From 88baf77b09fe89fa5efad111c680163f2c84d5f8 Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Wed, 21 Apr 2021 01:25:49 +0200 Subject: expr: socket: add cgroups v2 support Add NFT_SOCKET_CGROUPSV2 key type and NFTA_SOCKET_LEVEL attribute. Signed-off-by: Pablo Neira Ayuso --- include/libnftnl/expr.h | 1 + include/linux/netfilter/nf_tables.h | 2 ++ src/expr/socket.c | 18 ++++++++++++++++++ 3 files changed, 21 insertions(+) diff --git a/include/libnftnl/expr.h b/include/libnftnl/expr.h index 8e90a6a..4e6059a 100644 --- a/include/libnftnl/expr.h +++ b/include/libnftnl/expr.h @@ -81,6 +81,7 @@ enum { enum { NFTNL_EXPR_SOCKET_KEY = NFTNL_EXPR_BASE, NFTNL_EXPR_SOCKET_DREG, + NFTNL_EXPR_SOCKET_LEVEL, }; enum { diff --git a/include/linux/netfilter/nf_tables.h b/include/linux/netfilter/nf_tables.h index b21be8a..e0d5736 100644 --- a/include/linux/netfilter/nf_tables.h +++ b/include/linux/netfilter/nf_tables.h @@ -992,6 +992,7 @@ enum nft_socket_attributes { NFTA_SOCKET_UNSPEC, NFTA_SOCKET_KEY, NFTA_SOCKET_DREG, + NFTA_SOCKET_LEVEL, __NFTA_SOCKET_MAX }; #define NFTA_SOCKET_MAX (__NFTA_SOCKET_MAX - 1) @@ -1007,6 +1008,7 @@ enum nft_socket_keys { NFT_SOCKET_TRANSPARENT, NFT_SOCKET_MARK, NFT_SOCKET_WILDCARD, + NFT_SOCKET_CGROUPV2, __NFT_SOCKET_MAX }; #define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1) diff --git a/src/expr/socket.c b/src/expr/socket.c index c7337cf..02d86f8 100644 --- a/src/expr/socket.c +++ b/src/expr/socket.c @@ -22,6 +22,7 @@ struct nftnl_expr_socket { enum nft_socket_keys key; enum nft_registers dreg; + uint32_t level; }; static int @@ -37,6 +38,9 @@ nftnl_expr_socket_set(struct nftnl_expr *e, uint16_t type, case NFTNL_EXPR_SOCKET_DREG: memcpy(&socket->dreg, data, sizeof(socket->dreg)); break; + case NFTNL_EXPR_SOCKET_LEVEL: + memcpy(&socket->level, data, sizeof(socket->level)); + break; default: return -1; } @@ -56,6 +60,9 @@ nftnl_expr_socket_get(const struct nftnl_expr *e, uint16_t type, case NFTNL_EXPR_SOCKET_DREG: *data_len = sizeof(socket->dreg); return &socket->dreg; + case NFTNL_EXPR_SOCKET_LEVEL: + *data_len = sizeof(socket->level); + return &socket->level; } return NULL; } @@ -71,6 +78,7 @@ static int nftnl_expr_socket_cb(const struct nlattr *attr, void *data) switch (type) { case NFTA_SOCKET_KEY: case NFTA_SOCKET_DREG: + case NFTA_SOCKET_LEVEL: if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) abi_breakage(); break; @@ -89,6 +97,8 @@ nftnl_expr_socket_build(struct nlmsghdr *nlh, const struct nftnl_expr *e) mnl_attr_put_u32(nlh, NFTA_SOCKET_KEY, htonl(socket->key)); if (e->flags & (1 << NFTNL_EXPR_SOCKET_DREG)) mnl_attr_put_u32(nlh, NFTA_SOCKET_DREG, htonl(socket->dreg)); + if (e->flags & (1 << NFTNL_EXPR_SOCKET_LEVEL)) + mnl_attr_put_u32(nlh, NFTA_SOCKET_LEVEL, htonl(socket->level)); } static int @@ -108,6 +118,10 @@ nftnl_expr_socket_parse(struct nftnl_expr *e, struct nlattr *attr) socket->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_SOCKET_DREG])); e->flags |= (1 << NFTNL_EXPR_SOCKET_DREG); } + if (tb[NFTA_SOCKET_LEVEL]) { + socket->level = ntohl(mnl_attr_get_u32(tb[NFTA_SOCKET_LEVEL])); + e->flags |= (1 << NFTNL_EXPR_SOCKET_LEVEL); + } return 0; } @@ -116,6 +130,7 @@ static const char *socket_key2str_array[NFT_SOCKET_MAX + 1] = { [NFT_SOCKET_TRANSPARENT] = "transparent", [NFT_SOCKET_MARK] = "mark", [NFT_SOCKET_WILDCARD] = "wildcard", + [NFT_SOCKET_CGROUPV2] = "cgroupv2", }; static const char *socket_key2str(uint8_t key) @@ -136,6 +151,9 @@ nftnl_expr_socket_snprintf(char *buf, size_t len, return snprintf(buf, len, "load %s => reg %u ", socket_key2str(socket->key), socket->dreg); } + if (e->flags & (1 << NFTNL_EXPR_SOCKET_LEVEL)) + return snprintf(buf, len, "level %u ", socket->level); + return 0; } -- cgit v1.2.3