1 /*
2 * "security" table
3 *
4 * This is for use by Mandatory Access Control (MAC) security models,
5 * which need to be able to manage security policy in separate context
6 * to DAC.
7 *
8 * Based on iptable_mangle.c
9 *
10 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
11 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
12 * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License version 2 as
16 * published by the Free Software Foundation.
17 */
18 #include <linux/module.h>
19 #include <linux/netfilter_ipv4/ip_tables.h>
20 #include <net/ip.h>
21
22 MODULE_LICENSE("GPL");
23 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
24 MODULE_DESCRIPTION("iptables security table, for MAC rules");
25
26 #define SECURITY_VALID_HOOKS (1 << NF_INET_LOCAL_IN) | \
27 (1 << NF_INET_FORWARD) | \
28 (1 << NF_INET_LOCAL_OUT)
29
30 static struct
31 {
32 struct ipt_replace repl;
33 struct ipt_standard entries[3];
34 struct ipt_error term;
35 } initial_table __net_initdata = {
36 .repl = {
37 .name = "security",
38 .valid_hooks = SECURITY_VALID_HOOKS,
39 .num_entries = 4,
40 .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error),
41 .hook_entry = {
42 [NF_INET_LOCAL_IN] = 0,
43 [NF_INET_FORWARD] = sizeof(struct ipt_standard),
44 [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
45 },
46 .underflow = {
47 [NF_INET_LOCAL_IN] = 0,
48 [NF_INET_FORWARD] = sizeof(struct ipt_standard),
49 [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) * 2,
50 },
51 },
52 .entries = {
53 IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_IN */
54 IPT_STANDARD_INIT(NF_ACCEPT), /* FORWARD */
55 IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */
56 },
57 .term = IPT_ERROR_INIT, /* ERROR */
58 };
59
60 static struct xt_table security_table = {
61 .name = "security",
62 .valid_hooks = SECURITY_VALID_HOOKS,
63 .lock = __RW_LOCK_UNLOCKED(security_table.lock),
64 .me = THIS_MODULE,
65 .af = AF_INET,
66 };
67
68 static unsigned int
ipt_local_in_hook(unsigned int hook,struct sk_buff * skb,const struct net_device * in,const struct net_device * out,int (* okfn)(struct sk_buff *))69 ipt_local_in_hook(unsigned int hook,
70 struct sk_buff *skb,
71 const struct net_device *in,
72 const struct net_device *out,
73 int (*okfn)(struct sk_buff *))
74 {
75 return ipt_do_table(skb, hook, in, out,
76 dev_net(in)->ipv4.iptable_security);
77 }
78
79 static unsigned int
ipt_forward_hook(unsigned int hook,struct sk_buff * skb,const struct net_device * in,const struct net_device * out,int (* okfn)(struct sk_buff *))80 ipt_forward_hook(unsigned int hook,
81 struct sk_buff *skb,
82 const struct net_device *in,
83 const struct net_device *out,
84 int (*okfn)(struct sk_buff *))
85 {
86 return ipt_do_table(skb, hook, in, out,
87 dev_net(in)->ipv4.iptable_security);
88 }
89
90 static unsigned int
ipt_local_out_hook(unsigned int hook,struct sk_buff * skb,const struct net_device * in,const struct net_device * out,int (* okfn)(struct sk_buff *))91 ipt_local_out_hook(unsigned int hook,
92 struct sk_buff *skb,
93 const struct net_device *in,
94 const struct net_device *out,
95 int (*okfn)(struct sk_buff *))
96 {
97 /* Somebody is playing with raw sockets. */
98 if (skb->len < sizeof(struct iphdr)
99 || ip_hdrlen(skb) < sizeof(struct iphdr))
100 return NF_ACCEPT;
101 return ipt_do_table(skb, hook, in, out,
102 dev_net(out)->ipv4.iptable_security);
103 }
104
105 static struct nf_hook_ops ipt_ops[] __read_mostly = {
106 {
107 .hook = ipt_local_in_hook,
108 .owner = THIS_MODULE,
109 .pf = PF_INET,
110 .hooknum = NF_INET_LOCAL_IN,
111 .priority = NF_IP_PRI_SECURITY,
112 },
113 {
114 .hook = ipt_forward_hook,
115 .owner = THIS_MODULE,
116 .pf = PF_INET,
117 .hooknum = NF_INET_FORWARD,
118 .priority = NF_IP_PRI_SECURITY,
119 },
120 {
121 .hook = ipt_local_out_hook,
122 .owner = THIS_MODULE,
123 .pf = PF_INET,
124 .hooknum = NF_INET_LOCAL_OUT,
125 .priority = NF_IP_PRI_SECURITY,
126 },
127 };
128
iptable_security_net_init(struct net * net)129 static int __net_init iptable_security_net_init(struct net *net)
130 {
131 net->ipv4.iptable_security =
132 ipt_register_table(net, &security_table, &initial_table.repl);
133
134 if (IS_ERR(net->ipv4.iptable_security))
135 return PTR_ERR(net->ipv4.iptable_security);
136
137 return 0;
138 }
139
iptable_security_net_exit(struct net * net)140 static void __net_exit iptable_security_net_exit(struct net *net)
141 {
142 ipt_unregister_table(net->ipv4.iptable_security);
143 }
144
145 static struct pernet_operations iptable_security_net_ops = {
146 .init = iptable_security_net_init,
147 .exit = iptable_security_net_exit,
148 };
149
iptable_security_init(void)150 static int __init iptable_security_init(void)
151 {
152 int ret;
153
154 ret = register_pernet_subsys(&iptable_security_net_ops);
155 if (ret < 0)
156 return ret;
157
158 ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
159 if (ret < 0)
160 goto cleanup_table;
161
162 return ret;
163
164 cleanup_table:
165 unregister_pernet_subsys(&iptable_security_net_ops);
166 return ret;
167 }
168
iptable_security_fini(void)169 static void __exit iptable_security_fini(void)
170 {
171 nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
172 unregister_pernet_subsys(&iptable_security_net_ops);
173 }
174
175 module_init(iptable_security_init);
176 module_exit(iptable_security_fini);
177