Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-12 07:01:57 +00:00
Code Issues Packages Projects Releases Wiki Activity
134b0fc544
linux/include/net
History
James Morris 134b0fc544 IPsec: propagate security module errors up from flow_cache_lookup 
When a security module is loaded (in this case, SELinux), the
security_xfrm_policy_lookup() hook can return an access denied permission
(or other error).  We were not handling that correctly, and in fact
inverting the return logic and propagating a false "ok" back up to
xfrm_lookup(), which then allowed packets to pass as if they were not
associated with an xfrm policy.

The way I was seeing the problem was when connecting via IPsec to a
confined service on an SELinux box (vsftpd), which did not have the
appropriate SELinux policy permissions to send packets via IPsec.

The first SYNACK would be blocked, because of an uncached lookup via
flow_cache_lookup(), which would fail to resolve an xfrm policy because
the SELinux policy is checked at that point via the resolver.

However, retransmitted SYNACKs would then find a cached flow entry when
calling into flow_cache_lookup() with a null xfrm policy, which is
interpreted by xfrm_lookup() as the packet not having any associated
policy and similarly to the first case, allowing it to pass without
transformation.

The solution presented here is to first ensure that errno values are
correctly propagated all the way back up through the various call chains
from security_xfrm_policy_lookup(), and handled correctly.

Then, flow_cache_lookup() is modified, so that if the policy resolver
fails (typically a permission denied via the security module), the flow
cache entry is killed rather than having a null policy assigned (which
indicates that the packet can pass freely).  This also forces any future
lookups for the same flow to consult the security module (e.g. SELinux)
for current security policy (rather than, say, caching the error on the
flow cache entry).

