History

inet_diag: Add equal-operator for ports

inet_diag currently provides less/greater than or equal operators for comparing ports when filtering sockets. An equal comparison can be performed by combining the two existing operators, or a user can for example request a port range and then do the final filtering in userspace. However, these approaches both have drawbacks. Implementing equal using LE/GE causes the size and complexity of a filter to grow quickly as the number of ports increase, while it on busy machines would be great if the kernel only returns information about relevant sockets. This patch introduces source and destination port equal operators. INET_DIAG_BC_S_EQ is used to match a source port, INET_DIAG_BC_D_EQ a destination port, and usage is the same as for the existing port operators. I.e., the port to match is stored in the no-member of the next inet_diag_bc_op-struct in the filter.

Kristian Evensen committed 8 years ago

Commit bbb61891 parent d323b522 files · +10 −0Browse files

Unified · Split

2 files
  1. include/uapi/linux/inet_diag.h +2 −0
  2. net/ipv4/inet_diag.c +8 −0
include/uapi/linux/inet_diag.h+2−0
@@ -92,6 +92,8 @@ enum { · 91 unmodified lines
92 INET_DIAG_BC_D_COND,92 INET_DIAG_BC_D_COND,
93 INET_DIAG_BC_DEV_COND, /* u32 ifindex */93 INET_DIAG_BC_DEV_COND, /* u32 ifindex */
94 INET_DIAG_BC_MARK_COND,94 INET_DIAG_BC_MARK_COND,
95 INET_DIAG_BC_S_EQ,
96 INET_DIAG_BC_D_EQ,
95};97};
96 98
97struct inet_diag_hostcond {99struct inet_diag_hostcond {
net/ipv4/inet_diag.c+8−0
@@ -564,12 +564,18 @@ static int inet_diag_bc_run(const struct nlattr *_bc, · 563 unmodified lines
564 case INET_DIAG_BC_JMP:564 case INET_DIAG_BC_JMP:
565 yes = 0;565 yes = 0;
566 break;566 break;
567 case INET_DIAG_BC_S_EQ:
568 yes = entry->sport == op[1].no;
569 break;
567 case INET_DIAG_BC_S_GE:570 case INET_DIAG_BC_S_GE:
568 yes = entry->sport >= op[1].no;571 yes = entry->sport >= op[1].no;
569 break;572 break;
570 case INET_DIAG_BC_S_LE:573 case INET_DIAG_BC_S_LE:
571 yes = entry->sport <= op[1].no;574 yes = entry->sport <= op[1].no;
572 break;575 break;
576 case INET_DIAG_BC_D_EQ:
577 yes = entry->dport == op[1].no;
578 break;
573 case INET_DIAG_BC_D_GE:579 case INET_DIAG_BC_D_GE:
574 yes = entry->dport >= op[1].no;580 yes = entry->dport >= op[1].no;
575 break;581 break;
@@ -802,8 +808,10 @@ static int inet_diag_bc_audit(const struct nlattr *attr, · 226 unmodified lines
802 if (!valid_devcond(bc, len, &min_len))808 if (!valid_devcond(bc, len, &min_len))
803 return -EINVAL;809 return -EINVAL;
804 break;810 break;
811 case INET_DIAG_BC_S_EQ:
805 case INET_DIAG_BC_S_GE:812 case INET_DIAG_BC_S_GE:
806 case INET_DIAG_BC_S_LE:813 case INET_DIAG_BC_S_LE:
814 case INET_DIAG_BC_D_EQ:
807 case INET_DIAG_BC_D_GE:815 case INET_DIAG_BC_D_GE:
808 case INET_DIAG_BC_D_LE:816 case INET_DIAG_BC_D_LE:
809 if (!valid_port_comparison(bc, len, &min_len))817 if (!valid_port_comparison(bc, len, &min_len))