From patchwork Tue Mar 5 12:48:47 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mr Dash Four X-Patchwork-Id: 225004 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 5B3A32C0348 for ; Tue, 5 Mar 2013 23:48:59 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752806Ab3CEMs6 (ORCPT ); Tue, 5 Mar 2013 07:48:58 -0500 Received: from mail-wg0-f41.google.com ([74.125.82.41]:58282 "EHLO mail-wg0-f41.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751526Ab3CEMs5 (ORCPT ); Tue, 5 Mar 2013 07:48:57 -0500 Received: by mail-wg0-f41.google.com with SMTP id ds1so2911518wgb.4 for ; Tue, 05 Mar 2013 04:48:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlemail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:cc :subject:content-type:content-transfer-encoding; bh=BsrccXhBhwBiqm7Q2KpeddevifUAzhKu7Zu1V/H7InE=; b=da4NJZIjEIWY+FWKH6N3nxys8250J6/kmIZNlRllaSkxMuJ2wK1YGBIa/Sceu7g95d GTD7HGSp73Fs1rKPb2dDdlGo5weDvHMb1F+VlJQXuVsT08TExclYaHulGk6Ifmz+livL tkkLKuGE/GLoOSkez9U8e1/vD8bxQSWLyfkOqAhw4vittCUwKSec57FH3sRvD3GqNDU/ OreOZxtfMHR4uubcefu9wI/YEQ+HB+klbQTPCBRggLYUuaTx3RkbvcPUSpovyW0ucwz0 /uq+qRdYUcoa4eEpIfz/yWz3vofwbM6OGqIqztnX0vrWw4DhgAyDTsQBhb9qNM5ahDJR 8fwQ== X-Received: by 10.180.87.129 with SMTP id ay1mr12228540wib.1.1362487736519; Tue, 05 Mar 2013 04:48:56 -0800 (PST) Received: from [10.68.68.173] (cpc2-gill1-0-0-cust218.basl.cable.virginmedia.com. [82.34.56.219]) by mx.google.com with ESMTPS id c15sm21095098wiw.3.2013.03.05.04.48.54 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 05 Mar 2013 04:48:55 -0800 (PST) Message-ID: <5135E9AF.6010800@googlemail.com> Date: Tue, 05 Mar 2013 12:48:47 +0000 From: Mr Dash Four User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 MIME-Version: 1.0 To: Pablo Neira Ayuso CC: Eric Paris , Netfilter Core Team , Fedora SELinux Users Subject: [PATCH 1/2] iptables (userspace): add secmark match Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org This patch is part of the userspace changes needed for the "secmark" match in iptables. Signed-off-by: Mr Dash Four --- extensions/libxt_secmark.c | 100 ++++++++++++++++++++++++++++++++++ extensions/libxt_secmark.man | 22 ++++++++ include/linux/netfilter/xt_secmark.h | 24 ++++++++ 3 files changed, 146 insertions(+) create mode 100644 extensions/libxt_secmark.c create mode 100644 extensions/libxt_secmark.man create mode 100644 include/linux/netfilter/xt_secmark.h -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/extensions/libxt_secmark.c b/extensions/libxt_secmark.c new file mode 100644 index 0000000..92ecc6b --- /dev/null +++ b/extensions/libxt_secmark.c @@ -0,0 +1,100 @@ +/* + * Shared library add-on to iptables to add secmark match support. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 (or + * any later at your option) as published by the Free Software Foundation. + */ +#include +#include +#include +#include +#include +#include + +#include +#include + +#define PFX "secmark match: " + +enum { + O_SELCTX = 0, +}; + +#define s struct xt_secmark_match_info +static const struct xt_option_entry secmark_opts[] = { + {.name = "selctx", .id = O_SELCTX, .type = XTTYPE_STRING, + .flags = XTOPT_MAND|XTOPT_PUT, XTOPT_POINTER(s, secctx)}, + XTOPT_TABLEEND, +}; +#undef s + +static void secmark_help(void) +{ + printf("secmark match options:\n" + " --selctx STRING SELinux security context\n"); +} + +static void secmark_parse(struct xt_option_call *cb) +{ + struct xt_secmark_match_info *info = cb->data; + + xtables_option_parse(cb); + switch (cb->entry->id) { + case O_SELCTX: + if (strchr(cb->arg, '\n') != NULL) + xtables_error(PARAMETER_PROBLEM, PFX + "new lines not allowed in --selctx"); + info->mode = SECMARK_MODE_SEL; + break; + } +} + +static void +secmark_print_selctx(const struct xt_secmark_match_info *info, char *str) +{ + switch (info->mode) { + case SECMARK_MODE_SEL: + printf(" %sselctx %s", str, info->secctx); + break; + + default: + xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode); + } +} + +static void secmark_print(const void *ip, const struct xt_entry_match *match, + int numeric) +{ + const struct xt_secmark_match_info *info = + (struct xt_secmark_match_info *)match->data; + + secmark_print_selctx(info, ""); +} + +static void secmark_save(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_secmark_match_info *info = + (struct xt_secmark_match_info *)match->data; + + secmark_print_selctx(info, "--"); +} + +static struct xtables_match secmark_match = { + .family = NFPROTO_UNSPEC, + .name = "secmark", + .version = XTABLES_VERSION, + .revision = 0, + .size = XT_ALIGN(sizeof(struct xt_secmark_match_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_secmark_match_info)), + .help = secmark_help, + .print = secmark_print, + .save = secmark_save, + .x6_parse = secmark_parse, + .x6_options = secmark_opts, +}; + +void _init(void) +{ + xtables_register_match(&secmark_match); +} diff --git a/extensions/libxt_secmark.man b/extensions/libxt_secmark.man new file mode 100644 index 0000000..b38e32c --- /dev/null +++ b/extensions/libxt_secmark.man @@ -0,0 +1,22 @@ +The secmark match is used to match the security mark value +associated with a packet. +.PP +Only one option is available with this match which needs +to be specified: +.TP +\fB\-\-selctx\fP \fIselctx\fP +This option selects the SELinux security context (\fBselctx\fP) to +be used for packet matching. This security context needs to have already +been assigned to a packet by using the \fBSECMARK\fP target. +.PP +For this extension to be used, the appropriate SELinux support needs +to be installed and present in the Linux kernel. +.PP +Examples: +.IP +iptables \-I INPUT \-p icmp \-\-icmp-type 3 \-m secmark \-\-selctx +system_u:object_r:dns_packet_t:s0 \-j ACCEPT +.IP +iptables \-I OUTPUT \-m secmark \-\-selctx +system_u:object_r:ssh_packet_t:s0 \-j DROP + diff --git a/include/linux/netfilter/xt_secmark.h b/include/linux/netfilter/xt_secmark.h new file mode 100644 index 0000000..c74a35d --- /dev/null +++ b/include/linux/netfilter/xt_secmark.h @@ -0,0 +1,24 @@ +#ifndef _XT_SECMARK_MATCH_H +#define _XT_SECMARK_MATCH_H + +#include + +/* + * Header file for iptables xt_secmark match + * + * This is intended for use by various security subsystems (but not + * at the same time). + * + * 'mode' refers to the specific security subsystem which the + * packets are being marked for. + */ +#define SECMARK_MODE_SEL 0x01 /* SELinux */ +#define SECMARK_SECCTX_MAX 256 + +struct xt_secmark_match_info { + __u8 mode; + __u32 secid; + char secctx[SECMARK_SECCTX_MAX]; +}; + +#endif /* _XT_SECMARK_MATCH_H */