Commit | Line | Data |
---|---|---|
100468e9 JM |
1 | /* |
2 | * This module is used to copy security markings from packets | |
3 | * to connections, and restore security markings from connections | |
4 | * back to packets. This would normally be performed in conjunction | |
5 | * with the SECMARK target and state match. | |
6 | * | |
7 | * Based somewhat on CONNMARK: | |
8 | * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com> | |
9 | * by Henrik Nordstrom <hno@marasystems.com> | |
10 | * | |
560ee653 | 11 | * (C) 2006,2008 Red Hat, Inc., James Morris <jmorris@redhat.com> |
100468e9 JM |
12 | * |
13 | * This program is free software; you can redistribute it and/or modify | |
14 | * it under the terms of the GNU General Public License version 2 as | |
15 | * published by the Free Software Foundation. | |
16 | * | |
17 | */ | |
18 | #include <linux/module.h> | |
19 | #include <linux/skbuff.h> | |
20 | #include <linux/netfilter/x_tables.h> | |
21 | #include <linux/netfilter/xt_CONNSECMARK.h> | |
587aa641 | 22 | #include <net/netfilter/nf_conntrack.h> |
37fccd85 | 23 | #include <net/netfilter/nf_conntrack_ecache.h> |
100468e9 JM |
24 | |
25 | #define PFX "CONNSECMARK: " | |
26 | ||
27 | MODULE_LICENSE("GPL"); | |
28 | MODULE_AUTHOR("James Morris <jmorris@redhat.com>"); | |
2ae15b64 | 29 | MODULE_DESCRIPTION("Xtables: target for copying between connection and security mark"); |
100468e9 JM |
30 | MODULE_ALIAS("ipt_CONNSECMARK"); |
31 | MODULE_ALIAS("ip6t_CONNSECMARK"); | |
32 | ||
33 | /* | |
34 | * If the packet has a security mark and the connection does not, copy | |
35 | * the security mark from the packet to the connection. | |
36 | */ | |
a47362a2 | 37 | static void secmark_save(const struct sk_buff *skb) |
100468e9 JM |
38 | { |
39 | if (skb->secmark) { | |
587aa641 | 40 | struct nf_conn *ct; |
100468e9 JM |
41 | enum ip_conntrack_info ctinfo; |
42 | ||
587aa641 | 43 | ct = nf_ct_get(skb, &ctinfo); |
37fccd85 | 44 | if (ct && !ct->secmark) { |
587aa641 | 45 | ct->secmark = skb->secmark; |
a71996fc | 46 | nf_conntrack_event_cache(IPCT_SECMARK, ct); |
37fccd85 | 47 | } |
100468e9 JM |
48 | } |
49 | } | |
50 | ||
51 | /* | |
52 | * If packet has no security mark, and the connection does, restore the | |
53 | * security mark from the connection to the packet. | |
54 | */ | |
55 | static void secmark_restore(struct sk_buff *skb) | |
56 | { | |
57 | if (!skb->secmark) { | |
3cf93c96 | 58 | const struct nf_conn *ct; |
100468e9 JM |
59 | enum ip_conntrack_info ctinfo; |
60 | ||
587aa641 PM |
61 | ct = nf_ct_get(skb, &ctinfo); |
62 | if (ct && ct->secmark) | |
63 | skb->secmark = ct->secmark; | |
100468e9 JM |
64 | } |
65 | } | |
66 | ||
d3c5ee6d | 67 | static unsigned int |
7eb35586 | 68 | connsecmark_tg(struct sk_buff *skb, const struct xt_target_param *par) |
100468e9 | 69 | { |
7eb35586 | 70 | const struct xt_connsecmark_target_info *info = par->targinfo; |
100468e9 JM |
71 | |
72 | switch (info->mode) { | |
73 | case CONNSECMARK_SAVE: | |
74 | secmark_save(skb); | |
75 | break; | |
76 | ||
77 | case CONNSECMARK_RESTORE: | |
78 | secmark_restore(skb); | |
79 | break; | |
80 | ||
81 | default: | |
82 | BUG(); | |
83 | } | |
84 | ||
85 | return XT_CONTINUE; | |
86 | } | |
87 | ||
af5d6dc2 | 88 | static bool connsecmark_tg_check(const struct xt_tgchk_param *par) |
100468e9 | 89 | { |
af5d6dc2 | 90 | const struct xt_connsecmark_target_info *info = par->targinfo; |
100468e9 | 91 | |
af5d6dc2 JE |
92 | if (strcmp(par->table, "mangle") != 0 && |
93 | strcmp(par->table, "security") != 0) { | |
560ee653 | 94 | printk(KERN_INFO PFX "target only valid in the \'mangle\' " |
af5d6dc2 | 95 | "or \'security\' tables, not \'%s\'.\n", par->table); |
560ee653 JM |
96 | return false; |
97 | } | |
98 | ||
100468e9 JM |
99 | switch (info->mode) { |
100 | case CONNSECMARK_SAVE: | |
101 | case CONNSECMARK_RESTORE: | |
102 | break; | |
103 | ||
104 | default: | |
105 | printk(KERN_INFO PFX "invalid mode: %hu\n", info->mode); | |
e1931b78 | 106 | return false; |
100468e9 JM |
107 | } |
108 | ||
92f3b2b1 | 109 | if (nf_ct_l3proto_try_module_get(par->family) < 0) { |
67b4af29 | 110 | printk(KERN_WARNING "can't load conntrack support for " |
92f3b2b1 | 111 | "proto=%u\n", par->family); |
67b4af29 JE |
112 | return false; |
113 | } | |
e1931b78 | 114 | return true; |
100468e9 JM |
115 | } |
116 | ||
a2df1648 | 117 | static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par) |
11078c37 | 118 | { |
92f3b2b1 | 119 | nf_ct_l3proto_module_put(par->family); |
11078c37 YK |
120 | } |
121 | ||
92f3b2b1 JE |
122 | static struct xt_target connsecmark_tg_reg __read_mostly = { |
123 | .name = "CONNSECMARK", | |
124 | .revision = 0, | |
125 | .family = NFPROTO_UNSPEC, | |
126 | .checkentry = connsecmark_tg_check, | |
127 | .destroy = connsecmark_tg_destroy, | |
128 | .target = connsecmark_tg, | |
129 | .targetsize = sizeof(struct xt_connsecmark_target_info), | |
130 | .me = THIS_MODULE, | |
100468e9 JM |
131 | }; |
132 | ||
d3c5ee6d | 133 | static int __init connsecmark_tg_init(void) |
100468e9 | 134 | { |
92f3b2b1 | 135 | return xt_register_target(&connsecmark_tg_reg); |
100468e9 JM |
136 | } |
137 | ||
d3c5ee6d | 138 | static void __exit connsecmark_tg_exit(void) |
100468e9 | 139 | { |
92f3b2b1 | 140 | xt_unregister_target(&connsecmark_tg_reg); |
100468e9 JM |
141 | } |
142 | ||
d3c5ee6d JE |
143 | module_init(connsecmark_tg_init); |
144 | module_exit(connsecmark_tg_exit); |