Root/
1 | /* |
2 | * This module is used to copy security markings from packets |
3 | * to connections, and restore security markings from connections |
4 | * back to packets. This would normally be performed in conjunction |
5 | * with the SECMARK target and state match. |
6 | * |
7 | * Based somewhat on CONNMARK: |
8 | * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com> |
9 | * by Henrik Nordstrom <hno@marasystems.com> |
10 | * |
11 | * (C) 2006,2008 Red Hat, Inc., James Morris <jmorris@redhat.com> |
12 | * |
13 | * This program is free software; you can redistribute it and/or modify |
14 | * it under the terms of the GNU General Public License version 2 as |
15 | * published by the Free Software Foundation. |
16 | * |
17 | */ |
18 | #include <linux/module.h> |
19 | #include <linux/skbuff.h> |
20 | #include <linux/netfilter/x_tables.h> |
21 | #include <linux/netfilter/xt_CONNSECMARK.h> |
22 | #include <net/netfilter/nf_conntrack.h> |
23 | #include <net/netfilter/nf_conntrack_ecache.h> |
24 | |
25 | #define PFX "CONNSECMARK: " |
26 | |
27 | MODULE_LICENSE("GPL"); |
28 | MODULE_AUTHOR("James Morris <jmorris@redhat.com>"); |
29 | MODULE_DESCRIPTION("Xtables: target for copying between connection and security mark"); |
30 | MODULE_ALIAS("ipt_CONNSECMARK"); |
31 | MODULE_ALIAS("ip6t_CONNSECMARK"); |
32 | |
33 | /* |
34 | * If the packet has a security mark and the connection does not, copy |
35 | * the security mark from the packet to the connection. |
36 | */ |
37 | static void secmark_save(const struct sk_buff *skb) |
38 | { |
39 | if (skb->secmark) { |
40 | struct nf_conn *ct; |
41 | enum ip_conntrack_info ctinfo; |
42 | |
43 | ct = nf_ct_get(skb, &ctinfo); |
44 | if (ct && !ct->secmark) { |
45 | ct->secmark = skb->secmark; |
46 | nf_conntrack_event_cache(IPCT_SECMARK, ct); |
47 | } |
48 | } |
49 | } |
50 | |
51 | /* |
52 | * If packet has no security mark, and the connection does, restore the |
53 | * security mark from the connection to the packet. |
54 | */ |
55 | static void secmark_restore(struct sk_buff *skb) |
56 | { |
57 | if (!skb->secmark) { |
58 | const struct nf_conn *ct; |
59 | enum ip_conntrack_info ctinfo; |
60 | |
61 | ct = nf_ct_get(skb, &ctinfo); |
62 | if (ct && ct->secmark) |
63 | skb->secmark = ct->secmark; |
64 | } |
65 | } |
66 | |
67 | static unsigned int |
68 | connsecmark_tg(struct sk_buff *skb, const struct xt_target_param *par) |
69 | { |
70 | const struct xt_connsecmark_target_info *info = par->targinfo; |
71 | |
72 | switch (info->mode) { |
73 | case CONNSECMARK_SAVE: |
74 | secmark_save(skb); |
75 | break; |
76 | |
77 | case CONNSECMARK_RESTORE: |
78 | secmark_restore(skb); |
79 | break; |
80 | |
81 | default: |
82 | BUG(); |
83 | } |
84 | |
85 | return XT_CONTINUE; |
86 | } |
87 | |
88 | static bool connsecmark_tg_check(const struct xt_tgchk_param *par) |
89 | { |
90 | const struct xt_connsecmark_target_info *info = par->targinfo; |
91 | |
92 | if (strcmp(par->table, "mangle") != 0 && |
93 | strcmp(par->table, "security") != 0) { |
94 | printk(KERN_INFO PFX "target only valid in the \'mangle\' " |
95 | "or \'security\' tables, not \'%s\'.\n", par->table); |
96 | return false; |
97 | } |
98 | |
99 | switch (info->mode) { |
100 | case CONNSECMARK_SAVE: |
101 | case CONNSECMARK_RESTORE: |
102 | break; |
103 | |
104 | default: |
105 | printk(KERN_INFO PFX "invalid mode: %hu\n", info->mode); |
106 | return false; |
107 | } |
108 | |
109 | if (nf_ct_l3proto_try_module_get(par->family) < 0) { |
110 | printk(KERN_WARNING "can't load conntrack support for " |
111 | "proto=%u\n", par->family); |
112 | return false; |
113 | } |
114 | return true; |
115 | } |
116 | |
117 | static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par) |
118 | { |
119 | nf_ct_l3proto_module_put(par->family); |
120 | } |
121 | |
122 | static struct xt_target connsecmark_tg_reg __read_mostly = { |
123 | .name = "CONNSECMARK", |
124 | .revision = 0, |
125 | .family = NFPROTO_UNSPEC, |
126 | .checkentry = connsecmark_tg_check, |
127 | .destroy = connsecmark_tg_destroy, |
128 | .target = connsecmark_tg, |
129 | .targetsize = sizeof(struct xt_connsecmark_target_info), |
130 | .me = THIS_MODULE, |
131 | }; |
132 | |
133 | static int __init connsecmark_tg_init(void) |
134 | { |
135 | return xt_register_target(&connsecmark_tg_reg); |
136 | } |
137 | |
138 | static void __exit connsecmark_tg_exit(void) |
139 | { |
140 | xt_unregister_target(&connsecmark_tg_reg); |
141 | } |
142 | |
143 | module_init(connsecmark_tg_init); |
144 | module_exit(connsecmark_tg_exit); |
145 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9