New patch
[PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls
1
Changes from v2 (https://lore.kernel.org/r/20250305170935.80558-1-mkoutny@suse.com):
2
- don't accept zero classid neither (Pablo N. A.)
3
- eliminate code that might rely on comparison against zero with
4
!CONFIG_CGROUP_NET_CLASSID
1
5
6
Michal Koutný (3):
7
netfilter: Make xt_cgroup independent from net_cls
8
cgroup: Guard users of sock_cgroup_classid()
9
cgroup: Drop sock_cgroup_classid() dummy implementation
10
11
include/linux/cgroup-defs.h | 10 ++++------
12
net/ipv4/inet_diag.c | 2 +-
13
net/netfilter/Kconfig | 2 +-
14
net/netfilter/xt_cgroup.c | 26 ++++++++++++++++++++++++++
15
4 files changed, 32 insertions(+), 8 deletions(-)
16
17
18
base-commit: dd83757f6e686a2188997cb58b5975f744bb7786
19
--
20
2.48.1
21
diff view generated by jsdifflib
[PATCH] netfilter: Make xt_cgroup independent from net_cls
[PATCH v3 1/3] netfilter: Make xt_cgroup independent from net_cls
1
The xt_group matching supports the default hierarchy since commit
1
The xt_group matching supports the default hierarchy since commit
2
c38c4597e4bf3 ("netfilter: implement xt_cgroup cgroup2 path match").
2
c38c4597e4bf3 ("netfilter: implement xt_cgroup cgroup2 path match").
3
The cgroup v1 matching (based on clsid) and cgroup v2 matching (based on
3
The cgroup v1 matching (based on clsid) and cgroup v2 matching (based on
4
path) are rather independent. Adjust Kconfig so that xt_group can be
4
path) are rather independent. Downgrade the Kconfig dependency to
5
built even without CONFIG_NET_CLS_CGROUP for path matching. Also add a
5
mere CONFIG_SOCK_GROUP_DATA so that xt_group can be built even without
6
message for users when they attempt to specify any non-trivial clsid.
6
CONFIG_NET_CLS_CGROUP for path matching.
7
Also add a message for users when they attempt to specify any clsid.
7
8
8
Link: https://lists.opensuse.org/archives/list/kernel@lists.opensuse.org/thread/S23NOILB7MUIRHSKPBOQKJHVSK26GP6X/
9
Link: https://lists.opensuse.org/archives/list/kernel@lists.opensuse.org/thread/S23NOILB7MUIRHSKPBOQKJHVSK26GP6X/
10
Cc: Jan Engelhardt <ej@inai.de>
11
Cc: Florian Westphal <fw@strlen.de>
9
Signed-off-by: Michal Koutný <mkoutny@suse.com>
12
Signed-off-by: Michal Koutný <mkoutny@suse.com>
10
---
13
---
11
net/netfilter/Kconfig | 1 -
14
net/netfilter/Kconfig | 2 +-
12
net/netfilter/xt_cgroup.c | 23 +++++++++++++++++++++++
15
net/netfilter/xt_cgroup.c | 17 +++++++++++++++++
13
2 files changed, 23 insertions(+), 1 deletion(-)
16
2 files changed, 18 insertions(+), 1 deletion(-)
14
17
15
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
18
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
16
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
17
--- a/net/netfilter/Kconfig
20
--- a/net/netfilter/Kconfig
18
+++ b/net/netfilter/Kconfig
21
+++ b/net/netfilter/Kconfig
19
@@ -XXX,XX +XXX,XX @@ config NETFILTER_XT_MATCH_CGROUP
22
@@ -XXX,XX +XXX,XX @@ config NETFILTER_XT_MATCH_CGROUP
20
    tristate '"control group" match support'
23
    tristate '"control group" match support'
21
    depends on NETFILTER_ADVANCED
24
    depends on NETFILTER_ADVANCED
22
    depends on CGROUPS
25
    depends on CGROUPS
23
-    select CGROUP_NET_CLASSID
26
-    select CGROUP_NET_CLASSID
27
+    select SOCK_CGROUP_DATA
24
    help
28
    help
25
    Socket/process control group matching allows you to match locally
29
    Socket/process control group matching allows you to match locally
26
    generated packets based on which net_cls control group processes
30
    generated packets based on which net_cls control group processes
27
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
31
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
28
index XXXXXXX..XXXXXXX 100644
32
index XXXXXXX..XXXXXXX 100644
29
--- a/net/netfilter/xt_cgroup.c
33
--- a/net/netfilter/xt_cgroup.c
30
+++ b/net/netfilter/xt_cgroup.c
34
+++ b/net/netfilter/xt_cgroup.c
