[MLSXFRM]: Flow based matching of xfrm policy and state

This implements a seemless mechanism for xfrm policy selection and
state matching based on the flow sid. This also includes the necessary
SELinux enforcement pieces.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 2 insertions, 5 deletions

diff --git a/net/core/flow.c b/net/core/flow.c
index 2191af5f26ac..645241165e6c 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -32,7 +32,6 @@ struct flow_cache_entry {
         u8                      dir;
         struct flowi            key;
         u32                     genid;
-        u32                     sk_sid;
         void                    *object;
         atomic_t                *object_ref;
 };
@@ -165,7 +164,7 @@ static int flow_key_compare(struct flowi *key1, struct flowi *key2)
         return 0;
 }
 
-void *flow_cache_lookup(struct flowi *key, u32 sk_sid, u16 family, u8 dir,
+void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
                         flow_resolve_t resolver)
 {
         struct flow_cache_entry *fle, **head;
@@ -189,7 +188,6 @@ void *flow_cache_lookup(struct flowi *key, u32 sk_sid, u16 family, u8 dir,
         for (fle = *head; fle; fle = fle->next) {
                 if (fle->family == family &&
                     fle->dir == dir &&
-                    fle->sk_sid == sk_sid &&
                     flow_key_compare(key, &fle->key) == 0) {
                         if (fle->genid == atomic_read(&flow_cache_genid)) {
                                 void *ret = fle->object;
@@ -214,7 +212,6 @@ void *flow_cache_lookup(struct flowi *key, u32 sk_sid, u16 family, u8 dir,
                         *head = fle;
                         fle->family = family;
                         fle->dir = dir;
-                        fle->sk_sid = sk_sid;
                         memcpy(&fle->key, key, sizeof(*key));
                         fle->object = NULL;
                         flow_count(cpu)++;
@@ -226,7 +223,7 @@ nocache:
                 void *obj;
                 atomic_t *obj_ref;
 
-                resolver(key, sk_sid, family, dir, &obj, &obj_ref);
+                resolver(key, family, dir, &obj, &obj_ref);
 
                 if (fle) {
                         fle->genid = atomic_read(&flow_cache_genid);