From patchwork Tue Jul 10 06:53:50 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Piotr Sawicki X-Patchwork-Id: 10516199 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 6BBFD6020F for ; Tue, 10 Jul 2018 06:54:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5A97928C13 for ; Tue, 10 Jul 2018 06:54:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4EB7928C2B; Tue, 10 Jul 2018 06:54:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, FORGED_MUA_MOZILLA, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 56BA828C13 for ; Tue, 10 Jul 2018 06:54:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751715AbeGJGx7 (ORCPT ); Tue, 10 Jul 2018 02:53:59 -0400 Received: from mailout2.w1.samsung.com ([210.118.77.12]:58861 "EHLO mailout2.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751274AbeGJGx4 (ORCPT ); Tue, 10 Jul 2018 02:53:56 -0400 Received: from eucas1p1.samsung.com (unknown [182.198.249.206]) by mailout2.w1.samsung.com (KnoxPortal) with ESMTP id 20180710065354euoutp024149ed6e4a1f9eeb0fbc550e39e16fa5~-72lVwbQX2429224292euoutp02F for ; Tue, 10 Jul 2018 06:53:54 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout2.w1.samsung.com 20180710065354euoutp024149ed6e4a1f9eeb0fbc550e39e16fa5~-72lVwbQX2429224292euoutp02F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1531205634; bh=4hkvVY1niLSMkMwpQLFBvbXiCrxbASYP++ggh+xoguI=; h=Subject:From:To:Date:In-Reply-To:References:From; b=LNdrLtysZYlZgABW4qPThn81jsGP95Itqr+9MFm2hDl/nQ3Zg75gMrfCTqt6HKF4k 4MipLfQc7L4BAX6XUiIYBlveSIceFZiUU0ZUnqRiTamCMJ5h18SXBa5N5bmdpU9S8x 9KF/4suqpxtqatSMDNsiy2boWPhNaVo+VLG4dApk= Received: from eusmges1new.samsung.com (unknown [203.254.199.242]) by eucas1p2.samsung.com (KnoxPortal) with ESMTP id 20180710065353eucas1p2b8cc565a75b0b160918dedb4af952e52~-72krwn7F0195701957eucas1p2t; Tue, 10 Jul 2018 06:53:53 +0000 (GMT) Received: from eucas1p1.samsung.com ( [182.198.249.206]) by eusmges1new.samsung.com (EUCPMTA) with SMTP id F6.7A.05700.008544B5; Tue, 10 Jul 2018 07:53:52 +0100 (BST) Received: from eusmtrp1.samsung.com (unknown [182.198.249.138]) by eucas1p2.samsung.com (KnoxPortal) with ESMTPA id 20180710065352eucas1p2fbc5313e30223318f61f69ad3543cfeb~-72jttMHp0195701957eucas1p2s; Tue, 10 Jul 2018 06:53:52 +0000 (GMT) Received: from eusmgms2.samsung.com (unknown [182.198.249.180]) by eusmtrp1.samsung.com (KnoxPortal) with ESMTP id 20180710065352eusmtrp13a1464b160aee92e08d4f3555ce017db~-72jd3ZA20402304023eusmtrp15; Tue, 10 Jul 2018 06:53:52 +0000 (GMT) X-AuditID: cbfec7f2-1dbff70000011644-97-5b4458003877 Received: from eusmtip2.samsung.com ( [203.254.199.222]) by eusmgms2.samsung.com (EUCPMTA) with SMTP id 9D.40.04183.FF7544B5; Tue, 10 Jul 2018 07:53:51 +0100 (BST) Received: from [106.120.51.16] (unknown [106.120.51.16]) by eusmtip2.samsung.com (KnoxPortal) with ESMTPA id 20180710065351eusmtip2fd3b30b2ffff872e95316ba897105586~-72jIF_I10627806278eusmtip2f; Tue, 10 Jul 2018 06:53:51 +0000 (GMT) Subject: [PATCH RFC] Smack: Fix handling of IPv4 traffic received by PF_INET6 sockets From: Piotr Sawicki To: linux-security-module@vger.kernel.org, Casey Schaufler , jmorris@namei.org, serge@hallyn.com, "SMACK-discuss@lists.01.org" Date: Tue, 10 Jul 2018 08:53:50 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <20180709123728eucas1p2e80949d219441dced3b0ab58e73315ce~-s5SM65Kc0595005950eucas1p2U@eucas1p2.samsung.com> Content-Language: en-US X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprHKsWRmVeSWpSXmKPExsWy7djPc7oMES7RBofOWlnc2/aLzWLd+sVM Fh96HrFZnL9wjt3i6tKN7A6sHtd2R3p0z/7H4tHzPdnj6P5FbB6fN8kFsEZx2aSk5mSWpRbp 2yVwZbRef8ZacFak4vOGD+wNjNsFuxg5OSQETCSW3njO1MXIxSEksIJRYv2cS8wQzhdGicVf rjNCOJ8ZJXb9f8XexcgB1nL8vQxEfDmjxOrrk9ghnLeMEnNOP2YDmSssEC7x80YPmM0G1NCz 7icLSJGIwHZGiU9XF7KDJFgEVCXWztrNCmKLCkRIbJzwiRnE5hUQlDg58wkLiM0pUC7xq28x WJxZQF6ieetsKFtc4taT+WCHSwhMZpc43rKMCaK5TOLH/HnMEN+5SCy+/p4dwhaWeHV8C5Qt I3F6cg8LhF0v0bv+GBvEoB5Gidat89ggEtYSnydtYQb5mVlAU2L9Ln2IsKPE/1Ub2SBBwSdx 460gxD18EpO2TWeGCPNKdLQJQVTrSLzpW8ICEZaSWNSdBxH2kDh1YDfjBEbFWUgenoXkyVlI