linux-toradex.git/net/ipv4/cipso_ipv4.c, branch v3.19.3

cipso: don't use IPCB() to locate the CIPSO IP option

2015-03-06T22:57:32+00:00

commit 04f81f0154e4bf002be6f4d85668ce1257efa4d9 upstream.

Using the IPCB() macro to get the IPv4 options is convenient, but
unfortunately NetLabel often needs to examine the CIPSO option outside
of the scope of the IP layer in the stack.  While historically IPCB()
worked above the IP layer, due to the inclusion of the inet_skb_param
struct at the head of the {tcp,udp}_skb_cb structs, recent commit
971f10ec ("tcp: better TCP_SKB_CB layout to reduce cache line misses")
reordered the tcp_skb_cb struct and invalidated this IPCB() trick.

This patch fixes the problem by creating a new function,
cipso_v4_optptr(), which locates the CIPSO option inside the IP header
without calling IPCB().  Unfortunately, this isn't as fast as a simple
lookup so some additional tweaks were made to limit the use of this
new function.

Reported-by: Casey Schaufler 
Signed-off-by: Paul Moore 
Tested-by: Casey Schaufler 
Signed-off-by: Greg Kroah-Hartman

cipso: remove NULL assignment on static

2014-11-04T20:09:52+00:00

Also add blank line after structure declarations

Signed-off-by: Fabian Frederick 
Signed-off-by: David S. Miller

ipv4: include linux/bug.h instead of asm/bug.h

2014-11-04T20:09:20+00:00

Signed-off-by: Fabian Frederick 
Signed-off-by: David S. Miller

cipso: kerneldoc warning fix

2014-11-04T20:09:20+00:00

Signed-off-by: Fabian Frederick 
Signed-off-by: David S. Miller

cipso: add __init to cipso_v4_cache_init

2014-10-01T19:46:20+00:00

cipso_v4_cache_init is only called by __init cipso_v4_init

Signed-off-by: Fabian Frederick 
Signed-off-by: David S. Miller

netlabel: shorter names for the NetLabel catmap funcs/structs

2014-08-01T15:17:37+00:00

Historically the NetLabel LSM secattr catmap functions and data
structures have had very long names which makes a mess of the NetLabel
code and anyone who uses NetLabel.  This patch renames the catmap
functions and structures from "*_secattr_catmap_*" to just "*_catmap_*"
which improves things greatly.

There are no substantial code or logic changes in this patch.

Signed-off-by: Paul Moore 
Tested-by: Casey Schaufler

netlabel: fix the horribly broken catmap functions

2014-08-01T15:17:17+00:00

The NetLabel secattr catmap functions, and the SELinux import/export
glue routines, were broken in many horrible ways and the SELinux glue
code fiddled with the NetLabel catmap structures in ways that we
probably shouldn't allow.  At some point this "worked", but that was
likely due to a bit of dumb luck and sub-par testing (both inflicted
by yours truly).  This patch corrects these problems by basically
gutting the code in favor of something less obtuse and restoring the
NetLabel abstractions in the SELinux catmap glue code.

Everything is working now, and if it decides to break itself in the
future this code will be much easier to debug than the code it
replaces.

One noteworthy side effect of the changes is that it is no longer
necessary to allocate a NetLabel catmap before calling one of the
NetLabel APIs to set a bit in the catmap.  NetLabel will automatically
allocate the catmap nodes when needed, resulting in less allocations
when the lowest bit is greater than 255 and less code in the LSMs.

Cc: stable@vger.kernel.org
Reported-by: Christian Evans 
Signed-off-by: Paul Moore 
Tested-by: Casey Schaufler

netlabel: fix a problem when setting bits below the previously lowest bit

2014-08-01T15:17:03+00:00

The NetLabel category (catmap) functions have a problem in that they
assume categories will be set in an increasing manner, e.g. the next
category set will always be larger than the last.  Unfortunately, this
is not a valid assumption and could result in problems when attempting
to set categories less than the startbit in the lowest catmap node.
In some cases kernel panics and other nasties can result.

This patch corrects the problem by checking for this and allocating a
new catmap node instance and placing it at the front of the list.

Cc: stable@vger.kernel.org
Reported-by: Christian Evans 
Signed-off-by: Paul Moore 
Tested-by: Casey Schaufler

ipv4: ERROR: code indent should use tabs where possible

2013-12-26T18:43:21+00:00

Signed-off-by: Weilong Chen 
Signed-off-by: David S. Miller

ipv4/ipv6: Fix FSF address in file headers

2013-12-06T17:37:56+00:00

Several files refer to an old address for the Free Software Foundation
in the file header comment.  Resolve by replacing the address with
the URL  so that we do not have to keep
updating the header comments anytime the address changes.

CC: Alexey Kuznetsov 
CC: James Morris 
CC: Hideaki YOSHIFUJI 
CC: Patrick McHardy 
Signed-off-by: Jeff Kirsher 
Signed-off-by: David S. Miller