Merge branches 'topic/fix/misc' and 'topic/fix/hda' into for-linus
[linux-2.6] / net / ipv6 / netfilter / ip6table_security.c
1 /*
2  * "security" table for IPv6
3  *
4  * This is for use by Mandatory Access Control (MAC) security models,
5  * which need to be able to manage security policy in separate context
6  * to DAC.
7  *
8  * Based on iptable_mangle.c
9  *
10  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
12  * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
13  *
14  * This program is free software; you can redistribute it and/or modify
15  * it under the terms of the GNU General Public License version 2 as
16  * published by the Free Software Foundation.
17  */
18 #include <linux/module.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
20
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
23 MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
24
25 #define SECURITY_VALID_HOOKS    (1 << NF_INET_LOCAL_IN) | \
26                                 (1 << NF_INET_FORWARD) | \
27                                 (1 << NF_INET_LOCAL_OUT)
28
29 static struct
30 {
31         struct ip6t_replace repl;
32         struct ip6t_standard entries[3];
33         struct ip6t_error term;
34 } initial_table __net_initdata = {
35         .repl = {
36                 .name = "security",
37                 .valid_hooks = SECURITY_VALID_HOOKS,
38                 .num_entries = 4,
39                 .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
40                 .hook_entry = {
41                         [NF_INET_LOCAL_IN]      = 0,
42                         [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
43                         [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
44                 },
45                 .underflow = {
46                         [NF_INET_LOCAL_IN]      = 0,
47                         [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
48                         [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
49                 },
50         },
51         .entries = {
52                 IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
53                 IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
54                 IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
55         },
56         .term = IP6T_ERROR_INIT,                /* ERROR */
57 };
58
59 static struct xt_table security_table = {
60         .name           = "security",
61         .valid_hooks    = SECURITY_VALID_HOOKS,
62         .lock           = __RW_LOCK_UNLOCKED(security_table.lock),
63         .me             = THIS_MODULE,
64         .af             = AF_INET6,
65 };
66
67 static unsigned int
68 ip6t_local_in_hook(unsigned int hook,
69                    struct sk_buff *skb,
70                    const struct net_device *in,
71                    const struct net_device *out,
72                    int (*okfn)(struct sk_buff *))
73 {
74         return ip6t_do_table(skb, hook, in, out,
75                              dev_net(in)->ipv6.ip6table_security);
76 }
77
78 static unsigned int
79 ip6t_forward_hook(unsigned int hook,
80                   struct sk_buff *skb,
81                   const struct net_device *in,
82                   const struct net_device *out,
83                   int (*okfn)(struct sk_buff *))
84 {
85         return ip6t_do_table(skb, hook, in, out,
86                              dev_net(in)->ipv6.ip6table_security);
87 }
88
89 static unsigned int
90 ip6t_local_out_hook(unsigned int hook,
91                     struct sk_buff *skb,
92                     const struct net_device *in,
93                     const struct net_device *out,
94                     int (*okfn)(struct sk_buff *))
95 {
96         /* TBD: handle short packets via raw socket */
97         return ip6t_do_table(skb, hook, in, out,
98                              dev_net(out)->ipv6.ip6table_security);
99 }
100
101 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
102         {
103                 .hook           = ip6t_local_in_hook,
104                 .owner          = THIS_MODULE,
105                 .pf             = PF_INET6,
106                 .hooknum        = NF_INET_LOCAL_IN,
107                 .priority       = NF_IP6_PRI_SECURITY,
108         },
109         {
110                 .hook           = ip6t_forward_hook,
111                 .owner          = THIS_MODULE,
112                 .pf             = PF_INET6,
113                 .hooknum        = NF_INET_FORWARD,
114                 .priority       = NF_IP6_PRI_SECURITY,
115         },
116         {
117                 .hook           = ip6t_local_out_hook,
118                 .owner          = THIS_MODULE,
119                 .pf             = PF_INET6,
120                 .hooknum        = NF_INET_LOCAL_OUT,
121                 .priority       = NF_IP6_PRI_SECURITY,
122         },
123 };
124
125 static int __net_init ip6table_security_net_init(struct net *net)
126 {
127         net->ipv6.ip6table_security =
128                 ip6t_register_table(net, &security_table, &initial_table.repl);
129
130         if (IS_ERR(net->ipv6.ip6table_security))
131                 return PTR_ERR(net->ipv6.ip6table_security);
132
133         return 0;
134 }
135
136 static void __net_exit ip6table_security_net_exit(struct net *net)
137 {
138         ip6t_unregister_table(net->ipv6.ip6table_security);
139 }
140
141 static struct pernet_operations ip6table_security_net_ops = {
142         .init = ip6table_security_net_init,
143         .exit = ip6table_security_net_exit,
144 };
145
146 static int __init ip6table_security_init(void)
147 {
148         int ret;
149
150         ret = register_pernet_subsys(&ip6table_security_net_ops);
151         if (ret < 0)
152                 return ret;
153
154         ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
155         if (ret < 0)
156                 goto cleanup_table;
157
158         return ret;
159
160 cleanup_table:
161         unregister_pernet_subsys(&ip6table_security_net_ops);
162         return ret;
163 }
164
165 static void __exit ip6table_security_fini(void)
166 {
167         nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
168         unregister_pernet_subsys(&ip6table_security_net_ops);
169 }
170
171 module_init(ip6table_security_init);
172 module_exit(ip6table_security_fini);