expr: meta: Add cgroup support

PATCH Applied Ana Rey 2 participants 6 messages Nov 3, 2014 – Nov 10, 2014

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

Ana Rey

author

2014-11-03 17:10 UTC #0 lore raw

PATCH 1/1 expr: meta: Add cgroup support

The kernel support is add in the commit:
netfilter: nft_meta: add cgroup support

Signed-off-by Ana Rey <[email protected]>

---
 include/linux/netfilter/nf_tables.h |    2 ++
 src/expr/meta.c                     |    3 ++-
 2 files changed, 4 insertions(+), 1 deletion(-)

include/linux/netfilter/nf_tables.h +2 -0

index bb21315..a8d3a49 100644
@@ -579,6 +579,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_CPU: cpu id through smp_processor_id()
  * @NFT_META_IIFGROUP: packet input interface group
  * @NFT_META_OIFGROUP: packet output interface group
+ * @NFT_META_CGROUP: packet cgroup (skb->sk->sk_classid)
  */
 enum nft_meta_keys {
 	NFT_META_LEN,

@@ -604,6 +605,7 @@ enum nft_meta_keys {
 	NFT_META_CPU,
 	NFT_META_IIFGROUP,
 	NFT_META_OIFGROUP,
+	NFT_META_CGROUP,
 };
 
 /**

src/expr/meta.c +2 -1

index 5b5159f..59cb55b 100644
@@ -23,7 +23,7 @@
 #include "expr_ops.h"
 
 #ifndef NFT_META_MAX
-#define NFT_META_MAX (NFT_META_OIFGROUP + 1)
+#define NFT_META_MAX (NFT_META_CGROUP + 1)
 #endif
 
 struct nft_expr_meta {

@@ -157,6 +157,7 @@ static const char *meta_key2str_array[NFT_META_MAX] = {
 	[NFT_META_CPU]		= "cpu",
 	[NFT_META_IIFGROUP]	= "iifgroup",
 	[NFT_META_OIFGROUP]	= "oifgroup",
+	[NFT_META_CGROUP]	= "cgroup",
 };
 
 static const char *meta_key2str(uint8_t key)

Signature · 1 line

1.7.10.4

Ana Rey

author

2014-11-03 17:10 UTC #1 lore raw

PATCH 1/1 netfilter: nft_meta: add cgroup support

This allows you to filter traffic by process control group (cgroup).

Signed-off-by Ana Rey <[email protected]>

---
 include/uapi/linux/netfilter/nf_tables.h |    2 ++
 net/netfilter/nft_meta.c                 |    7 +++++++
 2 files changed, 9 insertions(+)

include/uapi/linux/netfilter/nf_tables.h +2 -0

index c26df67..8ee8429 100644
@@ -579,6 +579,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_CPU: cpu id through smp_processor_id()
  * @NFT_META_IIFGROUP: packet input interface group
  * @NFT_META_OIFGROUP: packet output interface group
+ * @NFT_META_CGROUP: packet cgroup
  */
 enum nft_meta_keys {
 	NFT_META_LEN,

@@ -604,6 +605,7 @@ enum nft_meta_keys {
 	NFT_META_CPU,
 	NFT_META_IIFGROUP,
 	NFT_META_OIFGROUP,
+	NFT_META_CGROUP,
 };
 
 /**

net/netfilter/nft_meta.c +7 -0

index 1e7c076..e99911e 100644
@@ -165,6 +165,12 @@ void nft_meta_get_eval(const struct nft_expr *expr,
 			goto err;
 		dest->data[0] = out->group;
 		break;
+	case NFT_META_CGROUP:
+		if (skb->sk == NULL)
+			break;
+
+		dest->data[0] = skb->sk->sk_classid;
+		break;
 	default:
 		WARN_ON(1);
 		goto err;

@@ -240,6 +246,7 @@ int nft_meta_get_init(const struct nft_ctx *ctx,
 	case NFT_META_CPU:
 	case NFT_META_IIFGROUP:
 	case NFT_META_OIFGROUP:
+	case NFT_META_CGROUP:
 		break;
 	default:
 		return -EOPNOTSUPP;

Signature · 1 line

1.7.10.4

Pablo Neira Ayuso

maintainer Applied

2014-11-10 17:00 UTC #2 lore raw

Re: [PATCH] netfilter: nft_meta: add cgroup support

Quoted 1 line · Ana Rey

This allows you to filter traffic by process control group (cgroup).

Applied to nf-next, thanks Ana.

Ana Rey

author

2014-11-03 17:10 UTC #3 lore raw

PATCH 1/1 src: Add cgroup support in meta expresion

In reply to Ana Rey

The new attribute of meta is "cgroup".

Example of use in nft:

 # nft add rule ip test output meta cgroup != 0x100001 counter drop

Moreover, It adds tests in meta.t test file.