Signed-off-by: James Morris <jmorris@namei.org>
2006-10-11 23:59:34 -07:00
..
bluetooth [Bluetooth] Support create connection cancel command 2006-09-28 18:01:33 -07:00
irda [IrDA]: Memory allocations cleanups 2006-09-28 18:02:48 -07:00
netfilter Merge git://git.infradead.org/hdrcleanup-2.6 2006-06-20 15:10:08 -07:00
sctp [SCTP]: Cleanups 2006-09-22 15:19:03 -07:00
tc_act [PKT_SCHED]: Kill pkt_act.h inlining. 2006-09-22 14:55:10 -07:00
tipc [TIPC]: Corrected potential misuse of tipc_media_addr structure. 2006-06-25 23:38:29 -07:00
act_api.h [PKT_SCHED]: Kill pkt_act.h inlining. 2006-09-22 14:55:10 -07:00
addrconf.h [IPV6] ADDRCONF: Mobile IPv6 Home Address support. 2006-09-22 15:20:29 -07:00
af_unix.h [AF_UNIX]: Kernel memory leak fix for af_unix datagram getpeersec patch 2006-08-02 14:12:06 -07:00
ah.h [IPSEC]: Use HMAC template and hash interface 2006-09-21 11:46:18 +10:00
arp.h [IPV4] net/ipv4/arp.c: trivial annotations 2006-09-28 18:02:14 -07:00
atmclip.h [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
ax25.h [AX.25]: Reference counting for AX.25 routes. 2006-07-03 19:30:18 -07:00
checksum.h
cipso_ipv4.h [NetLabel]: audit fixups due to delayed feedback 2006-09-29 17:05:05 -07:00
compat.h Merge git://git.infradead.org/hdrcleanup-2.6 2006-06-20 15:10:08 -07:00
datalink.h [NET]: Kill skb->real_dev 2005-08-29 15:32:25 -07:00
dn_dev.h [DECnet]: Endian annotation and fixes for DECnet. 2006-03-20 22:42:39 -08:00
dn_fib.h [DECNET]: cleanups 2006-09-22 14:54:40 -07:00
dn_neigh.h [DECnet]: Endian annotation and fixes for DECnet. 2006-03-20 22:42:39 -08:00
dn_nsp.h [DECnet]: Endian annotation and fixes for DECnet. 2006-03-20 22:42:39 -08:00
dn_route.h [DECnet]: Endian annotation and fixes for DECnet. 2006-03-20 22:42:39 -08:00
dn.h [DECnet]: Endian annotation and fixes for DECnet. 2006-03-20 22:42:39 -08:00
dsfield.h
dst.h [NET]: Annotate dst_ops protocol 2006-09-28 18:02:58 -07:00
esp.h [IPSEC] esp: Defer output IV initialization to first use. 2006-09-22 15:17:35 -07:00
fib_rules.h [NET]: Introduce RTA_TABLE/FRA_TABLE attributes 2006-09-22 14:54:25 -07:00
flow.h IPsec: propagate security module errors up from flow_cache_lookup 2006-10-11 23:59:34 -07:00
gen_stats.h
genetlink.h [PATCH] Add genetlink utilities for payload length calculation 2006-10-01 00:39:29 -07:00
icmp.h [IPV4]: icmp_send() annotation 2006-09-28 18:01:06 -07:00
ieee80211_crypt.h [PATCH] ieee80211: Add TKIP crypt->build_iv 2006-01-27 17:08:07 -05:00
ieee80211_radiotap.h [PATCH] ieee80211: Added ieee80211_radiotap.h 2005-09-21 23:03:55 -04:00
ieee80211.h [PATCH] ieee80211: Make ieee80211_rx_any usable 2006-07-27 16:17:28 -04:00
ieee80211softmac_wx.h [PATCH] softmac: add SIOCSIWMLME 2006-04-24 16:15:58 -04:00
ieee80211softmac.h [PATCH] softmac: export highest_supported_rate function 2006-07-27 16:17:28 -04:00
if_inet6.h [IPV6] ADDRCONF: Convert addrconf_lock to RCU. 2006-09-22 15:20:26 -07:00
inet6_connection_sock.h [IPV6]: Generalise some functions 2006-01-03 13:10:46 -08:00
inet6_hashtables.h Don't include linux/config.h from anywhere else in include/ 2006-04-26 12:56:16 +01:00
inet_common.h [NET]: move struct proto_ops to const 2006-01-03 13:11:15 -08:00
inet_connection_sock.h [IPV4]: inet_csk_search_req() annotations 2006-09-28 18:02:15 -07:00
inet_ecn.h [INET_SOCK]: Move struct inet_sock & helper functions to net/inet_sock.h 2006-01-03 13:11:21 -08:00
inet_hashtables.h [IPV4]: annotate inet_lookup() and friends 2006-09-28 18:02:26 -07:00
inet_sock.h [IPV4]: annotate inet_lookup() and friends 2006-09-28 18:02:26 -07:00
inet_timewait_sock.h [IPV4]: inet_rcv_saddr() annotations 2006-09-28 18:02:28 -07:00
inetpeer.h [IPV4]: inetpeer annotations 2006-09-28 18:01:09 -07:00
ip6_checksum.h
ip6_fib.h [IPV6] ROUTE: Unify RT6_F_xxx and RT6_SELECT_F_xxx flags 2006-09-22 14:55:56 -07:00
ip6_route.h [NETFILTER]: ip6table_mangle: reroute when nfmark changes in NF_IP6_LOCAL_OUT 2006-09-22 15:19:51 -07:00
ip6_tunnel.h
ip_fib.h [IPV4]: net/ipv4/fib annotations 2006-09-28 18:02:23 -07:00
ip_mp_alg.h [IPV4]: multipath_set_nhinfo() annotations 2006-09-28 18:01:15 -07:00
ip_vs.h [IPVS]: ipvs annotations 2006-09-28 18:03:04 -07:00
ip.h [IPV4]: ip_icmp_error() annotations 2006-09-28 18:02:09 -07:00
ipcomp.h [CRYPTO] users: Use crypto_comp and crypto_has_* 2006-09-21 11:46:22 +10:00
ipconfig.h
ipip.h
ipv6.h [IPV6]: struct in6_addr annotations 2006-09-28 18:02:30 -07:00
ipx.h
iw_handler.h [PATCH] WE-20 for kernel 2.6.16 2006-03-23 07:12:57 -05:00
lapb.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h [PATCH] gfp flags annotations - part 1 2005-10-08 15:00:57 -07:00
llc_if.h [LLC]: add multicast support for datagrams 2006-06-17 21:26:08 -07:00
llc_pdu.h [LLC]: Fix typo 2005-11-14 21:58:18 -08:00
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h [LLC]: Fix the accept path 2005-09-22 07:57:21 -03:00
llc.h [LLC]: llc_mac_hdr_init const arguments 2006-03-20 22:59:36 -08:00
mip6.h [IPV6] MIP6: Add receiving mobility header functions through raw socket. 2006-09-22 15:07:01 -07:00
ndisc.h Don't include linux/config.h from anywhere else in include/ 2006-04-26 12:56:16 +01:00
neighbour.h [IPV6] NDISC: Set per-entry is_router flag in Proxy NA. 2006-09-22 15:20:24 -07:00
netdma.h Remove all inclusions of <linux/config.h> 2006-10-04 03:38:54 -04:00
netevent.h [NET]: Network Event Notifier Mechanism. 2006-08-02 13:38:20 -07:00
netlabel.h NetLabel: fix a cache race condition 2006-10-11 23:59:29 -07:00
netlink.h [IPV4]: introduce nla_get_be32()/NLA_PUT_BE32() 2006-09-28 17:54:14 -07:00
netrom.h [NETROM]: Eleminate HZ from NET/ROM kernel interfaces 2006-05-03 23:27:47 -07:00
nexthop.h [IPv4]: FIB configuration using struct fib_config 2006-09-22 14:55:04 -07:00
p8022.h [NET]: Fix sparse warnings 2005-08-29 16:01:32 -07:00
pkt_cls.h [NET]: Remove explicit initializations of skb->input_dev 2005-08-29 15:33:26 -07:00
pkt_sched.h [PKT_SCHED]: Fix regression in PSCHED_TADD{,2}. 2006-07-24 12:44:23 -07:00
protocol.h [NET] gso: Fix up GSO packets with broken checksums 2006-07-08 13:34:56 -07:00
psnap.h [NET]: Kill skb->real_dev 2005-08-29 15:32:25 -07:00
raw.h Merge git://git.infradead.org/hdrcleanup-2.6 2006-06-20 15:10:08 -07:00
rawv6.h [IPV4/6]: Check if packet was actually delivered to a raw socket to decide whether to send an ICMP unreachable 2005-08-29 15:37:22 -07:00
red.h [PKT_SCHED] RED: Fix overflow in calculation of queue average 2006-08-04 22:59:51 -07:00
request_sock.h [MLSXFRM]: Auto-labeling of child sockets 2006-09-22 14:53:29 -07:00
rose.h [ROSE]: Eleminate HZ from ROSE kernel interfaces 2006-05-03 23:28:20 -07:00
route.h [IPV4]: route.h annotations 2006-09-28 18:02:10 -07:00
sch_generic.h Don't include linux/config.h from anywhere else in include/ 2006-04-26 12:56:16 +01:00
scm.h [AF_UNIX]: Kernel memory leak fix for af_unix datagram getpeersec patch 2006-08-02 14:12:06 -07:00
slhc_vj.h [NET]: Remove __ARGS from include/net/slhc_vj.h 2005-07-05 15:12:04 -07:00
snmp.h [SCTP]: Extend /proc/net/sctp/snmp to provide more statistics. 2006-09-22 14:55:16 -07:00
sock.h [PATCH] Vectorize aio_read/aio_write fileop methods 2006-10-01 00:39:28 -07:00
syncppp.h [PATCH] drivers/net/wan/: possible cleanups 2005-09-14 08:36:54 -04:00
tcp_ecn.h [IPV6]: Added GSO support for TCPv6 2006-06-30 14:12:10 -07:00
tcp_states.h [TCP]: Move the TCPF_ enum to tcp_states.h 2006-01-03 13:10:57 -08:00
tcp.h [TCP]: SNMPv2 tcpAttemptFails counter error 2006-08-02 13:38:19 -07:00
timewait_sock.h [TWSK]: Introduce struct timewait_sock_ops 2006-01-03 13:10:54 -08:00
transp_v6.h [ICSK]: Rename struct tcp_func to struct inet_connection_sock_af_ops 2006-01-03 13:10:38 -08:00
udp.h [UDP]: saddr_cmp function should take const socket pointers 2006-09-22 15:18:23 -07:00
x25.h [X25]: allow ITU-T DTE facilities for x25 2006-03-22 00:01:31 -08:00
x25device.h [X25]: Restore skb->dev setting in x25_type_trans(). 2006-04-09 22:37:18 -07:00
xfrm.h [XFRM]: xfrm_replay_advance() annotations 2006-09-28 18:02:41 -07:00