[mirror_ubuntu-bionic-kernel.git] / net / netfilter / xt_CONNSECMARK.c

/*
 * This module is used to copy security markings from packets
 * to connections, and restore security markings from connections
 * back to packets.  This would normally be performed in conjunction
 * with the SECMARK target and state match.
 *
 * Based somewhat on CONNMARK:
 *   Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
 *    by Henrik Nordstrom <hno@marasystems.com>
 *
 * (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 */
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_CONNSECMARK.h>
#include <net/netfilter/nf_conntrack.h>

#define PFX "CONNSECMARK: "

MODULE_LICENSE("GPL");
MODULE_AUTHOR("James Morris <jmorris@redhat.com>");
MODULE_DESCRIPTION("ip[6]tables CONNSECMARK module");
MODULE_ALIAS("ipt_CONNSECMARK");
MODULE_ALIAS("ip6t_CONNSECMARK");

/*
 * If the packet has a security mark and the connection does not, copy
 * the security mark from the packet to the connection.
 */
static void secmark_save(struct sk_buff *skb)
{
	if (skb->secmark) {
		struct nf_conn *ct;
		enum ip_conntrack_info ctinfo;

		ct = nf_ct_get(skb, &ctinfo);
		if (ct && !ct->secmark)
			ct->secmark = skb->secmark;
	}
}

/*
 * If packet has no security mark, and the connection does, restore the
 * security mark from the connection to the packet.
 */
static void secmark_restore(struct sk_buff *skb)
{
	if (!skb->secmark) {
		struct nf_conn *ct;
		enum ip_conntrack_info ctinfo;

		ct = nf_ct_get(skb, &ctinfo);
		if (ct && ct->secmark)
			skb->secmark = ct->secmark;
	}
}

static unsigned int target(struct sk_buff **pskb, const struct net_device *in,
			   const struct net_device *out, unsigned int hooknum,
			   const struct xt_target *target,
			   const void *targinfo)
{
	struct sk_buff *skb = *pskb;
	const struct xt_connsecmark_target_info *info = targinfo;

	switch (info->mode) {
	case CONNSECMARK_SAVE:
		secmark_save(skb);
		break;

	case CONNSECMARK_RESTORE:
		secmark_restore(skb);
		break;

	default:
		BUG();
	}

	return XT_CONTINUE;
}

static int checkentry(const char *tablename, const void *entry,
		      const struct xt_target *target, void *targinfo,
		      unsigned int hook_mask)
{
	struct xt_connsecmark_target_info *info = targinfo;

	if (nf_ct_l3proto_try_module_get(target->family) < 0) {
		printk(KERN_WARNING "can't load conntrack support for "
				    "proto=%d\n", target->family);
		return 0;
	}
	switch (info->mode) {
	case CONNSECMARK_SAVE:
	case CONNSECMARK_RESTORE:
		break;

	default:
		printk(KERN_INFO PFX "invalid mode: %hu\n", info->mode);
		return 0;
	}

	return 1;
}

static void
destroy(const struct xt_target *target, void *targinfo)
{
	nf_ct_l3proto_module_put(target->family);
}

static struct xt_target xt_connsecmark_target[] = {
	{
		.name		= "CONNSECMARK",
		.family		= AF_INET,
		.checkentry	= checkentry,
		.destroy	= destroy,
		.target		= target,
		.targetsize	= sizeof(struct xt_connsecmark_target_info),
		.table		= "mangle",
		.me		= THIS_MODULE,
	},
	{
		.name		= "CONNSECMARK",
		.family		= AF_INET6,
		.checkentry	= checkentry,
		.destroy	= destroy,
		.target		= target,
		.targetsize	= sizeof(struct xt_connsecmark_target_info),
		.table		= "mangle",
		.me		= THIS_MODULE,
	},
};

static int __init xt_connsecmark_init(void)
{
	return xt_register_targets(xt_connsecmark_target,
				   ARRAY_SIZE(xt_connsecmark_target));
}

static void __exit xt_connsecmark_fini(void)
{
	xt_unregister_targets(xt_connsecmark_target,
			      ARRAY_SIZE(xt_connsecmark_target));
}