The kernel support is add in the commit:
netfilter: nft_meta: add cgroup support

The libnftnl support is add in the commit:
expr: meta: Add cgroup support

More information about the steps to use cgroup:
https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt

More info about cgroup in iptables:
http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3

---
 include/linux/netfilter/nf_tables.h |    2 ++
 src/meta.c                          |    3 +++
 src/parser.y                        |    2 ++
 src/scanner.l                       |    1 +
 tests/regression/any/meta.t         |    9 +++++++++
 5 files changed, 17 insertions(+)

include/linux/netfilter/nf_tables.h +2 -0

index f04d997..d21e41a 100644
@@ -579,6 +579,7 @@ enum nft_exthdr_attributes {
  * @NFT_META_CPU: cpu id through smp_processor_id()
  * @NFT_META_IIFGROUP: packet input interface group
  * @NFT_META_OIFGROUP: packet output interface group
+ * @NFT_META_CGROUP: packet cgroup
  */
 enum nft_meta_keys {
 	NFT_META_LEN,

@@ -604,6 +605,7 @@ enum nft_meta_keys {
 	NFT_META_CPU,
 	NFT_META_IIFGROUP,
 	NFT_META_OIFGROUP,
+	NFT_META_CGROUP,
 };
 
 /**

src/meta.c +3 -0

index faa29eb..61dc5cf 100644
@@ -436,6 +436,9 @@ static const struct meta_template meta_templates[] = {
 	[NFT_META_OIFGROUP]	= META_TEMPLATE("oifgroup", &devgroup_type,
 						4 * BITS_PER_BYTE,
 						BYTEORDER_HOST_ENDIAN),
+	[NFT_META_CGROUP]	= META_TEMPLATE("cgroup",  &integer_type,
+						4 * BITS_PER_BYTE,
+						BYTEORDER_HOST_ENDIAN),
 };
 
 static void meta_expr_print(const struct expr *expr)

src/parser.y +2 -0

index 9e9a839..096a86d 100644
@@ -324,6 +324,7 @@ static void location_update(struct location *loc, struct location *rhs, int n)
 %token CPU			"cpu"
 %token IIFGROUP			"iifgroup"
 %token OIFGROUP			"oifgroup"
+%token CGROUP			"cgroup"
 
 %token CT			"ct"
 %token DIRECTION		"direction"

@@ -1759,6 +1760,7 @@ meta_key_unqualified	:	MARK		{ $$ = NFT_META_MARK; }
 			|       CPU		{ $$ = NFT_META_CPU; }
 			|       IIFGROUP	{ $$ = NFT_META_IIFGROUP; }
 			|       OIFGROUP	{ $$ = NFT_META_OIFGROUP; }
+			|       CGROUP		{ $$ = NFT_META_CGROUP; }
 			;
 
 meta_stmt		:	META	meta_key	SET	expr

src/scanner.l +1 -0

index 32e59d9..859d18f 100644
@@ -432,6 +432,7 @@ addrstring	({macaddr}|{ip4addr}|{ip6addr})
 "cpu"			{ return CPU; }
 "iifgroup"		{ return IIFGROUP; }
 "oifgroup"		{ return OIFGROUP; }
+"cgroup"		{ return CGROUP; }
 
 "ct"			{ return CT; }
 "direction"		{ return DIRECTION; }

tests/regression/any/meta.t +9 -0

index 1e7a0fe..ba6756d 100644
@@ -179,3 +179,12 @@ meta oifgroup {11,33};ok;oifgroup {11,33}
 meta oifgroup {11-33};ok
 - meta oifgroup != {11,33};ok
 - meta oifgroup != {11-33};ok
+
+meta cgroup 0x100001;ok;cgroup 1048577
+meta cgroup != 0x100001;ok;cgroup != 1048577
+meta cgroup { 0x100001, 0x100002};ok
+# meta cgroup != { 0x100001, 0x100002};ok
+meta cgroup 0x100001 - 0x100003;ok
+# meta cgroup != 0x100001 - 0x100003;ok
+meta cgroup {0x100001 - 0x100003};ok
+# meta cgroup != { 0x100001 - 0x100003};ok

Signature · 1 line

1.7.10.4

Pablo Neira Ayuso

maintainer Applied

2014-11-10 17:12 UTC #4 lore raw

Re: [nft PATCH] src: Add cgroup support in meta expresion

Quoted 10 lines · Ana Rey

The new attribute of meta is "cgroup".
Example of use in nft:
 # nft add rule ip test output meta cgroup != 0x100001 counter drop
Moreover, It adds tests in meta.t test file.
The kernel support is add in the commit:
netfilter: nft_meta: add cgroup support

Quoted 8 lines

The libnftnl support is add in the commit:
expr: meta: Add cgroup support
More information about the steps to use cgroup:
https://www.kernel.org/doc/Documentation/cgroups/net_cls.txt
More info about cgroup in iptables:
http://git.kernel.org/cgit/linux/kernel/git/pablo/nftables.git/commit/net/netfilter/xt_cgroup.c?id=82a37132f300ea53bdcd812917af5a6329ec80c3

Applied, thanks.

Pablo Neira Ayuso

maintainer Applied

2014-11-10 17:13 UTC #5 lore raw

In reply to Ana Rey

Quoted 2 lines · Ana Rey

The kernel support is add in the commit:
netfilter: nft_meta: add cgroup support

Applied, thanks.