1/*
2 * "security" table
3 *
4 * This is for use by Mandatory Access Control (MAC) security models,
5 * which need to be able to manage security policy in separate context
6 * to DAC.
7 *
8 * Based on iptable_mangle.c
9 *
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
12 * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License version 2 as
16 * published by the Free Software Foundation.
17 */
18#include <linux/module.h>
19#include <linux/netfilter_ipv4/ip_tables.h>
20#include <linux/slab.h>
21#include <net/ip.h>
22
23MODULE_LICENSE("GPL");
24MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
25MODULE_DESCRIPTION("iptables security table, for MAC rules");
26
27#define SECURITY_VALID_HOOKS	(1 << NF_INET_LOCAL_IN) | \
28				(1 << NF_INET_FORWARD) | \
29				(1 << NF_INET_LOCAL_OUT)
30
31static const struct xt_table security_table = {
32	.name		= "security",
33	.valid_hooks	= SECURITY_VALID_HOOKS,
34	.me		= THIS_MODULE,
35	.af		= NFPROTO_IPV4,
36	.priority	= NF_IP_PRI_SECURITY,
37};
38
39static unsigned int
40iptable_security_hook(const struct nf_hook_ops *ops, struct sk_buff *skb,
41		      const struct nf_hook_state *state)
42{
43	const struct net *net;
44
45	if (ops->hooknum == NF_INET_LOCAL_OUT &&
46	    (skb->len < sizeof(struct iphdr) ||
47	     ip_hdrlen(skb) < sizeof(struct iphdr)))
48		/* Somebody is playing with raw sockets. */
49		return NF_ACCEPT;
50
51	net = dev_net(state->in ? state->in : state->out);
52	return ipt_do_table(skb, ops->hooknum, state,
53			    net->ipv4.iptable_security);
54}
55
56static struct nf_hook_ops *sectbl_ops __read_mostly;
57
58static int __net_init iptable_security_net_init(struct net *net)
59{
60	struct ipt_replace *repl;
61
62	repl = ipt_alloc_initial_table(&security_table);
63	if (repl == NULL)
64		return -ENOMEM;
65	net->ipv4.iptable_security =
66		ipt_register_table(net, &security_table, repl);
67	kfree(repl);
68	return PTR_ERR_OR_ZERO(net->ipv4.iptable_security);
69}
70
71static void __net_exit iptable_security_net_exit(struct net *net)
72{
73	ipt_unregister_table(net, net->ipv4.iptable_security);
74}
75
76static struct pernet_operations iptable_security_net_ops = {
77	.init = iptable_security_net_init,
78	.exit = iptable_security_net_exit,
79};
80
81static int __init iptable_security_init(void)
82{
83	int ret;
84
85	ret = register_pernet_subsys(&iptable_security_net_ops);
86        if (ret < 0)
87		return ret;
88
89	sectbl_ops = xt_hook_link(&security_table, iptable_security_hook);
90	if (IS_ERR(sectbl_ops)) {
91		ret = PTR_ERR(sectbl_ops);
92		goto cleanup_table;
93	}
94
95	return ret;
96
97cleanup_table:
98	unregister_pernet_subsys(&iptable_security_net_ops);
99	return ret;
100}
101
102static void __exit iptable_security_fini(void)
103{
104	xt_hook_unlink(&security_table, sectbl_ops);
105	unregister_pernet_subsys(&iptable_security_net_ops);
106}
107
108module_init(iptable_security_init);
109module_exit(iptable_security_fini);
110