Skip to content

Commit

Permalink
---
Browse files Browse the repository at this point in the history 
yaml
---
r: 90626
b: refs/heads/master
c: 03e1ad7
h: refs/heads/master
v: v3
  • Loading branch information
Paul Moore authored and David S. Miller committed Apr 13, 2008
1 parent 143012d commit 3c666a0
Show file tree
Hide file tree
Showing 9 changed files with 110 additions and 107 deletions.
2 changes: 1 addition & 1 deletion [refs]
View file
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
---
refs/heads/master: 00447872a643787411c2c0cb1df6169dda8b0c47
refs/heads/master: 03e1ad7b5d871d4189b1da3125c2f12d1b5f7d0b
48 changes: 24 additions & 24 deletions trunk/include/linux/security.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -910,24 +910,24 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
* Security hooks for XFRM operations.
*
* @xfrm_policy_alloc_security:
* @xp contains the xfrm_policy being added to Security Policy Database
* used by the XFRM system.
* @ctxp is a pointer to the xfrm_sec_ctx being added to Security Policy
* Database used by the XFRM system.
* @sec_ctx contains the security context information being provided by
* the user-level policy update program (e.g., setkey).
* Allocate a security structure to the xp->security field; the security
* field is initialized to NULL when the xfrm_policy is allocated.
* Return 0 if operation was successful (memory to allocate, legal context)
* @xfrm_policy_clone_security:
* @old contains an existing xfrm_policy in the SPD.
* @new contains a new xfrm_policy being cloned from old.
* Allocate a security structure to the new->security field
* that contains the information from the old->security field.
* @old_ctx contains an existing xfrm_sec_ctx.
* @new_ctxp contains a new xfrm_sec_ctx being cloned from old.
* Allocate a security structure in new_ctxp that contains the
* information from the old_ctx structure.
* Return 0 if operation was successful (memory to allocate).
* @xfrm_policy_free_security:
* @xp contains the xfrm_policy
* @ctx contains the xfrm_sec_ctx
* Deallocate xp->security.
* @xfrm_policy_delete_security:
* @xp contains the xfrm_policy.
* @ctx contains the xfrm_sec_ctx.
* Authorize deletion of xp->security.
* @xfrm_state_alloc_security:
* @x contains the xfrm_state being added to the Security Association
Expand All @@ -947,7 +947,7 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
* @x contains the xfrm_state.
* Authorize deletion of x->security.
* @xfrm_policy_lookup:
* @xp contains the xfrm_policy for which the access control is being
* @ctx contains the xfrm_sec_ctx for which the access control is being
* checked.
* @fl_secid contains the flow security label that is used to authorize
* access to the policy xp.
Expand Down Expand Up @@ -1454,17 +1454,17 @@ struct security_operations {
#endif /* CONFIG_SECURITY_NETWORK */

#ifdef CONFIG_SECURITY_NETWORK_XFRM
int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp,
int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp,
struct xfrm_user_sec_ctx *sec_ctx);
int (*xfrm_policy_clone_security) (struct xfrm_policy *old, struct xfrm_policy *new);
void (*xfrm_policy_free_security) (struct xfrm_policy *xp);
int (*xfrm_policy_delete_security) (struct xfrm_policy *xp);
int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
int (*xfrm_state_alloc_security) (struct xfrm_state *x,
struct xfrm_user_sec_ctx *sec_ctx,
u32 secid);
void (*xfrm_state_free_security) (struct xfrm_state *x);
int (*xfrm_state_delete_security) (struct xfrm_state *x);
int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
int (*xfrm_policy_lookup)(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
int (*xfrm_state_pol_flow_match)(struct xfrm_state *x,
struct xfrm_policy *xp, struct flowi *fl);
int (*xfrm_decode_session)(struct sk_buff *skb, u32 *secid, int ckall);
Expand Down Expand Up @@ -2562,38 +2562,38 @@ static inline void security_inet_conn_established(struct sock *sk,

#ifdef CONFIG_SECURITY_NETWORK_XFRM

int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx);
int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new);
void security_xfrm_policy_free(struct xfrm_policy *xp);
int security_xfrm_policy_delete(struct xfrm_policy *xp);
int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx);
int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
struct xfrm_sec_ctx *polsec, u32 secid);
int security_xfrm_state_delete(struct xfrm_state *x);
void security_xfrm_state_free(struct xfrm_state *x);
int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
struct xfrm_policy *xp, struct flowi *fl);
int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);