npyFcMICRpZVjOKppcW56anFhnmp5XrFibnFpXnpesn5uZsYganm9L/jn3Ywfr2UdIhRgINR iYd3Q6pztBBrYllxZe4hRgkOZiURXoMcoBBvSmJlVWpRfnxRaU5q8SFGaQ4WJXHeOI26KCGB 9MSS1OzU1ILUIpgsEwenVAPjzNKcPzU3lvHIlVyq69NVrVXILF15bPPev1Ki2c8jNDN0Cz/W Z6Qo/F9yY91SoVl6PkZRKx2Ndc9uXzflxRJ1OXnZ97/anbdpuKvNrr4ZoP6mRXtjjSyz+5Zl HiE3A54/4Hp8SOnhv8YJk1LP7JigxPj65u8U1X3b7C+fDFgpMyV026HHuRktSizFGYmGWsxF xYkAH/lrajEDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrGIsWRmVeSWpSXmKPExsVy+t/xe7r/w12iDaZtMLe4t+0Xm8W69YuZ LD70PGKzOH/hHLvF1aUb2R1YPa7tjvTonv2PxaPne7LH0f2L2Dw+b5ILYI3SsynKLy1JVcjI Ly6xVYo2tDDSM7S00DMysdQzNDaPtTIyVdK3s0lJzcksSy3St0vQy2i9/oy14KxIxecNH9gb GLcLdjFycEgImEgcfy/TxcjFISSwlFFi2fVFbF2MnEBxKYm5//ayQ9jCEn+udbFBFL1mlNj3 cykjSEJYIFzi6qmprCA2G9CgnnU/WUCKRAS2M0o8bW1hgug4xSjx7v9KJpAqXgE3iS0bd4CN ZRFQlVg7azdYt6hAhETTvDXsEDWCEidnPmEBsTkFyiV+9S1mBrGZBcwk5m1+CGXLSzRvnQ1l i0vcejKfaQKj4Cwk7bOQtMxC0jILScsCRpZVjCKppcW56bnFRnrFibnFpXnpesn5uZsYgXG0 7djPLTsYu94FH2IU4GBU4uHdkOocLcSaWFZcmXuIUYKDWUmE1yAHKMSbklhZlVqUH19UmpNa fIjRFOi5icxSosn5wBjPK4k3NDU0t7A0NDc2NzazUBLnPW9QGSUkkJ5YkpqdmlqQWgTTx8TB KdXA2MYh/rbQ9Pxpo2tLj3NdnaLVufz66anRHTbhe/xrA50tTnEtMuBMev/tdL1J4E/frGR5 /7p1Ey6rWFufWbZ2Vd8y891dHmV2Qu/NnnBHb8m8kclpVMn6K1uN69xBlct3lmfOKrsd3isa pDxto+pbN7Emr1+nf80N5f17sO2qiPWr/UeZ/8v4KrEUZyQaajEXFScCAOml4F+5AgAA Message-Id: <20180710065352eucas1p2fbc5313e30223318f61f69ad3543cfeb~-72jttMHp0195701957eucas1p2s@eucas1p2.samsung.com> X-CMS-MailID: 20180710065352eucas1p2fbc5313e30223318f61f69ad3543cfeb X-Msg-Generator: CA X-RootMTR: 20180709123728eucas1p2e80949d219441dced3b0ab58e73315ce X-EPHeader: CA CMS-TYPE: 201P X-CMS-RootMailID: 20180709123728eucas1p2e80949d219441dced3b0ab58e73315ce References: <20180709123728eucas1p2e80949d219441dced3b0ab58e73315ce~-s5SM65Kc0595005950eucas1p2U@eucas1p2.samsung.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP A socket which has sk_family set to PF_INET6 is able to receive not only IPv6 but also IPv4 traffic (IPv4-mapped IPv6 addresses). Prior to this change, the smk_skb_to_addr_ipv6() could have been called for socket buffers containing IPv4 packets. Signed-off-by: Piotr Sawicki ---  security/smack/smack_lsm.c | 12 ++++++++----  1 file changed, 8 insertions(+), 4 deletions(-)          /* @@ -3950,7 +3954,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)           */          netlbl_secattr_init(&secattr); -        rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr); +        rc = netlbl_skbuff_getattr(skb, family, &secattr);          if (rc == 0)              skp = smack_from_secattr(&secattr, ssp);          else @@ -3963,7 +3967,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)  #endif  #ifdef CONFIG_AUDIT          smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); -        ad.a.u.net->family = sk->sk_family; +        ad.a.u.net->family = family;          ad.a.u.net->netif = skb->skb_iif;          ipv4_skb_to_auditdata(skb, &ad.a, NULL);  #endif @@ -3977,7 +3981,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)          rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,                      MAY_WRITE, rc);          if (rc != 0) -            netlbl_skbuff_err(skb, sk->sk_family, rc, 0); +            netlbl_skbuff_err(skb, family, rc, 0);          break;  #if IS_ENABLED(CONFIG_IPV6)      case PF_INET6: diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 19de675..1315de4 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -3924,15 +3924,19 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)      struct smack_known *skp = NULL;      int rc = 0;      struct smk_audit_info ad; +    u16 family = sk->sk_family;  #ifdef CONFIG_AUDIT      struct lsm_network_audit net;  #endif  #if IS_ENABLED(CONFIG_IPV6)      struct sockaddr_in6 sadd;      int proto; + +    if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) +        family = PF_INET;  #endif /* CONFIG_IPV6 */ -    switch (sk->sk_family) { +    switch (family) {      case PF_INET:  #ifdef CONFIG_SECURITY_SMACK_NETFILTER