12 files changed, 655 insertions, 61 deletions

diff --git a/include/linux/pfkeyv2.h b/include/linux/pfkeyv2.h
index 724066778aff..6351c4055ace 100644
--- a/include/linux/pfkeyv2.h
+++ b/include/linux/pfkeyv2.h
@@ -216,6 +216,16 @@ struct sadb_x_nat_t_port {
 } __attribute__((packed));
 /* sizeof(struct sadb_x_nat_t_port) == 8 */
 
+/* Generic LSM security context */
+struct sadb_x_sec_ctx {
+        uint16_t        sadb_x_sec_len;
+        uint16_t        sadb_x_sec_exttype;
+        uint8_t         sadb_x_ctx_alg;  /* LSMs: e.g., selinux == 1 */
+        uint8_t         sadb_x_ctx_doi;
+        uint16_t        sadb_x_ctx_len;
+} __attribute__((packed));
+/* sizeof(struct sadb_sec_ctx) = 8 */
+
 /* Message types */
 #define SADB_RESERVED           0
 #define SADB_GETSPI             1
@@ -325,7 +335,8 @@ struct sadb_x_nat_t_port {
 #define SADB_X_EXT_NAT_T_SPORT          21
 #define SADB_X_EXT_NAT_T_DPORT          22
 #define SADB_X_EXT_NAT_T_OA             23
-#define SADB_EXT_MAX                    23
+#define SADB_X_EXT_SEC_CTX              24
+#define SADB_EXT_MAX                    24
 
 /* Identity Extension values */
 #define SADB_IDENTTYPE_RESERVED 0
diff --git a/include/linux/security.h b/include/linux/security.h
index f7e0ae018712..ef753654daa5 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -59,6 +59,12 @@ struct sk_buff;
 struct sock;
 struct sockaddr;
 struct socket;
+struct flowi;
+struct dst_entry;
+struct xfrm_selector;
+struct xfrm_policy;
+struct xfrm_state;
+struct xfrm_user_sec_ctx;
 
 extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
 extern int cap_netlink_recv(struct sk_buff *skb);
@@ -788,6 +794,52 @@ struct swap_info_struct;
  *      which is used to copy security attributes between local stream sockets.
  * @sk_free_security:
  *      Deallocate security structure.
+ * @sk_getsid:
+ *      Retrieve the LSM-specific sid for the sock to enable caching of network
+ *      authorizations.
+ *
+ * Security hooks for XFRM operations.
+ *
+ * @xfrm_policy_alloc_security:
+ *      @xp contains the xfrm_policy being added to Security Policy Database
+ *      used by the XFRM system.
+ *      @sec_ctx contains the security context information being provided by
+ *      the user-level policy update program (e.g., setkey).
+ *      Allocate a security structure to the xp->selector.security field.
+ *      The security field is initialized to NULL when the xfrm_policy is
+ *      allocated.
+ *      Return 0 if operation was successful (memory to allocate, legal context)
+ * @xfrm_policy_clone_security:
+ *      @old contains an existing xfrm_policy in the SPD.
+ *      @new contains a new xfrm_policy being cloned from old.
+ *      Allocate a security structure to the new->selector.security field
+ *      that contains the information from the old->selector.security field.
+ *      Return 0 if operation was successful (memory to allocate).
+ * @xfrm_policy_free_security:
+ *      @xp contains the xfrm_policy
+ *      Deallocate xp->selector.security.
+ * @xfrm_state_alloc_security:
+ *      @x contains the xfrm_state being added to the Security Association
+ *      Database by the XFRM system.
+ *      @sec_ctx contains the security context information being provided by
+ *      the user-level SA generation program (e.g., setkey or racoon).
+ *      Allocate a security structure to the x->sel.security field.  The
+ *      security field is initialized to NULL when the xfrm_state is
+ *      allocated.
+ *      Return 0 if operation was successful (memory to allocate, legal context).
+ * @xfrm_state_free_security:
+ *      @x contains the xfrm_state.
+ *      Deallocate x>sel.security.
+ * @xfrm_policy_lookup:
+ *      @xp contains the xfrm_policy for which the access control is being
+ *      checked.
+ *      @sk_sid contains the sock security label that is used to authorize
+ *      access to the policy xp.
+ *      @dir contains the direction of the flow (input or output).
+ *      Check permission when a sock selects a xfrm_policy for processing
+ *      XFRMs on a packet.  The hook is called when selecting either a
+ *      per-socket policy or a generic xfrm policy.
+ *      Return 0 if permission is granted.
  *
  * Security hooks affecting all Key Management operations
  *
@@ -1237,8 +1289,18 @@ struct security_operations {
         int (*socket_getpeersec) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len);
         int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
         void (*sk_free_security) (struct sock *sk);
+        unsigned int (*sk_getsid) (struct sock *sk, struct flowi *fl, u8 dir);
 #endif  /* CONFIG_SECURITY_NETWORK */
 
