xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[MLSXFRM]: Add flow labeling

Browse Source 
This labels the flows that could utilize IPSec xfrms at the points the
flows are defined so that IPSec policy and SAs at the right label can
be used.

The following protos are currently not handled, but they should
continue to be able to use single-labeled IPSec like they currently
do.

ipmr
ip_gre
ipip
igmp
sit
sctp
ip6_tunnel (IPv6 over IPv6 tunnel device)
decnet

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Venkat Yekkirala
2006-08-04 23:12:42 -07:00
committed by David S. Miller
parent 4e2ba18eae
commit beb8d13bed
26 changed files with 79 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
security/selinux/xfrm.c
View File

@@ -158,11 +158,11 @@ int selinux_xfrm_flow_state_match(struct flowi *fl, struct xfrm_state *xfrm)
* LSM hook implementation that determines the sid for the session.
*/
int selinux_xfrm_decode_session(struct sk_buff *skb, struct flowi *fl)
int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
{
struct sec_path *sp;
fl->secid = SECSID_NULL;
*sid = SECSID_NULL;
if (skb == NULL)
return 0;
@@ -177,10 +177,13 @@ int selinux_xfrm_decode_session(struct sk_buff *skb, struct flowi *fl)
struct xfrm_sec_ctx *ctx = x->security;
if (!sid_set) {
fl->secid = ctx->ctx_sid;
*sid = ctx->ctx_sid;
sid_set = 1;
if (!ckall)
break;
}
else if (fl->secid != ctx->ctx_sid)
else if (*sid != ctx->ctx_sid)
return -EINVAL;
}
}