1// SPDX-License-Identifier: GPL-2.0-only
  2/*
  3 *  Simplified MAC Kernel (smack) security module
  4 *
  5 *  This file contains the Smack netfilter implementation
  6 *
  7 *  Author:
  8 *	Casey Schaufler <casey@schaufler-ca.com>
  9 *
 10 *  Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
 11 *  Copyright (C) 2014 Intel Corporation.
 
 
 
 
 12 */
 13
 14#include <linux/netfilter_ipv4.h>
 15#include <linux/netfilter_ipv6.h>
 16#include <linux/netdevice.h>
 17#include <net/inet_sock.h>
 18#include <net/net_namespace.h>
 19#include "smack.h"
 20
 21#if IS_ENABLED(CONFIG_IPV6)
 22
 23static unsigned int smack_ipv6_output(void *priv,
 24					struct sk_buff *skb,
 25					const struct nf_hook_state *state)
 26{
 27	struct sock *sk = skb_to_full_sk(skb);
 28	struct socket_smack *ssp;
 29	struct smack_known *skp;
 30
 31	if (sk && sk->sk_security) {
 32		ssp = sk->sk_security;
 33		skp = ssp->smk_out;
 34		skb->secmark = skp->smk_secid;
 35	}
 36
 37	return NF_ACCEPT;
 38}
 39#endif	/* IPV6 */
 40
 41static unsigned int smack_ipv4_output(void *priv,
 42					struct sk_buff *skb,
 43					const struct nf_hook_state *state)
 44{
 45	struct sock *sk = skb_to_full_sk(skb);
 46	struct socket_smack *ssp;
 47	struct smack_known *skp;
 48
 49	if (sk && sk->sk_security) {
 50		ssp = sk->sk_security;
 51		skp = ssp->smk_out;
 52		skb->secmark = skp->smk_secid;
 53	}
 54
 55	return NF_ACCEPT;
 56}
 57
 58static const struct nf_hook_ops smack_nf_ops[] = {
 59	{
 60		.hook =		smack_ipv4_output,
 61		.pf =		NFPROTO_IPV4,
 62		.hooknum =	NF_INET_LOCAL_OUT,
 63		.priority =	NF_IP_PRI_SELINUX_FIRST,
 64	},
 65#if IS_ENABLED(CONFIG_IPV6)
 66	{
 67		.hook =		smack_ipv6_output,
 68		.pf =		NFPROTO_IPV6,
 69		.hooknum =	NF_INET_LOCAL_OUT,
 70		.priority =	NF_IP6_PRI_SELINUX_FIRST,
 71	},
 72#endif	/* IPV6 */
 73};
 74
 75static int __net_init smack_nf_register(struct net *net)
 76{
 77	return nf_register_net_hooks(net, smack_nf_ops,
 78				     ARRAY_SIZE(smack_nf_ops));
 79}
 80
 81static void __net_exit smack_nf_unregister(struct net *net)
 82{
 83	nf_unregister_net_hooks(net, smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
 84}
 85
 86static struct pernet_operations smack_net_ops = {
 87	.init = smack_nf_register,
 88	.exit = smack_nf_unregister,
 89};
 90
 91static int __init smack_nf_ip_init(void)
 92{
 
 
 93	if (smack_enabled == 0)
 94		return 0;
 95
 96	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
 97	return register_pernet_subsys(&smack_net_ops);
 
 
 
 
 
 98}
 99
100__initcall(smack_nf_ip_init);

 
 1/*
 2 *  Simplified MAC Kernel (smack) security module
 3 *
 4 *  This file contains the Smack netfilter implementation
 5 *
 6 *  Author:
 7 *	Casey Schaufler <casey@schaufler-ca.com>
 8 *
 9 *  Copyright (C) 2014 Casey Schaufler <casey@schaufler-ca.com>
10 *  Copyright (C) 2014 Intel Corporation.
11 *
12 *	This program is free software; you can redistribute it and/or modify
13 *	it under the terms of the GNU General Public License version 2,
14 *	as published by the Free Software Foundation.
15 */
16
17#include <linux/netfilter_ipv4.h>
18#include <linux/netfilter_ipv6.h>
19#include <linux/netdevice.h>
20#include <net/inet_sock.h>
 
21#include "smack.h"
22
23#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
24
25static unsigned int smack_ipv6_output(void *priv,
26					struct sk_buff *skb,
27					const struct nf_hook_state *state)
28{
29	struct sock *sk = skb_to_full_sk(skb);
30	struct socket_smack *ssp;
31	struct smack_known *skp;
32
33	if (sk && sk->sk_security) {
34		ssp = sk->sk_security;
35		skp = ssp->smk_out;
36		skb->secmark = skp->smk_secid;
37	}
38
39	return NF_ACCEPT;
40}
41#endif	/* IPV6 */
42
43static unsigned int smack_ipv4_output(void *priv,
44					struct sk_buff *skb,
45					const struct nf_hook_state *state)
46{
47	struct sock *sk = skb_to_full_sk(skb);
48	struct socket_smack *ssp;
49	struct smack_known *skp;
50
51	if (sk && sk->sk_security) {
52		ssp = sk->sk_security;
53		skp = ssp->smk_out;
54		skb->secmark = skp->smk_secid;
55	}
56
57	return NF_ACCEPT;
58}
59
60static struct nf_hook_ops smack_nf_ops[] = {
61	{
62		.hook =		smack_ipv4_output,
63		.pf =		NFPROTO_IPV4,
64		.hooknum =	NF_INET_LOCAL_OUT,
65		.priority =	NF_IP_PRI_SELINUX_FIRST,
66	},
67#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
68	{
69		.hook =		smack_ipv6_output,
70		.pf =		NFPROTO_IPV6,
71		.hooknum =	NF_INET_LOCAL_OUT,
72		.priority =	NF_IP6_PRI_SELINUX_FIRST,
73	},
74#endif	/* IPV6 */
75};
76
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
77static int __init smack_nf_ip_init(void)
78{
79	int err;
80
81	if (smack_enabled == 0)
82		return 0;
83
84	printk(KERN_DEBUG "Smack: Registering netfilter hooks\n");
85
86	err = nf_register_hooks(smack_nf_ops, ARRAY_SIZE(smack_nf_ops));
87	if (err)
88		pr_info("Smack: nf_register_hooks: error %d\n", err);
89
90	return 0;
91}
92
93__initcall(smack_nf_ip_init);