From patchwork Wed Jul 18 10:39:09 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Piotr Sawicki X-Patchwork-Id: 10532033 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9C448602CA for ; Wed, 18 Jul 2018 10:39:17 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9D8AC2859E for ; Wed, 18 Jul 2018 10:39:17 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 91C1D2901A; Wed, 18 Jul 2018 10:39:17 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, FORGED_MUA_MOZILLA, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DBEFC2859E for ; Wed, 18 Jul 2018 10:39:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728424AbeGRLQc (ORCPT ); Wed, 18 Jul 2018 07:16:32 -0400 Received: from mailout2.w1.samsung.com ([210.118.77.12]:39272 "EHLO mailout2.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726996AbeGRLQc (ORCPT ); Wed, 18 Jul 2018 07:16:32 -0400 Received: from eucas1p2.samsung.com (unknown [182.198.249.207]) by mailout2.w1.samsung.com (KnoxPortal) with ESMTP id 20180718103914euoutp0286521bc4b01f85486b63c7c1354f9bab~CcFnGDnWW2605626056euoutp02X for ; Wed, 18 Jul 2018 10:39:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout2.w1.samsung.com 20180718103914euoutp0286521bc4b01f85486b63c7c1354f9bab~CcFnGDnWW2605626056euoutp02X DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1531910354; bh=Fz6vjbAxZOXcvCjGD26flXMCSmD08WkkL6dW5dfFl8Q=; h=From:Subject:To:Date:References:From; b=Dfg9F6COjJ5NG4btEbD04zwSFnOsekCtzDMDqykwhDbGbuYVrMSGYtMG0oL/PkIhs DatZKAG4/BPROGII8AshAmWTA0EwXlNZeQXeVhi1jQkGkysWUoyzzIjsaY26tdKFKF LM35qDgko0WPPR1aNjiRlESP9p2PmeCNuymvc8J8= Received: from eusmges2new.samsung.com (unknown [203.254.199.244]) by eucas1p1.samsung.com (KnoxPortal) with ESMTP id 20180718103913eucas1p16e2394d9714982a3a20d7b271c475e93~CcFmgAjVA1240212402eucas1p1n; Wed, 18 Jul 2018 10:39:13 +0000 (GMT) Received: from eucas1p1.samsung.com ( [182.198.249.206]) by eusmges2new.samsung.com (EUCPMTA) with SMTP id 07.72.05751.1D81F4B5; Wed, 18 Jul 2018 11:39:13 +0100 (BST) Received: from eusmtrp1.samsung.com (unknown [182.198.249.138]) by eucas1p1.samsung.com (KnoxPortal) with ESMTPA id 20180718103912eucas1p1bdceed080e229f29e37c1aadb10cebc1~CcFlYShn11831418314eucas1p1f; Wed, 18 Jul 2018 10:39:12 +0000 (GMT) Received: from eusmgms2.samsung.com (unknown [182.198.249.180]) by eusmtrp1.samsung.com (KnoxPortal) with ESMTP id 20180718103912eusmtrp184c3d09094804397ad9494c2279d183f~CcFlIaprg0818808188eusmtrp1t; Wed, 18 Jul 2018 10:39:12 +0000 (GMT) X-AuditID: cbfec7f4-c47ff70000001677-26-5b4f18d1798d Received: from eusmtip2.samsung.com ( [203.254.199.222]) by eusmgms2.samsung.com (EUCPMTA) with SMTP id C4.40.04183.FC81F4B5; Wed, 18 Jul 2018 11:39:11 +0100 (BST) Received: from [106.120.51.16] (unknown [106.120.51.16]) by eusmtip2.samsung.com (KnoxPortal) with ESMTPA id 20180718103911eusmtip223ff5b7291ebb2428ad2a2fee9268bb8~CcFkze26M2672626726eusmtip2L; Wed, 18 Jul 2018 10:39:11 +0000 (GMT) From: Piotr Sawicki Subject: [PATCH v2 RFC] mack: Check UDP-Lite and DCCP protocols during IPv6 handling To: LSM , Casey Schaufler , jmorris@namei.org, serge@hallyn.com, "SMACK-discuss@lists.01.org" Newsgroups: gmane.linux.kernel.lsm X-Mozilla-News-Host: news://news.gmane.org Date: Wed, 18 Jul 2018 12:39:09 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Language: en-US X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrOKsWRmVeSWpSXmKPExsWy7djPc7oXJfyjDX7s4LK4t+0Xm8W69YuZ LD70PGKzeP9qAavF+Qvn2C2uLt3I7sDmcW13pEf37H8sHj3fkz0OvtvD5HF0/yI2j8+b5ALY orhsUlJzMstSi/TtErgyvu/7zVowg6ti0637LA2Mizm6GDk5JARMJI7/2cPWxcjFISSwglFi +pF1LBDOF0aJu3tPsINUCQl8ZpRY+EEapuNj+19miKLljBL/P+9jhHDeMkr8u/UArIMNqKpn 3U8WEFtYIExiwosusB0iAnsZJTb8eAeW4BNQkrj35g8rxFgtiVM7d4LFWQRUJX5MecgIYosK REgcebAQzOYVEJQ4OfMJWA2zgLjErSfzmSBseYntb+cwQ8yZxy5xtN8Yor5MYsrWI1DzXST6 P1xhhLCFJV4d38IOYctInJ7cwwJh10v0rj8GdqiEQA+jROvWeWwQCWuJz5O2AC3gAFqmKbF+ lz5E2FFif287O0hYQoBP4sZbQYhz+CQmbZvODBHmlehoE4Ko1pF407eEBSIsJbGoO28Co9Is JH/NQvLXLCR/zUJYu4CRZRWjeGppcW56arFRXmq5XnFibnFpXrpecn7uJkZg8jn97/iXHYy7 /iQdYhTgYFTi4T3w3zdaiDWxrLgy9xCjBAezkgjvwfd+0UK8KYmVValF+fFFpTmpxYcYpTlY lMR54zTqooQE0hNLUrNTUwtSi2CyTBycUg2M9tkiBS+e8AsveWVe07zIZcG1vif1r79eObVj O1f2Ka7Xyy882sZtcTn5SexxcVdRsf/6bA+l0gUWcMr0aZWmd122znrSWFnDaKSQ7x3zr0U9 +Sn3k56SRbmHJp/jcb6+4OWtc24zlBZ3X0sutKs4ZvRn+fwUB3P9jv6H6z7ERWe2CBjdX8up xFKckWioxVxUnAgAEaO3NjoDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrAIsWRmVeSWpSXmKPExsVy+t/xe7rnJfyjDe7utrK4t+0Xm8W69YuZ LD70PGKzeP9qAavF+Qvn2C2uLt3I7sDmcW13pEf37H8sHj3fkz0OvtvD5HF0/yI2j8+b5ALY ovRsivJLS1IVMvKLS2yVog0tjPQMLS30jEws9QyNzWOtjEyV9O1sUlJzMstSi/TtEvQyvu/7 zVowg6ti0637LA2Mizm6GDk5JARMJD62/2XuYuTiEBJYyijR2LCRDSIhJTH33152CFtY4s+1 LjaIoteMEg2XpjGBJNiAunvW/WQBsYUFwiQmvIAoEhHYyyixaV43WIJPQEni3ps/rBCTtCRO 7dwJFucVcJNY9+oo2AYWAVWJH1MeMoLYogIREquXv2CFqBGUODnzCVg9s4CZxLzND5khbHGJ W0/mM0HY8hLb385hnsAoOAtJyywkLbOQtMxC0rKAkWUVo0hqaXFuem6xkV5xYm5xaV66XnJ+ 7iZGYGxtO/Zzyw7GrnfBhxgFOBiVeHgP/PeNFmJNLCuuzD3EKMHBrCTCe/C9X7QQb0piZVVq UX58UWlOavEhRlOghyYyS4km5wPjPq8k3tDU0NzC0tDc2NzYzEJJnPe8QWWUkEB6Yklqdmpq QWoRTB8TB6dUA+PyJw+n1t4y6+UU33hZtU+vf4bUG763s7RePVKuiUtzX9GRososNGljI/c9 0Qdn4vM3yP+pmmb0dSEPg9BX5+a5wVMSxbk2qfPs7X+5pKp+rruBQozkK86aOQ/7anwusKd1 hJ6J/21l0TL7p+Xutwd9X9TvfyVZsSbIr8bW/TD7dxbnP/YBn5VYijMSDbWYi4oTAcUaF+bD AgAA Message-Id: <20180718103912eucas1p1bdceed080e229f29e37c1aadb10cebc1~CcFlYShn11831418314eucas1p1f@eucas1p1.samsung.com> X-CMS-MailID: 20180718103912eucas1p1bdceed080e229f29e37c1aadb10cebc1 X-Msg-Generator: CA X-RootMTR: 20180718103912eucas1p1bdceed080e229f29e37c1aadb10cebc1 X-EPHeader: CA CMS-TYPE: 201P X-CMS-RootMailID: 20180718103912eucas1p1bdceed080e229f29e37c1aadb10cebc1 References: Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP The smack_socket_sock_rcv_skb() function is checking smack labels only for UDP and TCP frames carried in IPv6 packets. From now on, it is able also to handle UDP-Lite and DCCP protocols. Signed-off-by: Piotr Sawicki --- security/smack/smack_lsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) sip->sin6_port = uh->source; @@ -3986,7 +3987,8 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) #if IS_ENABLED(CONFIG_IPV6) case PF_INET6: proto = smk_skb_to_addr_ipv6(skb, &sadd); - if (proto != IPPROTO_UDP && proto != IPPROTO_TCP) + if (proto != IPPROTO_UDP && proto != IPPROTO_UDPLITE && + proto != IPPROTO_TCP && proto != IPPROTO_DCCP) break; #ifdef SMACK_IPV6_SECMARK_LABELING if (skb && skb->secmark != 0) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8b6cd5a..c2282ac 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -3896,6 +3896,7 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip) sip->sin6_port = th->source; break; case IPPROTO_UDP: + case IPPROTO_UDPLITE: uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); if (uh != NULL)