#else /* CONFIG_SECURITY_NETWORK_XFRM */

static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
{
return 0;
}

static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
{
return 0;
}

static inline void security_xfrm_policy_free(struct xfrm_policy *xp)
static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
{
}

static inline int security_xfrm_policy_delete(struct xfrm_policy *xp)
static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
{
return 0;
}
Expand All @@ -2619,7 +2619,7 @@ static inline int security_xfrm_state_delete(struct xfrm_state *x)
return 0;
}

static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 fl_secid, u8 dir)
static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
{
return 0;
}
Expand Down
23 changes: 11 additions & 12 deletions trunk/net/key/af_key.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2292,7 +2292,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
goto out;
}

err = security_xfrm_policy_alloc(xp, uctx);
err = security_xfrm_policy_alloc(&xp->security, uctx);
kfree(uctx);

if (err)
Expand Down Expand Up @@ -2352,10 +2352,11 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
int err;
struct sadb_address *sa;
struct sadb_x_policy *pol;
struct xfrm_policy *xp, tmp;
struct xfrm_policy *xp;
struct xfrm_selector sel;
struct km_event c;
struct sadb_x_sec_ctx *sec_ctx;
struct xfrm_sec_ctx *pol_ctx;

if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
Expand Down Expand Up @@ -2385,25 +2386,23 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
sel.dport_mask = htons(0xffff);

sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
memset(&tmp, 0, sizeof(struct xfrm_policy));

if (sec_ctx != NULL) {
struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);

if (!uctx)
return -ENOMEM;

err = security_xfrm_policy_alloc(&tmp, uctx);
err = security_xfrm_policy_alloc(&pol_ctx, uctx);
kfree(uctx);

if (err)
return err;
}

xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1,
&sel, tmp.security, 1, &err);
security_xfrm_policy_free(&tmp);
} else
pol_ctx = NULL;

xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN,
pol->sadb_x_policy_dir - 1, &sel, pol_ctx,
1, &err);
security_xfrm_policy_free(pol_ctx);
if (xp == NULL)
return -ENOENT;

Expand Down Expand Up @@ -3298,7 +3297,7 @@ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
if ((*dir = verify_sec_ctx_len(p)))
goto out;
uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
*dir = security_xfrm_policy_alloc(xp, uctx);
*dir = security_xfrm_policy_alloc(&xp->security, uctx);
kfree(uctx);

if (*dir)
Expand Down
24 changes: 15 additions & 9 deletions trunk/net/xfrm/xfrm_policy.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -263,7 +263,7 @@ void xfrm_policy_destroy(struct xfrm_policy *policy)
list_del(&policy->bytype);
write_unlock_bh(&xfrm_policy_lock);

security_xfrm_policy_free(policy);
security_xfrm_policy_free(policy->security);
kfree(policy);
}
EXPORT_SYMBOL(xfrm_policy_destroy);
Expand Down Expand Up @@ -676,7 +676,8 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
xfrm_sec_ctx_match(ctx, pol->security)) {
xfrm_pol_hold(pol);
if (delete) {
*err = security_xfrm_policy_delete(pol);
*err = security_xfrm_policy_delete(
pol->security);
if (*err) {
write_unlock_bh(&xfrm_policy_lock);
return pol;
Expand Down Expand Up @@ -718,7 +719,8 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
if (pol->type == type && pol->index == id) {
xfrm_pol_hold(pol);
if (delete) {
*err = security_xfrm_policy_delete(pol);
*err = security_xfrm_policy_delete(
pol->security);
if (*err) {
write_unlock_bh(&xfrm_policy_lock);
return pol;
Expand Down Expand Up @@ -756,7 +758,7 @@ xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
&xfrm_policy_inexact[dir], bydst) {
if (pol->type != type)
continue;
err = security_xfrm_policy_delete(pol);
err = security_xfrm_policy_delete(pol->security);
if (err) {
xfrm_audit_policy_delete(pol, 0,
audit_info->loginuid,
Expand All @@ -770,7 +772,8 @@ xfrm_policy_flush_secctx_check(u8 type, struct xfrm_audit *audit_info)
bydst) {
if (pol->type != type)
continue;
err = security_xfrm_policy_delete(pol);
err = security_xfrm_policy_delete(
pol->security);
if (err) {
xfrm_audit_policy_delete(pol, 0,
audit_info->loginuid,
Expand Down Expand Up @@ -931,7 +934,8 @@ static int xfrm_policy_match(struct xfrm_policy *pol, struct flowi *fl,

match = xfrm_selector_match(sel, fl, family);
if (match)
ret = security_xfrm_policy_lookup(pol, fl->secid, dir);
ret = security_xfrm_policy_lookup(pol->security, fl->secid,
dir);

return ret;
}
Expand Down Expand Up @@ -1048,8 +1052,9 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
int err = 0;

