New patch
[PATCH v3 0/3] netfilter: Make xt_cgroup independent from net_cls
1
Changes from v2 (https://lore.kernel.org/r/20250305170935.80558-1-mkoutny@suse.com):
2
- don't accept zero classid neither (Pablo N. A.)
3
- eliminate code that might rely on comparison against zero with
4
!CONFIG_CGROUP_NET_CLASSID
1
5
6
Michal Koutný (3):
7
netfilter: Make xt_cgroup independent from net_cls
8
cgroup: Guard users of sock_cgroup_classid()
9
cgroup: Drop sock_cgroup_classid() dummy implementation
10
11
include/linux/cgroup-defs.h | 10 ++++------
12
net/ipv4/inet_diag.c | 2 +-
13
net/netfilter/Kconfig | 2 +-
14
net/netfilter/xt_cgroup.c | 26 ++++++++++++++++++++++++++
15
4 files changed, 32 insertions(+), 8 deletions(-)
16
17
18
base-commit: dd83757f6e686a2188997cb58b5975f744bb7786
19
--
20
2.48.1
21
diff view generated by jsdifflib
[PATCH v2] netfilter: Make xt_cgroup independent from net_cls
[PATCH v3 1/3] netfilter: Make xt_cgroup independent from net_cls
1
The xt_group matching supports the default hierarchy since commit
1
The xt_group matching supports the default hierarchy since commit
2
c38c4597e4bf3 ("netfilter: implement xt_cgroup cgroup2 path match").
2
c38c4597e4bf3 ("netfilter: implement xt_cgroup cgroup2 path match").
3
The cgroup v1 matching (based on clsid) and cgroup v2 matching (based on
3
The cgroup v1 matching (based on clsid) and cgroup v2 matching (based on
4
path) are rather independent. Downgrade the Kconfig dependency to
4
path) are rather independent. Downgrade the Kconfig dependency to
5
mere CONFIG_SOCK_GROUP_DATA so that xt_group can be built even without
5
mere CONFIG_SOCK_GROUP_DATA so that xt_group can be built even without
6
CONFIG_NET_CLS_CGROUP for path matching.
6
CONFIG_NET_CLS_CGROUP for path matching.
7
Also add a message for users when they attempt to specify any
7
Also add a message for users when they attempt to specify any clsid.
8
non-trivial clsid.
9
8
10
Link: https://lists.opensuse.org/archives/list/kernel@lists.opensuse.org/thread/S23NOILB7MUIRHSKPBOQKJHVSK26GP6X/
9
Link: https://lists.opensuse.org/archives/list/kernel@lists.opensuse.org/thread/S23NOILB7MUIRHSKPBOQKJHVSK26GP6X/
10
Cc: Jan Engelhardt <ej@inai.de>
11
Cc: Florian Westphal <fw@strlen.de>
11
Signed-off-by: Michal Koutný <mkoutny@suse.com>
12
Signed-off-by: Michal Koutný <mkoutny@suse.com>
12
---
13
---
13
net/netfilter/Kconfig | 2 +-
14
net/netfilter/Kconfig | 2 +-
14
net/netfilter/xt_cgroup.c | 22 ++++++++++++++++++++++
15
net/netfilter/xt_cgroup.c | 17 +++++++++++++++++
15
2 files changed, 23 insertions(+), 1 deletion(-)
16
2 files changed, 18 insertions(+), 1 deletion(-)
16
17
Changes from v1 (https://lore.kernel.org/r/20250228165216.339407-1-mkoutny@suse.com)
18
- terser guard (Jan)
19
- verboser message (Florian)
20
- better select !CGROUP_BPF (kernel test robot)
21
17
22
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
18
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
23
index XXXXXXX..XXXXXXX 100644
19
index XXXXXXX..XXXXXXX 100644
24
--- a/net/netfilter/Kconfig
20
--- a/net/netfilter/Kconfig
25
+++ b/net/netfilter/Kconfig
21
+++ b/net/netfilter/Kconfig
...
...
39
@@ -XXX,XX +XXX,XX @@ MODULE_DESCRIPTION("Xtables: process control group matching");
35
@@ -XXX,XX +XXX,XX @@ MODULE_DESCRIPTION("Xtables: process control group matching");
40
MODULE_ALIAS("ipt_cgroup");
36
MODULE_ALIAS("ipt_cgroup");
41
MODULE_ALIAS("ip6t_cgroup");
37
MODULE_ALIAS("ip6t_cgroup");
42
38
43
+#define NET_CLS_CLASSID_INVALID_MSG "xt_cgroup: classid invalid without net_cls cgroups\n"
39
+#define NET_CLS_CLASSID_INVALID_MSG "xt_cgroup: classid invalid without net_cls cgroups\n"
44
+
45
+static bool possible_classid(u32 classid)
46
+{
47
+    return IS_ENABLED(CONFIG_CGROUP_NET_CLASSID) || classid == 0;
48
+}
49
+
40
+
50
static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
41
static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
51
{
42
{
52
    struct xt_cgroup_info_v0 *info = par->matchinfo;
43
    struct xt_cgroup_info_v0 *info = par->matchinfo;
53
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
44
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
54
    if (info->invert & ~1)
45
    if (info->invert & ~1)
55
        return -EINVAL;
46
        return -EINVAL;
56
47
57
+    if (!possible_classid(info->id)) {
48
+    if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
58
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
49
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
59
+        return -EINVAL;
50
+        return -EINVAL;
60
+    }
51
+    }
61
+
52
+
62
    return 0;
53
    return 0;
63
}
54
}
64
55
65
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
56
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
66
        return -EINVAL;
57
        return -EINVAL;
67
    }
58
    }
68
59
69
+    if (!possible_classid(info->classid)) {
60
+    if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
70
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
61
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
71
+        return -EINVAL;
62
+        return -EINVAL;
72
+    }
63
+    }
73
+
64
+
74
    info->priv = NULL;
65
    info->priv = NULL;
75
    if (info->has_path) {
66
    if (info->has_path) {
76
        cgrp = cgroup_get_from_path(info->path);
67
        cgrp = cgroup_get_from_path(info->path);
77
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
68
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
78
        return -EINVAL;
69
        return -EINVAL;
79
    }
70
    }
80
71
81
+    if (info->has_classid && !possible_classid(info->classid)) {
72
+    if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
82
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
73
+        pr_info(NET_CLS_CLASSID_INVALID_MSG);
83
+        return -EINVAL;
74
+        return -EINVAL;
84
+    }
75
+    }
85
+
76
+
86
    info->priv = NULL;
77
    info->priv = NULL;
87
    if (info->has_path) {
78
    if (info->has_path) {
88
        cgrp = cgroup_get_from_path(info->path);
79
        cgrp = cgroup_get_from_path(info->path);
89
90
base-commit: dd83757f6e686a2188997cb58b5975f744bb7786
91
--
80
--
92
2.48.1
81
2.48.1
93
82
diff view generated by jsdifflib
New patch
[PATCH v3 2/3] cgroup: Guard users of sock_cgroup_classid()
1
Exclude code that relies on sock_cgroup_classid() as preparation of
2
removal of the function.
1
3
4
Signed-off-by: Michal Koutný <mkoutny@suse.com>
5
---
6
net/ipv4/inet_diag.c | 2 +-
7
net/netfilter/xt_cgroup.c | 9 +++++++++
8
2 files changed, 10 insertions(+), 1 deletion(-)
9
10
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
11
index XXXXXXX..XXXXXXX 100644
12
--- a/net/ipv4/inet_diag.c
13
+++ b/net/ipv4/inet_diag.c
14
@@ -XXX,XX +XXX,XX @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb,
15
     ext & (1 << (INET_DIAG_TCLASS - 1))) {
16
        u32 classid = 0;
17
18
-#ifdef CONFIG_SOCK_CGROUP_DATA
19
+#ifdef CONFIG_CGROUP_NET_CLASSID
20
        classid = sock_cgroup_classid(&sk->sk_cgrp_data);
21
#endif
22
        /* Fallback to socket priority if class id isn't set.