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+        int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx);
+        int (*xfrm_policy_clone_security) (struct xfrm_policy *old, struct xfrm_policy *new);
+        void (*xfrm_policy_free_security) (struct xfrm_policy *xp);
+        int (*xfrm_state_alloc_security) (struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
+        void (*xfrm_state_free_security) (struct xfrm_state *x);
+        int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 sk_sid, u8 dir);
+#endif  /* CONFIG_SECURITY_NETWORK_XFRM */
+
         /* key management security hooks */
 #ifdef CONFIG_KEYS
         int (*key_alloc)(struct key *key);
@@ -2679,6 +2741,11 @@ static inline void security_sk_free(struct sock *sk)
 {
         return security_ops->sk_free_security(sk);
 }
+
+static inline unsigned int security_sk_sid(struct sock *sk, struct flowi *fl, u8 dir)
+{
+        return security_ops->sk_getsid(sk, fl, dir);
+}
 #else   /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct socket * sock,
                                                struct socket * other, 
@@ -2795,8 +2862,73 @@ static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
 static inline void security_sk_free(struct sock *sk)
 {
 }
+
+static inline unsigned int security_sk_sid(struct sock *sk, struct flowi *fl, u8 dir)
+{
+        return 0;
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return security_ops->xfrm_policy_alloc_security(xp, sec_ctx);
+}
+
+static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
+{
+        return security_ops->xfrm_policy_clone_security(old, new);
+}
+
+static inline void security_xfrm_policy_free(struct xfrm_policy *xp)
+{
+        security_ops->xfrm_policy_free_security(xp);
+}
+
+static inline int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return security_ops->xfrm_state_alloc_security(x, sec_ctx);
+}
+
+static inline void security_xfrm_state_free(struct xfrm_state *x)
+{
+        security_ops->xfrm_state_free_security(x);
+}
+
+static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
+{
+        return security_ops->xfrm_policy_lookup(xp, sk_sid, dir);
+}
+#else   /* CONFIG_SECURITY_NETWORK_XFRM */
+static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return 0;
+}
+
+static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
+{
+        return 0;
+}
+
+static inline void security_xfrm_policy_free(struct xfrm_policy *xp)
+{
+}
+
+static inline int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return 0;
+}
+
+static inline void security_xfrm_state_free(struct xfrm_state *x)
+{
+}
+
+static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
+{
+        return 0;
+}
+#endif  /* CONFIG_SECURITY_NETWORK_XFRM */
+
 #ifdef CONFIG_KEYS
 #ifdef CONFIG_SECURITY
 static inline int security_key_alloc(struct key *key)
diff --git a/include/linux/xfrm.h b/include/linux/xfrm.h
index 0fb077d68441..82fbb758e28f 100644
--- a/include/linux/xfrm.h
+++ b/include/linux/xfrm.h
@@ -27,6 +27,22 @@ struct xfrm_id
         __u8            proto;
 };
 
+struct xfrm_sec_ctx {
+        __u8    ctx_doi;
+        __u8    ctx_alg;
+        __u16   ctx_len;
+        __u32   ctx_sid;
+        char    ctx_str[0];
+};
+
+/* Security Context Domains of Interpretation */
+#define XFRM_SC_DOI_RESERVED 0
+#define XFRM_SC_DOI_LSM 1
+
+/* Security Context Algorithms */
+#define XFRM_SC_ALG_RESERVED 0
+#define XFRM_SC_ALG_SELINUX 1
+
 /* Selector, used as selector both on policy rules (SPD) and SAs. */
 
 struct xfrm_selector
@@ -146,6 +162,18 @@ enum {
 
 #define XFRM_NR_MSGTYPES (XFRM_MSG_MAX + 1 - XFRM_MSG_BASE)
 
+/*
+ * Generic LSM security context for comunicating to user space
+ * NOTE: Same format as sadb_x_sec_ctx
+ */
+struct xfrm_user_sec_ctx {
+        __u16                   len;
+        __u16                   exttype;
+        __u8                    ctx_alg;  /* LSMs: e.g., selinux == 1 */
+        __u8                    ctx_doi;
+        __u16                   ctx_len;
+};
+
 struct xfrm_user_tmpl {
         struct xfrm_id          id;
         __u16                   family;
@@ -176,6 +204,7 @@ enum xfrm_attr_type_t {
         XFRMA_TMPL,             /* 1 or more struct xfrm_user_tmpl */
         XFRMA_SA,
         XFRMA_POLICY,
+        XFRMA_SEC_CTX,          /* struct xfrm_sec_ctx */
         __XFRMA_MAX
 
 #define XFRMA_MAX (__XFRMA_MAX - 1)
diff --git a/include/net/flow.h b/include/net/flow.h
index 9a5c94b1a0ec..ec7eb86eb203 100644
--- a/include/net/flow.h
+++ b/include/net/flow.h
@@ -84,11 +84,12 @@ struct flowi {
 #define FLOW_DIR_OUT    1
 #define FLOW_DIR_FWD    2
 
-typedef void (*flow_resolve_t)(struct flowi *key, u16 family, u8 dir,
+struct sock;
+typedef void (*flow_resolve_t)(struct flowi *key, u32 sk_sid, u16 family, u8 dir,
                                void **objp, atomic_t **obj_refp);
 
-extern void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
-                               flow_resolve_t resolver);
+extern void *flow_cache_lookup(struct flowi *key, u32 sk_sid, u16 family, u8 dir,
+                               flow_resolve_t resolver);
 extern void flow_cache_flush(void);
 extern atomic_t flow_cache_genid;
 
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 1cdb87912137..487abca3ca6f 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -144,6 +144,9 @@ struct xfrm_state
          * transformer. */
         struct xfrm_type        *type;
 
+        /* Security context */
+        struct xfrm_sec_ctx     *security;
+
         /* Private data of this transformer, format is opaque,
          * interpreted by xfrm_type methods. */
         void                    *data;
@@ -298,6 +301,7 @@ struct xfrm_policy
         __u8                    flags;
         __u8                    dead;
         __u8                    xfrm_nr;
+        struct xfrm_sec_ctx     *security;
         struct xfrm_tmpl        xfrm_vec[XFRM_MAX_DEPTH];
 };
 
@@ -510,6 +514,25 @@ xfrm_selector_match(struct xfrm_selector *sel, struct flowi *fl,
         return 0;
 }
 
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+/*      If neither has a context --> match
+ *      Otherwise, both must have a context and the sids, doi, alg must match
+ */
+static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
+{
+        return ((!s1 && !s2) ||
+                (s1 && s2 &&
+                 (s1->ctx_sid == s2->ctx_sid) &&
+                 (s1->ctx_doi == s2->ctx_doi) &&
+                 (s1->ctx_alg == s2->ctx_alg)));
+}
+#else
+static inline int xfrm_sec_ctx_match(struct xfrm_sec_ctx *s1, struct xfrm_sec_ctx *s2)
+{
+        return 1;
+}
+#endif
+
 /* A struct encoding bundle of transformations to apply to some set of flow.
  *
  * dst->child points to the next element of bundle.
@@ -878,8 +901,8 @@ static inline int xfrm_dst_lookup(struct xfrm_dst **dst, struct flowi *fl, unsig
 struct xfrm_policy *xfrm_policy_alloc(gfp_t gfp);
 extern int xfrm_policy_walk(int (*func)(struct xfrm_policy *, int, int, void*), void *);
 int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl);
-struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
-                                      int delete);
+struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel,
+                                          struct xfrm_sec_ctx *ctx, int delete);
 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete);
 void xfrm_policy_flush(void);
 u32 xfrm_get_acqseq(void);
diff --git a/net/core/flow.c b/net/core/flow.c
index 7e95b39de9fd..c4f25385029f 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -23,6 +23,7 @@
 #include <net/flow.h>
 #include <asm/atomic.h>
 #include <asm/semaphore.h>
+#include <linux/security.h>
 
