summaryrefslogtreecommitdiff
path: root/security/selinux/include/xfrm.h
diff options
context:
space:
mode:
authorPaul Moore <pmoore@redhat.com>2013-12-10 23:57:54 +0400
committerPaul Moore <pmoore@redhat.com>2013-12-13 02:21:31 +0400
commit817eff718dca4e54d5721211ddde0914428fbb7c (patch)
treeaf7ee8d6ca454532624c7148e9f96bd1a67c0cb3 /security/selinux/include/xfrm.h
parent446b802437f285de68ffb8d6fac3c44c3cab5b04 (diff)
downloadlinux-817eff718dca4e54d5721211ddde0914428fbb7c.tar.xz
selinux: look for IPsec labels on both inbound and outbound packets
Previously selinux_skb_peerlbl_sid() would only check for labeled IPsec security labels on inbound packets, this patch enables it to check both inbound and outbound traffic for labeled IPsec security labels. Reported-by: Janak Desai <Janak.Desai@gtri.gatech.edu> Cc: stable@vger.kernel.org Signed-off-by: Paul Moore <pmoore@redhat.com>
Diffstat (limited to 'security/selinux/include/xfrm.h')
-rw-r--r--security/selinux/include/xfrm.h8
1 files changed, 5 insertions, 3 deletions
diff --git a/security/selinux/include/xfrm.h b/security/selinux/include/xfrm.h
index 0dec76c64cf5..48c3cc94c168 100644
--- a/security/selinux/include/xfrm.h
+++ b/security/selinux/include/xfrm.h
@@ -39,6 +39,7 @@ int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
struct common_audit_data *ad, u8 proto);
int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
+int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
static inline void selinux_xfrm_notify_policyload(void)
{
@@ -79,11 +80,12 @@ static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
static inline void selinux_xfrm_notify_policyload(void)
{
}
-#endif
-static inline int selinux_skb_xfrm_sid(struct sk_buff *skb, u32 *sid)
+static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
{
- return selinux_xfrm_decode_session(skb, sid, 0);
+ *sid = SECSID_NULL;
+ return 0;
}
+#endif
#endif /* _SELINUX_XFRM_H_ */