Commit 85e55296 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'Smack-for-5.6' of git://github.com/cschaufler/smack-next 

Pull smack fix from Casey Schaufler:
 "One fix for an obscure error found using an old version of ping(1)
  that did not use IPv6 sockets in the documented way"

* tag 'Smack-for-5.6' of git://github.com/cschaufler/smack-next:
  broken ping to ipv6 linklocal addresses on debian buster
parents 99be3f60 87fbfffc

security/smack/smack_lsm.c

+19 −22
Original line number Diff line number Diff line
@@ -2831,42 +2831,39 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, 
				int addrlen)

{

	int rc = 0;

#if IS_ENABLED(CONFIG_IPV6)

	struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;

#endif

#ifdef SMACK_IPV6_SECMARK_LABELING

	struct smack_known *rsp;

	struct socket_smack *ssp;

#endif



	if (sock->sk == NULL)

		return 0;



	if (sock->sk->sk_family != PF_INET &&

	    (!IS_ENABLED(CONFIG_IPV6) || sock->sk->sk_family != PF_INET6))

		return 0;

	if (addrlen < offsetofend(struct sockaddr, sa_family))

		return 0;

	if (IS_ENABLED(CONFIG_IPV6) && sap->sa_family == AF_INET6) {

		struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;

#ifdef SMACK_IPV6_SECMARK_LABELING

	ssp = sock->sk->sk_security;

		struct smack_known *rsp;

#endif



	switch (sock->sk->sk_family) {

	case PF_INET:

		if (addrlen < sizeof(struct sockaddr_in) ||

		    sap->sa_family != AF_INET)

			return -EINVAL;

		rc = smack_netlabel_send(sock->sk, (struct sockaddr_in *)sap);

		break;

	case PF_INET6:

		if (addrlen < SIN6_LEN_RFC2133 || sap->sa_family != AF_INET6)

			return -EINVAL;

		if (addrlen < SIN6_LEN_RFC2133)

			return 0;

#ifdef SMACK_IPV6_SECMARK_LABELING

		rsp = smack_ipv6host_label(sip);

		if (rsp != NULL)

		if (rsp != NULL) {

			struct socket_smack *ssp = sock->sk->sk_security;



			rc = smk_ipv6_check(ssp->smk_out, rsp, sip,

					    SMK_CONNECTING);

		}

#endif

#ifdef SMACK_IPV6_PORT_LABELING

		rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING);

#endif

		break;

		return rc;

	}

	if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in))

		return 0;

	rc = smack_netlabel_send(sock->sk, (struct sockaddr_in *)sap);

	return rc;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE