Commit 3df98d79 authored by Paul Moore's avatar Paul Moore
Browse files

lsm,selinux: pass flowi_common instead of flowi to the LSM hooks 



As pointed out by Herbert in a recent related patch, the LSM hooks do
not have the necessary address family information to use the flowi
struct safely.  As none of the LSMs currently use any of the protocol
specific flowi information, replace the flowi pointers with pointers
to the address family independent flowi_common struct.

Reported-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Acked-by: default avatarJames Morris <jamorris@linux.microsoft.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent b2d99bcb

drivers/net/ethernet/chelsio/inline_crypto/chtls/chtls_cm.c

+1 −1
Original line number Diff line number Diff line
@@ -1148,7 +1148,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk, 
		fl6.daddr = ip6h->saddr;

		fl6.fl6_dport = inet_rsk(oreq)->ir_rmt_port;

		fl6.fl6_sport = htons(inet_rsk(oreq)->ir_num);

		security_req_classify_flow(oreq, flowi6_to_flowi(&fl6));

		security_req_classify_flow(oreq, flowi6_to_flowi_common(&fl6));

		dst = ip6_dst_lookup_flow(sock_net(lsk), lsk, &fl6, NULL);

		if (IS_ERR(dst))

			goto free_sk;

drivers/net/wireguard/socket.c

+2 −2
Original line number Diff line number Diff line
@@ -49,7 +49,7 @@ static int send4(struct wg_device *wg, struct sk_buff *skb, 
		rt = dst_cache_get_ip4(cache, &fl.saddr);



	if (!rt) {

		security_sk_classify_flow(sock, flowi4_to_flowi(&fl));

		security_sk_classify_flow(sock, flowi4_to_flowi_common(&fl));

		if (unlikely(!inet_confirm_addr(sock_net(sock), NULL, 0,

						fl.saddr, RT_SCOPE_HOST))) {

			endpoint->src4.s_addr = 0;
@@ -129,7 +129,7 @@ static int send6(struct wg_device *wg, struct sk_buff *skb, 
		dst = dst_cache_get_ip6(cache, &fl.saddr);



	if (!dst) {

		security_sk_classify_flow(sock, flowi6_to_flowi(&fl));

		security_sk_classify_flow(sock, flowi6_to_flowi_common(&fl));

		if (unlikely(!ipv6_addr_any(&fl.saddr) &&

			     !ipv6_chk_addr(sock_net(sock), &fl.saddr, NULL, 0))) {

			endpoint->src6 = fl.saddr = in6addr_any;

include/linux/lsm_hook_defs.h

+2 −2
Original line number Diff line number Diff line
@@ -311,7 +311,7 @@ LSM_HOOK(int, 0, secmark_relabel_packet, u32 secid) 
LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_inc, void)

LSM_HOOK(void, LSM_RET_VOID, secmark_refcount_dec, void)

LSM_HOOK(void, LSM_RET_VOID, req_classify_flow, const struct request_sock *req,

	 struct flowi *fl)

	 struct flowi_common *flic)

LSM_HOOK(int, 0, tun_dev_alloc_security, void **security)

LSM_HOOK(void, LSM_RET_VOID, tun_dev_free_security, void *security)

LSM_HOOK(int, 0, tun_dev_create, void)
@@ -351,7 +351,7 @@ LSM_HOOK(int, 0, xfrm_state_delete_security, struct xfrm_state *x) 
LSM_HOOK(int, 0, xfrm_policy_lookup, struct xfrm_sec_ctx *ctx, u32 fl_secid,

	 u8 dir)

LSM_HOOK(int, 1, xfrm_state_pol_flow_match, struct xfrm_state *x,

	 struct xfrm_policy *xp, const struct flowi *fl)

	 struct xfrm_policy *xp, const struct flowi_common *flic)

LSM_HOOK(int, 0, xfrm_decode_session, struct sk_buff *skb, u32 *secid,

	 int ckall)

#endif /* CONFIG_SECURITY_NETWORK_XFRM */

include/linux/lsm_hooks.h

+1 −1
Original line number Diff line number Diff line
@@ -1105,7 +1105,7 @@ 
 * @xfrm_state_pol_flow_match:

 *	@x contains the state to match.

 *	@xp contains the policy to check for a match.

 *	@fl contains the flow to check for a match.

 *	@flic contains the flowi_common struct to check for a match.

 *	Return 1 if there is a match.

 * @xfrm_decode_session:

 *	@skb points to skb to decode.

include/linux/security.h

+14 −9
Original line number Diff line number Diff line
@@ -167,7 +167,7 @@ struct sk_buff; 
struct sock;

struct sockaddr;

struct socket;

struct flowi;

struct flowi_common;

struct dst_entry;

struct xfrm_selector;

struct xfrm_policy;
@@ -1355,8 +1355,9 @@ int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u 
int security_sk_alloc(struct sock *sk, int family, gfp_t priority);

void security_sk_free(struct sock *sk);

void security_sk_clone(const struct sock *sk, struct sock *newsk);

void security_sk_classify_flow(struct sock *sk, struct flowi *fl);

void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);

void security_sk_classify_flow(struct sock *sk, struct flowi_common *flic);

void security_req_classify_flow(const struct request_sock *req,

				struct flowi_common *flic);

void security_sock_graft(struct sock*sk, struct socket *parent);

int security_inet_conn_request(struct sock *sk,

			struct sk_buff *skb, struct request_sock *req);
@@ -1507,11 +1508,13 @@ static inline void security_sk_clone(const struct sock *sk, struct sock *newsk) 
{

}



static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)

static inline void security_sk_classify_flow(struct sock *sk,

					     struct flowi_common *flic)

{

}



static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)

static inline void security_req_classify_flow(const struct request_sock *req,

					      struct flowi_common *flic)

{

}
@@ -1638,9 +1641,9 @@ void security_xfrm_state_free(struct xfrm_state *x); 
int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);

int security_xfrm_state_pol_flow_match(struct xfrm_state *x,

				       struct xfrm_policy *xp,

				       const struct flowi *fl);

				       const struct flowi_common *flic);

int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);

void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);

void security_skb_classify_flow(struct sk_buff *skb, struct flowi_common *flic);



#else	/* CONFIG_SECURITY_NETWORK_XFRM */
@@ -1692,7 +1695,8 @@ static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_s 
}



static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,

			struct xfrm_policy *xp, const struct flowi *fl)

						     struct xfrm_policy *xp,

						     const struct flowi_common *flic)

{

	return 1;

}
@@ -1702,7 +1706,8 @@ static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid) 
	return 0;

}



static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)

static inline void security_skb_classify_flow(struct sk_buff *skb,

					      struct flowi_common *flic)

{

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE