From f9efc8cb79c0f2329b3845faaf73b20524ea83ab Mon Sep 17 00:00:00 2001 From: Pablo Neira Ayuso Date: Tue, 4 Sep 2018 11:49:15 +0200 Subject: extensions: add cgroup revision 2 Just like revision v1, but cgroup path field is smaller. Signed-off-by: Pablo Neira Ayuso --- extensions/libxt_cgroup.c | 76 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 76 insertions(+) (limited to 'extensions') diff --git a/extensions/libxt_cgroup.c b/extensions/libxt_cgroup.c index 480d64c9..d4a29092 100644 --- a/extensions/libxt_cgroup.c +++ b/extensions/libxt_cgroup.c @@ -80,6 +80,26 @@ static void cgroup_parse_v1(struct xt_option_call *cb) } } +static void cgroup_parse_v2(struct xt_option_call *cb) +{ + struct xt_cgroup_info_v2 *info = cb->data; + + xtables_option_parse(cb); + + switch (cb->entry->id) { + case O_PATH: + info->has_path = true; + if (cb->invert) + info->invert_path = true; + break; + case O_CLASSID: + info->has_classid = true; + if (cb->invert) + info->invert_classid = true; + break; + } +} + static void cgroup_print_v0(const void *ip, const struct xt_entry_match *match, int numeric) { @@ -121,6 +141,32 @@ static void cgroup_save_v1(const void *ip, const struct xt_entry_match *match) info->classid); } +static void +cgroup_print_v2(const void *ip, const struct xt_entry_match *match, int numeric) +{ + const struct xt_cgroup_info_v2 *info = (void *)match->data; + + printf(" cgroup"); + if (info->has_path) + printf(" %s%s", info->invert_path ? "! ":"", info->path); + if (info->has_classid) + printf(" %s%u", info->invert_classid ? "! ":"", info->classid); +} + +static void cgroup_save_v2(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_cgroup_info_v2 *info = (void *)match->data; + + if (info->has_path) { + printf("%s --path", info->invert_path ? " !" : ""); + xtables_save_string(info->path); + } + + if (info->has_classid) + printf("%s --cgroup %u", info->invert_classid ? " !" : "", + info->classid); +} + static int cgroup_xlate_v0(struct xt_xlate *xl, const struct xt_xlate_mt_params *params) { @@ -147,6 +193,22 @@ static int cgroup_xlate_v1(struct xt_xlate *xl, return 1; } +static int cgroup_xlate_v2(struct xt_xlate *xl, + const struct xt_xlate_mt_params *params) +{ + const struct xt_cgroup_info_v2 *info = (void *)params->match->data; + + if (info->has_path) + return 0; + + if (info->has_classid) + xt_xlate_add(xl, "meta cgroup %s%u", + info->invert_classid ? "!= " : "", + info->classid); + + return 1; +} + static struct xtables_match cgroup_match[] = { { .family = NFPROTO_UNSPEC, @@ -176,6 +238,20 @@ static struct xtables_match cgroup_match[] = { .x6_options = cgroup_opts_v1, .xlate = cgroup_xlate_v1, }, + { + .family = NFPROTO_UNSPEC, + .revision = 2, + .name = "cgroup", + .version = XTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_cgroup_info_v2)), + .userspacesize = offsetof(struct xt_cgroup_info_v2, priv), + .help = cgroup_help_v1, + .print = cgroup_print_v2, + .save = cgroup_save_v2, + .x6_parse = cgroup_parse_v2, + .x6_options = cgroup_opts_v1, + .xlate = cgroup_xlate_v2, + }, }; void _init(void) -- cgit v1.2.3