 struct flow_cache_entry {
         struct flow_cache_entry *next;
@@ -30,6 +31,7 @@ struct flow_cache_entry {
         u8                      dir;
         struct flowi            key;
         u32                     genid;
+        u32                     sk_sid;
         void                    *object;
         atomic_t                *object_ref;
 };
@@ -162,7 +164,7 @@ static int flow_key_compare(struct flowi *key1, struct flowi *key2)
         return 0;
 }
 
-void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
+void *flow_cache_lookup(struct flowi *key, u32 sk_sid, u16 family, u8 dir,
                         flow_resolve_t resolver)
 {
         struct flow_cache_entry *fle, **head;
@@ -186,6 +188,7 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
         for (fle = *head; fle; fle = fle->next) {
                 if (fle->family == family &&
                     fle->dir == dir &&
+                    fle->sk_sid == sk_sid &&
                     flow_key_compare(key, &fle->key) == 0) {
                         if (fle->genid == atomic_read(&flow_cache_genid)) {
                                 void *ret = fle->object;
@@ -210,6 +213,7 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
                         *head = fle;
                         fle->family = family;
                         fle->dir = dir;
+                        fle->sk_sid = sk_sid;
                         memcpy(&fle->key, key, sizeof(*key));
                         fle->object = NULL;
                         flow_count(cpu)++;
@@ -221,7 +225,7 @@ nocache:
                 void *obj;
                 atomic_t *obj_ref;
 
-                resolver(key, family, dir, &obj, &obj_ref);
+                resolver(key, sk_sid, family, dir, &obj, &obj_ref);
 
                 if (fle) {
                         fle->genid = atomic_read(&flow_cache_genid);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 39031684b65c..d32f7791f1e4 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -336,6 +336,7 @@ static u8 sadb_ext_min_len[] = {
         [SADB_X_EXT_NAT_T_SPORT]        = (u8) sizeof(struct sadb_x_nat_t_port),
         [SADB_X_EXT_NAT_T_DPORT]        = (u8) sizeof(struct sadb_x_nat_t_port),
         [SADB_X_EXT_NAT_T_OA]           = (u8) sizeof(struct sadb_address),
+        [SADB_X_EXT_SEC_CTX]            = (u8) sizeof(struct sadb_x_sec_ctx),
 };
 
 /* Verify sadb_address_{len,prefixlen} against sa_family.  */
@@ -383,6 +384,55 @@ static int verify_address_len(void *p)
         return 0;
 }
 
+static inline int pfkey_sec_ctx_len(struct sadb_x_sec_ctx *sec_ctx)
+{
+        int len = 0;
+
+        len += sizeof(struct sadb_x_sec_ctx);
+        len += sec_ctx->sadb_x_ctx_len;
+        len += sizeof(uint64_t) - 1;
+        len /= sizeof(uint64_t);
+
+        return len;
+}
+
+static inline int verify_sec_ctx_len(void *p)
+{
+        struct sadb_x_sec_ctx *sec_ctx = (struct sadb_x_sec_ctx *)p;
+        int len;
+
+        if (sec_ctx->sadb_x_ctx_len > PAGE_SIZE)
+                return -EINVAL;
+
+        len = pfkey_sec_ctx_len(sec_ctx);
+
+        if (sec_ctx->sadb_x_sec_len != len)
+                return -EINVAL;
+
+        return 0;
+}
+
+static inline struct xfrm_user_sec_ctx *pfkey_sadb2xfrm_user_sec_ctx(struct sadb_x_sec_ctx *sec_ctx)
+{
+        struct xfrm_user_sec_ctx *uctx = NULL;
+        int ctx_size = sec_ctx->sadb_x_ctx_len;
+
+        uctx = kmalloc((sizeof(*uctx)+ctx_size), GFP_KERNEL);
+
+        if (!uctx)
+                return NULL;
+
+        uctx->len = pfkey_sec_ctx_len(sec_ctx);
+        uctx->exttype = sec_ctx->sadb_x_sec_exttype;
+        uctx->ctx_doi = sec_ctx->sadb_x_ctx_doi;
+        uctx->ctx_alg = sec_ctx->sadb_x_ctx_alg;
+        uctx->ctx_len = sec_ctx->sadb_x_ctx_len;
+        memcpy(uctx + 1, sec_ctx + 1,
+               uctx->ctx_len);
+
+        return uctx;
+}
+
 static int present_and_same_family(struct sadb_address *src,
                                    struct sadb_address *dst)
 {
@@ -438,6 +488,10 @@ static int parse_exthdrs(struct sk_buff *skb, struct sadb_msg *hdr, void **ext_h
                                 if (verify_address_len(p))
                                         return -EINVAL;
                         }                               
+                        if (ext_type == SADB_X_EXT_SEC_CTX) {
+                                if (verify_sec_ctx_len(p))
+                                        return -EINVAL;
+                        }
                         ext_hdrs[ext_type-1] = p;
                 }
                 p   += ext_len;
@@ -586,6 +640,9 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
         struct sadb_key *key;
         struct sadb_x_sa2 *sa2;
         struct sockaddr_in *sin;
+        struct sadb_x_sec_ctx *sec_ctx;
+        struct xfrm_sec_ctx *xfrm_ctx;
+        int ctx_size = 0;
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         struct sockaddr_in6 *sin6;
 #endif
@@ -609,6 +666,12 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
                         sizeof(struct sadb_address)*2 + 
                                 sockaddr_size*2 +
                                         sizeof(struct sadb_x_sa2);
+
+        if ((xfrm_ctx = x->security)) {
+                ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
+                size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
+        }
+
         /* identity & sensitivity */
 
         if ((x->props.family == AF_INET &&
@@ -899,6 +962,20 @@ static struct sk_buff * pfkey_xfrm_state2msg(struct xfrm_state *x, int add_keys,
                 n_port->sadb_x_nat_t_port_reserved = 0;
         }
 
