3 files changed, 36 insertions, 46 deletions

diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index a79702bcdcd0..f333c95c4189 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -565,7 +565,7 @@ struct xfrm_audit
 };
 
 #ifdef CONFIG_AUDITSYSCALL
-static inline struct audit_buffer *xfrm_audit_start(u32 auid, u32 sid)
+static inline struct audit_buffer *xfrm_audit_start(u32 auid, u32 secid)
 {
         struct audit_buffer *audit_buf = NULL;
         char *secctx;
@@ -578,8 +578,8 @@ static inline struct audit_buffer *xfrm_audit_start(u32 auid, u32 sid)
 
         audit_log_format(audit_buf, "auid=%u", auid);
 
-        if (sid != 0 &&
-            security_secid_to_secctx(sid, &secctx, &secctx_len) == 0) {
+        if (secid != 0 &&
+            security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
                 audit_log_format(audit_buf, " subj=%s", secctx);
                 security_release_secctx(secctx, secctx_len);
         } else
@@ -588,13 +588,13 @@ static inline struct audit_buffer *xfrm_audit_start(u32 auid, u32 sid)
 }
 
 extern void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
-                                  u32 auid, u32 sid);
+                                  u32 auid, u32 secid);
 extern void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
-                                  u32 auid, u32 sid);
+                                  u32 auid, u32 secid);
 extern void xfrm_audit_state_add(struct xfrm_state *x, int result,
-                                 u32 auid, u32 sid);
+                                 u32 auid, u32 secid);
 extern void xfrm_audit_state_delete(struct xfrm_state *x, int result,
-                                    u32 auid, u32 sid);
+                                    u32 auid, u32 secid);
 #else
 #define xfrm_audit_policy_add(x, r, a, s)       do { ; } while (0)
 #define xfrm_audit_policy_delete(x, r, a, s)    do { ; } while (0)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 74807a7d3d69..abc3e39b115b 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -24,6 +24,7 @@
 #include <linux/netfilter.h>
 #include <linux/module.h>
 #include <linux/cache.h>
+#include <linux/audit.h>
 #include <net/dst.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
@@ -2401,15 +2402,14 @@ static inline void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
         }
 }
 
-void
-xfrm_audit_policy_add(struct xfrm_policy *xp, int result, u32 auid, u32 sid)
+void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
+                           u32 auid, u32 secid)
 {
         struct audit_buffer *audit_buf;
-        extern int audit_enabled;
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(auid, sid);
+        audit_buf = xfrm_audit_start(auid, secid);
         if (audit_buf == NULL)
                 return;
         audit_log_format(audit_buf, " op=SPD-add res=%u", result);
@@ -2418,15 +2418,14 @@ xfrm_audit_policy_add(struct xfrm_policy *xp, int result, u32 auid, u32 sid)
 }
 EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);
 
-void
-xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, u32 auid, u32 sid)
+void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
+                              u32 auid, u32 secid)
 {
         struct audit_buffer *audit_buf;
-        extern int audit_enabled;
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(auid, sid);
+        audit_buf = xfrm_audit_start(auid, secid);
         if (audit_buf == NULL)
                 return;
         audit_log_format(audit_buf, " op=SPD-delete res=%u", result);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index f7c0951c9fd9..9e57378c51df 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -19,6 +19,7 @@
 #include <linux/ipsec.h>
 #include <linux/module.h>
 #include <linux/cache.h>
+#include <linux/audit.h>
 #include <asm/uaccess.h>
 
 #include "xfrm_hash.h"
@@ -1998,69 +1999,59 @@ void __init xfrm_state_init(void)
 static inline void xfrm_audit_common_stateinfo(struct xfrm_state *x,
                                                struct audit_buffer *audit_buf)
 {
-        if (x->security)
+        struct xfrm_sec_ctx *ctx = x->security;
+        u32 spi = ntohl(x->id.spi);
+
+        if (ctx)
                 audit_log_format(audit_buf, " sec_alg=%u sec_doi=%u sec_obj=%s",
-                                 x->security->ctx_alg, x->security->ctx_doi,
-                                 x->security->ctx_str);
+                                 ctx->ctx_alg, ctx->ctx_doi, ctx->ctx_str);
 
         switch(x->props.family) {
         case AF_INET:
-                audit_log_format(audit_buf, " src=%u.%u.%u.%u dst=%u.%u.%u.%u",
+                audit_log_format(audit_buf,
+                                 " src=" NIPQUAD_FMT " dst=" NIPQUAD_FMT,
                                  NIPQUAD(x->props.saddr.a4),
                                  NIPQUAD(x->id.daddr.a4));
                 break;
         case AF_INET6:
-                {
-                        struct in6_addr saddr6, daddr6;
-
-                        memcpy(&saddr6, x->props.saddr.a6,
-                                sizeof(struct in6_addr));
-                        memcpy(&daddr6, x->id.daddr.a6,
-                                sizeof(struct in6_addr));
-                        audit_log_format(audit_buf,
-                                         " src=" NIP6_FMT " dst=" NIP6_FMT,
-                                         NIP6(saddr6), NIP6(daddr6));
-                }
+                audit_log_format(audit_buf,
+                                 " src=" NIP6_FMT " dst=" NIP6_FMT,
+                                 NIP6(*(struct in6_addr *)x->props.saddr.a6),
+                                 NIP6(*(struct in6_addr *)x->id.daddr.a6));
                 break;
         }
+
+        audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
 }
 
-void
-xfrm_audit_state_add(struct xfrm_state *x, int result, u32 auid, u32 sid)
+void xfrm_audit_state_add(struct xfrm_state *x, int result,
+                          u32 auid, u32 secid)
 {
         struct audit_buffer *audit_buf;
-        u32 spi;
-        extern int audit_enabled;
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(auid, sid);
+        audit_buf = xfrm_audit_start(auid, secid);
         if (audit_buf == NULL)
                 return;
-        audit_log_format(audit_buf, " op=SAD-add res=%u",result);
+        audit_log_format(audit_buf, " op=SAD-add res=%u", result);
         xfrm_audit_common_stateinfo(x, audit_buf);
-        spi = ntohl(x->id.spi);
-        audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
         audit_log_end(audit_buf);
 }
 EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
 
-void
-xfrm_audit_state_delete(struct xfrm_state *x, int result, u32 auid, u32 sid)
+void xfrm_audit_state_delete(struct xfrm_state *x, int result,
+                             u32 auid, u32 secid)
 {
         struct audit_buffer *audit_buf;
-        u32 spi;
-        extern int audit_enabled;
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(auid, sid);
+        audit_buf = xfrm_audit_start(auid, secid);
         if (audit_buf == NULL)
                 return;
-        audit_log_format(audit_buf, " op=SAD-delete res=%u",result);
+        audit_log_format(audit_buf, " op=SAD-delete res=%u", result);
         xfrm_audit_common_stateinfo(x, audit_buf);
-        spi = ntohl(x->id.spi);
-        audit_log_format(audit_buf, " spi=%u(0x%x)", spi, spi);
         audit_log_end(audit_buf);
 }
 EXPORT_SYMBOL_GPL(xfrm_audit_state_delete);