aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux
diff options
context:
space:
mode:
authorJames Morris <jmorris@namei.org>2006-06-09 03:29:17 -0400
committerDavid S. Miller <davem@sunset.davemloft.net>2006-06-18 00:29:57 -0400
commit984bc16cc92ea3c247bf34ad667cfb95331b9d3c (patch)
tree2342638457f43980501179056f4ba1e4e3c2c1aa /include/linux
parentc749b29fae74ed59c507d84025b3298202b42609 (diff)
[SECMARK]: Add secmark support to core networking.
Add a secmark field to the skbuff structure, to allow security subsystems to place security markings on network packets. This is similar to the nfmark field, except is intended for implementing security policy, rather than than networking policy. This patch was already acked in principle by Dave Miller. Signed-off-by: James Morris <jmorris@namei.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux')
-rw-r--r--include/linux/skbuff.h22
1 files changed, 22 insertions, 0 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 23bad3bf3c9d..fe2c58e5306f 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -210,6 +210,7 @@ enum {
210 * @nf_bridge: Saved data about a bridged frame - see br_netfilter.c 210 * @nf_bridge: Saved data about a bridged frame - see br_netfilter.c
211 * @tc_index: Traffic control index 211 * @tc_index: Traffic control index
212 * @tc_verd: traffic control verdict 212 * @tc_verd: traffic control verdict
213 * @secmark: security marking
213 */ 214 */
214 215
215struct sk_buff { 216struct sk_buff {
@@ -289,6 +290,9 @@ struct sk_buff {
289#ifdef CONFIG_NET_DMA 290#ifdef CONFIG_NET_DMA
290 dma_cookie_t dma_cookie; 291 dma_cookie_t dma_cookie;
291#endif 292#endif
293#ifdef CONFIG_NETWORK_SECMARK
294 __u32 secmark;
295#endif
292 296
293 297
294 /* These elements must be at the end, see alloc_skb() for details. */ 298 /* These elements must be at the end, see alloc_skb() for details. */
@@ -1400,5 +1404,23 @@ static inline void nf_reset(struct sk_buff *skb)
1400static inline void nf_reset(struct sk_buff *skb) {} 1404static inline void nf_reset(struct sk_buff *skb) {}
1401#endif /* CONFIG_NETFILTER */ 1405#endif /* CONFIG_NETFILTER */
1402 1406
1407#ifdef CONFIG_NETWORK_SECMARK
1408static inline void skb_copy_secmark(struct sk_buff *to, const struct sk_buff *from)
1409{
1410 to->secmark = from->secmark;
1411}
1412
1413static inline void skb_init_secmark(struct sk_buff *skb)
1414{
1415 skb->secmark = 0;
1416}
1417#else
1418static inline void skb_copy_secmark(struct sk_buff *to, const struct sk_buff *from)
1419{ }
1420
1421static inline void skb_init_secmark(struct sk_buff *skb)
1422{ }
1423#endif
1424
1403#endif /* __KERNEL__ */ 1425#endif /* __KERNEL__ */
1404#endif /* _LINUX_SKBUFF_H */ 1426#endif /* _LINUX_SKBUFF_H */