[linux-2.6-block.git] / net / ipv6 / netfilter / ip6table_security.c

/*
 * "security" table for IPv6
 *
 * This is for use by Mandatory Access Control (MAC) security models,
 * which need to be able to manage security policy in separate context
 * to DAC.
 *
 * Based on iptable_mangle.c
 *
 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
 * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */
#include <linux/module.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include <linux/slab.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
MODULE_DESCRIPTION("ip6tables security table, for MAC rules");

#define SECURITY_VALID_HOOKS	(1 << NF_INET_LOCAL_IN) | \
				(1 << NF_INET_FORWARD) | \
				(1 << NF_INET_LOCAL_OUT)

static const struct xt_table security_table = {
	.name		= "security",
	.valid_hooks	= SECURITY_VALID_HOOKS,
	.me		= THIS_MODULE,
	.af		= NFPROTO_IPV6,
	.priority	= NF_IP6_PRI_SECURITY,
};

static unsigned int
ip6table_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
		       const struct nf_hook_state *state)
{
	return ip6t_do_table(skb, ops->hooknum, state,
			     state->net->ipv6.ip6table_security);
}

static struct nf_hook_ops *sectbl_ops __read_mostly;

static int __net_init ip6table_security_net_init(struct net *net)
{
	struct ip6t_replace *repl;

	repl = ip6t_alloc_initial_table(&security_table);
	if (repl == NULL)
		return -ENOMEM;
	net->ipv6.ip6table_security =
		ip6t_register_table(net, &security_table, repl);
	kfree(repl);
	return PTR_ERR_OR_ZERO(net->ipv6.ip6table_security);
}

static void __net_exit ip6table_security_net_exit(struct net *net)
{
	ip6t_unregister_table(net, net->ipv6.ip6table_security);
}

static struct pernet_operations ip6table_security_net_ops = {
	.init = ip6table_security_net_init,
	.exit = ip6table_security_net_exit,
};

static int __init ip6table_security_init(void)
{
	int ret;

	ret = register_pernet_subsys(&ip6table_security_net_ops);
	if (ret < 0)
		return ret;

	sectbl_ops = xt_hook_link(&security_table, ip6table_security_hook);
	if (IS_ERR(sectbl_ops)) {
		ret = PTR_ERR(sectbl_ops);
		goto cleanup_table;
	}

	return ret;

cleanup_table:
	unregister_pernet_subsys(&ip6table_security_net_ops);
	return ret;
}

static void __exit ip6table_security_fini(void)
{
	xt_hook_unlink(&security_table, sectbl_ops);
	unregister_pernet_subsys(&ip6table_security_net_ops);
}

module_init(ip6table_security_init);
module_exit(ip6table_security_fini);
Commit	Line	Data
17e6e59f JM	1	/*
	2	* "security" table for IPv6
	3	*
	4	* This is for use by Mandatory Access Control (MAC) security models,
	5	* which need to be able to manage security policy in separate context
	6	* to DAC.
	7	*
	8	* Based on iptable_mangle.c
	9	*
	10	* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
	11	* Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
	12	* Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
	13	*
	14	* This program is free software; you can redistribute it and/or modify
	15	* it under the terms of the GNU General Public License version 2 as
	16	* published by the Free Software Foundation.
	17	*/
	18	#include <linux/module.h>
	19	#include <linux/netfilter_ipv6/ip6_tables.h>
5a0e3ad6	20	#include <linux/slab.h>
17e6e59f JM	21
	22	MODULE_LICENSE("GPL");
	23	MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
	24	MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
	25
	26	#define SECURITY_VALID_HOOKS (1 << NF_INET_LOCAL_IN) \| \
	27	(1 << NF_INET_FORWARD) \| \
	28	(1 << NF_INET_LOCAL_OUT)
	29
35aad0ff	30	static const struct xt_table security_table = {
17e6e59f JM	31	.name = "security",
17e6e59f JM	32	.valid_hooks = SECURITY_VALID_HOOKS,
17e6e59f	33	.me = THIS_MODULE,
f88e6a8a	34	.af = NFPROTO_IPV6,
2b95efe7	35	.priority = NF_IP6_PRI_SECURITY,
17e6e59f JM	36	};
	37
	38	static unsigned int
795aa6ef	39	ip6table_security_hook(const struct nf_hook_ops ops, struct sk_buff skb,
238e54c9	40	const struct nf_hook_state *state)
17e6e59f	41	{
8f8a3715	42	return ip6t_do_table(skb, ops->hooknum, state,
9dff2c96	43	state->net->ipv6.ip6table_security);
17e6e59f JM	44	}
17e6e59f JM	45
2b95efe7	46	static struct nf_hook_ops *sectbl_ops __read_mostly;
17e6e59f JM	47
	48	static int __net_init ip6table_security_net_init(struct net *net)
	49	{
e3eaa991	50	struct ip6t_replace *repl;
17e6e59f	51
e3eaa991 JE	52	repl = ip6t_alloc_initial_table(&security_table);
	53	if (repl == NULL)
	54	return -ENOMEM;
	55	net->ipv6.ip6table_security =
	56	ip6t_register_table(net, &security_table, repl);
	57	kfree(repl);
8c6ffba0	58	return PTR_ERR_OR_ZERO(net->ipv6.ip6table_security);
17e6e59f JM	59	}
	60
	61	static void __net_exit ip6table_security_net_exit(struct net *net)
	62	{
f54e9367	63	ip6t_unregister_table(net, net->ipv6.ip6table_security);
17e6e59f JM	64	}
	65
	66	static struct pernet_operations ip6table_security_net_ops = {
	67	.init = ip6table_security_net_init,
	68	.exit = ip6table_security_net_exit,
	69	};
	70
	71	static int __init ip6table_security_init(void)
	72	{
	73	int ret;
	74
	75	ret = register_pernet_subsys(&ip6table_security_net_ops);
	76	if (ret < 0)
	77	return ret;
	78
2b95efe7 JE	79	sectbl_ops = xt_hook_link(&security_table, ip6table_security_hook);
	80	if (IS_ERR(sectbl_ops)) {
	81	ret = PTR_ERR(sectbl_ops);
17e6e59f	82	goto cleanup_table;
2b95efe7	83	}
17e6e59f JM	84
	85	return ret;
	86
	87	cleanup_table:
	88	unregister_pernet_subsys(&ip6table_security_net_ops);
	89	return ret;
	90	}
	91
	92	static void __exit ip6table_security_fini(void)
	93	{
2b95efe7	94	xt_hook_unlink(&security_table, sectbl_ops);
17e6e59f JM	95	unregister_pernet_subsys(&ip6table_security_net_ops);
	96	}
	97
	98	module_init(ip6table_security_init);
	99	module_exit(ip6table_security_fini);