[MLSXFRM]: Auto-labeling of child sockets

This automatically labels the TCP, Unix stream, and dccp child sockets
as well as openreqs to be at the same MLS level as the peer. This will
result in the selection of appropriately labeled IPSec Security
Associations.

This also uses the sock's sid (as opposed to the isec sid) in SELinux
enforcement of secmark in rcv_skb and postroute_last hooks.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 4 insertions, 2 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 46922e57e31..302786a11cd 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -470,7 +470,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         fl.oif = treq->iif;
         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
         fl.fl_ip_sport = inet_sk(sk)->sport;
-        security_sk_classify_flow(sk, &fl);
+        security_req_classify_flow(req, &fl);
 
         if (dst == NULL) {
                 opt = np->opt;
@@ -826,6 +826,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 
         tcp_rsk(req)->snt_isn = isn;
 
+        security_inet_conn_request(sk, skb, req);
+
         if (tcp_v6_send_synack(sk, req, NULL))
                 goto drop;
 
@@ -929,7 +931,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 fl.oif = sk->sk_bound_dev_if;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->sport;
-                security_sk_classify_flow(sk, &fl);
+                security_req_classify_flow(req, &fl);
 
                 if (ip6_dst_lookup(sk, &dst, &fl))
                         goto out;