From patchwork Sun Nov 8 18:54:07 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 541472 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 473341402CC for ; Mon, 9 Nov 2015 05:54:32 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b=hin+aPV8; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751040AbbKHSy2 (ORCPT ); Sun, 8 Nov 2015 13:54:28 -0500 Received: from mail-pa0-f48.google.com ([209.85.220.48]:33617 "EHLO mail-pa0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750909AbbKHSy0 (ORCPT ); Sun, 8 Nov 2015 13:54:26 -0500 Received: by pabfh17 with SMTP id fh17so174799146pab.0 for ; Sun, 08 Nov 2015 10:54:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=9fpKIjOZGyOkzcvaFqL5lKOmUBBFwHEv4IJWRIDz8zM=; b=hin+aPV8M1PtCJA5TQU3u4MRVAdcHTwl+G54rWDP68fKT31yYLwYT9A7KZitxPcioM FwjIbeizMd93clZ7MPBJhEjhmiihWncb0438Ym3awbwwjKFUyM+OKCkKyGtO7PJM/q0r QQreMP1IDyA4gbTuzWKFJqpu4MUsFmdW9YVZ/djf4xCWv0GlvJKeIdAE9psgCUWDEaDY QyQvn3zMhBqYDfVPPdsspNzZDH25/fN9WD8DPSXpn2H0ipGVranoY1jp9pqjZooqa4ly UQDmqk1Dv93uhe0iYdyZMSOQLuyT/tdq9skm479JAcQP/OuJWVG28tKnrmZWA9IFilpG Rvww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=9fpKIjOZGyOkzcvaFqL5lKOmUBBFwHEv4IJWRIDz8zM=; b=a2DE/HQUG2m2XLT4Ue8MTSQPIRUK9TxmKVsqPdl+ZiYUSoDvU/2G5OEVo4TH5pT6c3 NbBChPtGmF0DmumeZpCpyFkGJvOmGwxNKW2wp6uYv1+xqewVM/qttvgnaL6OJtvY0nFw Vd/juTA0Es6TkQ+1keHOUr9XQMJdTfj49tXr8lEChBA/TOMnFHOVy2qYl1S4xUlPK7SZ ah1wALtURzrfpd1Zw0dISd0j+XdXEwtIe4kAoBkUhRl46JmkrWk097ru27Yb791w5cxO IBdc3PNbflHLtZtF7PkCkNCPte8tEsJeu1S7/klCNCP68c3hTGRKgB1xidf1DRlRs3Gb Lgsw== X-Gm-Message-State: ALoCoQkNyDcf91OUbUgrlfyd8QQtwTOMNaPziy2Bsw9GYFVFODycN/xLI2oWZIQgGP3xbNsLjJ2G X-Received: by 10.68.91.228 with SMTP id ch4mr33639986pbb.41.1447008866147; Sun, 08 Nov 2015 10:54:26 -0800 (PST) Received: from localhost ([2620:0:1000:3002:b17b:97c4:6cf0:245b]) by smtp.gmail.com with ESMTPSA id yk5sm11921481pac.5.2015.11.08.10.54.24 (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Sun, 08 Nov 2015 10:54:25 -0800 (PST) From: Eric Dumazet To: "David S . Miller" Cc: netdev , Pablo Neira Ayuso , Paul Moore , Casey Schaufler , Eric Dumazet , Eric Dumazet Subject: [PATCH net 1/6] net: add skb_to_full_sk() helper and use it in selinux_netlbl_skbuff_setsid() Date: Sun, 8 Nov 2015 10:54:07 -0800 Message-Id: <1447008853-16060-2-git-send-email-edumazet@google.com> X-Mailer: git-send-email 2.6.0.rc2.230.g3dd15c0 In-Reply-To: <1447008853-16060-1-git-send-email-edumazet@google.com> References: <1447008853-16060-1-git-send-email-edumazet@google.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Generalize selinux_skb_sk() added in commit 212cd0895330 ("selinux: fix random read in selinux_ip_postroute_compat()") so that we can use it other contexts. Use it right away in selinux_netlbl_skbuff_setsid() Fixes: ca6fb0651883 ("tcp: attach SYNACK messages to request sockets instead of listener") Signed-off-by: Eric Dumazet --- include/net/inet_sock.h | 12 ++++++++++++ security/selinux/hooks.c | 16 ++-------------- security/selinux/netlabel.c | 2 +- 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h index f5bf7310e334..2134e6d815bc 100644 --- a/include/net/inet_sock.h +++ b/include/net/inet_sock.h @@ -210,6 +210,18 @@ struct inet_sock { #define IP_CMSG_ORIGDSTADDR BIT(6) #define IP_CMSG_CHECKSUM BIT(7) +/* SYNACK messages might be attached to request sockets. + * Some places want to reach the listener in this case. + */ +static inline struct sock *skb_to_full_sk(const struct sk_buff *skb) +{ + struct sock *sk = skb->sk; + + if (sk && sk->sk_state == TCP_NEW_SYN_RECV) + sk = inet_reqsk(sk)->rsk_listener; + return sk; +} + static inline struct inet_sock *inet_sk(const struct sock *sk) { return (struct inet_sock *)sk; diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c9b2d5467477..23307da15f1d 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4931,23 +4931,11 @@ static unsigned int selinux_ipv4_output(void *priv, return selinux_ip_output(skb, PF_INET); } -/* SYNACK messages might be attached to request sockets. - * To get back to sk_security, we need to look at the listener. - */ -static struct sock *selinux_skb_sk(const struct sk_buff *skb) -{ - struct sock *sk = skb->sk; - - if (sk && sk->sk_state == TCP_NEW_SYN_RECV) - sk = inet_reqsk(sk)->rsk_listener; - return sk; -} - static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, int ifindex, u16 family) { - struct sock *sk = selinux_skb_sk(skb); + struct sock *sk = skb_to_full_sk(skb); struct sk_security_struct *sksec; struct common_audit_data ad; struct lsm_network_audit net = {0,}; @@ -5002,7 +4990,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, if (!secmark_active && !peerlbl_active) return NF_ACCEPT; - sk = selinux_skb_sk(skb); + sk = skb_to_full_sk(skb); #ifdef CONFIG_XFRM /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index 0364120d1ec8..1f989a539fd4 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -245,7 +245,7 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, /* if this is a locally generated packet check to see if it is already * being labeled by it's parent socket, if it is just exit */ - sk = skb->sk; + sk = skb_to_full_sk(skb); if (sk != NULL) { struct sk_security_struct *sksec = sk->sk_security; if (sksec->nlbl_state != NLBL_REQSKB)