9 files changed, 74 insertions, 0 deletions

diff --git a/include/linux/netfilter_ipv4/ip_conntrack.h b/include/linux/netfilter_ipv4/ip_conntrack.h
index 17d7ef938a09..e0e9951eb8c3 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack.h
@@ -121,6 +121,10 @@ struct ip_conntrack
         u_int32_t mark;
 #endif
 
+#ifdef CONFIG_IP_NF_CONNTRACK_SECMARK
+        u_int32_t secmark;
+#endif
+
         /* Traversed often, so hopefully in different cacheline to top */
         /* These are my tuples; original and reply */
         struct ip_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];
diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
index dbe7a114d0c5..411117815807 100644
--- a/include/net/netfilter/nf_conntrack.h
+++ b/include/net/netfilter/nf_conntrack.h
@@ -114,6 +114,10 @@ struct nf_conn
         u_int32_t mark;
 #endif
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+        u_int32_t secmark;
+#endif
+
         /* Storage reserved for other modules: */
         union nf_conntrack_proto proto;
 
diff --git a/include/net/netfilter/nf_conntrack_compat.h b/include/net/netfilter/nf_conntrack_compat.h
index 3cac19fb3648..f1b1482d7200 100644
--- a/include/net/netfilter/nf_conntrack_compat.h
+++ b/include/net/netfilter/nf_conntrack_compat.h
@@ -20,6 +20,19 @@ static inline u_int32_t *nf_ct_get_mark(const struct sk_buff *skb,
 }
 #endif /* CONFIG_IP_NF_CONNTRACK_MARK */
 
+#ifdef CONFIG_IP_NF_CONNTRACK_SECMARK
+static inline u_int32_t *nf_ct_get_secmark(const struct sk_buff *skb,
+                                           u_int32_t *ctinfo)
+{
+        struct ip_conntrack *ct = ip_conntrack_get(skb, ctinfo);
+
+        if (ct)
+                return &ct->secmark;
+        else
+                return NULL;
+}
+#endif /* CONFIG_IP_NF_CONNTRACK_SECMARK */
+
 #ifdef CONFIG_IP_NF_CT_ACCT
 static inline struct ip_conntrack_counter *
 nf_ct_get_counters(const struct sk_buff *skb)
@@ -70,6 +83,19 @@ static inline u_int32_t *nf_ct_get_mark(const struct sk_buff *skb,
 }
 #endif /* CONFIG_NF_CONNTRACK_MARK */
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+static inline u_int32_t *nf_ct_get_secmark(const struct sk_buff *skb,
+                                           u_int32_t *ctinfo)
+{
+        struct nf_conn *ct = nf_ct_get(skb, ctinfo);
+
+        if (ct)
+                return &ct->secmark;
+        else
+                return NULL;
+}
+#endif /* CONFIG_NF_CONNTRACK_MARK */
+
 #ifdef CONFIG_NF_CT_ACCT
 static inline struct ip_conntrack_counter *
 nf_ct_get_counters(const struct sk_buff *skb)
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index ff4b118f14a9..e1d7f5fbc526 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -55,6 +55,18 @@ config IP_NF_CONNTRACK_MARK
           of packets, but this mark value is kept in the conntrack session
           instead of the individual packets.
         
+config IP_NF_CONNTRACK_SECMARK
+        bool  'Connection tracking security mark support'
+        depends on IP_NF_CONNTRACK && NETWORK_SECMARK
+        help
+          This option enables security markings to be applied to
+          connections.  Typically they are copied to connections from
+          packets using the CONNSECMARK target and copied back from
+          connections to packets with the same target, with the packets
+          being originally labeled via SECMARK.
+
+          If unsure, say 'N'.
+
 config IP_NF_CONNTRACK_EVENTS
         bool "Connection tracking events (EXPERIMENTAL)"
         depends on EXPERIMENTAL && IP_NF_CONNTRACK
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 4fe9e69378df..7e4cf9a4d15f 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -724,6 +724,9 @@ init_conntrack(struct ip_conntrack_tuple *tuple,
                 /* this is ugly, but there is no other place where to put it */
                 conntrack->nat.masq_index = exp->master->nat.masq_index;
 #endif
+#ifdef CONFIG_IP_NF_CONNTRACK_SECMARK
+                conntrack->secmark = exp->master->secmark;
+#endif
                 nf_conntrack_get(&conntrack->master->ct_general);
                 CONNTRACK_STAT_INC(expect_new);
         } else {
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 6cb9b989d14c..88445aac3f28 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -189,6 +189,11 @@ static int ct_seq_show(struct seq_file *s, void *v)
                 return -ENOSPC;
 #endif
 
+#ifdef CONFIG_IP_NF_CONNTRACK_SECMARK
+        if (seq_printf(s, "secmark=%u ", conntrack->secmark))
+                return -ENOSPC;
+#endif
+
         if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
                 return -ENOSPC;
 
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 10eccdd4d6ea..023f81e5f96b 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -60,6 +60,18 @@ config NF_CONNTRACK_MARK
           of packets, but this mark value is kept in the conntrack session
           instead of the individual packets.
 
+config NF_CONNTRACK_SECMARK
+        bool  'Connection tracking security mark support'
+        depends on NF_CONNTRACK && NETWORK_SECMARK
+        help
+          This option enables security markings to be applied to
+          connections.  Typically they are copied to connections from
+          packets using the CONNSECMARK target and copied back from
+          connections to packets with the same target, with the packets
+          being originally labeled via SECMARK.
+
+          If unsure, say 'N'.
+
 config NF_CONNTRACK_EVENTS
         bool "Connection tracking events (EXPERIMENTAL)"
         depends on EXPERIMENTAL && NF_CONNTRACK
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index bc2bd4c3859e..cd299f4b7db1 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -990,6 +990,9 @@ init_conntrack(const struct nf_conntrack_tuple *tuple,
 #ifdef CONFIG_NF_CONNTRACK_MARK
                 conntrack->mark = exp->master->mark;
 #endif
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+                conntrack->secmark = exp->master->secmark;
+#endif
                 nf_conntrack_get(&conntrack->master->ct_general);
                 NF_CT_STAT_INC(expect_new);
         } else
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index e01d20d8e287..e34c574f0351 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -213,6 +213,11 @@ static int ct_seq_show(struct seq_file *s, void *v)
                 return -ENOSPC;
 #endif
 
+#ifdef CONFIG_NF_CONNTRACK_SECMARK
+        if (seq_printf(s, "secmark=%u ", conntrack->secmark))
+                return -ENOSPC;
+#endif
+
         if (seq_printf(s, "use=%u\n", atomic_read(&conntrack->ct_general.use)))
                 return -ENOSPC;