Eric Lee / smarc-fsl-linux-kernel

08 Jun, 2007

1 commit

  • 4aa2e62c4   xfrm: Add security check before flushing SAD/SPD ... Browse Code »

    Currently we check for permission before deleting entries from SAD and
    SPD, (see security_xfrm_policy_delete() security_xfrm_state_delete())
    However we are not checking for authorization when flushing the SPD and
    the SAD completely. It was perhaps missed in the original security hooks
    patch.

    This patch adds a security check when flushing entries from the SAD and
    SPD. It runs the entire database and checks each entry for a denial.
    If the process attempting the flush is unable to remove all of the
    entries a denial is logged the the flush function returns an error
    without removing anything.

    This is particularly useful when a process may need to create or delete
    its own xfrm entries used for things like labeled networking but that
    same process should not be able to delete other entries or flush the
    entire database.

    Signed-off-by: Joy Latten
    Signed-off-by: Eric Paris
    Signed-off-by: James Morris

    Joy Latten
     

20 May, 2007

1 commit

  • c92b3a2f1   [IPSEC] pfkey: Load specific algorithm in pfkey_add rather than all ... Browse Code »

    This is a natural extension of the changeset

    [XFRM]: Probe selected algorithm only.

    which only removed the probe call for xfrm_user. This patch does exactly
    the same thing for af_key. In other words, we load the algorithm requested
    by the user rather than everything when adding xfrm states in af_key.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

26 Apr, 2007

2 commits

  • 3ff50b799   [NET]: cleanup extra semicolons ... Browse Code »

    Spring cleaning time...

    There seems to be a lot of places in the network code that have
    extra bogus semicolons after conditionals. Most commonly is a
    bogus semicolon after: switch() { }

    Signed-off-by: Stephen Hemminger
    Signed-off-by: David S. Miller

    Stephen Hemminger
     
  • badff6d01   [SK_BUFF]: Introduce skb_reset_transport_header(skb) ... Browse Code »

    For the common, open coded 'skb->h.raw = skb->data' operation, so that we can
    later turn skb->h.raw into a offset, reducing the size of struct sk_buff in
    64bit land while possibly keeping it as a pointer on 32bit.

    This one touches just the most simple cases:

    skb->h.raw = skb->data;
    skb->h.raw = {skb_push|[__]skb_pull}()

    The next ones will handle the slightly more "complex" cases.

    Signed-off-by: Arnaldo Carvalho de Melo
    Signed-off-by: David S. Miller

    Arnaldo Carvalho de Melo
     

19 Apr, 2007

1 commit

18 Apr, 2007

1 commit

08 Mar, 2007

3 commits

  • 16bec31db   [IPSEC]: xfrm audit hook misplaced in pfkey_delete and xfrm_del_sa ... Browse Code »

    Inside pfkey_delete and xfrm_del_sa the audit hooks were not called if
    there was any permission/security failures in attempting to do the del
    operation (such as permission denied from security_xfrm_state_delete).
    This patch moves the audit hook to the exit path such that all failures
    (and successes) will actually get audited.

    Signed-off-by: Eric Paris
    Acked-by: Venkat Yekkirala
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Eric Paris
     
  • 215a2dd3b   [IPSEC]: Add xfrm policy change auditing to pfkey_spdget ... Browse Code »

    pfkey_spdget neither had an LSM security hook nor auditing for the
    removal of xfrm_policy structs. The security hook was added when it was
    moved into xfrm_policy_byid instead of the callers to that function by
    my earlier patch and this patch adds the auditing hooks as well.

    Signed-off-by: Eric Paris
    Acked-by: Venkat Yekkirala
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Eric Paris
     
  • ef41aaa0b   [IPSEC]: xfrm_policy delete security check misplaced ... Browse Code »

    The security hooks to check permissions to remove an xfrm_policy were
    actually done after the policy was removed. Since the unlinking and
    deletion are done in xfrm_policy_by* functions this moves the hooks
    inside those 2 functions. There we have all the information needed to
    do the security check and it can be done before the deletion. Since
    auditing requires the result of that security check err has to be passed
    back and forth from the xfrm_policy_by* functions.

    This patch also fixes a bug where a deletion that failed the security
    check could cause improper accounting on the xfrm_policy
    (xfrm_get_policy didn't have a put on the exit path for the hold taken
    by xfrm_policy_by*)

    It also fixes the return code when no policy is found in
    xfrm_add_pol_expire. In old code (at least back in the 2.6.18 days) err
    wasn't used before the return when no policy is found and so the
    initialization would cause err to be ENOENT. But since err has since
    been used above when we don't get a policy back from the xfrm_policy_by*
    function we would always return 0 instead of the intended ENOENT. Also
    fixed some white space damage in the same area.

