Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=37fccd8577d38e249dde71512fb38d2f6a4d9d3c
Commit:     37fccd8577d38e249dde71512fb38d2f6a4d9d3c
Parent:     0f417ce989f84cfd5418e3b316064bfbb2708196
Author:     Pablo Neira Ayuso <[EMAIL PROTECTED]>
AuthorDate: Mon Dec 17 22:28:41 2007 -0800
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Mon Jan 28 14:58:52 2008 -0800

    [NETFILTER]: ctnetlink: add support for secmark
    
    This patch adds support for James Morris' connsecmark.
    
    Signed-off-by: Pablo Neira Ayuso <[EMAIL PROTECTED]>
    Signed-off-by: Patrick McHardy <[EMAIL PROTECTED]>
    Signed-off-by: David S. Miller <[EMAIL PROTECTED]>
---
 include/linux/netfilter/nf_conntrack_common.h |    4 ++++
 include/linux/netfilter/nfnetlink_conntrack.h |    1 +
 net/netfilter/nf_conntrack_netlink.c          |   22 ++++++++++++++++++++++
 net/netfilter/xt_CONNSECMARK.c                |    5 ++++-
 4 files changed, 31 insertions(+), 1 deletions(-)

diff --git a/include/linux/netfilter/nf_conntrack_common.h 
b/include/linux/netfilter/nf_conntrack_common.h
index 19747e8..bad1eb7 100644
--- a/include/linux/netfilter/nf_conntrack_common.h
+++ b/include/linux/netfilter/nf_conntrack_common.h
@@ -133,6 +133,10 @@ enum ip_conntrack_events
        /* NAT sequence adjustment */
        IPCT_NATSEQADJ_BIT = 13,
        IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),
+
+       /* Secmark is set */
+       IPCT_SECMARK_BIT = 14,
+       IPCT_SECMARK = (1 << IPCT_SECMARK_BIT),
 };
 
 enum ip_conntrack_expect_events {
diff --git a/include/linux/netfilter/nfnetlink_conntrack.h 
b/include/linux/netfilter/nfnetlink_conntrack.h
index c19d976..e3e1533 100644
--- a/include/linux/netfilter/nfnetlink_conntrack.h
+++ b/include/linux/netfilter/nfnetlink_conntrack.h
@@ -39,6 +39,7 @@ enum ctattr_type {
        CTA_TUPLE_MASTER,
        CTA_NAT_SEQ_ADJ_ORIG,
        CTA_NAT_SEQ_ADJ_REPLY,
+       CTA_SECMARK,
        __CTA_MAX
 };
 #define CTA_MAX (__CTA_MAX - 1)
diff --git a/net/netfilter/nf_conntrack_netlink.c 
b/net/netfilter/nf_conntrack_netlink.c
index 94027c8..d4eedc6 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -254,6 +254,22 @@ nla_put_failure:
 #define ctnetlink_dump_mark(a, b) (0)
 #endif
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+static inline int
+ctnetlink_dump_secmark(struct sk_buff *skb, const struct nf_conn *ct)
+{
+       __be32 mark = htonl(ct->secmark);
+
+       NLA_PUT(skb, CTA_SECMARK, sizeof(u_int32_t), &mark);
+       return 0;
+
+nla_put_failure:
+       return -1;
+}
+#else
+#define ctnetlink_dump_secmark(a, b) (0)
+#endif
+
 #define master_tuple(ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
 
 static inline int
@@ -392,6 +408,7 @@ ctnetlink_fill_info(struct sk_buff *skb, u32 pid, u32 seq,
            ctnetlink_dump_protoinfo(skb, ct) < 0 ||
            ctnetlink_dump_helpinfo(skb, ct) < 0 ||
            ctnetlink_dump_mark(skb, ct) < 0 ||
+           ctnetlink_dump_secmark(skb, ct) < 0 ||
            ctnetlink_dump_id(skb, ct) < 0 ||
            ctnetlink_dump_use(skb, ct) < 0 ||
            ctnetlink_dump_master(skb, ct) < 0 ||
@@ -493,6 +510,11 @@ static int ctnetlink_conntrack_event(struct notifier_block 
*this,
                    && ctnetlink_dump_mark(skb, ct) < 0)
                        goto nla_put_failure;
 #endif
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+               if ((events & IPCT_SECMARK || ct->secmark)
+                   && ctnetlink_dump_secmark(skb, ct) < 0)
+                       goto nla_put_failure;
+#endif
 
                if (events & IPCT_COUNTER_FILLING &&
                    (ctnetlink_dump_counters(skb, ct, IP_CT_DIR_ORIGINAL) < 0 ||
diff --git a/net/netfilter/xt_CONNSECMARK.c b/net/netfilter/xt_CONNSECMARK.c
index 2c265e8..2333f7e 100644
--- a/net/netfilter/xt_CONNSECMARK.c
+++ b/net/netfilter/xt_CONNSECMARK.c
@@ -20,6 +20,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_CONNSECMARK.h>
 #include <net/netfilter/nf_conntrack.h>
+#include <net/netfilter/nf_conntrack_ecache.h>
 
 #define PFX "CONNSECMARK: "
 
@@ -40,8 +41,10 @@ static void secmark_save(const struct sk_buff *skb)
                enum ip_conntrack_info ctinfo;
 
                ct = nf_ct_get(skb, &ctinfo);
-               if (ct && !ct->secmark)
+               if (ct && !ct->secmark) {
                        ct->secmark = skb->secmark;
+                       nf_conntrack_event_cache(IPCT_SECMARK, skb);
+               }
        }
 }
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to