[net-next-2.6.git] / net / netfilter / xt_owner.c

/*
 * Kernel module to match various things tied to sockets associated with
 * locally generated outgoing packets.
 *
 * (C) 2000 Marc Boucher <marc@mbsi.ca>
 *
 * Copyright © CC Computer Consultants GmbH, 2007 - 2008
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/file.h>
#include <net/sock.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_owner.h>

static bool
owner_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_owner_match_info *info = par->matchinfo;
	const struct file *filp;

	if (skb->sk == NULL || skb->sk->sk_socket == NULL)
		return (info->match ^ info->invert) == 0;
	else if (info->match & info->invert & XT_OWNER_SOCKET)
		/*
		 * Socket exists but user wanted ! --socket-exists.
		 * (Single ampersands intended.)
		 */
		return false;

	filp = skb->sk->sk_socket->file;
	if (filp == NULL)
		return ((info->match ^ info->invert) &
		       (XT_OWNER_UID | XT_OWNER_GID)) == 0;

	if (info->match & XT_OWNER_UID)
		if ((filp->f_cred->fsuid >= info->uid_min &&
		    filp->f_cred->fsuid <= info->uid_max) ^
		    !(info->invert & XT_OWNER_UID))
			return false;

	if (info->match & XT_OWNER_GID)
		if ((filp->f_cred->fsgid >= info->gid_min &&
		    filp->f_cred->fsgid <= info->gid_max) ^
		    !(info->invert & XT_OWNER_GID))
			return false;

	return true;
}

static struct xt_match owner_mt_reg __read_mostly = {
	.name       = "owner",
	.revision   = 1,
	.family     = NFPROTO_UNSPEC,
	.match      = owner_mt,
	.matchsize  = sizeof(struct xt_owner_match_info),
	.hooks      = (1 << NF_INET_LOCAL_OUT) |
	              (1 << NF_INET_POST_ROUTING),
	.me         = THIS_MODULE,
};

static int __init owner_mt_init(void)
{
	return xt_register_match(&owner_mt_reg);
}

static void __exit owner_mt_exit(void)
{
	xt_unregister_match(&owner_mt_reg);
}

module_init(owner_mt_init);
module_exit(owner_mt_exit);
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: socket owner matching");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_owner");
MODULE_ALIAS("ip6t_owner");
Commit	Line	Data
0265ab44 JE	1	/*
	2	* Kernel module to match various things tied to sockets associated with
	3	* locally generated outgoing packets.
	4	*
	5	* (C) 2000 Marc Boucher <marc@mbsi.ca>
	6	*
edc26f7a	7	* Copyright © CC Computer Consultants GmbH, 2007 - 2008
0265ab44 JE	8	*
	9	* This program is free software; you can redistribute it and/or modify
	10	* it under the terms of the GNU General Public License version 2 as
	11	* published by the Free Software Foundation.
	12	*/
	13	#include <linux/module.h>
	14	#include <linux/skbuff.h>
	15	#include <linux/file.h>
	16	#include <net/sock.h>
	17	#include <linux/netfilter/x_tables.h>
	18	#include <linux/netfilter/xt_owner.h>
0265ab44 JE	19
0265ab44 JE	20	static bool
62fc8051	21	owner_mt(const struct sk_buff skb, struct xt_action_param par)
0265ab44	22	{
f7108a20	23	const struct xt_owner_match_info *info = par->matchinfo;
0265ab44 JE	24	const struct file *filp;
	25
	26	if (skb->sk == NULL \|\| skb->sk->sk_socket == NULL)
	27	return (info->match ^ info->invert) == 0;
	28	else if (info->match & info->invert & XT_OWNER_SOCKET)
	29	/*
	30	* Socket exists but user wanted ! --socket-exists.
	31	* (Single ampersands intended.)
	32	*/
	33	return false;
	34
	35	filp = skb->sk->sk_socket->file;
	36	if (filp == NULL)
	37	return ((info->match ^ info->invert) &
	38	(XT_OWNER_UID \| XT_OWNER_GID)) == 0;
	39
	40	if (info->match & XT_OWNER_UID)
d76b0d9b DH	41	if ((filp->f_cred->fsuid >= info->uid_min &&
d76b0d9b DH	42	filp->f_cred->fsuid <= info->uid_max) ^
edc26f7a	43	!(info->invert & XT_OWNER_UID))
0265ab44 JE	44	return false;
	45
	46	if (info->match & XT_OWNER_GID)
d76b0d9b DH	47	if ((filp->f_cred->fsgid >= info->gid_min &&
d76b0d9b DH	48	filp->f_cred->fsgid <= info->gid_max) ^
edc26f7a	49	!(info->invert & XT_OWNER_GID))
0265ab44 JE	50	return false;
	51
	52	return true;
	53	}
	54
6461caed JE	55	static struct xt_match owner_mt_reg __read_mostly = {
	56	.name = "owner",
	57	.revision = 1,
	58	.family = NFPROTO_UNSPEC,
	59	.match = owner_mt,
	60	.matchsize = sizeof(struct xt_owner_match_info),
	61	.hooks = (1 << NF_INET_LOCAL_OUT) \|
	62	(1 << NF_INET_POST_ROUTING),
	63	.me = THIS_MODULE,
0265ab44 JE	64	};
	65
	66	static int __init owner_mt_init(void)
	67	{
6461caed	68	return xt_register_match(&owner_mt_reg);
0265ab44 JE	69	}
	70
	71	static void __exit owner_mt_exit(void)
	72	{
6461caed	73	xt_unregister_match(&owner_mt_reg);
0265ab44 JE	74	}
	75
	76	module_init(owner_mt_init);
	77	module_exit(owner_mt_exit);
6461caed	78	MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
2ae15b64	79	MODULE_DESCRIPTION("Xtables: socket owner matching");
0265ab44 JE	80	MODULE_LICENSE("GPL");
	81	MODULE_ALIAS("ipt_owner");
	82	MODULE_ALIAS("ip6t_owner");