]>
Commit | Line | Data |
---|---|---|
100468e9 JM |
1 | /* |
2 | * This module is used to copy security markings from packets | |
3 | * to connections, and restore security markings from connections | |
4 | * back to packets. This would normally be performed in conjunction | |
5 | * with the SECMARK target and state match. | |
6 | * | |
7 | * Based somewhat on CONNMARK: | |
8 | * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com> | |
9 | * by Henrik Nordstrom <hno@marasystems.com> | |
10 | * | |
11 | * (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com> | |
12 | * | |
13 | * This program is free software; you can redistribute it and/or modify | |
14 | * it under the terms of the GNU General Public License version 2 as | |
15 | * published by the Free Software Foundation. | |
16 | * | |
17 | */ | |
18 | #include <linux/module.h> | |
19 | #include <linux/skbuff.h> | |
20 | #include <linux/netfilter/x_tables.h> | |
21 | #include <linux/netfilter/xt_CONNSECMARK.h> | |
587aa641 | 22 | #include <net/netfilter/nf_conntrack.h> |
37fccd85 | 23 | #include <net/netfilter/nf_conntrack_ecache.h> |
100468e9 JM |
24 | |
25 | #define PFX "CONNSECMARK: " | |
26 | ||
27 | MODULE_LICENSE("GPL"); | |
28 | MODULE_AUTHOR("James Morris <jmorris@redhat.com>"); | |
2ae15b64 | 29 | MODULE_DESCRIPTION("Xtables: target for copying between connection and security mark"); |
100468e9 JM |
30 | MODULE_ALIAS("ipt_CONNSECMARK"); |
31 | MODULE_ALIAS("ip6t_CONNSECMARK"); | |
32 | ||
33 | /* | |
34 | * If the packet has a security mark and the connection does not, copy | |
35 | * the security mark from the packet to the connection. | |
36 | */ | |
a47362a2 | 37 | static void secmark_save(const struct sk_buff *skb) |
100468e9 JM |
38 | { |
39 | if (skb->secmark) { | |
587aa641 | 40 | struct nf_conn *ct; |
100468e9 JM |
41 | enum ip_conntrack_info ctinfo; |
42 | ||
587aa641 | 43 | ct = nf_ct_get(skb, &ctinfo); |
37fccd85 | 44 | if (ct && !ct->secmark) { |
587aa641 | 45 | ct->secmark = skb->secmark; |
37fccd85 PNA |
46 | nf_conntrack_event_cache(IPCT_SECMARK, skb); |
47 | } | |
100468e9 JM |
48 | } |
49 | } | |
50 | ||
51 | /* | |
52 | * If packet has no security mark, and the connection does, restore the | |
53 | * security mark from the connection to the packet. | |
54 | */ | |
55 | static void secmark_restore(struct sk_buff *skb) | |
56 | { | |
57 | if (!skb->secmark) { | |
587aa641 | 58 | struct nf_conn *ct; |
100468e9 JM |
59 | enum ip_conntrack_info ctinfo; |
60 | ||
587aa641 PM |
61 | ct = nf_ct_get(skb, &ctinfo); |
62 | if (ct && ct->secmark) | |
63 | skb->secmark = ct->secmark; | |
100468e9 JM |
64 | } |
65 | } | |
66 | ||
d3c5ee6d JE |
67 | static unsigned int |
68 | connsecmark_tg(struct sk_buff *skb, const struct net_device *in, | |
69 | const struct net_device *out, unsigned int hooknum, | |
70 | const struct xt_target *target, const void *targinfo) | |
100468e9 | 71 | { |
100468e9 JM |
72 | const struct xt_connsecmark_target_info *info = targinfo; |
73 | ||
74 | switch (info->mode) { | |
75 | case CONNSECMARK_SAVE: | |
76 | secmark_save(skb); | |
77 | break; | |
78 | ||
79 | case CONNSECMARK_RESTORE: | |
80 | secmark_restore(skb); | |
81 | break; | |
82 | ||
83 | default: | |
84 | BUG(); | |
85 | } | |
86 | ||
87 | return XT_CONTINUE; | |
88 | } | |
89 | ||
d3c5ee6d JE |
90 | static bool |
91 | connsecmark_tg_check(const char *tablename, const void *entry, | |
92 | const struct xt_target *target, void *targinfo, | |
93 | unsigned int hook_mask) | |
100468e9 | 94 | { |
a47362a2 | 95 | const struct xt_connsecmark_target_info *info = targinfo; |
100468e9 JM |
96 | |
97 | switch (info->mode) { | |
98 | case CONNSECMARK_SAVE: | |
99 | case CONNSECMARK_RESTORE: | |
100 | break; | |
101 | ||
102 | default: | |
103 | printk(KERN_INFO PFX "invalid mode: %hu\n", info->mode); | |
e1931b78 | 104 | return false; |
100468e9 JM |
105 | } |
106 | ||
67b4af29 JE |
107 | if (nf_ct_l3proto_try_module_get(target->family) < 0) { |
108 | printk(KERN_WARNING "can't load conntrack support for " | |
df54aae0 | 109 | "proto=%u\n", target->family); |
67b4af29 JE |
110 | return false; |
111 | } | |
e1931b78 | 112 | return true; |
100468e9 JM |
113 | } |
114 | ||
11078c37 | 115 | static void |
d3c5ee6d | 116 | connsecmark_tg_destroy(const struct xt_target *target, void *targinfo) |
11078c37 YK |
117 | { |
118 | nf_ct_l3proto_module_put(target->family); | |
119 | } | |
120 | ||
d3c5ee6d | 121 | static struct xt_target connsecmark_tg_reg[] __read_mostly = { |
4470bbc7 PM |
122 | { |
123 | .name = "CONNSECMARK", | |
124 | .family = AF_INET, | |
d3c5ee6d JE |
125 | .checkentry = connsecmark_tg_check, |
126 | .destroy = connsecmark_tg_destroy, | |
127 | .target = connsecmark_tg, | |
4470bbc7 PM |
128 | .targetsize = sizeof(struct xt_connsecmark_target_info), |
129 | .table = "mangle", | |
130 | .me = THIS_MODULE, | |
131 | }, | |
132 | { | |
133 | .name = "CONNSECMARK", | |
134 | .family = AF_INET6, | |
d3c5ee6d JE |
135 | .checkentry = connsecmark_tg_check, |
136 | .destroy = connsecmark_tg_destroy, | |
137 | .target = connsecmark_tg, | |
4470bbc7 PM |
138 | .targetsize = sizeof(struct xt_connsecmark_target_info), |
139 | .table = "mangle", | |
140 | .me = THIS_MODULE, | |
141 | }, | |
100468e9 JM |
142 | }; |
143 | ||
d3c5ee6d | 144 | static int __init connsecmark_tg_init(void) |
100468e9 | 145 | { |
d3c5ee6d JE |
146 | return xt_register_targets(connsecmark_tg_reg, |
147 | ARRAY_SIZE(connsecmark_tg_reg)); | |
100468e9 JM |
148 | } |
149 | ||
d3c5ee6d | 150 | static void __exit connsecmark_tg_exit(void) |
100468e9 | 151 | { |
d3c5ee6d JE |
152 | xt_unregister_targets(connsecmark_tg_reg, |
153 | ARRAY_SIZE(connsecmark_tg_reg)); | |
100468e9 JM |
154 | } |
155 | ||
d3c5ee6d JE |
156 | module_init(connsecmark_tg_init); |
157 | module_exit(connsecmark_tg_exit); |