Re: [PATCH nf] netfilter: nft_socket: make cgroup match work in input too

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 9.4.2022 14.20, Florian Westphal wrote:
cgroupv2 helper function ignores the already-looked up sk
and uses skb->sk instead.

Just pass sk from the calling function instead; this will
make cgroup matching work for udp and tcp in input even when
edemux did not set skb->sk already.

Cc: Topi Miettinen <toiwoton@xxxxxxxxx>
Signed-off-by: Florian Westphal <fw@xxxxxxxxx>
---
  NB: compile tested only.

  net/netfilter/nft_socket.c | 7 +++----
  1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index bd3792f080ed..6d9e8e0a3a7d 100644
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -37,12 +37,11 @@ static void nft_socket_wildcard(const struct nft_pktinfo *pkt,
#ifdef CONFIG_SOCK_CGROUP_DATA
  static noinline bool
-nft_sock_get_eval_cgroupv2(u32 *dest, const struct nft_pktinfo *pkt, u32 level)
+nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo *pkt, u32 level)
  {
-	struct sock *sk = skb_to_full_sk(pkt->skb);
  	struct cgroup *cgrp;
- if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk)))
+	if (!sk_fullsock(sk))
  		return false;
cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
@@ -109,7 +108,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
  		break;
  #ifdef CONFIG_SOCK_CGROUP_DATA
  	case NFT_SOCKET_CGROUPV2:
-		if (!nft_sock_get_eval_cgroupv2(dest, pkt, priv->level)) {
+		if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) {
  			regs->verdict.code = NFT_BREAK;
  			return;
  		}

Great, now rule 'ct state new socket cgroupv2 level 1 vmap @dict_cgroup_level_1_in' in input filter started matching incoming packets.

Tested-by: Topi Miettinen <toiwoton@xxxxxxxxx>

-Topi



[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux