netlabel: Pass a family parameter to netlbl_skbuff_err().

This makes it possible to route the error to the appropriate
labelling engine.  CALIPSO is far less verbose than CIPSO
when encountering a bogus packet, so there is no need for a
CALIPSO error handler.

Signed-off-by: Huw Davies <huw@codeweavers.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

3 files changed, 9 insertions, 7 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index cb7c5c8028e7..51eafe5d3bf4 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4603,13 +4603,13 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
                                                addrp, family, peer_sid, &ad);
                 if (err) {
-                        selinux_netlbl_err(skb, err, 0);
+                        selinux_netlbl_err(skb, family, err, 0);
                         return err;
                 }
                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
                                    PEER__RECV, &ad);
                 if (err) {
-                        selinux_netlbl_err(skb, err, 0);
+                        selinux_netlbl_err(skb, family, err, 0);
                         return err;
                 }
         }
@@ -4977,7 +4977,7 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb,
                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
                                                addrp, family, peer_sid, &ad);
                 if (err) {
-                        selinux_netlbl_err(skb, err, 1);
+                        selinux_netlbl_err(skb, family, err, 1);
                         return NF_DROP;
                 }
         }
diff --git a/security/selinux/include/netlabel.h b/security/selinux/include/netlabel.h
index 8c59b8f150e8..75686d53df07 100644
--- a/security/selinux/include/netlabel.h
+++ b/security/selinux/include/netlabel.h
@@ -40,7 +40,8 @@
 #ifdef CONFIG_NETLABEL
 void selinux_netlbl_cache_invalidate(void);
 
-void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway);
+void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error,
+                        int gateway);
 
 void selinux_netlbl_sk_security_free(struct sk_security_struct *sksec);
 void selinux_netlbl_sk_security_reset(struct sk_security_struct *sksec);
@@ -72,6 +73,7 @@ static inline void selinux_netlbl_cache_invalidate(void)
 }
 
 static inline void selinux_netlbl_err(struct sk_buff *skb,
+                                      u16 family,
                                       int error,
                                       int gateway)
 {
diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
index ca220c3fbcf9..dfca50dc292a 100644
--- a/security/selinux/netlabel.c
+++ b/security/selinux/netlabel.c
@@ -151,9 +151,9 @@ void selinux_netlbl_cache_invalidate(void)
  * present on the packet, NetLabel is smart enough to only act when it should.
  *
  */
-void selinux_netlbl_err(struct sk_buff *skb, int error, int gateway)
+void selinux_netlbl_err(struct sk_buff *skb, u16 family, int error, int gateway)
 {
-        netlbl_skbuff_err(skb, error, gateway);
+        netlbl_skbuff_err(skb, family, error, gateway);
 }
 
 /**
@@ -405,7 +405,7 @@ int selinux_netlbl_sock_rcv_skb(struct sk_security_struct *sksec,
                 return 0;
 
         if (nlbl_sid != SECINITSID_UNLABELED)
-                netlbl_skbuff_err(skb, rc, 0);
+                netlbl_skbuff_err(skb, family, rc, 0);
         return rc;
 }