ia64/linux-2.6.18-xen.hg

view net/netfilter/xt_CONNSECMARK.c @ 912:dd42cdb0ab89

[IA64] Build blktap2 driver by default in x86 builds.

add CONFIG_XEN_BLKDEV_TAP2=y to buildconfigs/linux-defconfig_xen_ia64.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>
author Isaku Yamahata <yamahata@valinux.co.jp>
date Mon Jun 29 12:09:16 2009 +0900 (2009-06-29)
parents 831230e53067
children
line source
1 /*
2 * This module is used to copy security markings from packets
3 * to connections, and restore security markings from connections
4 * back to packets. This would normally be performed in conjunction
5 * with the SECMARK target and state match.
6 *
7 * Based somewhat on CONNMARK:
8 * Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
9 * by Henrik Nordstrom <hno@marasystems.com>
10 *
11 * (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
12 *
13 * This program is free software; you can redistribute it and/or modify
14 * it under the terms of the GNU General Public License version 2 as
15 * published by the Free Software Foundation.
16 *
17 */
18 #include <linux/module.h>
19 #include <linux/skbuff.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter/xt_CONNSECMARK.h>
22 #include <net/netfilter/nf_conntrack_compat.h>
24 #define PFX "CONNSECMARK: "
26 MODULE_LICENSE("GPL");
27 MODULE_AUTHOR("James Morris <jmorris@redhat.com>");
28 MODULE_DESCRIPTION("ip[6]tables CONNSECMARK module");
29 MODULE_ALIAS("ipt_CONNSECMARK");
30 MODULE_ALIAS("ip6t_CONNSECMARK");
32 /*
33 * If the packet has a security mark and the connection does not, copy
34 * the security mark from the packet to the connection.
35 */
36 static void secmark_save(struct sk_buff *skb)
37 {
38 if (skb->secmark) {
39 u32 *connsecmark;
40 enum ip_conntrack_info ctinfo;
42 connsecmark = nf_ct_get_secmark(skb, &ctinfo);
43 if (connsecmark && !*connsecmark)
44 if (*connsecmark != skb->secmark)
45 *connsecmark = skb->secmark;
46 }
47 }
49 /*
50 * If packet has no security mark, and the connection does, restore the
51 * security mark from the connection to the packet.
52 */
53 static void secmark_restore(struct sk_buff *skb)
54 {
55 if (!skb->secmark) {
56 u32 *connsecmark;
57 enum ip_conntrack_info ctinfo;
59 connsecmark = nf_ct_get_secmark(skb, &ctinfo);
60 if (connsecmark && *connsecmark)
61 if (skb->secmark != *connsecmark)
62 skb->secmark = *connsecmark;
63 }
64 }
66 static unsigned int target(struct sk_buff **pskb, const struct net_device *in,
67 const struct net_device *out, unsigned int hooknum,
68 const struct xt_target *target,
69 const void *targinfo, void *userinfo)
70 {
71 struct sk_buff *skb = *pskb;
72 const struct xt_connsecmark_target_info *info = targinfo;
74 switch (info->mode) {
75 case CONNSECMARK_SAVE:
76 secmark_save(skb);
77 break;
79 case CONNSECMARK_RESTORE:
80 secmark_restore(skb);
81 break;
83 default:
84 BUG();
85 }
87 return XT_CONTINUE;
88 }
90 static int checkentry(const char *tablename, const void *entry,
91 const struct xt_target *target, void *targinfo,
92 unsigned int targinfosize, unsigned int hook_mask)
93 {
94 struct xt_connsecmark_target_info *info = targinfo;
96 switch (info->mode) {
97 case CONNSECMARK_SAVE:
98 case CONNSECMARK_RESTORE:
99 break;
101 default:
102 printk(KERN_INFO PFX "invalid mode: %hu\n", info->mode);
103 return 0;
104 }
106 return 1;
107 }
109 static struct xt_target ipt_connsecmark_reg = {
110 .name = "CONNSECMARK",
111 .target = target,
112 .targetsize = sizeof(struct xt_connsecmark_target_info),
113 .table = "mangle",
114 .checkentry = checkentry,
115 .me = THIS_MODULE,
116 .family = AF_INET,
117 .revision = 0,
118 };
120 static struct xt_target ip6t_connsecmark_reg = {
121 .name = "CONNSECMARK",
122 .target = target,
123 .targetsize = sizeof(struct xt_connsecmark_target_info),
124 .table = "mangle",
125 .checkentry = checkentry,
126 .me = THIS_MODULE,
127 .family = AF_INET6,
128 .revision = 0,
129 };
131 static int __init xt_connsecmark_init(void)
132 {
133 int err;
135 need_conntrack();
137 err = xt_register_target(&ipt_connsecmark_reg);
138 if (err)
139 return err;
141 err = xt_register_target(&ip6t_connsecmark_reg);
142 if (err)
143 xt_unregister_target(&ipt_connsecmark_reg);
145 return err;
146 }
148 static void __exit xt_connsecmark_fini(void)
149 {
150 xt_unregister_target(&ip6t_connsecmark_reg);
151 xt_unregister_target(&ipt_connsecmark_reg);
152 }
154 module_init(xt_connsecmark_init);
155 module_exit(xt_connsecmark_fini);