[PATCH nf] netfilter: nft_socket: make cgroup match work in input too

[PATCH nf] netfilter: nft_socket: make cgroup match work in input too

[Florian Westphal]

cgroupv2 helper function ignores the already-looked up sk
and uses skb->sk instead.

Just pass sk from the calling function instead; this will
make cgroup matching work for udp and tcp in input even when
edemux did not set skb->sk already.

Cc: Topi Miettinen <toiwoton@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
---
 NB: compile tested only.

 net/netfilter/nft_socket.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
index bd3792f080ed..6d9e8e0a3a7d 100644
--- a/net/netfilter/nft_socket.c
+++ b/net/netfilter/nft_socket.c
@@ -37,12 +37,11 @@ static void nft_socket_wildcard(const struct nft_pktinfo *pkt,
 
 #ifdef CONFIG_SOCK_CGROUP_DATA
 static noinline bool
-nft_sock_get_eval_cgroupv2(u32 *dest, const struct nft_pktinfo *pkt, u32 level)
+nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo *pkt, u32 level)
 {
-	struct sock *sk = skb_to_full_sk(pkt->skb);
 	struct cgroup *cgrp;
 
-	if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk)))
+	if (!sk_fullsock(sk))
 		return false;
 
 	cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
@@ -109,7 +108,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
 		break;
 #ifdef CONFIG_SOCK_CGROUP_DATA
 	case NFT_SOCKET_CGROUPV2:
-		if (!nft_sock_get_eval_cgroupv2(dest, pkt, priv->level)) {
+		if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) {
 			regs->verdict.code = NFT_BREAK;
 			return;
 		}
-- 
2.35.1

Re: [PATCH nf] netfilter: nft_socket: make cgroup match work in input too

[Topi Miettinen]

On 9.4.2022 14.20, Florian Westphal wrote:
> cgroupv2 helper function ignores the already-looked up sk
> and uses skb->sk instead.
> 
> Just pass sk from the calling function instead; this will
> make cgroup matching work for udp and tcp in input even when
> edemux did not set skb->sk already.
> 
> Cc: Topi Miettinen <toiwoton@gmail.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> ---
>   NB: compile tested only.
> 
>   net/netfilter/nft_socket.c | 7 +++----
>   1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netfilter/nft_socket.c b/net/netfilter/nft_socket.c
> index bd3792f080ed..6d9e8e0a3a7d 100644
> --- a/net/netfilter/nft_socket.c
> +++ b/net/netfilter/nft_socket.c
> @@ -37,12 +37,11 @@ static void nft_socket_wildcard(const struct nft_pktinfo *pkt,
>   
>   #ifdef CONFIG_SOCK_CGROUP_DATA
>   static noinline bool
> -nft_sock_get_eval_cgroupv2(u32 *dest, const struct nft_pktinfo *pkt, u32 level)
> +nft_sock_get_eval_cgroupv2(u32 *dest, struct sock *sk, const struct nft_pktinfo *pkt, u32 level)
>   {
> -	struct sock *sk = skb_to_full_sk(pkt->skb);
>   	struct cgroup *cgrp;
>   
> -	if (!sk || !sk_fullsock(sk) || !net_eq(nft_net(pkt), sock_net(sk)))
> +	if (!sk_fullsock(sk))
>   		return false;
>   
>   	cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
> @@ -109,7 +108,7 @@ static void nft_socket_eval(const struct nft_expr *expr,
>   		break;
>   #ifdef CONFIG_SOCK_CGROUP_DATA
>   	case NFT_SOCKET_CGROUPV2:
> -		if (!nft_sock_get_eval_cgroupv2(dest, pkt, priv->level)) {
> +		if (!nft_sock_get_eval_cgroupv2(dest, sk, pkt, priv->level)) {
>   			regs->verdict.code = NFT_BREAK;
>   			return;
>   		}

Great, now rule 'ct state new socket cgroupv2 level 1 vmap 
@dict_cgroup_level_1_in' in input filter started matching incoming packets.

Tested-by: Topi Miettinen <toiwoton@gmail.com>

-Topi

Re: [PATCH nf] netfilter: nft_socket: make cgroup match work in input too

[Pablo Neira Ayuso]

On Sat, Apr 09, 2022 at 01:20:19PM +0200, Florian Westphal wrote:
> cgroupv2 helper function ignores the already-looked up sk
> and uses skb->sk instead.
> 
> Just pass sk from the calling function instead; this will
> make cgroup matching work for udp and tcp in input even when
> edemux did not set skb->sk already.

Fixes: e0bb96db96f8 ("netfilter: nft_socket: add support for cgroupsv2")

> Cc: Topi Miettinen <toiwoton@gmail.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>

Re: [PATCH nf] netfilter: nft_socket: make cgroup match work in input too

[Pablo Neira Ayuso]

On Sat, Apr 09, 2022 at 01:20:19PM +0200, Florian Westphal wrote:
> cgroupv2 helper function ignores the already-looked up sk
> and uses skb->sk instead.
> 
> Just pass sk from the calling function instead; this will
> make cgroup matching work for udp and tcp in input even when
> edemux did not set skb->sk already.

Applied to nf.git, thanks Florian