[MLSXFRM]: Add flow labeling

This labels the flows that could utilize IPSec xfrms at the points the
flows are defined so that IPSec policy and SAs at the right label can
be used.

The following protos are currently not handled, but they should
continue to be able to use single-labeled IPSec like they currently
do.

ipmr
ip_gre
ipip
igmp
sit
sctp
ip6_tunnel (IPv6 over IPv6 tunnel device)
decnet

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

20 files changed, 36 insertions, 2 deletions

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 7f56f7e8f571..386498053b1c 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -678,6 +678,7 @@ static struct dst_entry* dccp_v4_route_skb(struct sock *sk,
                                      }
                           };
 
+        security_skb_classify_flow(skb, &fl);
         if (ip_route_output_flow(&rt, &fl, sk, 0)) {
                 IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
                 return NULL;
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 610c722ac27f..53d255c01431 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -201,6 +201,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         fl.oif = sk->sk_bound_dev_if;
         fl.fl_ip_dport = usin->sin6_port;
         fl.fl_ip_sport = inet->sport;
+        security_sk_classify_flow(sk, &fl);
 
         if (np->opt != NULL && np->opt->srcrt != NULL) {
                 const struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
@@ -322,6 +323,7 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         fl.oif = sk->sk_bound_dev_if;
                         fl.fl_ip_dport = inet->dport;
                         fl.fl_ip_sport = inet->sport;
+                        security_sk_classify_flow(sk, &fl);
 
                         err = ip6_dst_lookup(sk, &dst, &fl);
                         if (err) {
@@ -422,6 +424,7 @@ static int dccp_v6_send_response(struct sock *sk, struct request_sock *req,
         fl.oif = ireq6->iif;
         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
         fl.fl_ip_sport = inet_sk(sk)->sport;
+        security_sk_classify_flow(sk, &fl);
 
         if (dst == NULL) {
                 opt = np->opt;
@@ -566,6 +569,7 @@ static void dccp_v6_ctl_send_reset(struct sk_buff *rxskb)
         fl.oif = inet6_iif(rxskb);
         fl.fl_ip_dport = dh->dccph_dport;
         fl.fl_ip_sport = dh->dccph_sport;
+        security_skb_classify_flow(rxskb, &fl);
 
         /* sk = NULL, but it is safe for now. RST socket required. */
         if (!ip6_dst_lookup(NULL, &skb->dst, &fl)) {
@@ -622,6 +626,7 @@ static void dccp_v6_reqsk_send_ack(struct sk_buff *rxskb,
         fl.oif = inet6_iif(rxskb);
         fl.fl_ip_dport = dh->dccph_dport;
         fl.fl_ip_sport = dh->dccph_sport;
+        security_skb_classify_flow(rxskb, &fl);
 
         if (!ip6_dst_lookup(NULL, &skb->dst, &fl)) {
                 if (xfrm_lookup(&skb->dst, &fl, NULL, 0) >= 0) {
@@ -842,6 +847,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
                 fl.oif = sk->sk_bound_dev_if;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->sport;
+                security_sk_classify_flow(sk, &fl);
 
                 if (ip6_dst_lookup(sk, &dst, &fl))
                         goto out;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index c84a32070f8d..fc40da3b6d39 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1074,6 +1074,7 @@ int inet_sk_rebuild_header(struct sock *sk)
                 },
         };
                                                 
+        security_sk_classify_flow(sk, &fl);
         err = ip_route_output_flow(&rt, &fl, sk, 0);
 }
         if (!err)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 4c86ac3d882d..6ad797c14163 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -406,6 +406,7 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
                                                 .saddr = rt->rt_spec_dst,
                                                 .tos = RT_TOS(skb->nh.iph->tos) } },
                                     .proto = IPPROTO_ICMP };
+                security_skb_classify_flow(skb, &fl);
                 if (ip_route_output_key(&rt, &fl))
                         goto out_unlock;
         }
@@ -560,6 +561,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, u32 info)
                                 }
                         }
                 };
+                security_skb_classify_flow(skb_in, &fl);
                 if (ip_route_output_key(&rt, &fl))
                         goto out_unlock;
         }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index e50a1bfd7ccc..772b4eac78bc 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -327,6 +327,7 @@ struct dst_entry* inet_csk_route_req(struct sock *sk,
                                        { .sport = inet_sk(sk)->sport,
                                          .dport = ireq->rmt_port } } };
 
+        security_sk_classify_flow(sk, &fl);
         if (ip_route_output_flow(&rt, &fl, sk, 0)) {
                 IP_INC_STATS_BH(IPSTATS_MIB_OUTNOROUTES);
                 return NULL;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index a2ede167e045..308bdeac3455 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -328,6 +328,7 @@ int ip_queue_xmit(struct sk_buff *skb, int ipfragok)
                          * keep trying until route appears or the connection times
                          * itself out.
                          */
+                        security_sk_classify_flow(sk, &fl);
                         if (ip_route_output_flow(&rt, &fl, sk, 0))
                                 goto no_route;
                 }
@@ -1366,6 +1367,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
                                                { .sport = skb->h.th->dest,
                                                  .dport = skb->h.th->source } },
                                     .proto = sk->sk_protocol };
+                security_skb_classify_flow(skb, &fl);
                 if (ip_route_output_key(&rt, &fl))
                         return;
         }
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 269bc2067cb8..7f905bf2bde5 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -90,6 +90,7 @@ static inline struct rtable *route_reverse(struct sk_buff *skb,
         fl.proto = IPPROTO_TCP;
         fl.fl_ip_sport = tcph->dest;
         fl.fl_ip_dport = tcph->source;
+        security_skb_classify_flow(skb, &fl);
 
         xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0);
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 62b2762a2420..fe44cb50a1c5 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -484,6 +484,7 @@ static int raw_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                 if (!inet->hdrincl)
                         raw_probe_proto_opt(&fl, msg);
 
+                security_sk_classify_flow(sk, &fl);
                 err = ip_route_output_flow(&rt, &fl, sk, !(msg->msg_flags&MSG_DONTWAIT));
         }
         if (err)
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index e20be3331f67..307dc3c0d635 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -259,6 +259,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                                     .uli_u = { .ports =
                                                { .sport = skb->h.th->dest,
                                                  .dport = skb->h.th->source } } };
+                security_sk_classify_flow(sk, &fl);
                 if (ip_route_output_key(&rt, &fl)) {
                         reqsk_free(req);
                         goto out; 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f136cec96d95..a4d005eccc7f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -603,6 +603,7 @@ int udp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                     .uli_u = { .ports =
                                                { .sport = inet->sport,
                                                  .dport = dport } } };
+                security_sk_classify_flow(sk, &fl);
                 err = ip_route_output_flow(&rt, &fl, sk, !(msg->msg_flags&MSG_DONTWAIT));
                 if (err)
                         goto out;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index ac85e9c532c2..82a1b1a328db 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -637,6 +637,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                 fl.oif = sk->sk_bound_dev_if;
                 fl.fl_ip_dport = inet->dport;
                 fl.fl_ip_sport = inet->sport;
+                security_sk_classify_flow(sk, &fl);
 
                 if (np->opt && np->opt->srcrt) {
                         struct rt0_hdr *rt0 = (struct rt0_hdr *) np->opt->srcrt;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 3b55b4c8e2d1..c73508e090a6 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -156,6 +156,8 @@ ipv4_connected:
         if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
                 fl.oif = np->mcast_oif;
 
+        security_sk_classify_flow(sk, &fl);
+
         if (flowlabel) {
                 if (flowlabel->opt && flowlabel->opt->srcrt) {
                         struct rt0_hdr *rt0 = (struct rt0_hdr *) flowlabel->opt->srcrt;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 356a8a7ef22a..dbfce089e916 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -358,6 +358,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         fl.oif = iif;
         fl.fl_icmp_type = type;
         fl.fl_icmp_code = code;
+        security_skb_classify_flow(skb, &fl);
 
         if (icmpv6_xmit_lock())
                 return;
@@ -472,6 +473,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
                 ipv6_addr_copy(&fl.fl6_src, saddr);
         fl.oif = skb->dev->ifindex;
         fl.fl_icmp_type = ICMPV6_ECHO_REPLY;
+        security_skb_classify_flow(skb, &fl);
 
         if (icmpv6_xmit_lock())
                 return;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index bf491077b822..7a51a258615d 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -157,6 +157,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
         fl.oif = sk->sk_bound_dev_if;
         fl.fl_ip_sport = inet->sport;
         fl.fl_ip_dport = inet->dport;
+        security_sk_classify_flow(sk, &fl);
 
         if (np->opt && np->opt->srcrt) {
                 struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index b50055b9278d..67cfc3813c32 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -419,6 +419,7 @@ static inline void ndisc_flow_init(struct flowi *fl, u8 type,
         fl->proto               = IPPROTO_ICMPV6;
         fl->fl_icmp_type        = type;
         fl->fl_icmp_code        = 0;
+        security_sk_classify_flow(ndisc_socket->sk, fl);
 }
 
 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 8629ba195d2d..c4eba1aeb323 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -96,6 +96,7 @@ static void send_reset(struct sk_buff *oldskb)
         ipv6_addr_copy(&fl.fl6_dst, &oip6h->saddr);
         fl.fl_ip_sport = otcph.dest;
         fl.fl_ip_dport = otcph.source;
+        security_skb_classify_flow(oldskb, &fl);
         dst = ip6_route_output(NULL, &fl);
         if (dst == NULL)
                 return;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 15b862d8acab..d5040e172292 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -759,6 +759,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 
         if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
                 fl.oif = np->mcast_oif;
+        security_sk_classify_flow(sk, &fl);
 
         err = ip6_dst_lookup(sk, &dst, &fl);
         if (err)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 802a1a6b1037..46922e57e311 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -251,6 +251,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 final_p = &final;
         }
 
+        security_sk_classify_flow(sk, &fl);
+
         err = ip6_dst_lookup(sk, &dst, &fl);
         if (err)
                 goto failure;
@@ -374,6 +376,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         fl.oif = sk->sk_bound_dev_if;
                         fl.fl_ip_dport = inet->dport;
                         fl.fl_ip_sport = inet->sport;
+                        security_skb_classify_flow(skb, &fl);
 
                         if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
                                 sk->sk_err_soft = -err;
@@ -467,6 +470,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         fl.oif = treq->iif;
         fl.fl_ip_dport = inet_rsk(req)->rmt_port;
         fl.fl_ip_sport = inet_sk(sk)->sport;
+        security_sk_classify_flow(sk, &fl);
 
         if (dst == NULL) {
                 opt = np->opt;
@@ -625,6 +629,7 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
         fl.oif = inet6_iif(skb);
         fl.fl_ip_dport = t1->dest;
         fl.fl_ip_sport = t1->source;
+        security_skb_classify_flow(skb, &fl);
 
         /* sk = NULL, but it is safe for now. RST socket required. */
         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
@@ -691,6 +696,7 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         fl.oif = inet6_iif(skb);
         fl.fl_ip_dport = t1->dest;
         fl.fl_ip_sport = t1->source;
+        security_skb_classify_flow(skb, &fl);
 
         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
@@ -923,6 +929,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 fl.oif = sk->sk_bound_dev_if;
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->sport;
+                security_sk_classify_flow(sk, &fl);
 
                 if (ip6_dst_lookup(sk, &dst, &fl))
                         goto out;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 3d54f246411e..82c7c9cde2a8 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -782,6 +782,8 @@ do_udp_sendmsg:
                 connected = 0;
         }
 
+        security_sk_classify_flow(sk, fl);
+
         err = ip6_sk_dst_lookup(sk, &dst, fl);
         if (err)
                 goto out;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 79405daadc52..32c963c90573 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -863,7 +863,6 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
         u16 family;
         u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
 
-        fl->secid = security_sk_sid(sk, fl, dir);
 restart:
         genid = atomic_read(&flow_cache_genid);
         policy = NULL;
@@ -1039,7 +1038,7 @@ xfrm_decode_session(struct sk_buff *skb, struct flowi *fl, unsigned short family
                 return -EAFNOSUPPORT;
 
         afinfo->decode_session(skb, fl);
-        err = security_xfrm_decode_session(skb, fl);
+        err = security_xfrm_decode_session(skb, &fl->secid);
         xfrm_policy_put_afinfo(afinfo);
         return err;
 }