23
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
24
index XXXXXXX..XXXXXXX 100644
25
--- a/net/netfilter/xt_cgroup.c
26
+++ b/net/netfilter/xt_cgroup.c
27
@@ -XXX,XX +XXX,XX @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
28
static bool
29
cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
30
{
31
+#ifdef CONFIG_CGROUP_NET_CLASSID
32
    const struct xt_cgroup_info_v0 *info = par->matchinfo;
33
    struct sock *sk = skb->sk;
34
35
@@ -XXX,XX +XXX,XX @@ cgroup_mt_v0(const struct sk_buff *skb, struct xt_action_param *par)
36
37
    return (info->id == sock_cgroup_classid(&skb->sk->sk_cgrp_data)) ^
38
        info->invert;
39
+#endif
40
+    return false;
41
}
42
43
static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
44
@@ -XXX,XX +XXX,XX @@ static bool cgroup_mt_v1(const struct sk_buff *skb, struct xt_action_param *par)
45
    if (ancestor)
46
        return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
47
            info->invert_path;
48
+#ifdef CONFIG_CGROUP_NET_CLASSID
49
    else
50
        return (info->classid == sock_cgroup_classid(skcd)) ^
51
            info->invert_classid;
52
+#endif
53
+    return false;
54
}
55
56
static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
57
@@ -XXX,XX +XXX,XX @@ static bool cgroup_mt_v2(const struct sk_buff *skb, struct xt_action_param *par)
58
    if (ancestor)
59
        return cgroup_is_descendant(sock_cgroup_ptr(skcd), ancestor) ^
60
            info->invert_path;
61
+#ifdef CONFIG_CGROUP_NET_CLASSID
62
    else
63
        return (info->classid == sock_cgroup_classid(skcd)) ^
64
            info->invert_classid;
65
+#endif
66
+    return false;
67
}
68
69
static void cgroup_mt_destroy_v1(const struct xt_mtdtor_param *par)
70
--
71
2.48.1
72
diff view generated by jsdifflib
New patch
[PATCH v3 3/3] cgroup: Drop sock_cgroup_classid() dummy implementation
1
The semantic of returning 0 is unclear when !CONFIG_CGROUP_NET_CLASSID.
2
Since there are no callers of sock_cgroup_classid() with that config
3
anymore we can undefine the helper at all and enforce all (future)
4
callers to handle cases when !CONFIG_CGROUP_NET_CLASSID.
1
5
6
Signed-off-by: Michal Koutný <mkoutny@suse.com>
7
---
8
include/linux/cgroup-defs.h | 10 ++++------
9
1 file changed, 4 insertions(+), 6 deletions(-)
10
11
diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h
12
index XXXXXXX..XXXXXXX 100644
13
--- a/include/linux/cgroup-defs.h
14
+++ b/include/linux/cgroup-defs.h
15
@@ -XXX,XX +XXX,XX @@ static inline u16 sock_cgroup_prioidx(const struct sock_cgroup_data *skcd)
16
#endif
17
}
18
19
+#ifdef CONFIG_CGROUP_NET_CLASSID
20
static inline u32 sock_cgroup_classid(const struct sock_cgroup_data *skcd)
21
{
22
-#ifdef CONFIG_CGROUP_NET_CLASSID
23
    return READ_ONCE(skcd->classid);
24
-#else
25
-    return 0;
26
-#endif
27
}
28
+#endif
29
30
static inline void sock_cgroup_set_prioidx(struct sock_cgroup_data *skcd,
31
                     u16 prioidx)
32
@@ -XXX,XX +XXX,XX @@ static inline void sock_cgroup_set_prioidx(struct sock_cgroup_data *skcd,
33
#endif
34
}
35
36
+#ifdef CONFIG_CGROUP_NET_CLASSID
37
static inline void sock_cgroup_set_classid(struct sock_cgroup_data *skcd,
38
                     u32 classid)
39
{
40
-#ifdef CONFIG_CGROUP_NET_CLASSID
41
    WRITE_ONCE(skcd->classid, classid);
42
-#endif
43
}
44
+#endif
45
46
#else    /* CONFIG_SOCK_CGROUP_DATA */
47
48
--
49
2.48.1
50
diff view generated by jsdifflib

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.