+        /* security context */
+        if (xfrm_ctx) {
+                sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
+                                sizeof(struct sadb_x_sec_ctx) + ctx_size);
+                sec_ctx->sadb_x_sec_len =
+                  (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
+                sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
+                sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
+                sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
+                sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
+                memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
+                       xfrm_ctx->ctx_len);
+        }
+
         return skb;
 }
 
@@ -909,6 +986,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
         struct sadb_lifetime *lifetime;
         struct sadb_sa *sa;
         struct sadb_key *key;
+        struct sadb_x_sec_ctx *sec_ctx;
         uint16_t proto;
         int err;
         
@@ -993,6 +1071,21 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct sadb_msg *hdr,
                 x->lft.soft_add_expires_seconds = lifetime->sadb_lifetime_addtime;
                 x->lft.soft_use_expires_seconds = lifetime->sadb_lifetime_usetime;
         }
+
+        sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
+        if (sec_ctx != NULL) {
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+
+                if (!uctx)
+                        goto out;
+
+                err = security_xfrm_state_alloc(x, uctx);
+                kfree(uctx);
+
+                if (err)
+                        goto out;
+        }
+
         key = (struct sadb_key*) ext_hdrs[SADB_EXT_KEY_AUTH-1];
         if (sa->sadb_sa_auth) {
                 int keysize = 0;
@@ -1720,6 +1813,18 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
         return 0;
 }
 
+static inline int pfkey_xfrm_policy2sec_ctx_size(struct xfrm_policy *xp)
+{
+  struct xfrm_sec_ctx *xfrm_ctx = xp->security;
+
+        if (xfrm_ctx) {
+                int len = sizeof(struct sadb_x_sec_ctx);
+                len += xfrm_ctx->ctx_len;
+                return PFKEY_ALIGN8(len);
+        }
+        return 0;
+}
+
 static int pfkey_xfrm_policy2msg_size(struct xfrm_policy *xp)
 {
         int sockaddr_size = pfkey_sockaddr_size(xp->family);
@@ -1733,7 +1838,8 @@ static int pfkey_xfrm_policy2msg_size(struct xfrm_policy *xp)
                 (sockaddr_size * 2) +
                 sizeof(struct sadb_x_policy) +
                 (xp->xfrm_nr * (sizeof(struct sadb_x_ipsecrequest) +
-                                (socklen * 2)));
+                                (socklen * 2))) +
+                pfkey_xfrm_policy2sec_ctx_size(xp);
 }
 
 static struct sk_buff * pfkey_xfrm_policy2msg_prep(struct xfrm_policy *xp)
@@ -1757,6 +1863,8 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
         struct sadb_lifetime *lifetime;
         struct sadb_x_policy *pol;
         struct sockaddr_in   *sin;
+        struct sadb_x_sec_ctx *sec_ctx;
+        struct xfrm_sec_ctx *xfrm_ctx;
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
         struct sockaddr_in6  *sin6;
 #endif
@@ -1941,6 +2049,21 @@ static void pfkey_xfrm_policy2msg(struct sk_buff *skb, struct xfrm_policy *xp, i
                         }
                 }
         }
+
+        /* security context */
+        if ((xfrm_ctx = xp->security)) {
+                int ctx_size = pfkey_xfrm_policy2sec_ctx_size(xp);
+
+                sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb, ctx_size);
+                sec_ctx->sadb_x_sec_len = ctx_size / sizeof(uint64_t);
+                sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
+                sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
+                sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
+                sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
+                memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
+                       xfrm_ctx->ctx_len);
+        }
+
         hdr->sadb_msg_len = size / sizeof(uint64_t);
         hdr->sadb_msg_reserved = atomic_read(&xp->refcnt);
 }
@@ -1976,12 +2099,13 @@ out:
 
 static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
-        int err;
+        int err = 0;
         struct sadb_lifetime *lifetime;
         struct sadb_address *sa;
         struct sadb_x_policy *pol;
         struct xfrm_policy *xp;
         struct km_event c;
+        struct sadb_x_sec_ctx *sec_ctx;
 
         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
@@ -2028,6 +2152,22 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         if (xp->selector.dport)
                 xp->selector.dport_mask = ~0;
 
+        sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
+        if (sec_ctx != NULL) {
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+
+                if (!uctx) {
+                        err = -ENOBUFS;
+                        goto out;
+                }
+
+                err = security_xfrm_policy_alloc(xp, uctx);
+                kfree(uctx);
+
+                if (err)
+                        goto out;
+        }
+
         xp->lft.soft_byte_limit = XFRM_INF;
         xp->lft.hard_byte_limit = XFRM_INF;
         xp->lft.soft_packet_limit = XFRM_INF;
@@ -2051,10 +2191,9 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
 
         err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
                                  hdr->sadb_msg_type != SADB_X_SPDUPDATE);
-        if (err) {
-                kfree(xp);
-                return err;
-        }
+
+        if (err)
+                goto out;
 
         if (hdr->sadb_msg_type == SADB_X_SPDUPDATE)
                 c.event = XFRM_MSG_UPDPOLICY;
@@ -2069,6 +2208,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
         return 0;
 
 out:
+        security_xfrm_policy_free(xp);
         kfree(xp);
         return err;
 }
@@ -2078,9 +2218,10 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         int err;
         struct sadb_address *sa;
         struct sadb_x_policy *pol;
-        struct xfrm_policy *xp;
+        struct xfrm_policy *xp, tmp;
         struct xfrm_selector sel;
         struct km_event c;
+        struct sadb_x_sec_ctx *sec_ctx;
 
         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
@@ -2109,7 +2250,24 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         if (sel.dport)
                 sel.dport_mask = ~0;
 
