net/ipv6/netfilter/ip6table_security.c

   1 /*
   2  * "security" table for IPv6
   3  *
   4  * This is for use by Mandatory Access Control (MAC) security models,
   5  * which need to be able to manage security policy in separate context
   6  * to DAC.
   7  *
   8  * Based on iptable_mangle.c
   9  *
  10  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
  11  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
  12  * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License version 2 as
  16  * published by the Free Software Foundation.
  17  */
  18 #include <linux/module.h>
  19 #include <linux/netfilter_ipv6/ip6_tables.h>
  20
  21 MODULE_LICENSE("GPL");
  22 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
  23 MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
  24
  25 #define SECURITY_VALID_HOOKS    (1 << NF_INET_LOCAL_IN) | \
  26                                 (1 << NF_INET_FORWARD) | \
  27                                 (1 << NF_INET_LOCAL_OUT)
  28
  29 static const struct
  30 {
  31         struct ip6t_replace repl;
  32         struct ip6t_standard entries[3];
  33         struct ip6t_error term;
  34 } initial_table __net_initdata = {
  35         .repl = {
  36                 .name = "security",
  37                 .valid_hooks = SECURITY_VALID_HOOKS,
  38                 .num_entries = 4,
  39                 .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
  40                 .hook_entry = {
  41                         [NF_INET_LOCAL_IN]      = 0,
  42                         [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
  43                         [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
  44                 },
  45                 .underflow = {
  46                         [NF_INET_LOCAL_IN]      = 0,
  47                         [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
  48                         [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
  49                 },
  50         },
  51         .entries = {
  52                 IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
  53                 IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
  54                 IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
  55         },
  56         .term = IP6T_ERROR_INIT,                /* ERROR */
  57 };
  58
  59 static const struct xt_table security_table = {
  60         .name           = "security",
  61         .valid_hooks    = SECURITY_VALID_HOOKS,
  62         .me             = THIS_MODULE,
  63         .af             = NFPROTO_IPV6,
  64 };
  65
  66 static unsigned int
  67 ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
  68                        const struct net_device *in,
  69                        const struct net_device *out,
  70                        int (*okfn)(struct sk_buff *))
  71 {
  72         if (hook == NF_INET_LOCAL_OUT)
  73                 return ip6t_do_table(skb, hook, in, out,
  74                                      dev_net(out)->ipv6.ip6table_security);
  75
  76         /* INPUT/FORWARD: */
  77         return ip6t_do_table(skb, hook, in, out,
  78                              dev_net(in)->ipv6.ip6table_security);
  79 }
  80
  81 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
  82         {
  83                 .hook           = ip6table_security_hook,
  84                 .owner          = THIS_MODULE,
  85                 .pf             = NFPROTO_IPV6,
  86                 .hooknum        = NF_INET_LOCAL_IN,
  87                 .priority       = NF_IP6_PRI_SECURITY,
  88         },
  89         {
  90                 .hook           = ip6table_security_hook,
  91                 .owner          = THIS_MODULE,
  92                 .pf             = NFPROTO_IPV6,
  93                 .hooknum        = NF_INET_FORWARD,
  94                 .priority       = NF_IP6_PRI_SECURITY,
  95         },
  96         {
  97                 .hook           = ip6table_security_hook,
  98                 .owner          = THIS_MODULE,
  99                 .pf             = NFPROTO_IPV6,
 100                 .hooknum        = NF_INET_LOCAL_OUT,
 101                 .priority       = NF_IP6_PRI_SECURITY,
 102         },
 103 };
 104
 105 static int __net_init ip6table_security_net_init(struct net *net)
 106 {
 107         net->ipv6.ip6table_security =
 108                 ip6t_register_table(net, &security_table, &initial_table.repl);
 109
 110         if (IS_ERR(net->ipv6.ip6table_security))
 111                 return PTR_ERR(net->ipv6.ip6table_security);
 112
 113         return 0;
 114 }
 115
 116 static void __net_exit ip6table_security_net_exit(struct net *net)
 117 {
 118         ip6t_unregister_table(net, net->ipv6.ip6table_security);
 119 }
 120
 121 static struct pernet_operations ip6table_security_net_ops = {
 122         .init = ip6table_security_net_init,
 123         .exit = ip6table_security_net_exit,
 124 };
 125
 126 static int __init ip6table_security_init(void)
 127 {
 128         int ret;
 129
 130         ret = register_pernet_subsys(&ip6table_security_net_ops);
 131         if (ret < 0)
 132                 return ret;
 133
 134         ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
 135         if (ret < 0)
 136                 goto cleanup_table;
 137
 138         return ret;
 139
 140 cleanup_table:
 141         unregister_pernet_subsys(&ip6table_security_net_ops);
 142         return ret;
 143 }
 144
 145 static void __exit ip6table_security_fini(void)
 146 {
 147         nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
 148         unregister_pernet_subsys(&ip6table_security_net_ops);
 149 }
 150
 151 module_init(ip6table_security_init);
 152 module_exit(ip6table_security_fini);