diff options
| author | James Morris | 2006-06-09 09:31:46 +0200 |
|---|---|---|
| committer | David S. Miller | 2006-06-18 06:30:01 +0200 |
| commit | 7c9728c393dceb724d66d696cfabce82151a78e5 (patch) | |
| tree | af2b67ff7c579d669d01f28af33929f780b9c1b3 /net/ipv4/netfilter/Kconfig | |
| parent | [SECMARK]: Add xtables SECMARK target (diff) | |
| download | kernel-qcow2-linux-7c9728c393dceb724d66d696cfabce82151a78e5.tar.gz kernel-qcow2-linux-7c9728c393dceb724d66d696cfabce82151a78e5.tar.xz kernel-qcow2-linux-7c9728c393dceb724d66d696cfabce82151a78e5.zip | |
[SECMARK]: Add secmark support to conntrack
Add a secmark field to IP and NF conntracks, so that security markings
on packets can be copied to their associated connections, and also
copied back to packets as required. This is similar to the network
mark field currently used with conntrack, although it is intended for
enforcement of security policy rather than network policy.
Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/netfilter/Kconfig')
| -rw-r--r-- | net/ipv4/netfilter/Kconfig | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig index ff4b118f14a9..e1d7f5fbc526 100644 --- a/net/ipv4/netfilter/Kconfig +++ b/net/ipv4/netfilter/Kconfig @@ -55,6 +55,18 @@ config IP_NF_CONNTRACK_MARK of packets, but this mark value is kept in the conntrack session instead of the individual packets. +config IP_NF_CONNTRACK_SECMARK + bool 'Connection tracking security mark support' + depends on IP_NF_CONNTRACK && NETWORK_SECMARK + help + This option enables security markings to be applied to + connections. Typically they are copied to connections from + packets using the CONNSECMARK target and copied back from + connections to packets with the same target, with the packets + being originally labeled via SECMARK. + + If unsure, say 'N'. + config IP_NF_CONNTRACK_EVENTS bool "Connection tracking events (EXPERIMENTAL)" depends on EXPERIMENTAL && IP_NF_CONNTRACK |