[MLSXFRM]: Add security context to acquire messages using netlink
This includes the security context of a security association created for use by IKE in the acquire messages sent to IKE daemons using netlink/xfrm_user. This would allow the daemons to include the security context in the negotiation, so that the resultant association is unique to that security context. Signed-off-by: Serge Hallyn <serue@us.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
e0d1caa7b0
Коммит
0d681623d3
|
@ -911,27 +911,40 @@ rtattr_failure:
|
|||
return -1;
|
||||
}
|
||||
|
||||
static int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
|
||||
static int copy_sec_ctx(struct xfrm_sec_ctx *s, struct sk_buff *skb)
|
||||
{
|
||||
if (xp->security) {
|
||||
int ctx_size = sizeof(struct xfrm_sec_ctx) +
|
||||
xp->security->ctx_len;
|
||||
struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
|
||||
struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
|
||||
int ctx_size = sizeof(struct xfrm_sec_ctx) + s->ctx_len;
|
||||
struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
|
||||
struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
|
||||
|
||||
uctx->exttype = XFRMA_SEC_CTX;
|
||||
uctx->len = ctx_size;
|
||||
uctx->ctx_doi = xp->security->ctx_doi;
|
||||
uctx->ctx_alg = xp->security->ctx_alg;
|
||||
uctx->ctx_len = xp->security->ctx_len;
|
||||
memcpy(uctx + 1, xp->security->ctx_str, xp->security->ctx_len);
|
||||
}
|
||||
return 0;
|
||||
uctx->exttype = XFRMA_SEC_CTX;
|
||||
uctx->len = ctx_size;
|
||||
uctx->ctx_doi = s->ctx_doi;
|
||||
uctx->ctx_alg = s->ctx_alg;
|
||||
uctx->ctx_len = s->ctx_len;
|
||||
memcpy(uctx + 1, s->ctx_str, s->ctx_len);
|
||||
return 0;
|
||||
|
||||
rtattr_failure:
|
||||
return -1;
|
||||
}
|
||||
|
||||
static inline int copy_to_user_state_sec_ctx(struct xfrm_state *x, struct sk_buff *skb)
|
||||
{
|
||||
if (x->security) {
|
||||
return copy_sec_ctx(x->security, skb);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static inline int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
|
||||
{
|
||||
if (xp->security) {
|
||||
return copy_sec_ctx(xp->security, skb);
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
|
||||
{
|
||||
struct xfrm_dump_info *sp = ptr;
|
||||
|
@ -1710,7 +1723,7 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
|
|||
|
||||
if (copy_to_user_tmpl(xp, skb) < 0)
|
||||
goto nlmsg_failure;
|
||||
if (copy_to_user_sec_ctx(xp, skb))
|
||||
if (copy_to_user_state_sec_ctx(x, skb))
|
||||
goto nlmsg_failure;
|
||||
|
||||
nlh->nlmsg_len = skb->tail - b;
|
||||
|
|
Загрузка…
Ссылка в новой задаче