Root/
1 | /* |
2 | * This module is used to copy security markings from packets |
3 | * to connections, and restore security markings from connections |
4 | * back to packets. This would normally be performed in conjunction |
5 | * with the SECMARK target and state match. |
6 | * |
7 | * Based somewhat on CONNMARK: |
8 | * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com> |
9 | * by Henrik Nordstrom <hno@marasystems.com> |
10 | * |
11 | * (C) 2006,2008 Red Hat, Inc., James Morris <jmorris@redhat.com> |
12 | * |
13 | * This program is free software; you can redistribute it and/or modify |
14 | * it under the terms of the GNU General Public License version 2 as |
15 | * published by the Free Software Foundation. |
16 | * |
17 | */ |
18 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
19 | #include <linux/module.h> |
20 | #include <linux/skbuff.h> |
21 | #include <linux/netfilter/x_tables.h> |
22 | #include <linux/netfilter/xt_CONNSECMARK.h> |
23 | #include <net/netfilter/nf_conntrack.h> |
24 | #include <net/netfilter/nf_conntrack_ecache.h> |
25 | |
26 | MODULE_LICENSE("GPL"); |
27 | MODULE_AUTHOR("James Morris <jmorris@redhat.com>"); |
28 | MODULE_DESCRIPTION("Xtables: target for copying between connection and security mark"); |
29 | MODULE_ALIAS("ipt_CONNSECMARK"); |
30 | MODULE_ALIAS("ip6t_CONNSECMARK"); |
31 | |
32 | /* |
33 | * If the packet has a security mark and the connection does not, copy |
34 | * the security mark from the packet to the connection. |
35 | */ |
36 | static void secmark_save(const struct sk_buff *skb) |
37 | { |
38 | if (skb->secmark) { |
39 | struct nf_conn *ct; |
40 | enum ip_conntrack_info ctinfo; |
41 | |
42 | ct = nf_ct_get(skb, &ctinfo); |
43 | if (ct && !ct->secmark) { |
44 | ct->secmark = skb->secmark; |
45 | nf_conntrack_event_cache(IPCT_SECMARK, ct); |
46 | } |
47 | } |
48 | } |
49 | |
50 | /* |
51 | * If packet has no security mark, and the connection does, restore the |
52 | * security mark from the connection to the packet. |
53 | */ |
54 | static void secmark_restore(struct sk_buff *skb) |
55 | { |
56 | if (!skb->secmark) { |
57 | const struct nf_conn *ct; |
58 | enum ip_conntrack_info ctinfo; |
59 | |
60 | ct = nf_ct_get(skb, &ctinfo); |
61 | if (ct && ct->secmark) |
62 | skb->secmark = ct->secmark; |
63 | } |
64 | } |
65 | |
66 | static unsigned int |
67 | connsecmark_tg(struct sk_buff *skb, const struct xt_action_param *par) |
68 | { |
69 | const struct xt_connsecmark_target_info *info = par->targinfo; |
70 | |
71 | switch (info->mode) { |
72 | case CONNSECMARK_SAVE: |
73 | secmark_save(skb); |
74 | break; |
75 | |
76 | case CONNSECMARK_RESTORE: |
77 | secmark_restore(skb); |
78 | break; |
79 | |
80 | default: |
81 | BUG(); |
82 | } |
83 | |
84 | return XT_CONTINUE; |
85 | } |
86 | |
87 | static int connsecmark_tg_check(const struct xt_tgchk_param *par) |
88 | { |
89 | const struct xt_connsecmark_target_info *info = par->targinfo; |
90 | int ret; |
91 | |
92 | if (strcmp(par->table, "mangle") != 0 && |
93 | strcmp(par->table, "security") != 0) { |
94 | pr_info("target only valid in the \'mangle\' " |
95 | "or \'security\' tables, not \'%s\'.\n", par->table); |
96 | return -EINVAL; |
97 | } |
98 | |
99 | switch (info->mode) { |
100 | case CONNSECMARK_SAVE: |
101 | case CONNSECMARK_RESTORE: |
102 | break; |
103 | |
104 | default: |
105 | pr_info("invalid mode: %hu\n", info->mode); |
106 | return -EINVAL; |
107 | } |
108 | |
109 | ret = nf_ct_l3proto_try_module_get(par->family); |
110 | if (ret < 0) |
111 | pr_info("cannot load conntrack support for proto=%u\n", |
112 | par->family); |
113 | return ret; |
114 | } |
115 | |
116 | static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par) |
117 | { |
118 | nf_ct_l3proto_module_put(par->family); |
119 | } |
120 | |
121 | static struct xt_target connsecmark_tg_reg __read_mostly = { |
122 | .name = "CONNSECMARK", |
123 | .revision = 0, |
124 | .family = NFPROTO_UNSPEC, |
125 | .checkentry = connsecmark_tg_check, |
126 | .destroy = connsecmark_tg_destroy, |
127 | .target = connsecmark_tg, |
128 | .targetsize = sizeof(struct xt_connsecmark_target_info), |
129 | .me = THIS_MODULE, |
130 | }; |
131 | |
132 | static int __init connsecmark_tg_init(void) |
133 | { |
134 | return xt_register_target(&connsecmark_tg_reg); |
135 | } |
136 | |
137 | static void __exit connsecmark_tg_exit(void) |
138 | { |
139 | xt_unregister_target(&connsecmark_tg_reg); |
140 | } |
141 | |
142 | module_init(connsecmark_tg_init); |
143 | module_exit(connsecmark_tg_exit); |
144 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9