Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[linux-2.6] / net / ipv4 / netfilter / iptable_security.c
1 /*
2  * "security" table
3  *
4  * This is for use by Mandatory Access Control (MAC) security models,
5  * which need to be able to manage security policy in separate context
6  * to DAC.
7  *
8  * Based on iptable_mangle.c
9  *
10  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
12  * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
13  *
14  * This program is free software; you can redistribute it and/or modify
15  * it under the terms of the GNU General Public License version 2 as
16  * published by the Free Software Foundation.
17  */
18 #include <linux/module.h>
19 #include <linux/netfilter_ipv4/ip_tables.h>
20 #include <net/ip.h>
21
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
24 MODULE_DESCRIPTION("iptables security table, for MAC rules");
25
26 #define SECURITY_VALID_HOOKS    (1 << NF_INET_LOCAL_IN) | \
27                                 (1 << NF_INET_FORWARD) | \
28                                 (1 << NF_INET_LOCAL_OUT)
29
30 static struct
31 {
32         struct ipt_replace repl;
33         struct ipt_standard entries[3];
34         struct ipt_error term;
35 } initial_table __initdata = {
36         .repl = {
37                 .name = "security",
38                 .valid_hooks = SECURITY_VALID_HOOKS,
39                 .num_entries = 4,
40                 .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
41                 .hook_entry = {
42                         [NF_INET_LOCAL_IN]      = 0,
43                         [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
44                         [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
45                 },
46                 .underflow = {
47                         [NF_INET_LOCAL_IN]      = 0,
48                         [NF_INET_FORWARD]       = sizeof(struct ipt_standard),
49                         [NF_INET_LOCAL_OUT]     = sizeof(struct ipt_standard) * 2,
50                 },
51         },
52         .entries = {
53                 IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_IN */
54                 IPT_STANDARD_INIT(NF_ACCEPT),   /* FORWARD */
55                 IPT_STANDARD_INIT(NF_ACCEPT),   /* LOCAL_OUT */
56         },
57         .term = IPT_ERROR_INIT,                 /* ERROR */
58 };
59
60 static struct xt_table security_table = {
61         .name           = "security",
62         .valid_hooks    = SECURITY_VALID_HOOKS,
63         .lock           = __RW_LOCK_UNLOCKED(security_table.lock),
64         .me             = THIS_MODULE,
65         .af             = AF_INET,
66 };
67
68 static unsigned int
69 ipt_local_in_hook(unsigned int hook,
70                   struct sk_buff *skb,
71                   const struct net_device *in,
72                   const struct net_device *out,
73                   int (*okfn)(struct sk_buff *))
74 {
75         return ipt_do_table(skb, hook, in, out,
76                             nf_local_in_net(in, out)->ipv4.iptable_security);
77 }
78
79 static unsigned int
80 ipt_forward_hook(unsigned int hook,
81                  struct sk_buff *skb,
82                  const struct net_device *in,
83                  const struct net_device *out,
84                  int (*okfn)(struct sk_buff *))
85 {
86         return ipt_do_table(skb, hook, in, out,
87                             nf_forward_net(in, out)->ipv4.iptable_security);
88 }
89
90 static unsigned int
91 ipt_local_out_hook(unsigned int hook,
92                    struct sk_buff *skb,
93                    const struct net_device *in,
94                    const struct net_device *out,
95                    int (*okfn)(struct sk_buff *))
96 {
97         /* Somebody is playing with raw sockets. */
98         if (skb->len < sizeof(struct iphdr)
99             || ip_hdrlen(skb) < sizeof(struct iphdr)) {
100                 if (net_ratelimit())
101                         printk(KERN_INFO "iptable_security: ignoring short "
102                                "SOCK_RAW packet.\n");
103                 return NF_ACCEPT;
104         }
105         return ipt_do_table(skb, hook, in, out,
106                             nf_local_out_net(in, out)->ipv4.iptable_security);
107 }
108
109 static struct nf_hook_ops ipt_ops[] __read_mostly = {
110         {
111                 .hook           = ipt_local_in_hook,
112                 .owner          = THIS_MODULE,
113                 .pf             = PF_INET,
114                 .hooknum        = NF_INET_LOCAL_IN,
115                 .priority       = NF_IP_PRI_SECURITY,
116         },
117         {
118                 .hook           = ipt_forward_hook,
119                 .owner          = THIS_MODULE,
120                 .pf             = PF_INET,
121                 .hooknum        = NF_INET_FORWARD,
122                 .priority       = NF_IP_PRI_SECURITY,
123         },
124         {
125                 .hook           = ipt_local_out_hook,
126                 .owner          = THIS_MODULE,
127                 .pf             = PF_INET,
128                 .hooknum        = NF_INET_LOCAL_OUT,
129                 .priority       = NF_IP_PRI_SECURITY,
130         },
131 };
132
133 static int __net_init iptable_security_net_init(struct net *net)
134 {
135         net->ipv4.iptable_security =
136                 ipt_register_table(net, &security_table, &initial_table.repl);
137
138         if (IS_ERR(net->ipv4.iptable_security))
139                 return PTR_ERR(net->ipv4.iptable_security);
140
141         return 0;
142 }
143
144 static void __net_exit iptable_security_net_exit(struct net *net)
145 {
146         ipt_unregister_table(net->ipv4.iptable_security);
147 }
148
149 static struct pernet_operations iptable_security_net_ops = {
150         .init = iptable_security_net_init,
151         .exit = iptable_security_net_exit,
152 };
153
154 static int __init iptable_security_init(void)
155 {
156         int ret;
157
158         ret = register_pernet_subsys(&iptable_security_net_ops);
159         if (ret < 0)
160                 return ret;
161
162         ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
163         if (ret < 0)
164                 goto cleanup_table;
165
166         return ret;
167
168 cleanup_table:
169         unregister_pernet_subsys(&iptable_security_net_ops);
170         return ret;
171 }
172
173 static void __exit iptable_security_fini(void)
174 {
175         nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
176         unregister_pernet_subsys(&iptable_security_net_ops);
177 }
178
179 module_init(iptable_security_init);
180 module_exit(iptable_security_fini);