    Signed-off-by: Eric Paris
    Acked-by: Venkat Yekkirala
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Eric Paris
     

13 Feb, 2007

1 commit

11 Feb, 2007

1 commit

09 Feb, 2007

1 commit

  • 08de61bea   [PFKEYV2]: Extension for dynamic update of endpoint address(es) ... Browse Code »

    Extend PF_KEYv2 framework so that user application can take advantage
    of MIGRATE feature via PF_KEYv2 interface. User application can either
    send or receive an MIGRATE message to/from PF_KEY socket.

    Detail information can be found in the internet-draft
    .

    Signed-off-by: Shinta Sugimoto
    Signed-off-by: Masahide NAKAMURA
    Signed-off-by: YOSHIFUJI Hideaki
    Signed-off-by: David S. Miller

    Shinta Sugimoto
     

07 Dec, 2006

1 commit

03 Dec, 2006

2 commits

12 Oct, 2006

1 commit

  • 5b368e61c   IPsec: correct semantics for SELinux policy matching ... Browse Code »

    Currently when an IPSec policy rule doesn't specify a security
    context, it is assumed to be "unlabeled" by SELinux, and so
    the IPSec policy rule fails to match to a flow that it would
    otherwise match to, unless one has explicitly added an SELinux
    policy rule allowing the flow to "polmatch" to the "unlabeled"
    IPSec policy rules. In the absence of such an explicitly added
    SELinux policy rule, the IPSec policy rule fails to match and
    so the packet(s) flow in clear text without the otherwise applicable
    xfrm(s) applied.

    The above SELinux behavior violates the SELinux security notion of
    "deny by default" which should actually translate to "encrypt by
    default" in the above case.

    This was first reported by Evgeniy Polyakov and the way James Morris
    was seeing the problem was when connecting via IPsec to a
    confined service on an SELinux box (vsftpd), which did not have the
    appropriate SELinux policy permissions to send packets via IPsec.

    With this patch applied, SELinux "polmatching" of flows Vs. IPSec
    policy rules will only come into play when there's a explicit context
    specified for the IPSec policy rule (which also means there's corresponding
    SELinux policy allowing appropriate domains/flows to polmatch to this context).

    Secondly, when a security module is loaded (in this case, SELinux), the
    security_xfrm_policy_lookup() hook can return errors other than access denied,
    such as -EINVAL. We were not handling that correctly, and in fact
    inverting the return logic and propagating a false "ok" back up to
    xfrm_lookup(), which then allowed packets to pass as if they were not
    associated with an xfrm policy.

    The solution for this is to first ensure that errno values are
    correctly propagated all the way back up through the various call chains
    from security_xfrm_policy_lookup(), and handled correctly.

    Then, flow_cache_lookup() is modified, so that if the policy resolver
    fails (typically a permission denied via the security module), the flow
    cache entry is killed rather than having a null policy assigned (which
    indicates that the packet can pass freely). This also forces any future
    lookups for the same flow to consult the security module (e.g. SELinux)
    for current security policy (rather than, say, caching the error on the
    flow cache entry).

    This patch: Fix the selinux side of things.

    This makes sure SELinux polmatching of flow contexts to IPSec policy
    rules comes into play only when an explicit context is associated
    with the IPSec policy rule.

    Also, this no longer defaults the context of a socket policy to
    the context of the socket since the "no explicit context" case
    is now handled properly.

    Signed-off-by: Venkat Yekkirala
    Signed-off-by: James Morris

    Venkat Yekkirala
     

29 Sep, 2006

1 commit

23 Sep, 2006

4 commits

01 Jul, 2006

1 commit

18 Jun, 2006

1 commit

  • c8c05a8ee   [LSM-IPsec]: SELinux Authorize ... Browse Code »

    This patch contains a fix for the previous patch that adds security
    contexts to IPsec policies and security associations. In the previous
    patch, no authorization (besides the check for write permissions to
    SAD and SPD) is required to delete IPsec policies and security
    assocations with security contexts. Thus a user authorized to change
    SAD and SPD can bypass the IPsec policy authorization by simply
    deleteing policies with security contexts. To fix this security hole,
    an additional authorization check is added for removing security
    policies and security associations with security contexts.

    Note that if no security context is supplied on add or present on
    policy to be deleted, the SELinux module allows the change
    unconditionally. The hook is called on deletion when no context is
    present, which we may want to change. At present, I left it up to the
    module.

    LSM changes:

    The patch adds two new LSM hooks: xfrm_policy_delete and
    xfrm_state_delete. The new hooks are necessary to authorize deletion
    of IPsec policies that have security contexts. The existing hooks
    xfrm_policy_free and xfrm_state_free lack the context to do the
    authorization, so I decided to split authorization of deletion and
    memory management of security data, as is typical in the LSM
    interface.

    Use:

    The new delete hooks are checked when xfrm_policy or xfrm_state are
    deleted by either the xfrm_user interface (xfrm_get_policy,
    xfrm_del_sa) or the pfkey interface (pfkey_spddelete, pfkey_delete).

    SELinux changes:

    The new policy_delete and state_delete functions are added.

    Signed-off-by: Catherine Zhang
    Signed-off-by: Trent Jaeger
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Catherine Zhang
     

21 Mar, 2006

2 commits

24 Feb, 2006

1 commit

  • 21380b81e   [XFRM]: Eliminate refcounting confusion by creating __xfrm_state_put(). ... Browse Code »

    We often just do an atomic_dec(&x->refcnt) on an xfrm_state object
    because we know there is more than 1 reference remaining and thus
    we can elide the heavier xfrm_state_put() call.

    Do this behind an inline function called __xfrm_state_put() so that is
    more obvious and also to allow us to more cleanly add refcount
    debugging later.

    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Herbert Xu
     

25 Jan, 2006

1 commit

  • 151bb0ffe   [AF_KEY]: no message type set ... Browse Code »

    When returning a message to userspace in reply to a SADB_FLUSH or
    SADB_X_SPDFLUSH message, the type was not set for the returned PFKEY
    message. The patch below corrects this problem.

    Signed-off-by: Jerome Borsboom
    Signed-off-by: David S. Miller

    Jerome Borsboom
     

12 Jan, 2006

1 commit

10 Jan, 2006

1 commit

04 Jan, 2006

2 commits

  • 90ddc4f04   [NET]: move struct proto_ops to const ... Browse Code »

    I noticed that some of 'struct proto_ops' used in the kernel may share
    a cache line used by locks or other heavily modified data. (default
    linker alignement is 32 bytes, and L1_CACHE_LINE is 64 or 128 at
    least)

    This patch makes sure a 'struct proto_ops' can be declared as const,
    so that all cpus can share all parts of it without false sharing.

    This is not mandatory : a driver can still use a read/write structure
    if it needs to (and eventually a __read_mostly)

    I made a global stubstitute to change all existing occurences to make
    them const.

    This should reduce the possibility of false sharing on SMP, and
    speedup some socket system calls.

    Signed-off-by: Eric Dumazet
    Signed-off-by: David S. Miller

    Eric Dumazet
     
  • df71837d5   [LSM-IPSec]: Security association restriction. ... Browse Code »

    This patch series implements per packet access control via the
    extension of the Linux Security Modules (LSM) interface by hooks in
    the XFRM and pfkey subsystems that leverage IPSec security
    associations to label packets. Extensions to the SELinux LSM are
    included that leverage the patch for this purpose.

    This patch implements the changes necessary to the XFRM subsystem,
    pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
    socket to use only authorized security associations (or no security
    association) to send/receive network packets.

    Patch purpose:

    The patch is designed to enable access control per packets based on
    the strongly authenticated IPSec security association. Such access
    controls augment the existing ones based on network interface and IP
    address. The former are very coarse-grained, and the latter can be
    spoofed. By using IPSec, the system can control access to remote
    hosts based on cryptographic keys generated using the IPSec mechanism.
    This enables access control on a per-machine basis or per-application
    if the remote machine is running the same mechanism and trusted to
    enforce the access control policy.

    Patch design approach:

    The overall approach is that policy (xfrm_policy) entries set by
    user-level programs (e.g., setkey for ipsec-tools) are extended with a
    security context that is used at policy selection time in the XFRM
    subsystem to restrict the sockets that can send/receive packets via
    security associations (xfrm_states) that are built from those
    policies.

    A presentation available at
    www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
    from the SELinux symposium describes the overall approach.

    Patch implementation details:

    On output, the policy retrieved (via xfrm_policy_lookup or
    xfrm_sk_policy_lookup) must be authorized for the security context of
    the socket and the same security context is required for resultant
    security association (retrieved or negotiated via racoon in
    ipsec-tools). This is enforced in xfrm_state_find.

    On input, the policy retrieved must also be authorized for the socket
    (at __xfrm_policy_check), and the security context of the policy must
    also match the security association being used.

    The patch has virtually no impact on packets that do not use IPSec.
    The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
    before.

    Also, if IPSec is used without security contexts, the impact is
    minimal. The LSM must allow such policies to be selected for the
    combination of socket and remote machine, but subsequent IPSec
    processing proceeds as in the original case.

    Testing:

    The pfkey interface is tested using the ipsec-tools. ipsec-tools have
    been modified (a separate ipsec-tools patch is available for version
    0.5) that supports assignment of xfrm_policy entries and security
    associations with security contexts via setkey and the negotiation
    using the security contexts via racoon.

