History

netfilter: nft_meta: add cgroup support

This allows you to filter traffic by process control group (cgroup).

Ana Rey committed 12 years ago

Commit ce674171 parent c5a589c2 files · +9 −0Browse files

Unified · Split

2 files
  1. include/uapi/linux/netfilter/nf_tables.h +2 −0
  2. net/netfilter/nft_meta.c +7 −0
include/uapi/linux/netfilter/nf_tables.h+2−0
@@ -579,6 +579,7 @@ enum nft_exthdr_attributes { · 578 unmodified lines
579 * @NFT_META_CPU: cpu id through smp_processor_id()579 * @NFT_META_CPU: cpu id through smp_processor_id()
580 * @NFT_META_IIFGROUP: packet input interface group580 * @NFT_META_IIFGROUP: packet input interface group
581 * @NFT_META_OIFGROUP: packet output interface group581 * @NFT_META_OIFGROUP: packet output interface group
582 * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
582 */583 */
583enum nft_meta_keys {584enum nft_meta_keys {
584 NFT_META_LEN,585 NFT_META_LEN,
@@ -604,6 +605,7 @@ enum nft_meta_keys { · 19 unmodified lines
604 NFT_META_CPU,605 NFT_META_CPU,
605 NFT_META_IIFGROUP,606 NFT_META_IIFGROUP,
606 NFT_META_OIFGROUP,607 NFT_META_OIFGROUP,
608 NFT_META_CGROUP,
607};609};
608 610
609/**611/**
net/netfilter/nft_meta.c+7−0
@@ -165,6 +165,12 @@ void nft_meta_get_eval(const struct nft_expr *expr, · 164 unmodified lines
165 goto err;165 goto err;
166 dest->data[0] = out->group;166 dest->data[0] = out->group;
167 break;167 break;
168 case NFT_META_CGROUP:
169 if (skb->sk == NULL)
170 break;
171
172 dest->data[0] = skb->sk->sk_classid;
173 break;
168 default:174 default:
169 WARN_ON(1);175 WARN_ON(1);
170 goto err;176 goto err;
@@ -240,6 +246,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx, · 69 unmodified lines
240 case NFT_META_CPU:246 case NFT_META_CPU:
241 case NFT_META_IIFGROUP:247 case NFT_META_IIFGROUP:
242 case NFT_META_OIFGROUP:248 case NFT_META_OIFGROUP:
249 case NFT_META_CGROUP:
243 break;250 break;
244 default:251 default:
245 return -EOPNOTSUPP;252 return -EOPNOTSUPP;