if (match) {
err = security_xfrm_policy_lookup(pol, fl->secid,
policy_to_flow_dir(dir));
err = security_xfrm_policy_lookup(pol->security,
fl->secid,
policy_to_flow_dir(dir));
if (!err)
xfrm_pol_hold(pol);
else if (err == -ESRCH)
Expand Down Expand Up @@ -1138,7 +1143,8 @@ static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)

if (newp) {
newp->selector = old->selector;
if (security_xfrm_policy_clone(old, newp)) {
if (security_xfrm_policy_clone(old->security,
&newp->security)) {
kfree(newp);
return NULL; /* ENOMEM */
}
Expand Down
33 changes: 17 additions & 16 deletions trunk/net/xfrm/xfrm_user.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -959,7 +959,7 @@ static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct nlattr **attrs
return 0;

uctx = nla_data(rt);
return security_xfrm_policy_alloc(pol, uctx);
return security_xfrm_policy_alloc(&pol->security, uctx);
}

static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
Expand Down Expand Up @@ -1143,7 +1143,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
NETLINK_CB(skb).sid);

if (err) {
security_xfrm_policy_free(xp);
security_xfrm_policy_free(xp->security);
kfree(xp);
return err;
}
Expand Down Expand Up @@ -1337,22 +1337,23 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
xp = xfrm_policy_byid(type, p->dir, p->index, delete, &err);
else {
struct nlattr *rt = attrs[XFRMA_SEC_CTX];
struct xfrm_policy tmp;
struct xfrm_sec_ctx *ctx;

err = verify_sec_ctx_len(attrs);
if (err)
return err;

memset(&tmp, 0, sizeof(struct xfrm_policy));
if (rt) {
struct xfrm_user_sec_ctx *uctx = nla_data(rt);

if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
err = security_xfrm_policy_alloc(&ctx, uctx);
if (err)
return err;
}
xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
} else
ctx = NULL;
xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, ctx,
delete, &err);
security_xfrm_policy_free(&tmp);
security_xfrm_policy_free(ctx);
}
if (xp == NULL)
return -ENOENT;
Expand Down Expand Up @@ -1572,26 +1573,26 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
xp = xfrm_policy_byid(type, p->dir, p->index, 0, &err);
else {
struct nlattr *rt = attrs[XFRMA_SEC_CTX];
struct xfrm_policy tmp;
struct xfrm_sec_ctx *ctx;

err = verify_sec_ctx_len(attrs);
if (err)
return err;

memset(&tmp, 0, sizeof(struct xfrm_policy));
if (rt) {
struct xfrm_user_sec_ctx *uctx = nla_data(rt);

if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
err = security_xfrm_policy_alloc(&ctx, uctx);
if (err)
return err;
}
xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
0, &err);
security_xfrm_policy_free(&tmp);
} else
ctx = NULL;
xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, ctx, 0, &err);
security_xfrm_policy_free(ctx);
}

if (xp == NULL)
return -ENOENT;

read_lock(&xp->lock);
if (xp->dead) {
read_unlock(&xp->lock);
Expand Down
14 changes: 8 additions & 6 deletions trunk/security/dummy.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -876,22 +876,23 @@ static inline void dummy_req_classify_flow(const struct request_sock *req,
#endif /* CONFIG_SECURITY_NETWORK */

#ifdef CONFIG_SECURITY_NETWORK_XFRM
static int dummy_xfrm_policy_alloc_security(struct xfrm_policy *xp,
struct xfrm_user_sec_ctx *sec_ctx)
static int dummy_xfrm_policy_alloc_security(struct xfrm_sec_ctx **ctxp,
struct xfrm_user_sec_ctx *sec_ctx)
{
return 0;
}

static inline int dummy_xfrm_policy_clone_security(struct xfrm_policy *old, struct xfrm_policy *new)
static inline int dummy_xfrm_policy_clone_security(struct xfrm_sec_ctx *old_ctx,
struct xfrm_sec_ctx **new_ctxp)
{
return 0;
}

static void dummy_xfrm_policy_free_security(struct xfrm_policy *xp)
static void dummy_xfrm_policy_free_security(struct xfrm_sec_ctx *ctx)
{
}

static int dummy_xfrm_policy_delete_security(struct xfrm_policy *xp)
static int dummy_xfrm_policy_delete_security(struct xfrm_sec_ctx *ctx)
{
return 0;
}
Expand All @@ -911,7 +912,8 @@ static int dummy_xfrm_state_delete_security(struct xfrm_state *x)
return 0;
}

static int dummy_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
static int dummy_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx,
u32 sk_sid, u8 dir)
{
return 0;
}
Expand Down
Loading

0 comments on commit 3c666a0

Please sign in to comment.