Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6

[linux-2.6] / net / netfilter / xt_SECMARK.c

diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c
index b11b3ecbb39d70f37862ab34c0a2ad522103288b..94f87ee7552b0708b855ce998a3a355e71b13af4 100644 (file)
--- a/net/netfilter/xt_SECMARK.c
+++ b/net/netfilter/xt_SECMARK.c
@@ -5,7 +5,7 @@
  * Based on the nfmark match by:
  * (C) 1999-2001 Marc Boucher <marc@mbsi.ca>
  *
- * (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
+ * (C) 2006,2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -72,12 +72,13 @@ static bool checkentry_selinux(struct xt_secmark_target_info *info)
                return false;
        }
 
-       err = selinux_relabel_packet_permission(sel->selsid);
+       err = selinux_secmark_relabel_packet_permission(sel->selsid);
        if (err) {
                printk(KERN_INFO PFX "unable to obtain relabeling permission\n");
                return false;
        }
 
+       selinux_secmark_refcount_inc();
        return true;
 }
 
@@ -88,6 +89,12 @@ secmark_tg_check(const char *tablename, const void *entry,
 {
        struct xt_secmark_target_info *info = targinfo;
 
+       if (strcmp(tablename, "mangle") && strcmp(tablename, "security")) {
+               printk(KERN_INFO PFX "target only valid in the \'mangle\' "
+                      "or \'security\' tables, not \'%s\'.\n", tablename);
+               return false;
+       }
+
        if (mode && mode != info->mode) {
                printk(KERN_INFO PFX "mode already set to %hu cannot mix with "
                       "rules for mode %hu\n", mode, info->mode);
@@ -110,23 +117,31 @@ secmark_tg_check(const char *tablename, const void *entry,
        return true;
 }
 
+static void secmark_tg_destroy(const struct xt_target *target, void *targinfo)
+{
+       switch (mode) {
+       case SECMARK_MODE_SEL:
+               selinux_secmark_refcount_dec();
+       }
+}
+
 static struct xt_target secmark_tg_reg[] __read_mostly = {
        {
                .name           = "SECMARK",
                .family         = AF_INET,
                .checkentry     = secmark_tg_check,
+               .destroy        = secmark_tg_destroy,
                .target         = secmark_tg,
                .targetsize     = sizeof(struct xt_secmark_target_info),
-               .table          = "mangle",
                .me             = THIS_MODULE,
        },
        {
                .name           = "SECMARK",
                .family         = AF_INET6,
                .checkentry     = secmark_tg_check,
+               .destroy        = secmark_tg_destroy,
                .target         = secmark_tg,
                .targetsize     = sizeof(struct xt_secmark_target_info),
-               .table          = "mangle",
                .me             = THIS_MODULE,
        },
 };