netfilter: xt_cgroup: Make it independent from net_cls

The xt_group matching supports the default hierarchy since commit
c38c4597e4bf3 ("netfilter: implement xt_cgroup cgroup2 path match").
The cgroup v1 matching (based on clsid) and cgroup v2 matching (based on
path) are rather independent. Downgrade the Kconfig dependency to
mere CONFIG_SOCK_GROUP_DATA so that xt_group can be built even without
CONFIG_NET_CLS_CGROUP for path matching.
Also add a message for users when they attempt to specify any clsid.

Link: https://lists.opensuse.org/archives/list/kernel@lists.opensuse.org/thread/S23NOILB7MUIRHSKPBOQKJHVSK26GP6X/
Cc: Jan Engelhardt <ej@inai.de>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 047ba81865edff61d2fca61a7614ee9f0e5d14ff..3b2183fc7e563b086065980d220d11996723657a 100644 (file)
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -1180,7 +1180,7 @@ config NETFILTER_XT_MATCH_CGROUP
        tristate '"control group" match support'
        depends on NETFILTER_ADVANCED
        depends on CGROUPS
-       select CGROUP_NET_CLASSID
+       select SOCK_CGROUP_DATA
        help
        Socket/process control group matching allows you to match locally
        generated packets based on which net_cls control group processes

diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index c0f5e9a4f3c6511920605071094a0d3864ed3a4e..66915bf0d89ad132e2b0faa0e593e0a34e035ca8 100644 (file)
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -23,6 +23,8 @@ MODULE_DESCRIPTION("Xtables: process control group matching");
 MODULE_ALIAS("ipt_cgroup");
 MODULE_ALIAS("ip6t_cgroup");
 
+#define NET_CLS_CLASSID_INVALID_MSG "xt_cgroup: classid invalid without net_cls cgroups\n"
+
 static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
 {
        struct xt_cgroup_info_v0 *info = par->matchinfo;
@@ -30,6 +32,11 @@ static int cgroup_mt_check_v0(const struct xt_mtchk_param *par)
        if (info->invert & ~1)
                return -EINVAL;
 
+       if (!IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
+               pr_info(NET_CLS_CLASSID_INVALID_MSG);
+               return -EINVAL;
+       }
+
        return 0;
 }
 
@@ -51,6 +58,11 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
                return -EINVAL;
        }
 
+       if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
+               pr_info(NET_CLS_CLASSID_INVALID_MSG);
+               return -EINVAL;
+       }
+
        info->priv = NULL;
        if (info->has_path) {
                cgrp = cgroup_get_from_path(info->path);
@@ -83,6 +95,11 @@ static int cgroup_mt_check_v2(const struct xt_mtchk_param *par)
                return -EINVAL;
        }
 
+       if (info->has_classid && !IS_ENABLED(CONFIG_CGROUP_NET_CLASSID)) {
+               pr_info(NET_CLS_CLASSID_INVALID_MSG);
+               return -EINVAL;
+       }
+
        info->priv = NULL;
        if (info->has_path) {
                cgrp = cgroup_get_from_path(info->path);