From 3bc84e5c1fdd1ff011af9788fe174e0514c2c9ea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Mon, 15 Oct 2018 14:18:36 +0200 Subject: src: add support for setting secmark MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add support for new nft object secmark holding security context strings. The following should demonstrate its usage (based on SELinux context): # define a tag containing a context string nft add secmark inet filter sshtag \"system_u:object_r:ssh_server_packet_t:s0\" nft list secmarks # set the secmark nft add rule inet filter input tcp dport 22 meta secmark set sshtag # map usage nft add map inet filter secmapping { type inet_service : secmark \; } nft add element inet filter secmapping { 22 : sshtag } nft list maps nft list map inet filter secmapping nft add rule inet filter input meta secmark set tcp dport map @secmapping [ Original patch based on v0.9.0. Rebase on top on git HEAD. --pablo ] Signed-off-by: Christian Göttsche Signed-off-by: Pablo Neira Ayuso --- include/rule.h | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'include/rule.h') diff --git a/include/rule.h b/include/rule.h index 88478aa6..9e029899 100644 --- a/include/rule.h +++ b/include/rule.h @@ -349,6 +349,10 @@ struct limit { uint32_t flags; }; +struct secmark { + char ctx[NFT_SECMARK_CTX_MAXLEN]; +}; + /** * struct obj - nftables stateful object statement * @@ -370,6 +374,7 @@ struct obj { struct ct_helper ct_helper; struct limit limit; struct ct_timeout ct_timeout; + struct secmark secmark; }; }; @@ -468,6 +473,8 @@ enum cmd_ops { * @CMD_OBJ_LIMIT: limit * @CMD_OBJ_LIMITS: multiple limits * @CMD_OBJ_FLOWTABLES: flow tables + * @CMD_OBJ_SECMARK: secmark + * @CMD_OBJ_SECMARKS: multiple secmarks */ enum cmd_obj { CMD_OBJ_INVALID, @@ -497,6 +504,8 @@ enum cmd_obj { CMD_OBJ_FLOWTABLE, CMD_OBJ_FLOWTABLES, CMD_OBJ_CT_TIMEOUT, + CMD_OBJ_SECMARK, + CMD_OBJ_SECMARKS, }; struct markup { -- cgit v1.2.3