* [PATCH v4 RFC] Smack: Check UDP-Lite and DCCP protocols during IPv6 handling
[not found] <CGME20180719094518eucas1p21032c7af4afc37854db8ea84836d6fe3@eucas1p2.samsung.com>
@ 2018-07-19 9:45 ` Piotr Sawicki
2018-07-19 22:50 ` Casey Schaufler
2018-07-23 20:04 ` Casey Schaufler
0 siblings, 2 replies; 3+ messages in thread
From: Piotr Sawicki @ 2018-07-19 9:45 UTC (permalink / raw)
To: linux-security-module
The smack_socket_sock_rcv_skb() function is checking smack labels
only for UDP and TCP frames carried in IPv6 packets. From now on,
it is able also to handle UDP-Lite and DCCP protocols.
Signed-off-by: Piotr Sawicki <p.sawicki2@partner.samsung.com>
---
Changes in v2:
- Add missing Signed-off-by field
Changes in v3:
- Fix the email subject
Changes in v4:
- Fix formatting issues caused by improper email client configuration
---
security/smack/smack_lsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 8b6cd5a..c2282ac 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3896,6 +3896,7 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
sip->sin6_port = th->source;
break;
case IPPROTO_UDP:
+ case IPPROTO_UDPLITE:
uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
if (uh != NULL)
sip->sin6_port = uh->source;
@@ -3986,7 +3987,8 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
#if IS_ENABLED(CONFIG_IPV6)
case PF_INET6:
proto = smk_skb_to_addr_ipv6(skb, &sadd);
- if (proto != IPPROTO_UDP && proto != IPPROTO_TCP)
+ if (proto != IPPROTO_UDP && proto != IPPROTO_UDPLITE &&
+ proto != IPPROTO_TCP && proto != IPPROTO_DCCP)
break;
#ifdef SMACK_IPV6_SECMARK_LABELING
if (skb && skb->secmark != 0)
--
2.7.4
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH v4 RFC] Smack: Check UDP-Lite and DCCP protocols during IPv6 handling
2018-07-19 9:45 ` [PATCH v4 RFC] Smack: Check UDP-Lite and DCCP protocols during IPv6 handling Piotr Sawicki
@ 2018-07-19 22:50 ` Casey Schaufler
2018-07-23 20:04 ` Casey Schaufler
1 sibling, 0 replies; 3+ messages in thread
From: Casey Schaufler @ 2018-07-19 22:50 UTC (permalink / raw)
To: linux-security-module
On 7/19/2018 2:45 AM, Piotr Sawicki wrote:
> The smack_socket_sock_rcv_skb() function is checking smack labels
> only for UDP and TCP frames carried in IPv6 packets. From now on,
> it is able also to handle UDP-Lite and DCCP protocols.
>
> Signed-off-by: Piotr Sawicki <p.sawicki2@partner.samsung.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
I will take this
> ---
> Changes in v2:
> - Add missing Signed-off-by field
> Changes in v3:
> - Fix the email subject
> Changes in v4:
> - Fix formatting issues caused by improper email client configuration
> ---
> security/smack/smack_lsm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 8b6cd5a..c2282ac 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -3896,6 +3896,7 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
> sip->sin6_port = th->source;
> break;
> case IPPROTO_UDP:
> + case IPPROTO_UDPLITE:
> uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
> if (uh != NULL)
> sip->sin6_port = uh->source;
> @@ -3986,7 +3987,8 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
> #if IS_ENABLED(CONFIG_IPV6)
> case PF_INET6:
> proto = smk_skb_to_addr_ipv6(skb, &sadd);
> - if (proto != IPPROTO_UDP && proto != IPPROTO_TCP)
> + if (proto != IPPROTO_UDP && proto != IPPROTO_UDPLITE &&
> + proto != IPPROTO_TCP && proto != IPPROTO_DCCP)
> break;
> #ifdef SMACK_IPV6_SECMARK_LABELING
> if (skb && skb->secmark != 0)
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v4 RFC] Smack: Check UDP-Lite and DCCP protocols during IPv6 handling
2018-07-19 9:45 ` [PATCH v4 RFC] Smack: Check UDP-Lite and DCCP protocols during IPv6 handling Piotr Sawicki
2018-07-19 22:50 ` Casey Schaufler
@ 2018-07-23 20:04 ` Casey Schaufler
1 sibling, 0 replies; 3+ messages in thread
From: Casey Schaufler @ 2018-07-23 20:04 UTC (permalink / raw)
To: linux-security-module
On 7/19/2018 2:45 AM, Piotr Sawicki wrote:
> The smack_socket_sock_rcv_skb() function is checking smack labels
> only for UDP and TCP frames carried in IPv6 packets. From now on,
> it is able also to handle UDP-Lite and DCCP protocols.
>
> Signed-off-by: Piotr Sawicki <p.sawicki2@partner.samsung.com>
Added to git://github.com/cschaufler/next-smack.git#smack-for-4.19-a
> ---
> Changes in v2:
> - Add missing Signed-off-by field
> Changes in v3:
> - Fix the email subject
> Changes in v4:
> - Fix formatting issues caused by improper email client configuration
> ---
> security/smack/smack_lsm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index 8b6cd5a..c2282ac 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -3896,6 +3896,7 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
> sip->sin6_port = th->source;
> break;
> case IPPROTO_UDP:
> + case IPPROTO_UDPLITE:
> uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
> if (uh != NULL)
> sip->sin6_port = uh->source;
> @@ -3986,7 +3987,8 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
> #if IS_ENABLED(CONFIG_IPV6)
> case PF_INET6:
> proto = smk_skb_to_addr_ipv6(skb, &sadd);
> - if (proto != IPPROTO_UDP && proto != IPPROTO_TCP)
> + if (proto != IPPROTO_UDP && proto != IPPROTO_UDPLITE &&
> + proto != IPPROTO_TCP && proto != IPPROTO_DCCP)
> break;
> #ifdef SMACK_IPV6_SECMARK_LABELING
> if (skb && skb->secmark != 0)
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2018-07-23 20:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20180719094518eucas1p21032c7af4afc37854db8ea84836d6fe3@eucas1p2.samsung.com>
2018-07-19 9:45 ` [PATCH v4 RFC] Smack: Check UDP-Lite and DCCP protocols during IPv6 handling Piotr Sawicki
2018-07-19 22:50 ` Casey Schaufler
2018-07-23 20:04 ` Casey Schaufler
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.