* [PATCH v2] cipso: handle CIPSO options correctly when NetLabel is disabled
@ 2012-06-01 15:54 Paul Moore
2012-06-01 18:18 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Paul Moore @ 2012-06-01 15:54 UTC (permalink / raw)
To: netdev; +Cc: linux-security-module
When NetLabel is not enabled, e.g. CONFIG_NETLABEL=n, and the system
receives a CIPSO tagged packet it is dropped (cipso_v4_validate()
returns non-zero). In most cases this is the correct and desired
behavior, however, in the case where we are simply forwarding the
traffic, e.g. acting as a network bridge, this becomes a problem.
This patch fixes the forwarding problem by providing the basic CIPSO
validation code directly in ip_options_compile() without the need for
the NetLabel or CIPSO code. The new validation code can not perform
any of the CIPSO option label/value verification that
cipso_v4_validate() does, but it can verify the basic CIPSO option
format.
The behavior when NetLabel is enabled is unchanged.
CC: stable@vger.kernel.org
Signed-off-by: Paul Moore <pmoore@redhat.com>
--
ChangeLog
-v2
* Moved the CONFIG_NETLABEL=n code into cipso_ipv4.h
-v1
* Initial version
---
include/net/cipso_ipv4.h | 29 ++++++++++++++++++++++++++++-
1 files changed, 28 insertions(+), 1 deletions(-)
diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
index 9808877..a7a683e 100644
--- a/include/net/cipso_ipv4.h
+++ b/include/net/cipso_ipv4.h
@@ -42,6 +42,7 @@
#include <net/netlabel.h>
#include <net/request_sock.h>
#include <linux/atomic.h>
+#include <asm/unaligned.h>
/* known doi values */
#define CIPSO_V4_DOI_UNKNOWN 0x00000000
@@ -285,7 +286,33 @@ static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
static inline int cipso_v4_validate(const struct sk_buff *skb,
unsigned char **option)
{
- return -ENOSYS;
+ unsigned char *opt = *option;
+ unsigned char err_offset = 0;
+ u8 opt_len = opt[1];
+ u8 opt_iter;
+
+ if (opt_len < 8) {
+ err_offset = 1;
+ goto out;
+ }
+
+ if (get_unaligned_be32(&opt[2]) == 0) {
+ err_offset = 2;
+ goto out;
+ }
+
+ for (opt_iter = 6; opt_iter < opt_len;) {
+ if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
+ err_offset = opt_iter + 1;
+ goto out;
+ }
+ opt_iter += opt[opt_iter + 1];
+ }
+
+out:
+ *option = opt + err_offset;
+ return err_offset;
+
}
#endif /* CONFIG_NETLABEL */
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v2] cipso: handle CIPSO options correctly when NetLabel is disabled
2012-06-01 15:54 [PATCH v2] cipso: handle CIPSO options correctly when NetLabel is disabled Paul Moore
@ 2012-06-01 18:18 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2012-06-01 18:18 UTC (permalink / raw)
To: pmoore; +Cc: netdev, linux-security-module
From: Paul Moore <pmoore@redhat.com>
Date: Fri, 01 Jun 2012 11:54:56 -0400
> When NetLabel is not enabled, e.g. CONFIG_NETLABEL=n, and the system
> receives a CIPSO tagged packet it is dropped (cipso_v4_validate()
> returns non-zero). In most cases this is the correct and desired
> behavior, however, in the case where we are simply forwarding the
> traffic, e.g. acting as a network bridge, this becomes a problem.
>
> This patch fixes the forwarding problem by providing the basic CIPSO
> validation code directly in ip_options_compile() without the need for
> the NetLabel or CIPSO code. The new validation code can not perform
> any of the CIPSO option label/value verification that
> cipso_v4_validate() does, but it can verify the basic CIPSO option
> format.
>
> The behavior when NetLabel is enabled is unchanged.
>
> CC: stable@vger.kernel.org
> Signed-off-by: Paul Moore <pmoore@redhat.com>
>
I like this a lot better, applied, thanks Paul.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-06-01 18:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-06-01 15:54 [PATCH v2] cipso: handle CIPSO options correctly when NetLabel is disabled Paul Moore
2012-06-01 18:18 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.