1 /*
2 * Shared library add-on to iptables to add SECMARK target support.
3 *
4 * Based on the MARK target.
5 *
6 * Copyright (C) 2006 Red Hat, Inc., James Morris <[email protected]>
7 */
8 #include <stdio.h>
9 #include <xtables.h>
10 #include <linux/netfilter/xt_SECMARK.h>
11
12 #define PFX "SECMARK target: "
13
14 enum {
15 O_SELCTX = 0,
16 };
17
SECMARK_help(void)18 static void SECMARK_help(void)
19 {
20 printf(
21 "SECMARK target options:\n"
22 " --selctx value Set the SELinux security context\n");
23 }
24
25 static const struct xt_option_entry SECMARK_opts[] = {
26 {.name = "selctx", .id = O_SELCTX, .type = XTTYPE_STRING,
27 .flags = XTOPT_MAND | XTOPT_PUT,
28 XTOPT_POINTER(struct xt_secmark_target_info, secctx)},
29 XTOPT_TABLEEND,
30 };
31
32 static const struct xt_option_entry SECMARK_opts_v1[] = {
33 {.name = "selctx", .id = O_SELCTX, .type = XTTYPE_STRING,
34 .flags = XTOPT_MAND | XTOPT_PUT,
35 XTOPT_POINTER(struct xt_secmark_target_info_v1, secctx)},
36 XTOPT_TABLEEND,
37 };
38
SECMARK_parse(struct xt_option_call * cb)39 static void SECMARK_parse(struct xt_option_call *cb)
40 {
41 struct xt_secmark_target_info *info = cb->data;
42
43 xtables_option_parse(cb);
44 info->mode = SECMARK_MODE_SEL;
45 }
46
SECMARK_parse_v1(struct xt_option_call * cb)47 static void SECMARK_parse_v1(struct xt_option_call *cb)
48 {
49 struct xt_secmark_target_info_v1 *info = cb->data;
50
51 xtables_option_parse(cb);
52 info->mode = SECMARK_MODE_SEL;
53 }
54
print_secmark(__u8 mode,const char * secctx)55 static void print_secmark(__u8 mode, const char *secctx)
56 {
57 switch (mode) {
58 case SECMARK_MODE_SEL:
59 printf("selctx %s", secctx);
60 break;
61
62 default:
63 xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu", mode);
64 }
65 }
66
SECMARK_print(const void * ip,const struct xt_entry_target * target,int numeric)67 static void SECMARK_print(const void *ip, const struct xt_entry_target *target,
68 int numeric)
69 {
70 const struct xt_secmark_target_info *info =
71 (struct xt_secmark_target_info*)(target)->data;
72
73 printf(" SECMARK ");
74 print_secmark(info->mode, info->secctx);
75 }
76
SECMARK_print_v1(const void * ip,const struct xt_entry_target * target,int numeric)77 static void SECMARK_print_v1(const void *ip,
78 const struct xt_entry_target *target, int numeric)
79 {
80 const struct xt_secmark_target_info_v1 *info =
81 (struct xt_secmark_target_info_v1 *)(target)->data;
82
83 printf(" SECMARK ");
84 print_secmark(info->mode, info->secctx);
85 }
86
SECMARK_save(const void * ip,const struct xt_entry_target * target)87 static void SECMARK_save(const void *ip, const struct xt_entry_target *target)
88 {
89 const struct xt_secmark_target_info *info =
90 (struct xt_secmark_target_info*)target->data;
91
92 printf(" --");
93 print_secmark(info->mode, info->secctx);
94 }
95
SECMARK_save_v1(const void * ip,const struct xt_entry_target * target)96 static void SECMARK_save_v1(const void *ip,
97 const struct xt_entry_target *target)
98 {
99 const struct xt_secmark_target_info_v1 *info =
100 (struct xt_secmark_target_info_v1 *)target->data;
101
102 printf(" --");
103 print_secmark(info->mode, info->secctx);
104 }
105
106 static struct xtables_target secmark_tg_reg[] = {
107 {
108 .family = NFPROTO_UNSPEC,
109 .name = "SECMARK",
110 .version = XTABLES_VERSION,
111 .revision = 0,
112 .size = XT_ALIGN(sizeof(struct xt_secmark_target_info)),
113 .userspacesize = XT_ALIGN(sizeof(struct xt_secmark_target_info)),
114 .help = SECMARK_help,
115 .print = SECMARK_print,
116 .save = SECMARK_save,
117 .x6_parse = SECMARK_parse,
118 .x6_options = SECMARK_opts,
119 },
120 {
121 .family = NFPROTO_UNSPEC,
122 .name = "SECMARK",
123 .version = XTABLES_VERSION,
124 .revision = 1,
125 .size = XT_ALIGN(sizeof(struct xt_secmark_target_info_v1)),
126 .userspacesize = XT_ALIGN(offsetof(struct xt_secmark_target_info_v1, secid)),
127 .help = SECMARK_help,
128 .print = SECMARK_print_v1,
129 .save = SECMARK_save_v1,
130 .x6_parse = SECMARK_parse_v1,
131 .x6_options = SECMARK_opts_v1,
132 }
133 };
134
_init(void)135 void _init(void)
136 {
137 xtables_register_targets(secmark_tg_reg, ARRAY_SIZE(secmark_tg_reg));
138 }
139