODULE,
	159	},
	160	{
	161	.name = "owner",
	162	.revision = 1,
ab4f21e6	163	.family = NFPROTO_UNSPEC,
0265ab44 JE	164	.match = owner_mt,
	165	.matchsize = sizeof(struct xt_owner_match_info),
	166	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	167	(1 << NF_INET_POST_ROUTING),
	168	.me = THIS_MODULE,
	169	},
	170	};
	171
	172	static int __init owner_mt_init(void)
	173	{
	174	return xt_register_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
	175	}
	176
	177	static void __exit owner_mt_exit(void)
	178	{
	179	xt_unregister_matches(owner_mt_reg, ARRAY_SIZE(owner_mt_reg));
	180	}
	181
	182	module_init(owner_mt_init);
	183	module_exit(owner_mt_exit);
	184	MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
2ae15b64	185	MODULE_DESCRIPTION("Xtables: socket owner matching");
0265ab44 JE	186	MODULE_LICENSE("GPL");
	187	MODULE_ALIAS("ipt_owner");
	188	MODULE_ALIAS("ip6t_owner");