1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
217e6e59fSJames Morris /*
317e6e59fSJames Morris * "security" table for IPv6
417e6e59fSJames Morris *
517e6e59fSJames Morris * This is for use by Mandatory Access Control (MAC) security models,
617e6e59fSJames Morris * which need to be able to manage security policy in separate context
717e6e59fSJames Morris * to DAC.
817e6e59fSJames Morris *
917e6e59fSJames Morris * Based on iptable_mangle.c
1017e6e59fSJames Morris *
1117e6e59fSJames Morris * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
1217e6e59fSJames Morris * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
1317e6e59fSJames Morris * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
1417e6e59fSJames Morris */
1517e6e59fSJames Morris #include <linux/module.h>
1617e6e59fSJames Morris #include <linux/netfilter_ipv6/ip6_tables.h>
175a0e3ad6STejun Heo #include <linux/slab.h>
1817e6e59fSJames Morris
1917e6e59fSJames Morris MODULE_LICENSE("GPL");
2017e6e59fSJames Morris MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
2117e6e59fSJames Morris MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
2217e6e59fSJames Morris
2317e6e59fSJames Morris #define SECURITY_VALID_HOOKS (1 << NF_INET_LOCAL_IN) | \
2417e6e59fSJames Morris (1 << NF_INET_FORWARD) | \
2517e6e59fSJames Morris (1 << NF_INET_LOCAL_OUT)
2617e6e59fSJames Morris
2735aad0ffSJan Engelhardt static const struct xt_table security_table = {
2817e6e59fSJames Morris .name = "security",
2917e6e59fSJames Morris .valid_hooks = SECURITY_VALID_HOOKS,
3017e6e59fSJames Morris .me = THIS_MODULE,
31f88e6a8aSJan Engelhardt .af = NFPROTO_IPV6,
322b95efe7SJan Engelhardt .priority = NF_IP6_PRI_SECURITY,
3317e6e59fSJames Morris };
3417e6e59fSJames Morris
352b95efe7SJan Engelhardt static struct nf_hook_ops *sectbl_ops __read_mostly;
3617e6e59fSJames Morris
ip6table_security_table_init(struct net * net)37fdacd57cSFlorian Westphal static int ip6table_security_table_init(struct net *net)
3817e6e59fSJames Morris {
39e3eaa991SJan Engelhardt struct ip6t_replace *repl;
40a67dd266SFlorian Westphal int ret;
4117e6e59fSJames Morris
42e3eaa991SJan Engelhardt repl = ip6t_alloc_initial_table(&security_table);
43e3eaa991SJan Engelhardt if (repl == NULL)
44e3eaa991SJan Engelhardt return -ENOMEM;
45ee177a54SFlorian Westphal ret = ip6t_register_table(net, &security_table, repl, sectbl_ops);
46e3eaa991SJan Engelhardt kfree(repl);
47a67dd266SFlorian Westphal return ret;
4817e6e59fSJames Morris }
4917e6e59fSJames Morris
ip6table_security_net_pre_exit(struct net * net)505f027bc7SDavid Wilder static void __net_exit ip6table_security_net_pre_exit(struct net *net)
515f027bc7SDavid Wilder {
52ee177a54SFlorian Westphal ip6t_unregister_table_pre_exit(net, "security");
535f027bc7SDavid Wilder }
545f027bc7SDavid Wilder
ip6table_security_net_exit(struct net * net)5517e6e59fSJames Morris static void __net_exit ip6table_security_net_exit(struct net *net)
5617e6e59fSJames Morris {
576c071754SFlorian Westphal ip6t_unregister_table_exit(net, "security");
5817e6e59fSJames Morris }
5917e6e59fSJames Morris
6017e6e59fSJames Morris static struct pernet_operations ip6table_security_net_ops = {
615f027bc7SDavid Wilder .pre_exit = ip6table_security_net_pre_exit,
6217e6e59fSJames Morris .exit = ip6table_security_net_exit,
6317e6e59fSJames Morris };
6417e6e59fSJames Morris
ip6table_security_init(void)6517e6e59fSJames Morris static int __init ip6table_security_init(void)
6617e6e59fSJames Morris {
67fdacd57cSFlorian Westphal int ret = xt_register_template(&security_table,
68fdacd57cSFlorian Westphal ip6table_security_table_init);
69fdacd57cSFlorian Westphal
70fdacd57cSFlorian Westphal if (ret < 0)
71fdacd57cSFlorian Westphal return ret;
7217e6e59fSJames Morris
73*44b5990eSFlorian Westphal sectbl_ops = xt_hook_ops_alloc(&security_table, ip6t_do_table);
74fdacd57cSFlorian Westphal if (IS_ERR(sectbl_ops)) {
75fdacd57cSFlorian Westphal xt_unregister_template(&security_table);
76b9e69e12SFlorian Westphal return PTR_ERR(sectbl_ops);
77fdacd57cSFlorian Westphal }
7817e6e59fSJames Morris
79b9e69e12SFlorian Westphal ret = register_pernet_subsys(&ip6table_security_net_ops);
80b9e69e12SFlorian Westphal if (ret < 0) {
81b9e69e12SFlorian Westphal kfree(sectbl_ops);
82fdacd57cSFlorian Westphal xt_unregister_template(&security_table);
83b9e69e12SFlorian Westphal return ret;
842b95efe7SJan Engelhardt }
8517e6e59fSJames Morris
8617e6e59fSJames Morris return ret;
8717e6e59fSJames Morris }
8817e6e59fSJames Morris
ip6table_security_fini(void)8917e6e59fSJames Morris static void __exit ip6table_security_fini(void)
9017e6e59fSJames Morris {
9117e6e59fSJames Morris unregister_pernet_subsys(&ip6table_security_net_ops);
92fdacd57cSFlorian Westphal xt_unregister_template(&security_table);
93b9e69e12SFlorian Westphal kfree(sectbl_ops);
9417e6e59fSJames Morris }
9517e6e59fSJames Morris
9617e6e59fSJames Morris module_init(ip6table_security_init);
9717e6e59fSJames Morris module_exit(ip6table_security_fini);
98