-        xp = xfrm_policy_bysel(pol->sadb_x_policy_dir-1, &sel, 1);
+        sec_ctx = (struct sadb_x_sec_ctx *) ext_hdrs[SADB_X_EXT_SEC_CTX-1];
+        memset(&tmp, 0, sizeof(struct xfrm_policy));
+
+        if (sec_ctx != NULL) {
+                struct xfrm_user_sec_ctx *uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+
+                if (!uctx)
+                        return -ENOMEM;
+
+                err = security_xfrm_policy_alloc(&tmp, uctx);
+                kfree(uctx);
+
+                if (err)
+                        return err;
+        }
+
+        xp = xfrm_policy_bysel_ctx(pol->sadb_x_policy_dir-1, &sel, tmp.security, 1);
+        security_xfrm_policy_free(&tmp);
         if (xp == NULL)
                 return -ENOENT;
 
@@ -2660,6 +2818,7 @@ static struct xfrm_policy *pfkey_compile_policy(u16 family, int opt,
 {
         struct xfrm_policy *xp;
         struct sadb_x_policy *pol = (struct sadb_x_policy*)data;
+        struct sadb_x_sec_ctx *sec_ctx;
 
         switch (family) {
         case AF_INET:
@@ -2709,10 +2868,32 @@ static struct xfrm_policy *pfkey_compile_policy(u16 family, int opt,
             (*dir = parse_ipsecrequests(xp, pol)) < 0)
                 goto out;
 
+        /* security context too */
+        if (len >= (pol->sadb_x_policy_len*8 +
+            sizeof(struct sadb_x_sec_ctx))) {
+                char *p = (char *)pol;
+                struct xfrm_user_sec_ctx *uctx;
+
+                p += pol->sadb_x_policy_len*8;
+                sec_ctx = (struct sadb_x_sec_ctx *)p;
+                if (len < pol->sadb_x_policy_len*8 +
+                    sec_ctx->sadb_x_sec_len)
+                        goto out;
+                if ((*dir = verify_sec_ctx_len(p)))
+                        goto out;
+                uctx = pfkey_sadb2xfrm_user_sec_ctx(sec_ctx);
+                *dir = security_xfrm_policy_alloc(xp, uctx);
+                kfree(uctx);
+
+                if (*dir)
+                        goto out;
+        }
+
         *dir = pol->sadb_x_policy_dir-1;
         return xp;
 
 out:
+        security_xfrm_policy_free(xp);
         kfree(xp);
         return NULL;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d19e274b9c4a..64a447375fdb 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -10,7 +10,7 @@
  *      YOSHIFUJI Hideaki
  *              Split up af-specific portion
  *      Derek Atkins <derek@ihtfp.com>          Add the post_input processor
- *      
+ *
  */
 
 #include <asm/bug.h>
@@ -256,6 +256,7 @@ void __xfrm_policy_destroy(struct xfrm_policy *policy)
         if (del_timer(&policy->timer))
                 BUG();
 
+        security_xfrm_policy_free(policy);
         kfree(policy);
 }
 EXPORT_SYMBOL(__xfrm_policy_destroy);
@@ -350,7 +351,8 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 
         write_lock_bh(&xfrm_policy_lock);
         for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL;) {
-                if (!delpol && memcmp(&policy->selector, &pol->selector, sizeof(pol->selector)) == 0) {
+                if (!delpol && memcmp(&policy->selector, &pol->selector, sizeof(pol->selector)) == 0 &&
+                    xfrm_sec_ctx_match(pol->security, policy->security)) {
                         if (excl) {
                                 write_unlock_bh(&xfrm_policy_lock);
                                 return -EEXIST;
@@ -416,14 +418,15 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
 }
 EXPORT_SYMBOL(xfrm_policy_insert);
 
-struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
-                                      int delete)
+struct xfrm_policy *xfrm_policy_bysel_ctx(int dir, struct xfrm_selector *sel,
+                                          struct xfrm_sec_ctx *ctx, int delete)
 {
         struct xfrm_policy *pol, **p;
 
         write_lock_bh(&xfrm_policy_lock);
         for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL; p = &pol->next) {
-                if (memcmp(sel, &pol->selector, sizeof(*sel)) == 0) {
+                if ((memcmp(sel, &pol->selector, sizeof(*sel)) == 0) &&
+                    (xfrm_sec_ctx_match(ctx, pol->security))) {
                         xfrm_pol_hold(pol);
                         if (delete)
                                 *p = pol->next;
@@ -438,7 +441,7 @@ struct xfrm_policy *xfrm_policy_bysel(int dir, struct xfrm_selector *sel,
         }
         return pol;
 }
-EXPORT_SYMBOL(xfrm_policy_bysel);
+EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
 
 struct xfrm_policy *xfrm_policy_byid(int dir, u32 id, int delete)
 {
@@ -519,7 +522,7 @@ EXPORT_SYMBOL(xfrm_policy_walk);
 
 /* Find policy to apply to this flow. */
 
-static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
+static void xfrm_policy_lookup(struct flowi *fl, u32 sk_sid, u16 family, u8 dir,
                                void **objp, atomic_t **obj_refp)
 {
         struct xfrm_policy *pol;
@@ -533,9 +536,12 @@ static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
                         continue;
 
                 match = xfrm_selector_match(sel, fl, family);
+
                 if (match) {
-                        xfrm_pol_hold(pol);
-                        break;
+                        if (!security_xfrm_policy_lookup(pol, sk_sid, dir)) {
+                                xfrm_pol_hold(pol);
+                                break;
+                        }
                 }
         }
         read_unlock_bh(&xfrm_policy_lock);
@@ -543,15 +549,37 @@ static void xfrm_policy_lookup(struct flowi *fl, u16 family, u8 dir,
                 *obj_refp = &pol->refcnt;
 }
 
