forge/linux-pinenote
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[SECMARK]: Add secmark support to core networking.

Browse source 
Add a secmark field to the skbuff structure, to allow security subsystems to
place security markings on network packets.  This is similar to the nfmark
field, except is intended for implementing security policy, rather than than
networking policy.

This patch was already acked in principle by Dave Miller.

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
James Morris 2006-06-09 00:29:17 -07:00 • committed by David S. Miller
commit 984bc16cc9
6 changed files with 34 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

22
include/linux/skbuff.h
View file

@ -210,6 +210,7 @@ enum {
* @nf_bridge: Saved data about a bridged frame - see br_netfilter.c
* @tc_index: Traffic control index
* @tc_verd: traffic control verdict
* @secmark: security marking
*/
struct sk_buff {
@ -289,6 +290,9 @@ struct sk_buff {
#ifdef CONFIG_NET_DMA
dma_cookie_t dma_cookie;
#endif
#ifdef CONFIG_NETWORK_SECMARK
__u32 secmark;
#endif
/* These elements must be at the end, see alloc_skb() for details. */
@ -1400,5 +1404,23 @@ static inline void nf_reset(struct sk_buff *skb)
static inline void nf_reset(struct sk_buff *skb) {}
#endif /* CONFIG_NETFILTER */
#ifdef CONFIG_NETWORK_SECMARK
static inline void skb_copy_secmark(struct sk_buff *to, const struct sk_buff *from)
{
to->secmark = from->secmark;
}
static inline void skb_init_secmark(struct sk_buff *skb)
{
skb->secmark = 0;
}
#else
static inline void skb_copy_secmark(struct sk_buff *to, const struct sk_buff *from)
{ }
static inline void skb_init_secmark(struct sk_buff *skb)
{ }
#endif
#endif /* __KERNEL__ */
#endif /* _LINUX_SKBUFF_H */