    The xfrm_user interface is tested via ad hoc programs that set
    security contexts. These programs are also available from me, and
    contain programs for setting, getting, and deleting policy for testing
    this interface. Testing of sa functions was done by tracing kernel
    behavior.

    Signed-off-by: Trent Jaeger
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Trent Jaeger
     

09 Oct, 2005

1 commit

  • dd0fc66fb   [PATCH] gfp flags annotations - part 1 ... Browse Code »

    - added typedef unsigned int __nocast gfp_t;

    - replaced __nocast uses for gfp flags with gfp_t - it gives exactly
    the same warnings as far as sparse is concerned, doesn't change
    generated code (from gcc point of view we replaced unsigned int with
    typedef) and documents what's going on far better.

    Signed-off-by: Al Viro
    Signed-off-by: Linus Torvalds

    Al Viro
     

06 Oct, 2005

1 commit

05 Oct, 2005

1 commit

21 Jun, 2005

2 commits

  • dd87147ee   [IPSEC]: Add XFRM_STATE_NOPMTUDISC flag ... Browse Code »

    This patch adds the flag XFRM_STATE_NOPMTUDISC for xfrm states. It is
    similar to the nopmtudisc on IPIP/GRE tunnels. It only has an effect
    on IPv4 tunnel mode states. For these states, it will ensure that the
    DF flag is always cleared.

    This is primarily useful to work around ICMP blackholes.

    In future this flag could also allow a larger MTU to be set within the
    tunnel just like IPIP/GRE tunnels. This could be useful for short haul
    tunnels where temporary fragmentation outside the tunnel is desired over
    smaller fragments inside the tunnel.

    Signed-off-by: Herbert Xu
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Herbert Xu
     
  • 72cb6962a   [IPSEC]: Add xfrm_init_state ... Browse Code »

    This patch adds xfrm_init_state which is simply a wrapper that calls
    xfrm_get_type and subsequently x->type->init_state. It also gets rid
    of the unused args argument.

    Abstracting it out allows us to add common initialisation code, e.g.,
    to set family-specific flags.

    The add_time setting in xfrm_user.c was deleted because it's already
    set by xfrm_state_alloc.

    Signed-off-by: Herbert Xu
    Acked-by: James Morris
    Signed-off-by: David S. Miller

    Herbert Xu
     

19 Jun, 2005

4 commits

  • 7d6dfe1f5   [IPSEC] Fix xfrm_state leaks in error path ... Browse Code »

    Herbert Xu wrote:
    > @@ -1254,6 +1326,7 @@ static int pfkey_add(struct sock *sk, st
    > if (IS_ERR(x))
    > return PTR_ERR(x);
    >
    > + xfrm_state_hold(x);

    This introduces a leak when xfrm_state_add()/xfrm_state_update()
    fail. We hold two references (one from xfrm_state_alloc(), one
    from xfrm_state_hold()), but only drop one. We need to take the
    reference because the reference from xfrm_state_alloc() can
    be dropped by __xfrm_state_delete(), so the fix is to drop both
    references on error. Same problem in xfrm_user.c.

    Signed-off-by: Patrick McHardy
    Signed-off-by: Herbert Xu
    Signed-off-by: David S. Miller

    Patrick McHardy
     
  • f60f6b8f7   [IPSEC] Use XFRM_MSG_* instead of XFRM_SAP_* ... Browse Code »

    This patch removes XFRM_SAP_* and converts them over to XFRM_MSG_*.
    The netlink interface is meant to map directly onto the underlying
    xfrm subsystem. Therefore rather than using a new independent
    representation for the events we can simply use the existing ones
    from xfrm_user.

    Signed-off-by: Herbert Xu

    Herbert Xu
     
  • bf08867f9   [IPSEC] Turn km_event.data into a union ... Browse Code »

    This patch turns km_event.data into a union. This makes code that
    uses it clearer.

    Signed-off-by: Herbert Xu

    Herbert Xu
     
  • 4f09f0bbc   [IPSEC] Fix xfrm to pfkey SA state conversion ... Browse Code »

    This patch adjusts the SA state conversion in af_key such that
    XFRM_STATE_ERROR/XFRM_STATE_DEAD will be converted to SADB_STATE_DEAD
    instead of SADB_STATE_DYING.

    According to RFC 2367, SADB_STATE_DYING SAs can be turned into
    mature ones through updating their lifetime settings. Since SAs
    which are in the states XFRM_STATE_ERROR/XFRM_STATE_DEAD cannot
    be resurrected, this value is unsuitable.

    Signed-off-by: Herbert Xu

    Herbert Xu