31
@@ -XXX,XX +XXX,XX @@ MODULE_DESCRIPTION("Xtables: process control group matching");
35
@@ -XXX,XX +XXX,XX @@ MODULE_DESCRIPTION("Xtables: process control group matching");
32
MODULE_ALIAS("ipt_cgroup");
36
MODULE_ALIAS("ipt_cgroup");
33
MODULE_ALIAS("ip6t_cgroup");
37
MODULE_ALIAS("ip6t_cgroup");
34
38
35
+static bool possible_classid(u32 classid)
39
+#define NET_CLS_CLASSID_INVALID_MSG "xt_cgroup: classid invalid without net_cls cgroups\n"
36
+{
37
+    if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID) && classid > 0)
38
+        return false;
39
+    else
40
+        return true;
41
+}
42
+
40
+
43
static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
41
static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
44
{
42
{
45
    struct xt_cgroup_info_v0 *info = par->matchinfo;
43
    struct xt_cgroup_info_v0 *info = par->matchinfo;
46
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
44
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
47
    if (info->invert & ~1)
45
    if (info->invert & ~1)
48
        return -EINVAL;
46
        return -EINVAL;
49
47
50
+    if (!possible_classid(info->id)) {
48
+    if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
51
+        pr_info("xt_cgroup: invalid classid\n");
49
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
52
+        return -EINVAL;
50
+        return -EINVAL;
53
+    }
51
+    }
54
+
52
+
55
    return 0;
53
    return 0;
56
}
54
}
57
55
58
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
56
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
59
        return -EINVAL;
57
        return -EINVAL;
60
    }
58
    }
61
59
62
+    if (!possible_classid(info->classid)) {
60
+    if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
63
+        pr_info("xt_cgroup: invalid classid\n");
61
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
64
+        return -EINVAL;
62
+        return -EINVAL;
65
+    }
63
+    }
66
+
64
+
67
    info->priv = NULL;
65
    info->priv = NULL;
68
    if (info->has_path) {
66
    if (info->has_path) {
69
        cgrp = cgroup_get_from_path(info->path);
67
        cgrp = cgroup_get_from_path(info->path);
70
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
68
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
71
        return -EINVAL;
69
        return -EINVAL;
72
    }
70
    }
73
71
74
+    if (info->has_classid && !possible_classid(info->classid)) {
72
+    if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
75
+        pr_info("xt_cgroup: invalid classid\n");
73
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
76
+        return -EINVAL;
74
+        return -EINVAL;
77
+    }
75
+    }
78
+
76
+
79
    info->priv = NULL;
77
    info->priv = NULL;
80
    if (info->has_path) {
78
    if (info->has_path) {
81
        cgrp = cgroup_get_from_path(info->path);
79
        cgrp = cgroup_get_from_path(info->path);
82
83
base-commit: dd83757f6e686a2188997cb58b5975f744bb7786
84
--
80
--
85
2.48.1
81
2.48.1
86
82
diff view generated by jsdifflib
New patch
[PATCH v3 2/3] cgroup: Guard users of sock_cgroup_classid()
1
Exclude code that relies on sock_cgroup_classid() as preparation of
2
removal of the function.
1
3
4
Signed-off-by: Michal Koutný <mkoutny@suse.com>
5
---
6
net/ipv4/inet_diag.c | 2 +-
7
net/netfilter/xt_cgroup.c | 9 +++++++++
8
2 files changed, 10 insertions(+), 1 deletion(-)
9
10
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
11
index XXXXXXX..XXXXXXX 100644
12
--- a/net/ipv4/inet_diag.c
13
+++ b/net/ipv4/inet_diag.c
14
@@ -XXX,XX +XXX,XX @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
15
     ext & (1 << (INET_DIAG_TCLASS - 1))) {
16
        u32 classid = 0;
17
18
-#ifdef CONFIG_SOCK_CGROUP_DATA
19
+#ifdef CONFIG_CGROUP_NET_CLASSID
20
        classid = sock_cgroup_classid(&sk->sk_cgrp_data);
21
#endif
22
        /* Fallback to socket priority if class id isn't set.
