netfilter: nft_meta: add cgroup support

This allows you to filter traffic by process control group (cgroup).

Ana Rey committed 12 years ago

Commit ce674171 parent c5a589c2 files · +9 −0Browse files

Unified · Split

2 files

@@ -579,6 +579,7 @@ enum nft_exthdr_attributes { · 578 unmodified lines
579	579	* @NFT_META_CPU: cpu id through smp_processor_id()
580	580	* @NFT_META_IIFGROUP: packet input interface group
581	581	* @NFT_META_OIFGROUP: packet output interface group
	582	+ * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
582	583	*/
583	584	enum nft_meta_keys {
584	585	NFT_META_LEN,
@@ -604,6 +605,7 @@ enum nft_meta_keys { · 19 unmodified lines
604	605	NFT_META_CPU,
605	606	NFT_META_IIFGROUP,
606	607	NFT_META_OIFGROUP,
	608	+ NFT_META_CGROUP,
607	609	};
608	610
609	611	/**

@@ -165,6 +165,12 @@ void nft_meta_get_eval(const struct nft_expr *expr, · 164 unmodified lines
165	165	goto err;
166	166	dest->data[0] = out->group;
167	167	break;
	168	+ case NFT_META_CGROUP:
	169	+ if (skb->sk == NULL)
	170	+ break;
	171	+
	172	+ dest->data[0] = skb->sk->sk_classid;
	173	+ break;
168	174	default:
169	175	WARN_ON(1);
170	176	goto err;
@@ -240,6 +246,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx, · 69 unmodified lines
240	246	case NFT_META_CPU:
241	247	case NFT_META_IIFGROUP:
242	248	case NFT_META_OIFGROUP:
	249	+ case NFT_META_CGROUP:
243	250	break;
244	251	default:
245	252	return -EOPNOTSUPP;