dbus: extend SocktBind{Allow|Deny}= with ip proto

Support filtering by ip protocol (L4) in SocketBind{Allow|Deny}=
properties.
The signature of dbus methods must be finalized before new release is
cut, hence reserve a parameter for ip protocol.
Implementation will follow.

Closes https://github.com/systemd/systemd/issues/19891

diff --git a/src/core/cgroup.h b/src/core/cgroup.h
index e6790eb0e833e64f8c8442cc74f281a9e323f2bf..526f056d1e8e7a6852ff46351b82dc876e5d91e7 100644 (file)
--- a/src/core/cgroup.h
+++ b/src/core/cgroup.h
@@ -104,7 +104,8 @@ struct CGroupBPFForeignProgram {
 
 struct CGroupSocketBindItem {
         LIST_FIELDS(CGroupSocketBindItem, socket_bind_items);
-        int address_family;
+        int32_t address_family;
+        int32_t ip_protocol;
         uint16_t nr_ports;
         uint16_t port_min;
 };

diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
index d7f03d0cfdb492e2807cbb8acdb3812db4e603bf..9f20d547cb232b0fe1779d5620fcea5fc0ed295a 100644 (file)
--- a/src/core/dbus-cgroup.c
+++ b/src/core/dbus-cgroup.c
@@ -389,12 +389,12 @@ static int property_get_socket_bind(
 
         assert(items);
 
-        r = sd_bus_message_open_container(reply, 'a', "(iqq)");
+        r = sd_bus_message_open_container(reply, 'a', "(iiqq)");
         if (r < 0)
                 return r;
 
         LIST_FOREACH(socket_bind_items, i, *items) {
-                r = sd_bus_message_append(reply, "(iqq)", i->address_family, i->nr_ports, i->port_min);
+                r = sd_bus_message_append(reply, "(iiqq)", i->address_family, i->ip_protocol, i->nr_ports, i->port_min);
                 if (r < 0)
                         return r;
         }
@@ -454,8 +454,8 @@ const sd_bus_vtable bus_cgroup_vtable[] = {
         SD_BUS_PROPERTY("ManagedOOMMemoryPressureLimit", "u", NULL, offsetof(CGroupContext, moom_mem_pressure_limit), 0),
         SD_BUS_PROPERTY("ManagedOOMPreference", "s", property_get_managed_oom_preference, offsetof(CGroupContext, moom_preference), 0),
         SD_BUS_PROPERTY("BPFProgram", "a(ss)", property_get_bpf_foreign_program, 0, 0),
-        SD_BUS_PROPERTY("SocketBindAllow", "a(iqq)", property_get_socket_bind, offsetof(CGroupContext, socket_bind_allow), 0),
-        SD_BUS_PROPERTY("SocketBindDeny", "a(iqq)", property_get_socket_bind, offsetof(CGroupContext, socket_bind_deny), 0),
+        SD_BUS_PROPERTY("SocketBindAllow", "a(iiqq)", property_get_socket_bind, offsetof(CGroupContext, socket_bind_allow), 0),
+        SD_BUS_PROPERTY("SocketBindDeny", "a(iiqq)", property_get_socket_bind, offsetof(CGroupContext, socket_bind_deny), 0),
         SD_BUS_VTABLE_END
 };
 
@@ -1882,19 +1882,22 @@ int bus_cgroup_set_property(
                 CGroupSocketBindItem **list;
                 uint16_t nr_ports, port_min;
                 size_t n = 0;
-                int family;
+                int32_t family, ip_protocol;
 
                 list = streq(name, "SocketBindAllow") ? &c->socket_bind_allow : &c->socket_bind_deny;
 
-                r = sd_bus_message_enter_container(message, 'a', "(iqq)");
+                r = sd_bus_message_enter_container(message, 'a', "(iiqq)");
                 if (r < 0)
                         return r;
 
-                while ((r = sd_bus_message_read(message, "(iqq)", &family, &nr_ports, &port_min)) > 0) {
+                while ((r = sd_bus_message_read(message, "(iiqq)", &family, &ip_protocol, &nr_ports, &port_min)) > 0) {
 
                         if (!IN_SET(family, AF_UNSPEC, AF_INET, AF_INET6))
                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= expects INET or INET6 family, if specified.", name);
 
+                        if (ip_protocol != 0)
+                                return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= expects ip protocol equals to 0, for the time being.", name);
+
                         if (port_min + (uint32_t) nr_ports > (1 << 16))
                                 return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "%s= expects maximum port value lesser than 65536.", name);
 