-static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl)
+static inline int policy_to_flow_dir(int dir)
+{
+        if (XFRM_POLICY_IN == FLOW_DIR_IN &&
+            XFRM_POLICY_OUT == FLOW_DIR_OUT &&
+            XFRM_POLICY_FWD == FLOW_DIR_FWD)
+                return dir;
+        switch (dir) {
+        default:
+        case XFRM_POLICY_IN:
+                return FLOW_DIR_IN;
+        case XFRM_POLICY_OUT:
+                return FLOW_DIR_OUT;
+        case XFRM_POLICY_FWD:
+                return FLOW_DIR_FWD;
+        };
+}
+
+static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struct flowi *fl, u32 sk_sid)
 {
         struct xfrm_policy *pol;
 
         read_lock_bh(&xfrm_policy_lock);
         if ((pol = sk->sk_policy[dir]) != NULL) {
-                int match = xfrm_selector_match(&pol->selector, fl,
+                int match = xfrm_selector_match(&pol->selector, fl,
                                                 sk->sk_family);
+                int err = 0;
+
                 if (match)
+                  err = security_xfrm_policy_lookup(pol, sk_sid, policy_to_flow_dir(dir));
+
+                if (match && !err)
                         xfrm_pol_hold(pol);
                 else
                         pol = NULL;
@@ -624,6 +652,10 @@ static struct xfrm_policy *clone_policy(struct xfrm_policy *old, int dir)
 
         if (newp) {
                 newp->selector = old->selector;
+                if (security_xfrm_policy_clone(old, newp)) {
+                        kfree(newp);
+                        return NULL;  /* ENOMEM */
+                }
                 newp->lft = old->lft;
                 newp->curlft = old->curlft;
                 newp->action = old->action;
@@ -735,22 +767,6 @@ xfrm_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int nx,
         return err;
 }
 
-static inline int policy_to_flow_dir(int dir)
-{
-        if (XFRM_POLICY_IN == FLOW_DIR_IN &&
-            XFRM_POLICY_OUT == FLOW_DIR_OUT &&
-            XFRM_POLICY_FWD == FLOW_DIR_FWD)
-                return dir;
-        switch (dir) {
-        default:
-        case XFRM_POLICY_IN:
-                return FLOW_DIR_IN;
-        case XFRM_POLICY_OUT:
-                return FLOW_DIR_OUT;
-        case XFRM_POLICY_FWD:
-                return FLOW_DIR_FWD;
-        };
-}
 
 static int stale_bundle(struct dst_entry *dst);
 
@@ -769,19 +785,20 @@ int xfrm_lookup(struct dst_entry **dst_p, struct flowi *fl,
         int err;
         u32 genid;
         u16 family = dst_orig->ops->family;
+        u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
+        u32 sk_sid = security_sk_sid(sk, fl, dir);
 restart:
         genid = atomic_read(&flow_cache_genid);
         policy = NULL;
         if (sk && sk->sk_policy[1])
-                policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+                policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, sk_sid);
 
         if (!policy) {
                 /* To accelerate a bit...  */
                 if ((dst_orig->flags & DST_NOXFRM) || !xfrm_policy_list[XFRM_POLICY_OUT])
                         return 0;
 
-                policy = flow_cache_lookup(fl, family,
-                                           policy_to_flow_dir(XFRM_POLICY_OUT),
+                policy = flow_cache_lookup(fl, sk_sid, family, dir,
                                            xfrm_policy_lookup);
         }
 
@@ -962,16 +979,20 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
 {
         struct xfrm_policy *pol;
         struct flowi fl;
+        u8 fl_dir = policy_to_flow_dir(dir);
+        u32 sk_sid;
 
         if (_decode_session(skb, &fl, family) < 0)
                 return 0;
 
+        sk_sid = security_sk_sid(sk, &fl, fl_dir);
+
         /* First, check used SA against their selectors. */
         if (skb->sp) {
                 int i;
 
                 for (i=skb->sp->len-1; i>=0; i--) {
-                  struct sec_decap_state *xvec = &(skb->sp->x[i]);
+                        struct sec_decap_state *xvec = &(skb->sp->x[i]);
                         if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
                                 return 0;
 
@@ -986,11 +1007,10 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
 
         pol = NULL;
         if (sk && sk->sk_policy[dir])
-                pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+                pol = xfrm_sk_policy_lookup(sk, dir, &fl, sk_sid);
 
         if (!pol)
-                pol = flow_cache_lookup(&fl, family,
-                                        policy_to_flow_dir(dir),
+                pol = flow_cache_lookup(&fl, sk_sid, family, fl_dir,
                                         xfrm_policy_lookup);
 
         if (!pol)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 479effc97666..e12d0be5f976 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -10,7 +10,7 @@
  *              Split up af-specific functions
  *      Derek Atkins <derek@ihtfp.com>
  *              Add UDP Encapsulation
- *      
+ *
  */
 
 #include <linux/workqueue.h>
@@ -70,6 +70,7 @@ static void xfrm_state_gc_destroy(struct xfrm_state *x)
                 x->type->destructor(x);
                 xfrm_put_type(x->type);
         }
+        security_xfrm_state_free(x);
         kfree(x);
 }
 
@@ -343,7 +344,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                               selector.
                          */
                         if (x->km.state == XFRM_STATE_VALID) {
-                                if (!xfrm_selector_match(&x->sel, fl, family))
+                                if (!xfrm_selector_match(&x->sel, fl, family) ||
+                                    !xfrm_sec_ctx_match(pol->security, x->security))
                                         continue;
                                 if (!best ||
                                     best->km.dying > x->km.dying ||
@@ -354,7 +356,8 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                                 acquire_in_progress = 1;
                         } else if (x->km.state == XFRM_STATE_ERROR ||
                                    x->km.state == XFRM_STATE_EXPIRED) {
-                                if (xfrm_selector_match(&x->sel, fl, family))
+                                if (xfrm_selector_match(&x->sel, fl, family) &&
+                                    xfrm_sec_ctx_match(pol->security, x->security))
                                         error = -ESRCH;
                         }
                 }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 0cdd9a07e043..92e2b804c606 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -7,7 +7,7 @@
  *      Kazunori MIYAZAWA @USAGI
  *      Kunihiro Ishiguro <kunihiro@ipinfusion.com>
  *              IPv6 support
- *      
+ *
  */
 
 #include <linux/module.h>
@@ -88,6 +88,34 @@ static int verify_encap_tmpl(struct rtattr **xfrma)
         return 0;
 }
 
