1 files changed, 25 insertions, 31 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index b200b9856f32..83cdefae9931 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -826,6 +826,8 @@ struct request_sock;
  *      Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
  * @inet_csk_clone:
  *      Sets the new child socket's sid to the openreq sid.
+ * @inet_conn_established:
+ *     Sets the connection's peersid to the secmark on skb.
  * @req_classify_flow:
  *      Sets the flow's sid to the openreq sid.
  *
@@ -836,10 +838,8 @@ struct request_sock;
  *      used by the XFRM system.
  *      @sec_ctx contains the security context information being provided by
  *      the user-level policy update program (e.g., setkey).
- *      @sk refers to the sock from which to derive the security context.
  *      Allocate a security structure to the xp->security field; the security
- *      field is initialized to NULL when the xfrm_policy is allocated. Only
- *      one of sec_ctx or sock can be specified.
+ *      field is initialized to NULL when the xfrm_policy is allocated.
  *      Return 0 if operation was successful (memory to allocate, legal context)
  * @xfrm_policy_clone_security:
  *      @old contains an existing xfrm_policy in the SPD.
@@ -858,9 +858,6 @@ struct request_sock;
  *      Database by the XFRM system.
  *      @sec_ctx contains the security context information being provided by
  *      the user-level SA generation program (e.g., setkey or racoon).
- *      @polsec contains the security context information associated with a xfrm
- *      policy rule from which to take the base context. polsec must be NULL
- *      when sec_ctx is specified.
  *      @secid contains the secid from which to take the mls portion of the context.
  *      Allocate a security structure to the x->security field; the security
  *      field is initialized to NULL when the xfrm_state is allocated. Set the
@@ -889,11 +886,6 @@ struct request_sock;
  *      @xp contains the policy to check for a match.
  *      @fl contains the flow to check for a match.
  *      Return 1 if there is a match.
- * @xfrm_flow_state_match:
- *      @fl contains the flow key to match.
- *      @xfrm points to the xfrm_state to match.
- *      @xp points to the xfrm_policy to match.
- *      Return 1 if there is a match.
  * @xfrm_decode_session:
  *      @skb points to skb to decode.
  *      @secid points to the flow key secid to set.
@@ -1373,25 +1365,24 @@ struct security_operations {
         int (*inet_conn_request)(struct sock *sk, struct sk_buff *skb,
                                         struct request_sock *req);
         void (*inet_csk_clone)(struct sock *newsk, const struct request_sock *req);
+        void (*inet_conn_established)(struct sock *sk, struct sk_buff *skb);
         void (*req_classify_flow)(const struct request_sock *req, struct flowi *fl);
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
         int (*xfrm_policy_alloc_security) (struct xfrm_policy *xp,
-                        struct xfrm_user_sec_ctx *sec_ctx, struct sock *sk);
+                        struct xfrm_user_sec_ctx *sec_ctx);
         int (*xfrm_policy_clone_security) (struct xfrm_policy *old, struct xfrm_policy *new);
         void (*xfrm_policy_free_security) (struct xfrm_policy *xp);
         int (*xfrm_policy_delete_security) (struct xfrm_policy *xp);
         int (*xfrm_state_alloc_security) (struct xfrm_state *x,
-                struct xfrm_user_sec_ctx *sec_ctx, struct xfrm_sec_ctx *polsec,
+                struct xfrm_user_sec_ctx *sec_ctx,
                 u32 secid);
         void (*xfrm_state_free_security) (struct xfrm_state *x);
         int (*xfrm_state_delete_security) (struct xfrm_state *x);
         int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
         int (*xfrm_state_pol_flow_match)(struct xfrm_state *x,
                         struct xfrm_policy *xp, struct flowi *fl);
-        int (*xfrm_flow_state_match)(struct flowi *fl, struct xfrm_state *xfrm,
-                        struct xfrm_policy *xp);
         int (*xfrm_decode_session)(struct sk_buff *skb, u32 *secid, int ckall);
 #endif  /* CONFIG_SECURITY_NETWORK_XFRM */
 
@@ -2966,9 +2957,15 @@ static inline void security_inet_csk_clone(struct sock *newsk,
 {
         security_ops->inet_csk_clone(newsk, req);
 }
+
+static inline void security_inet_conn_established(struct sock *sk,
+                        struct sk_buff *skb)
+{
+        security_ops->inet_conn_established(sk, skb);
+}
 #else   /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct socket * sock,
-                                               struct socket * other, 
+                                               struct socket * other,
                                                struct sock * newsk)
 {
         return 0;
@@ -3115,12 +3112,17 @@ static inline void security_inet_csk_clone(struct sock *newsk,
                         const struct request_sock *req)
 {
 }
+
+static inline void security_inet_conn_established(struct sock *sk,
+                        struct sk_buff *skb)
+{
+}
 #endif  /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
 static inline int security_xfrm_policy_alloc(struct xfrm_policy *xp, struct xfrm_user_sec_ctx *sec_ctx)
 {
-        return security_ops->xfrm_policy_alloc_security(xp, sec_ctx, NULL);
+        return security_ops->xfrm_policy_alloc_security(xp, sec_ctx);
 }
 
 static inline int security_xfrm_policy_clone(struct xfrm_policy *old, struct xfrm_policy *new)
@@ -3141,7 +3143,7 @@ static inline int security_xfrm_policy_delete(struct xfrm_policy *xp)
 static inline int security_xfrm_state_alloc(struct xfrm_state *x,
                         struct xfrm_user_sec_ctx *sec_ctx)
 {
-        return security_ops->xfrm_state_alloc_security(x, sec_ctx, NULL, 0);
+        return security_ops->xfrm_state_alloc_security(x, sec_ctx, 0);
 }
 
 static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
@@ -3149,7 +3151,11 @@ static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
 {
         if (!polsec)
                 return 0;
-        return security_ops->xfrm_state_alloc_security(x, NULL, polsec, secid);
+        /*
+         * We want the context to be taken from secid which is usually
+         * from the sock.
+         */
+        return security_ops->xfrm_state_alloc_security(x, NULL, secid);
 }
 
 static inline int security_xfrm_state_delete(struct xfrm_state *x)
@@ -3173,12 +3179,6 @@ static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
         return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
 }
 
-static inline int security_xfrm_flow_state_match(struct flowi *fl,
-                        struct xfrm_state *xfrm, struct xfrm_policy *xp)
-{
-        return security_ops->xfrm_flow_state_match(fl, xfrm, xp);
-}
-
 static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
 {
         return security_ops->xfrm_decode_session(skb, secid, 1);
@@ -3242,12 +3242,6 @@ static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
         return 1;
 }
 
-static inline int security_xfrm_flow_state_match(struct flowi *fl,
-                        struct xfrm_state *xfrm, struct xfrm_policy *xp)
-{
-        return 1;
-}
-
 static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
 {
         return 0;