@@ -1910,6 +1913,7 @@ int bus_cgroup_set_property(
 
                                 *item = (CGroupSocketBindItem) {
                                         .address_family = family,
+                                        .ip_protocol = ip_protocol,
                                         .nr_ports = nr_ports,
                                         .port_min = port_min
                                 };

diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index 46b6549d16bbac630e9a0802cde74705c88842c3..b18f3b34d16a07a941c7a015cdcb41d186f60721 100644 (file)
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -5687,6 +5687,8 @@ int config_parse_cgroup_socket_bind(
                 return log_oom();
         *item = (CGroupSocketBindItem) {
                 .address_family = af,
+                 /* No ip protocol specified for now. */
+                .ip_protocol = 0,
                 .nr_ports = nr_ports,
                 .port_min = port_min,
         };

diff --git a/src/shared/bus-unit-util.c b/src/shared/bus-unit-util.c
index 54d04aae50cb7d6c730d3a2637ba3d94a5c55caf..4c9fb305e41352dd4c3759f6486c8e4f5542fb7d 100644 (file)
--- a/src/shared/bus-unit-util.c
+++ b/src/shared/bus-unit-util.c
@@ -866,11 +866,12 @@ static int bus_append_cgroup_property(sd_bus_message *m, const char *field, cons
         if (STR_IN_SET(field, "SocketBindAllow",
                               "SocketBindDeny")) {
                 if (isempty(eq))
-                        r = sd_bus_message_append(m, "(sv)", field, "a(iqq)", 0);
+                        r = sd_bus_message_append(m, "(sv)", field, "a(iiqq)", 0);
                 else {
+                        /* No ip protocol specified for now. */
+                        int32_t family = AF_UNSPEC, ip_protocol = 0;
                         const char *address_family, *user_port;
                         _cleanup_free_ char *word = NULL;
-                        int family = AF_UNSPEC;
 
                         r = extract_first_word(&eq, &word, ":", 0);
                         if (r == -ENOMEM)
@@ -888,7 +889,7 @@ static int bus_append_cgroup_property(sd_bus_message *m, const char *field, cons
 
                         user_port = eq ? eq : word;
                         if (streq(user_port, "any")) {
-                                r = sd_bus_message_append(m, "(sv)", field, "a(iqq)", 1, family, 0, 0);
+                                r = sd_bus_message_append(m, "(sv)", field, "a(iiqq)", 1, family, ip_protocol, 0, 0);
                                 if (r < 0)
                                         return bus_log_create_error(r);
                         } else {
@@ -901,7 +902,7 @@ static int bus_append_cgroup_property(sd_bus_message *m, const char *field, cons
                                         return log_error_errno(r, "Invalid port or port range: %s", user_port);
 
                                 r = sd_bus_message_append(
-                                                m, "(sv)", field, "a(iqq)", 1, family, port_max - port_min + 1, port_min);
+                                                m, "(sv)", field, "a(iiqq)", 1, family, ip_protocol, port_max - port_min + 1, port_min);
                         }
                 }
                 if (r < 0)

diff --git a/src/systemctl/systemctl-show.c b/src/systemctl/systemctl-show.c
index d4d5a2b427ff284079f6b3b001bd555bef3545f3..178270b4b0aa55a7bc37c74ac921c910630260c9 100644 (file)
--- a/src/systemctl/systemctl-show.c
+++ b/src/systemctl/systemctl-show.c
@@ -1712,12 +1712,12 @@ static int print_property(const char *name, const char *expected_value, sd_bus_m
                         return 1;
                 } else if (STR_IN_SET(name, "SocketBindAllow", "SocketBindDeny")) {
                         uint16_t nr_ports, port_min;
-                        int af;
+                        int32_t af, ip_protocol;
 
-                        r = sd_bus_message_enter_container(m, SD_BUS_TYPE_ARRAY, "(iqq)");
+                        r = sd_bus_message_enter_container(m, SD_BUS_TYPE_ARRAY, "(iiqq)");
                         if (r < 0)
                                 return bus_log_parse_error(r);
-                        while ((r = sd_bus_message_read(m, "(iqq)", &af, &nr_ports, &port_min)) > 0) {
+                        while ((r = sd_bus_message_read(m, "(iiqq)", &af, &ip_protocol, &nr_ports, &port_min)) > 0) {
                                 const char *family, *colon;
 
                                 family = strempty(af_to_ipv4_ipv6(af));