+
+static inline int verify_sec_ctx_len(struct rtattr **xfrma)
+{
+        struct rtattr *rt = xfrma[XFRMA_SEC_CTX - 1];
+        struct xfrm_user_sec_ctx *uctx;
+        int len = 0;
+
+        if (!rt)
+                return 0;
+
+        if (rt->rta_len < sizeof(*uctx))
+                return -EINVAL;
+
+        uctx = RTA_DATA(rt);
+
+        if (uctx->ctx_len > PAGE_SIZE)
+                return -EINVAL;
+
+        len += sizeof(struct xfrm_user_sec_ctx);
+        len += uctx->ctx_len;
+
+        if (uctx->len != len)
+                return -EINVAL;
+
+        return 0;
+}
+
+
 static int verify_newsa_info(struct xfrm_usersa_info *p,
                              struct rtattr **xfrma)
 {
@@ -145,6 +173,8 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
                 goto out;
         if ((err = verify_encap_tmpl(xfrma)))
                 goto out;
+        if ((err = verify_sec_ctx_len(xfrma)))
+                goto out;
 
         err = -EINVAL;
         switch (p->mode) {
@@ -209,6 +239,30 @@ static int attach_encap_tmpl(struct xfrm_encap_tmpl **encapp, struct rtattr *u_a
         return 0;
 }
 
+
+static inline int xfrm_user_sec_ctx_size(struct xfrm_policy *xp)
+{
+        struct xfrm_sec_ctx *xfrm_ctx = xp->security;
+        int len = 0;
+
+        if (xfrm_ctx) {
+                len += sizeof(struct xfrm_user_sec_ctx);
+                len += xfrm_ctx->ctx_len;
+        }
+        return len;
+}
+
+static int attach_sec_ctx(struct xfrm_state *x, struct rtattr *u_arg)
+{
+        struct xfrm_user_sec_ctx *uctx;
+
+        if (!u_arg)
+                return 0;
+
+        uctx = RTA_DATA(u_arg);
+        return security_xfrm_state_alloc(x, uctx);
+}
+
 static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *p)
 {
         memcpy(&x->id, &p->id, sizeof(x->id));
@@ -253,6 +307,9 @@ static struct xfrm_state *xfrm_state_construct(struct xfrm_usersa_info *p,
         if (err)
                 goto error;
 
+        if ((err = attach_sec_ctx(x, xfrma[XFRMA_SEC_CTX-1])))
+                goto error;
+
         x->km.seq = p->seq;
 
         return x;
@@ -272,11 +329,11 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfrma)
         int err;
         struct km_event c;
 
-        err = verify_newsa_info(p, (struct rtattr **) xfrma);
+        err = verify_newsa_info(p, (struct rtattr **)xfrma);
         if (err)
                 return err;
 
-        x = xfrm_state_construct(p, (struct rtattr **) xfrma, &err);
+        x = xfrm_state_construct(p, (struct rtattr **)xfrma, &err);
         if (!x)
                 return err;
 
@@ -390,6 +447,19 @@ static int dump_one_state(struct xfrm_state *x, int count, void *ptr)
         if (x->encap)
                 RTA_PUT(skb, XFRMA_ENCAP, sizeof(*x->encap), x->encap);
 
+        if (x->security) {
+                int ctx_size = sizeof(struct xfrm_sec_ctx) +
+                                x->security->ctx_len;
+                struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
+                struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+                uctx->exttype = XFRMA_SEC_CTX;
+                uctx->len = ctx_size;
+                uctx->ctx_doi = x->security->ctx_doi;
+                uctx->ctx_alg = x->security->ctx_alg;
+                uctx->ctx_len = x->security->ctx_len;
+                memcpy(uctx + 1, x->security->ctx_str, x->security->ctx_len);
+        }
         nlh->nlmsg_len = skb->tail - b;
 out:
         sp->this_idx++;
@@ -603,6 +673,18 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)
         return verify_policy_dir(p->dir);
 }
 
+static int copy_from_user_sec_ctx(struct xfrm_policy *pol, struct rtattr **xfrma)
+{
+        struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
+        struct xfrm_user_sec_ctx *uctx;
+
+        if (!rt)
+                return 0;
+
+        uctx = RTA_DATA(rt);
+        return security_xfrm_policy_alloc(pol, uctx);
+}
+
 static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
                            int nr)
 {
@@ -681,7 +763,10 @@ static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p,
         }
 
         copy_from_user_policy(xp, p);
-        err = copy_from_user_tmpl(xp, xfrma);
+
+        if (!(err = copy_from_user_tmpl(xp, xfrma)))
+                err = copy_from_user_sec_ctx(xp, xfrma);
+
         if (err) {
                 *errp = err;
                 kfree(xp);
@@ -702,8 +787,11 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
         err = verify_newpolicy_info(p);
         if (err)
                 return err;
+        err = verify_sec_ctx_len((struct rtattr **)xfrma);
+        if (err)
+                return err;
 
-        xp = xfrm_policy_construct(p, (struct rtattr **) xfrma, &err);
+        xp = xfrm_policy_construct(p, (struct rtattr **)xfrma, &err);
         if (!xp)
                 return err;
 
@@ -761,6 +849,27 @@ rtattr_failure:
         return -1;
 }
 
+static int copy_to_user_sec_ctx(struct xfrm_policy *xp, struct sk_buff *skb)
+{
+        if (xp->security) {
+                int ctx_size = sizeof(struct xfrm_sec_ctx) +
+                                xp->security->ctx_len;
+                struct rtattr *rt = __RTA_PUT(skb, XFRMA_SEC_CTX, ctx_size);
+                struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+                uctx->exttype = XFRMA_SEC_CTX;
+                uctx->len = ctx_size;
+                uctx->ctx_doi = xp->security->ctx_doi;
+                uctx->ctx_alg = xp->security->ctx_alg;
+                uctx->ctx_len = xp->security->ctx_len;
+                memcpy(uctx + 1, xp->security->ctx_str, xp->security->ctx_len);
+        }
+        return 0;
+
+ rtattr_failure:
+        return -1;
+}
+
 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
 {
         struct xfrm_dump_info *sp = ptr;
@@ -782,6 +891,8 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
         copy_to_user_policy(xp, p, dir);
         if (copy_to_user_tmpl(xp, skb) < 0)
                 goto nlmsg_failure;
+        if (copy_to_user_sec_ctx(xp, skb))
+                goto nlmsg_failure;
 
