ownercmd for ip6tables

diff -urN a/userspace/ownercmd.patch.ipv6 b/userspace/ownercmd.patch.ipv6
@@ -0,0 +1,73 @@
+diff -urN ../../kernel/linux-2.4.20-pre4/include/linux/netfilter_ipv6/ip6t_owner.h linux-2.4.20-pre4/include/linux/netfilter_ipv6/ip6t_owner.h
+--- ../../kernel/linux-2.4.20-pre4/include/linux/netfilter_ipv6/ip6t_owner.h	2000-06-20 23:32:27.000000000 +0200
++++ linux-2.4.20-pre4/include/linux/netfilter_ipv6/ip6t_owner.h	2002-08-30 02:05:19.000000000 +0200
+@@ -6,12 +6,14 @@
+ #define IP6T_OWNER_GID	0x02
+ #define IP6T_OWNER_PID	0x04
+ #define IP6T_OWNER_SID	0x08
++#define IP6T_OWNER_COMM 0x10
+ 
+ struct ip6t_owner_info {
+     uid_t uid;
+     gid_t gid;
+     pid_t pid;
+     pid_t sid;
++    char comm[16];
+     u_int8_t match, invert;	/* flags */
+ };
+ 
+diff -urN ../../kernel/linux-2.4.20-pre4/net/ipv6/netfilter/ip6t_owner.c linux-2.4.20-pre4/net/ipv6/netfilter/ip6t_owner.c
+--- ../../kernel/linux-2.4.20-pre4/net/ipv6/netfilter/ip6t_owner.c	2001-10-31 00:08:12.000000000 +0100
++++ linux-2.4.20-pre4/net/ipv6/netfilter/ip6t_owner.c	2002-08-30 02:04:04.000000000 +0200
+@@ -16,6 +16,38 @@
+ MODULE_LICENSE("GPL");
+ 
+ static int
++match_comm(const struct sk_buff *skb, const char *comm)
++{
++	struct task_struct *p;
++	struct files_struct *files;
++	int i;
++
++	read_lock(&tasklist_lock);
++	for_each_task(p) {
++		if(strncmp(p->comm, comm, sizeof(p->comm)))
++			continue;
++
++		task_lock(p);
++		files = p->files;
++		if(files) {
++			read_lock(&files->file_lock);
++			for (i=0; i < files->max_fds; i++) {
++				if (fcheck_files(files, i) == skb->sk->socket->file) {
++					read_unlock(&files->file_lock);
++					task_unlock(p);
++					read_unlock(&tasklist_lock);
++					return 1;
++				}
++			}
++			read_unlock(&files->file_lock);
++		}
++		task_unlock(p);
++	}
++	read_unlock(&tasklist_lock);
++	return 0;
++}
++
++static int
+ match_pid(const struct sk_buff *skb, pid_t pid)
+ {
+ 	struct task_struct *p;
+@@ -119,6 +151,12 @@
+ 			return 0;
+ 	}
+ 
++	if(info->match & IP6T_OWNER_COMM) {
++		if (!match_comm(skb, info->comm) ^
++		    !!(info->invert & IP6T_OWNER_COMM))
++			return 0;
++	}
++
+ 	return 1;
+ }
+ 

diff -urN a/userspace/ownercmd.patch.ipv6.help b/userspace/ownercmd.patch.ipv6.help
@@ -0,0 +1,18 @@
+Author: Patrich McHardy <[email protected]>
+	Ported from Marc Boucher's ipv4 version
+Status: Untested, help text stolen from original version, feedback is welcome!
+
+This patch adds support for local process name matching
+to the owner match (--cmd-owner option).
+
+You can use this feature to filter connections forwarded by
+your ssh daemon with rules like:
+
+ip6tables -N CheckSSHSyns
+# allow forwarded connections to rsync port on 192.168.1.1
+ip6tables -A CheckSSHSyns -p tcp -d 192.168.1.1 --dport 873 -j RETURN
+# refuse everything else
+ip6tables -A CheckSSHSyns -j REJECT --reject-with tcp-reset
+
+ip6tables -I OUTPUT -p tcp --syn -m owner --cmd-owner sshd -j CheckSSHSyns
+

93 lines not on this page · raw message