module_init(xt_connsecmark_init);
module_exit(xt_connsecmark_fini);
Commit	Line	Data
100468e9 JM	1	/*
	2	* This module is used to copy security markings from packets
	3	* to connections, and restore security markings from connections
	4	* back to packets. This would normally be performed in conjunction
	5	* with the SECMARK target and state match.
	6	*
	7	* Based somewhat on CONNMARK:
	8	* Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
	9	* by Henrik Nordstrom <hno@marasystems.com>
	10	*
	11	* (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
	12	*
	13	* This program is free software; you can redistribute it and/or modify
	14	* it under the terms of the GNU General Public License version 2 as
	15	* published by the Free Software Foundation.
	16	*
	17	*/
	18	#include <linux/module.h>
	19	#include <linux/skbuff.h>
	20	#include <linux/netfilter/x_tables.h>
	21	#include <linux/netfilter/xt_CONNSECMARK.h>
587aa641	22	#include <net/netfilter/nf_conntrack.h>
100468e9 JM	23
	24	#define PFX "CONNSECMARK: "
	25
	26	MODULE_LICENSE("GPL");
	27	MODULE_AUTHOR("James Morris <jmorris@redhat.com>");
	28	MODULE_DESCRIPTION("ip[6]tables CONNSECMARK module");
	29	MODULE_ALIAS("ipt_CONNSECMARK");
	30	MODULE_ALIAS("ip6t_CONNSECMARK");
	31
	32	/*
	33	* If the packet has a security mark and the connection does not, copy
	34	* the security mark from the packet to the connection.
	35	*/
	36	static void secmark_save(struct sk_buff *skb)
	37	{
	38	if (skb->secmark) {
587aa641	39	struct nf_conn *ct;
100468e9 JM	40	enum ip_conntrack_info ctinfo;
100468e9 JM	41
587aa641 PM	42	ct = nf_ct_get(skb, &ctinfo);
	43	if (ct && !ct->secmark)
	44	ct->secmark = skb->secmark;
100468e9 JM	45	}
	46	}
	47
	48	/*
	49	* If packet has no security mark, and the connection does, restore the
	50	* security mark from the connection to the packet.
	51	*/
	52	static void secmark_restore(struct sk_buff *skb)
	53	{
	54	if (!skb->secmark) {
587aa641	55	struct nf_conn *ct;
100468e9 JM	56	enum ip_conntrack_info ctinfo;
100468e9 JM	57
587aa641 PM	58	ct = nf_ct_get(skb, &ctinfo);
	59	if (ct && ct->secmark)
	60	skb->secmark = ct->secmark;
100468e9 JM	61	}
	62	}
	63
	64	static unsigned int target(struct sk_buff *pskb, const struct net_device in,
	65	const struct net_device *out, unsigned int hooknum,
	66	const struct xt_target *target,
fe1cb108	67	const void *targinfo)
100468e9 JM	68	{
	69	struct sk_buff skb = pskb;
	70	const struct xt_connsecmark_target_info *info = targinfo;
	71
	72	switch (info->mode) {
	73	case CONNSECMARK_SAVE:
	74	secmark_save(skb);
	75	break;
	76
	77	case CONNSECMARK_RESTORE:
	78	secmark_restore(skb);
	79	break;
	80
	81	default:
	82	BUG();
	83	}
	84
	85	return XT_CONTINUE;
	86	}
	87
	88	static int checkentry(const char tablename, const void entry,
	89	const struct xt_target target, void targinfo,
efa74165	90	unsigned int hook_mask)
100468e9 JM	91	{
	92	struct xt_connsecmark_target_info *info = targinfo;
	93
11078c37 YK	94	if (nf_ct_l3proto_try_module_get(target->family) < 0) {
	95	printk(KERN_WARNING "can't load conntrack support for "
	96	"proto=%d\n", target->family);
	97	return 0;
	98	}
100468e9 JM	99	switch (info->mode) {
	100	case CONNSECMARK_SAVE:
	101	case CONNSECMARK_RESTORE:
	102	break;
	103
	104	default:
	105	printk(KERN_INFO PFX "invalid mode: %hu\n", info->mode);
	106	return 0;
	107	}
	108
	109	return 1;
	110	}
	111
11078c37 YK	112	static void
	113	destroy(const struct xt_target target, void targinfo)
	114	{
	115	nf_ct_l3proto_module_put(target->family);
	116	}
	117
4470bbc7 PM	118	static struct xt_target xt_connsecmark_target[] = {
	119	{
	120	.name = "CONNSECMARK",
	121	.family = AF_INET,
	122	.checkentry = checkentry,
11078c37	123	.destroy = destroy,
4470bbc7 PM	124	.target = target,
	125	.targetsize = sizeof(struct xt_connsecmark_target_info),
	126	.table = "mangle",
	127	.me = THIS_MODULE,
	128	},
	129	{
	130	.name = "CONNSECMARK",
	131	.family = AF_INET6,
	132	.checkentry = checkentry,
11078c37	133	.destroy = destroy,
4470bbc7 PM	134	.target = target,
	135	.targetsize = sizeof(struct xt_connsecmark_target_info),
	136	.table = "mangle",
	137	.me = THIS_MODULE,
	138	},
100468e9 JM	139	};
	140
	141	static int __init xt_connsecmark_init(void)
	142	{
28094864 TG	143	return xt_register_targets(xt_connsecmark_target,
28094864 TG	144	ARRAY_SIZE(xt_connsecmark_target));
100468e9 JM	145	}
	146
	147	static void __exit xt_connsecmark_fini(void)
	148	{
28094864 TG	149	xt_unregister_targets(xt_connsecmark_target,
28094864 TG	150	ARRAY_SIZE(xt_connsecmark_target));
100468e9 JM	151	}
	152
	153	module_init(xt_connsecmark_init);
	154	module_exit(xt_connsecmark_fini);