         nlh->nlmsg_len = skb->tail - b;
 out:
@@ -852,8 +963,25 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
 
         if (p->index)
                 xp = xfrm_policy_byid(p->dir, p->index, delete);
-        else
-                xp = xfrm_policy_bysel(p->dir, &p->sel, delete);
+        else {
+                struct rtattr **rtattrs = (struct rtattr **)xfrma;
+                struct rtattr *rt = rtattrs[XFRMA_SEC_CTX-1];
+                struct xfrm_policy tmp;
+
+                err = verify_sec_ctx_len(rtattrs);
+                if (err)
+                        return err;
+
+                memset(&tmp, 0, sizeof(struct xfrm_policy));
+                if (rt) {
+                        struct xfrm_user_sec_ctx *uctx = RTA_DATA(rt);
+
+                        if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
+                                return err;
+                }
+                xp = xfrm_policy_bysel_ctx(p->dir, &p->sel, tmp.security, delete);
+                security_xfrm_policy_free(&tmp);
+        }
         if (xp == NULL)
                 return -ENOENT;
 
@@ -1224,6 +1352,8 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
 
         if (copy_to_user_tmpl(xp, skb) < 0)
                 goto nlmsg_failure;
+        if (copy_to_user_sec_ctx(xp, skb))
+                goto nlmsg_failure;
 
         nlh->nlmsg_len = skb->tail - b;
         return skb->len;
@@ -1241,6 +1371,7 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_acquire));
+        len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
@@ -1324,6 +1455,8 @@ static int build_polexpire(struct sk_buff *skb, struct xfrm_policy *xp,
         copy_to_user_policy(xp, &upe->pol, dir);
         if (copy_to_user_tmpl(xp, skb) < 0)
                 goto nlmsg_failure;
+        if (copy_to_user_sec_ctx(xp, skb))
+                goto nlmsg_failure;
         upe->hard = !!hard;
 
         nlh->nlmsg_len = skb->tail - b;
@@ -1341,6 +1474,7 @@ static int xfrm_exp_policy_notify(struct xfrm_policy *xp, int dir, struct km_eve
 
         len = RTA_SPACE(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
         len += NLMSG_SPACE(sizeof(struct xfrm_user_polexpire));
+        len += RTA_SPACE(xfrm_user_sec_ctx_size(xp));
         skb = alloc_skb(len, GFP_ATOMIC);
         if (skb == NULL)
                 return -ENOMEM;
diff --git a/security/Kconfig b/security/Kconfig
index 64d3f1e9ca85..34f593410d57 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -54,6 +54,19 @@ config SECURITY_NETWORK
           implement socket and networking access controls.
           If you are unsure how to answer this question, answer N.
 
+config SECURITY_NETWORK_XFRM
+        bool "XFRM (IPSec) Networking Security Hooks"
+        depends on XFRM && SECURITY_NETWORK
+        help
+          This enables the XFRM (IPSec) networking security hooks.
+          If enabled, a security module can use these hooks to
+          implement per-packet access controls based on labels
+          derived from IPSec policy.  Non-IPSec communications are
+          designated as unlabelled, and only sockets authorized
+          to communicate unlabelled data can send without using
+          IPSec.
+          If you are unsure how to answer this question, answer N.
+
 config SECURITY_CAPABILITIES
         tristate "Default Linux Capabilities"
         depends on SECURITY
diff --git a/security/dummy.c b/security/dummy.c
index 3ca5f2b828a0..a15c54709fde 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -776,8 +776,42 @@ static inline int dummy_sk_alloc_security (struct sock *sk, int family, gfp_t pr
 static inline void dummy_sk_free_security (struct sock *sk)
 {
 }
+
+static unsigned int dummy_sk_getsid(struct sock *sk, struct flowi *fl, u8 dir)
+{
+        return 0;
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 
+#ifdef CONFIG_SECURITY_NETWORK_XFRM
+static int dummy_xfrm_policy_alloc_security(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return 0;
+}
+
+static inline int dummy_xfrm_policy_clone_security(struct xfrm_policy *old, struct xfrm_policy *new)
+{
+        return 0;
+}
+
+static void dummy_xfrm_policy_free_security(struct xfrm_policy *xp)
+{
+}
+
+static int dummy_xfrm_state_alloc_security(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx)
+{
+        return 0;
+}
+
+static void dummy_xfrm_state_free_security(struct xfrm_state *x)
+{
+}
+
+static int dummy_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid, u8 dir)
+{
+        return 0;
+}
+#endif /* CONFIG_SECURITY_NETWORK_XFRM */
 static int dummy_register_security (const char *name, struct security_operations *ops)
 {
         return -EINVAL;
@@ -970,7 +1004,16 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, socket_getpeersec);
         set_to_dummy_if_null(ops, sk_alloc_security);
         set_to_dummy_if_null(ops, sk_free_security);
-#endif  /* CONFIG_SECURITY_NETWORK */
+        set_to_dummy_if_null(ops, sk_getsid);
+ #endif /* CONFIG_SECURITY_NETWORK */
+#ifdef  CONFIG_SECURITY_NETWORK_XFRM
+        set_to_dummy_if_null(ops, xfrm_policy_alloc_security);
+        set_to_dummy_if_null(ops, xfrm_policy_clone_security);
+        set_to_dummy_if_null(ops, xfrm_policy_free_security);
+        set_to_dummy_if_null(ops, xfrm_state_alloc_security);
+        set_to_dummy_if_null(ops, xfrm_state_free_security);
+        set_to_dummy_if_null(ops, xfrm_policy_lookup);
+#endif  /* CONFIG_SECURITY_NETWORK_XFRM */
 #ifdef CONFIG_KEYS
         set_to_dummy_if_null(ops, key_alloc);
         set_to_dummy_if_null(ops, key_free);