Skip to contentSkip to conversation

Core networking changes

RFC PATCH In review Venkat Yekkirala 2 participants 2 messages Sep 18, 2007 – Sep 21, 2007

Subsystems (3)
Networking SELinux security module IPv4/IPv6
lore
Share & tools
lore

Venkat Yekkirala

author
#0 lore raw

RFC PATCH 3/4 Core networking changes

This calls into the skb_flow_out LSM hook for flow-controlling all traffic on their way out. The existing postroute_last LSM netfilter hook couldn't be used since it would be invoked for each xfrm as it is applied to a packet.

net/ipv4/ip_output.c +5 -0
index 0f1d7be..37a05a2 100644
@@ -204,6 +204,7 @@ static inline int ip_skb_dst_mtu(struct sk_buff *skb)
 
 static inline int ip_finish_output(struct sk_buff *skb)
 {
+	int err;
 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
 	/* Policy lookup after SNAT yielded a new policy */
 	if (skb->dst->xfrm != NULL) {

@@ -211,6 +212,10 @@ static inline int ip_finish_output(struct sk_buff *skb)
 		return dst_output(skb);
 	}
 #endif
+	err = security_skb_flow_out(skb, AF_INET);
+	if (err)
+		return err;
+
 	if (skb->len > ip_skb_dst_mtu(skb) && !skb_is_gso(skb))
 		return ip_fragment(skb, ip_finish_output2);
 	else
net/ipv6/ip6_output.c +5 -0
index 26de3c0..d682e8a 100644
@@ -73,6 +73,11 @@ static __inline__ void ipv6_select_ident(struct sk_buff *skb, struct frag_hdr *f
 static inline int ip6_output_finish(struct sk_buff *skb)
 {
 	struct dst_entry *dst = skb->dst;
+	int err;
+
+	err = security_skb_flow_out(skb, AF_INET6);
+	if (err)
+		return err;
 
 	if (dst->hh)
 		return neigh_hh_output(dst->hh, skb);

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

#1 lore raw
Quoted 44 lines · Venkat Yekkirala

This calls into the skb_flow_out LSM hook for flow-controlling all traffic on their way out. The existing postroute_last LSM netfilter hook couldn't be used since it would be invoked for each xfrm as it is applied to a packet.

net/ipv4/ip_output.c +5 -0
index 0f1d7be..37a05a2 100644
@@ -204,6 +204,7 @@ static inline int ip_skb_dst_mtu(struct sk_buff *skb)
 
 static inline int ip_finish_output(struct sk_buff *skb)
 {
+	int err;
 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
 	/* Policy lookup after SNAT yielded a new policy */
 	if (skb->dst->xfrm != NULL) {

@@ -211,6 +212,10 @@ static inline int ip_finish_output(struct sk_buff
 *skb) return dst_output(skb);
 	}
 #endif
+	err = security_skb_flow_out(skb, AF_INET);
+	if (err)
+		return err;
+
 	if (skb->len > ip_skb_dst_mtu(skb) && !skb_is_gso(skb))
 		return ip_fragment(skb, ip_finish_output2);
 	else
net/ipv6/ip6_output.c +5 -0
index 26de3c0..d682e8a 100644
@@ -73,6 +73,11 @@ static __inline__ void ipv6_select_ident(struct sk_buff
 *skb, struct frag_hdr *f static inline int ip6_output_finish(struct sk_buff
 *skb)
 {
 	struct dst_entry *dst = skb->dst;
+	int err;
+
+	err = security_skb_flow_out(skb, AF_INET6);
+	if (err)
+		return err;
 
 	if (dst->hh)
Quoted 1 line

return neigh_hh_output(dst->hh, skb);

Other than the hook name this looks good to me.

Signature · 7 lines
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.