Commit | Line | Data |
---|---|---|
100468e9 JM |
1 | /* |
2 | * This module is used to copy security markings from packets | |
3 | * to connections, and restore security markings from connections | |
4 | * back to packets. This would normally be performed in conjunction | |
5 | * with the SECMARK target and state match. | |
6 | * | |
7 | * Based somewhat on CONNMARK: | |
8 | * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com> | |
9 | * by Henrik Nordstrom <hno@marasystems.com> | |
10 | * | |
11 | * (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com> | |
12 | * | |
13 | * This program is free software; you can redistribute it and/or modify | |
14 | * it under the terms of the GNU General Public License version 2 as | |
15 | * published by the Free Software Foundation. | |
16 | * | |
17 | */ | |
18 | #include <linux/module.h> | |
19 | #include <linux/skbuff.h> | |
20 | #include <linux/netfilter/x_tables.h> | |
21 | #include <linux/netfilter/xt_CONNSECMARK.h> | |
587aa641 | 22 | #include <net/netfilter/nf_conntrack.h> |
100468e9 JM |
23 | |
24 | #define PFX "CONNSECMARK: " | |
25 | ||
26 | MODULE_LICENSE("GPL"); | |
27 | MODULE_AUTHOR("James Morris <jmorris@redhat.com>"); | |
28 | MODULE_DESCRIPTION("ip[6]tables CONNSECMARK module"); | |
29 | MODULE_ALIAS("ipt_CONNSECMARK"); | |
30 | MODULE_ALIAS("ip6t_CONNSECMARK"); | |
31 | ||
32 | /* | |
33 | * If the packet has a security mark and the connection does not, copy | |
34 | * the security mark from the packet to the connection. | |
35 | */ | |
a47362a2 | 36 | static void secmark_save(const struct sk_buff *skb) |
100468e9 JM |
37 | { |
38 | if (skb->secmark) { | |
587aa641 | 39 | struct nf_conn *ct; |
100468e9 JM |
40 | enum ip_conntrack_info ctinfo; |
41 | ||
587aa641 PM |
42 | ct = nf_ct_get(skb, &ctinfo); |
43 | if (ct && !ct->secmark) | |
44 | ct->secmark = skb->secmark; | |
100468e9 JM |
45 | } |
46 | } | |
47 | ||
48 | /* | |
49 | * If packet has no security mark, and the connection does, restore the | |
50 | * security mark from the connection to the packet. | |
51 | */ | |
52 | static void secmark_restore(struct sk_buff *skb) | |
53 | { | |
54 | if (!skb->secmark) { | |
587aa641 | 55 | struct nf_conn *ct; |
100468e9 JM |
56 | enum ip_conntrack_info ctinfo; |
57 | ||
587aa641 PM |
58 | ct = nf_ct_get(skb, &ctinfo); |
59 | if (ct && ct->secmark) | |
60 | skb->secmark = ct->secmark; | |
100468e9 JM |
61 | } |
62 | } | |
63 | ||
3db05fea | 64 | static unsigned int target(struct sk_buff *skb, const struct net_device *in, |
100468e9 JM |
65 | const struct net_device *out, unsigned int hooknum, |
66 | const struct xt_target *target, | |
fe1cb108 | 67 | const void *targinfo) |
100468e9 | 68 | { |
100468e9 JM |
69 | const struct xt_connsecmark_target_info *info = targinfo; |
70 | ||
71 | switch (info->mode) { | |
72 | case CONNSECMARK_SAVE: | |
73 | secmark_save(skb); | |
74 | break; | |
75 | ||
76 | case CONNSECMARK_RESTORE: | |
77 | secmark_restore(skb); | |
78 | break; | |
79 | ||
80 | default: | |
81 | BUG(); | |
82 | } | |
83 | ||
84 | return XT_CONTINUE; | |
85 | } | |
86 | ||
e1931b78 JE |
87 | static bool checkentry(const char *tablename, const void *entry, |
88 | const struct xt_target *target, void *targinfo, | |
89 | unsigned int hook_mask) | |
100468e9 | 90 | { |
a47362a2 | 91 | const struct xt_connsecmark_target_info *info = targinfo; |
100468e9 JM |
92 | |
93 | switch (info->mode) { | |
94 | case CONNSECMARK_SAVE: | |
95 | case CONNSECMARK_RESTORE: | |
96 | break; | |
97 | ||
98 | default: | |
99 | printk(KERN_INFO PFX "invalid mode: %hu\n", info->mode); | |
e1931b78 | 100 | return false; |
100468e9 JM |
101 | } |
102 | ||
67b4af29 JE |
103 | if (nf_ct_l3proto_try_module_get(target->family) < 0) { |
104 | printk(KERN_WARNING "can't load conntrack support for " | |
105 | "proto=%d\n", target->family); | |
106 | return false; | |
107 | } | |
e1931b78 | 108 | return true; |
100468e9 JM |
109 | } |
110 | ||
11078c37 YK |
111 | static void |
112 | destroy(const struct xt_target *target, void *targinfo) | |
113 | { | |
114 | nf_ct_l3proto_module_put(target->family); | |
115 | } | |
116 | ||
9f15c530 | 117 | static struct xt_target xt_connsecmark_target[] __read_mostly = { |
4470bbc7 PM |
118 | { |
119 | .name = "CONNSECMARK", | |
120 | .family = AF_INET, | |
121 | .checkentry = checkentry, | |
11078c37 | 122 | .destroy = destroy, |
4470bbc7 PM |
123 | .target = target, |
124 | .targetsize = sizeof(struct xt_connsecmark_target_info), | |
125 | .table = "mangle", | |
126 | .me = THIS_MODULE, | |
127 | }, | |
128 | { | |
129 | .name = "CONNSECMARK", | |
130 | .family = AF_INET6, | |
131 | .checkentry = checkentry, | |
11078c37 | 132 | .destroy = destroy, |
4470bbc7 PM |
133 | .target = target, |
134 | .targetsize = sizeof(struct xt_connsecmark_target_info), | |
135 | .table = "mangle", | |
136 | .me = THIS_MODULE, | |
137 | }, | |
100468e9 JM |
138 | }; |
139 | ||
140 | static int __init xt_connsecmark_init(void) | |
141 | { | |
28094864 TG |
142 | return xt_register_targets(xt_connsecmark_target, |
143 | ARRAY_SIZE(xt_connsecmark_target)); | |
100468e9 JM |
144 | } |
145 | ||
146 | static void __exit xt_connsecmark_fini(void) | |
147 | { | |
28094864 TG |
148 | xt_unregister_targets(xt_connsecmark_target, |
149 | ARRAY_SIZE(xt_connsecmark_target)); | |
100468e9 JM |
150 | } |
151 | ||
152 | module_init(xt_connsecmark_init); | |
153 | module_exit(xt_connsecmark_fini); |