23
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
24
index XXXXXXX..XXXXXXX 100644
25
--- a/net/netfilter/xt_cgroup.c
26
+++ b/net/netfilter/xt_cgroup.c
27
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
28
static bool
29
cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
30
{
31
+#ifdef CONFIG_CGROUP_NET_CLASSID
32
    const struct xt_cgroup_info_v0 *info = par->matchinfo;
33
    struct sock *sk = skb->sk;
34
35
@@ -XXX,XX +XXX,XX @@ cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
36
37
    return (info->id == sock_cgroup_classid(&skb->sk->sk_cgrp_data)) ^
38
        info->invert;
39
+#endif
40
+    return false;
41
}
42
43
static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
44
@@ -XXX,XX +XXX,XX @@ static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
45
    if (ancestor)
46
        return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
47
            info->invert_path;
48
+#ifdef CONFIG_CGROUP_NET_CLASSID
49
    else
50
        return (info->classid == sock_cgroup_classid(skcd)) ^
51
            info->invert_classid;
52
+#endif
53
+    return false;
54
}
55
56
static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
57
@@ -XXX,XX +XXX,XX @@ static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
58
    if (ancestor)
59
        return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
60
            info->invert_path;
61
+#ifdef CONFIG_CGROUP_NET_CLASSID
62
    else
63
        return (info->classid == sock_cgroup_classid(skcd)) ^
64
            info->invert_classid;
65
+#endif
66
+    return false;
67
}
68
69
static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
70
--
71
2.48.1
72
diff view generated by jsdifflib
New patch
[PATCH v3 3/3] cgroup: Drop sock_cgroup_classid() dummy implementation
1
The semantic of returning 0 is unclear when !CONFIG_CGROUP_NET_CLASSID.
2
Since there are no callers of sock_cgroup_classid() with that config
3
anymore we can undefine the helper at all and enforce all (future)
4
callers to handle cases when !CONFIG_CGROUP_NET_CLASSID.
1
5
6
Signed-off-by: Michal Koutný <mkoutny@suse.com>
7
---
8
include/linux/cgroup-defs.h | 10 ++++------
9
1 file changed, 4 insertions(+), 6 deletions(-)
10
11
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
12
index XXXXXXX..XXXXXXX 100644
13
--- a/include/linux/cgroup-defs.h
14
+++ b/include/linux/cgroup-defs.h
15
@@ -XXX,XX +XXX,XX @@ static inline u16 sock_cgroup_prioidx(const struct sock_cgroup_data *skcd)
16
#endif
17
}
18
19
+#ifdef CONFIG_CGROUP_NET_CLASSID
20
static inline u32 sock_cgroup_classid(const struct sock_cgroup_data *skcd)
21
{
22
-#ifdef CONFIG_CGROUP_NET_CLASSID
23
    return READ_ONCE(skcd->classid);
24
-#else
25
-    return 0;
26
-#endif
27
}
28
+#endif
29
30
static inline void sock_cgroup_set_prioidx(struct sock_cgroup_data *skcd,
31
                     u16 prioidx)
32
@@ -XXX,XX +XXX,XX @@ static inline void sock_cgroup_set_prioidx(struct sock_cgroup_data *skcd,
33
#endif
34
}
35
36
+#ifdef CONFIG_CGROUP_NET_CLASSID
37
static inline void sock_cgroup_set_classid(struct sock_cgroup_data *skcd,
38
                     u32 classid)
39
{
40
-#ifdef CONFIG_CGROUP_NET_CLASSID
41
    WRITE_ONCE(skcd->classid, classid);
42
-#endif
43
}
44
+#endif
45
46
#else    /* CONFIG_SOCK_CGROUP_DATA */
47
48
--
49
2.48.1
50
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.