Commit a04e71f6 authored by Huw Davies's avatar Huw Davies Committed by Paul Moore

netlabel: Pass a family parameter to netlbl_skbuff_err().

This makes it possible to route the error to the appropriate
labelling engine.  CALIPSO is far less verbose than CIPSO
when encountering a bogus packet, so there is no need for a
CALIPSO error handler.
Signed-off-by: default avatarHuw Davies <huw@codeweavers.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 2917f57b
...@@ -488,7 +488,7 @@ int netlbl_skbuff_setattr(struct sk_buff *skb, ...@@ -488,7 +488,7 @@ int netlbl_skbuff_setattr(struct sk_buff *skb,
int netlbl_skbuff_getattr(const struct sk_buff *skb, int netlbl_skbuff_getattr(const struct sk_buff *skb,
u16 family, u16 family,
struct netlbl_lsm_secattr *secattr); struct netlbl_lsm_secattr *secattr);
void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway); void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway);
/* /*
* LSM label mapping cache operations * LSM label mapping cache operations
......
...@@ -1249,6 +1249,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb, ...@@ -1249,6 +1249,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,
/** /**
* netlbl_skbuff_err - Handle a LSM error on a sk_buff * netlbl_skbuff_err - Handle a LSM error on a sk_buff
* @skb: the packet * @skb: the packet
* @family: the family
* @error: the error code * @error: the error code
* @gateway: true if host is acting as a gateway, false otherwise * @gateway: true if host is acting as a gateway, false otherwise
* *
...@@ -1258,10 +1259,14 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb, ...@@ -1258,10 +1259,14 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb,
* according to the packet's labeling protocol. * according to the packet's labeling protocol.
* *
*/ */
void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway) void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway)
{ {
switch (family) {
case AF_INET:
if (cipso_v4_optptr(skb)) if (cipso_v4_optptr(skb))
cipso_v4_error(skb, error, gateway); cipso_v4_error(skb, error, gateway);
break;
}
} }
/** /**
......
...@@ -4603,13 +4603,13 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) ...@@ -4603,13 +4603,13 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif, err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
addrp, family, peer_sid, &ad); addrp, family, peer_sid, &ad);
if (err) { if (err) {
selinux_netlbl_err(skb, err, 0); selinux_netlbl_err(skb, family, err, 0);
return err; return err;
} }
err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER, err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
PEER__RECV, &ad); PEER__RECV, &ad);
if (err) { if (err) {
selinux_netlbl_err(skb, err, 0); selinux_netlbl_err(skb, family, err, 0);
return err; return err;
} }
} }
...@@ -4977,7 +4977,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, ...@@ -4977,7 +4977,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb,
err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex, err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
addrp, family, peer_sid, &ad); addrp, family, peer_sid, &ad);
if (err) { if (err) {
selinux_netlbl_err(skb, err, 1); selinux_netlbl_err(skb, family, err, 1);
return NF_DROP; return NF_DROP;
} }
} }
......
...@@ -40,7 +40,8 @@ ...@@ -40,7 +40,8 @@
#ifdef CONFIG_NETLABEL #ifdef CONFIG_NETLABEL
void selinux_netlbl_cache_invalidate(void); void selinux_netlbl_cache_invalidate(void);
void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway); void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error,
int gateway);
void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec); void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec);
void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec); void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec);
...@@ -72,6 +73,7 @@ static inline void selinux_netlbl_cache_invalidate(void) ...@@ -72,6 +73,7 @@ static inline void selinux_netlbl_cache_invalidate(void)
} }
static inline void selinux_netlbl_err(struct sk_buff *skb, static inline void selinux_netlbl_err(struct sk_buff *skb,
u16 family,
int error, int error,
int gateway) int gateway)
{ {
......
...@@ -151,9 +151,9 @@ void selinux_netlbl_cache_invalidate(void) ...@@ -151,9 +151,9 @@ void selinux_netlbl_cache_invalidate(void)
* present on the packet, NetLabel is smart enough to only act when it should. * present on the packet, NetLabel is smart enough to only act when it should.
* *
*/ */
void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway) void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
{ {
netlbl_skbuff_err(skb, error, gateway); netlbl_skbuff_err(skb, family, error, gateway);
} }
/** /**
...@@ -405,7 +405,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec, ...@@ -405,7 +405,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
return 0; return 0;
if (nlbl_sid != SECINITSID_UNLABELED) if (nlbl_sid != SECINITSID_UNLABELED)
netlbl_skbuff_err(skb, rc, 0); netlbl_skbuff_err(skb, family, rc, 0);
return rc; return rc;
} }
......
...@@ -3992,7 +3992,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) ...@@ -3992,7 +3992,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in, rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
MAY_WRITE, rc); MAY_WRITE, rc);
if (rc != 0) if (rc != 0)
netlbl_skbuff_err(skb, rc, 0); netlbl_skbuff_err(skb, sk->sk_family, rc, 0);
break; break;
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
case PF_INET6: case PF_INET6:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment