1
2
3
4
5
6
7
8
9
10
11#include <linux/module.h>
12#include <linux/skbuff.h>
13#include <linux/file.h>
14#include <linux/rcupdate.h>
15#include <net/sock.h>
16
17#include <linux/netfilter_ipv4/ipt_owner.h>
18#include <linux/netfilter/x_tables.h>
19
20MODULE_LICENSE("GPL");
21MODULE_AUTHOR("Marc Boucher <marc@mbsi.ca>");
22MODULE_DESCRIPTION("iptables owner match");
23
24static bool
25match(const struct sk_buff *skb,
26 const struct net_device *in,
27 const struct net_device *out,
28 const struct xt_match *match,
29 const void *matchinfo,
30 int offset,
31 unsigned int protoff,
32 bool *hotdrop)
33{
34 const struct ipt_owner_info *info = matchinfo;
35
36 if (!skb->sk || !skb->sk->sk_socket || !skb->sk->sk_socket->file)
37 return false;
38
39 if(info->match & IPT_OWNER_UID) {
40 if ((skb->sk->sk_socket->file->f_uid != info->uid) ^
41 !!(info->invert & IPT_OWNER_UID))
42 return false;
43 }
44
45 if(info->match & IPT_OWNER_GID) {
46 if ((skb->sk->sk_socket->file->f_gid != info->gid) ^
47 !!(info->invert & IPT_OWNER_GID))
48 return false;
49 }
50
51 return true;
52}
53
54static bool
55checkentry(const char *tablename,
56 const void *ip,
57 const struct xt_match *match,
58 void *matchinfo,
59 unsigned int hook_mask)
60{
61 const struct ipt_owner_info *info = matchinfo;
62
63 if (info->match & (IPT_OWNER_PID|IPT_OWNER_SID|IPT_OWNER_COMM)) {
64 printk("ipt_owner: pid, sid and command matching "
65 "not supported anymore\n");
66 return false;
67 }
68 return true;
69}
70
71static struct xt_match owner_match __read_mostly = {
72 .name = "owner",
73 .family = AF_INET,
74 .match = match,
75 .matchsize = sizeof(struct ipt_owner_info),
76 .hooks = (1 << NF_IP_LOCAL_OUT) | (1 << NF_IP_POST_ROUTING),
77 .checkentry = checkentry,
78 .me = THIS_MODULE,
79};
80
81static int __init ipt_owner_init(void)
82{
83 return xt_register_match(&owner_match);
84}
85
86static void __exit ipt_owner_fini(void)
87{
88 xt_unregister_match(&owner_match);
89}
90
91module_init(ipt_owner_init);
92module_exit(ipt_owner_fini);
93