cregit-Linux how code gets into the kernel

Release 4.11 net/netfilter/xt_CONNSECMARK.c

Directory: net/netfilter
/*
 * This module is used to copy security markings from packets
 * to connections, and restore security markings from connections
 * back to packets.  This would normally be performed in conjunction
 * with the SECMARK target and state match.
 *
 * Based somewhat on CONNMARK:
 *   Copyright (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
 *    by Henrik Nordstrom <hno@marasystems.com>
 *
 * (C) 2006,2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 */

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_CONNSECMARK.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_ecache.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("James Morris <jmorris@redhat.com>");
MODULE_DESCRIPTION("Xtables: target for copying between connection and security mark");
MODULE_ALIAS("ipt_CONNSECMARK");
MODULE_ALIAS("ip6t_CONNSECMARK");

/*
 * If the packet has a security mark and the connection does not, copy
 * the security mark from the packet to the connection.
 */

static void secmark_save(const struct sk_buff *skb) { if (skb->secmark) { struct nf_conn *ct; enum ip_conntrack_info ctinfo; ct = nf_ct_get(skb, &ctinfo); if (ct && !ct->secmark) { ct->secmark = skb->secmark; nf_conntrack_event_cache(IPCT_SECMARK, ct); } } }

Contributors

PersonTokensPropCommitsCommitProp
James Morris4366.15%120.00%
Patrick McHardy1218.46%120.00%
Pablo Neira Ayuso812.31%120.00%
Jan Engelhardt11.54%120.00%
Alexey Dobriyan11.54%120.00%
Total65100.00%5100.00%

/* * If packet has no security mark, and the connection does, restore the * security mark from the connection to the packet. */
static void secmark_restore(struct sk_buff *skb) { if (!skb->secmark) { const struct nf_conn *ct; enum ip_conntrack_info ctinfo; ct = nf_ct_get(skb, &ctinfo); if (ct && ct->secmark) skb->secmark = ct->secmark; } }

Contributors

PersonTokensPropCommitsCommitProp
James Morris4376.79%133.33%
Patrick McHardy1221.43%133.33%
Jan Engelhardt11.79%133.33%
Total56100.00%3100.00%


static unsigned int connsecmark_tg(struct sk_buff *skb, const struct xt_action_param *par) { const struct xt_connsecmark_target_info *info = par->targinfo; switch (info->mode) { case CONNSECMARK_SAVE: secmark_save(skb); break; case CONNSECMARK_RESTORE: secmark_restore(skb); break; default: BUG(); } return XT_CONTINUE; }

Contributors

PersonTokensPropCommitsCommitProp
James Morris5590.16%120.00%
Jan Engelhardt58.20%360.00%
Herbert Xu11.64%120.00%
Total61100.00%5100.00%


static int connsecmark_tg_check(const struct xt_tgchk_param *par) { const struct xt_connsecmark_target_info *info = par->targinfo; int ret; if (strcmp(par->table, "mangle") != 0 && strcmp(par->table, "security") != 0) { pr_info("target only valid in the \'mangle\' " "or \'security\' tables, not \'%s\'.\n", par->table); return -EINVAL; } switch (info->mode) { case CONNSECMARK_SAVE: case CONNSECMARK_RESTORE: break; default: pr_info("invalid mode: %hu\n", info->mode); return -EINVAL; } ret = nf_ct_netns_get(par->net, par->family); if (ret < 0) pr_info("cannot load conntrack support for proto=%u\n", par->family); return ret; }

Contributors

PersonTokensPropCommitsCommitProp
Jan Engelhardt6148.80%872.73%
James Morris5947.20%218.18%
Florian Westphal54.00%19.09%
Total125100.00%11100.00%


static void connsecmark_tg_destroy(const struct xt_tgdtor_param *par) { nf_ct_netns_put(par->net, par->family); }

Contributors

PersonTokensPropCommitsCommitProp
Yasuyuki Kozakai1356.52%125.00%
Florian Westphal521.74%125.00%
Jan Engelhardt521.74%250.00%
Total23100.00%4100.00%

static struct xt_target connsecmark_tg_reg __read_mostly = { .name = "CONNSECMARK", .revision = 0, .family = NFPROTO_UNSPEC, .checkentry = connsecmark_tg_check, .destroy = connsecmark_tg_destroy, .target = connsecmark_tg, .targetsize = sizeof(struct xt_connsecmark_target_info), .me = THIS_MODULE, };
static int __init connsecmark_tg_init(void) { return xt_register_target(&connsecmark_tg_reg); }

Contributors

PersonTokensPropCommitsCommitProp
James Morris1168.75%125.00%
Jan Engelhardt425.00%250.00%
Patrick McHardy16.25%125.00%
Total16100.00%4100.00%


static void __exit connsecmark_tg_exit(void) { xt_unregister_target(&connsecmark_tg_reg); }

Contributors

PersonTokensPropCommitsCommitProp
James Morris1066.67%125.00%
Jan Engelhardt426.67%250.00%
Patrick McHardy16.67%125.00%
Total15100.00%4100.00%

module_init(connsecmark_tg_init); module_exit(connsecmark_tg_exit);

Overall Contributors

PersonTokensPropCommitsCommitProp
James Morris30764.50%28.33%
Jan Engelhardt9820.59%1458.33%
Patrick McHardy316.51%312.50%
Yasuyuki Kozakai173.57%14.17%
Pablo Neira Ayuso112.31%14.17%
Florian Westphal102.10%14.17%
Herbert Xu10.21%14.17%
Alexey Dobriyan10.21%14.17%
Total476100.00%24100.00%
Directory: net/netfilter
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.
Created with cregit.