diff options
| author | Venkat Yekkirala <vyekkirala@TrustedCS.com> | 2006-07-24 23:32:50 -0700 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2006-09-22 14:53:29 -0700 |
| commit | 4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf (patch) | |
| tree | 02adcb6fe6c346a8b99cf161ba5233ed1e572727 /net/ipv4/syncookies.c | |
| parent | cb969f072b6d67770b559617f14e767f47e77ece (diff) | |
| download | linux-4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf.tar.gz linux-4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf.tar.bz2 linux-4237c75c0a35535d7f9f2bfeeb4b4df1e068a0bf.zip | |
[MLSXFRM]: Auto-labeling of child sockets
This automatically labels the TCP, Unix stream, and dccp child sockets
as well as openreqs to be at the same MLS level as the peer. This will
result in the selection of appropriately labeled IPSec Security
Associations.
This also uses the sock's sid (as opposed to the isec sid) in SELinux
enforcement of secmark in rcv_skb and postroute_last hooks.
Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/syncookies.c')
| -rw-r--r-- | net/ipv4/syncookies.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 307dc3c0d635..661e0a4bca72 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -214,6 +214,10 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, if (!req) goto out; + if (security_inet_conn_request(sk, skb, req)) { + reqsk_free(req); + goto out; + } ireq = inet_rsk(req); treq = tcp_rsk(req); treq->rcv_isn = htonl(skb->h.th->seq) - 1; @@ -259,7 +263,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb, .uli_u = { .ports = { .sport = skb->h.th->dest, .dport = skb->h.th->source } } }; - security_sk_classify_flow(sk, &fl); + security_req_classify_flow(req, &fl); if (ip_route_output_key(&rt, &fl)) { reqsk_free(req); goto out; |