openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 

Steffen Klassert says:

====================
pull request (net-next): ipsec-next 2014-05-22

This is the last ipsec pull request before I leave for
a three weeks vacation tomorrow. David, can you please
take urgent ipsec patches directly into net/net-next
during this time?

I'll continue to run the ipsec/ipsec-next trees as soon
as I'm back.

1) Simplify the xfrm audit handling, from Tetsuo Handa.

2) Codingstyle cleanup for xfrm_output, from abian Frederick.

Please pull or let me know if there are problems.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2014-05-22 16:00:00 -04:00
parent b3f7a7b48f fc68086ce8
commit 65db611a5c
6 changed files with 62 additions and 162 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
include/net/xfrm.h
View File

@ -691,13 +691,6 @@ struct xfrm_spi_skb_cb {
#define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0])) #define XFRM_SPI_SKB_CB(__skb) ((struct xfrm_spi_skb_cb *)&((__skb)->cb[0]))
/* Audit Information */
struct xfrm_audit {
u32 secid;
kuid_t loginuid;
unsigned int sessionid;
};
#ifdef CONFIG_AUDITSYSCALL #ifdef CONFIG_AUDITSYSCALL
static inline struct audit_buffer *xfrm_audit_start(const char *op) static inline struct audit_buffer *xfrm_audit_start(const char *op)
{ {
@ -713,30 +706,24 @@ static inline struct audit_buffer *xfrm_audit_start(const char *op)
return audit_buf; return audit_buf;
} }
static inline void xfrm_audit_helper_usrinfo(kuid_t auid, unsigned int ses, u32 secid, static inline void xfrm_audit_helper_usrinfo(bool task_valid,
struct audit_buffer *audit_buf) struct audit_buffer *audit_buf)
{ {
char *secctx; const unsigned int auid = from_kuid(&init_user_ns, task_valid ?
u32 secctx_len; audit_get_loginuid(current) :
INVALID_UID);
const unsigned int ses = task_valid ? audit_get_sessionid(current) :
(unsigned int) -1;
audit_log_format(audit_buf, " auid=%u ses=%u", audit_log_format(audit_buf, " auid=%u ses=%u", auid, ses);
from_kuid(&init_user_ns, auid), ses); audit_log_task_context(audit_buf);
if (secid != 0 &&
security_secid_to_secctx(secid, &secctx, &secctx_len) == 0) {
audit_log_format(audit_buf, " subj=%s", secctx);
security_release_secctx(secctx, secctx_len);
} else
audit_log_task_context(audit_buf);
} }
void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, kuid_t auid, void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid);
unsigned int ses, u32 secid); void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, kuid_t auid, bool task_valid);
unsigned int ses, u32 secid); void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid);
void xfrm_audit_state_add(struct xfrm_state *x, int result, kuid_t auid, void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid);
unsigned int ses, u32 secid);
void xfrm_audit_state_delete(struct xfrm_state *x, int result, kuid_t auid,
unsigned int ses, u32 secid);
void xfrm_audit_state_replay_overflow(struct xfrm_state *x, void xfrm_audit_state_replay_overflow(struct xfrm_state *x,
struct sk_buff *skb); struct sk_buff *skb);
void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb, void xfrm_audit_state_replay(struct xfrm_state *x, struct sk_buff *skb,
@ -749,22 +736,22 @@ void xfrm_audit_state_icvfail(struct xfrm_state *x, struct sk_buff *skb,
#else #else
static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, static inline void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
kuid_t auid, unsigned int ses, u32 secid) bool task_valid)
{ {
} }
static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, static inline void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
kuid_t auid, unsigned int ses, u32 secid) bool task_valid)
{ {
} }
static inline void xfrm_audit_state_add(struct xfrm_state *x, int result, static inline void xfrm_audit_state_add(struct xfrm_state *x, int result,
kuid_t auid, unsigned int ses, u32 secid) bool task_valid)
{ {
} }
static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result, static inline void xfrm_audit_state_delete(struct xfrm_state *x, int result,
kuid_t auid, unsigned int ses, u32 secid) bool task_valid)
{ {
} }
@ -1508,7 +1495,7 @@ struct xfrmk_spdinfo {
struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq); struct xfrm_state *xfrm_find_acq_byseq(struct net *net, u32 mark, u32 seq);
int xfrm_state_delete(struct xfrm_state *x); int xfrm_state_delete(struct xfrm_state *x);
int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info); int xfrm_state_flush(struct net *net, u8 proto, bool task_valid);
void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si); void xfrm_sad_getinfo(struct net *net, struct xfrmk_sadinfo *si);
void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si); void xfrm_spd_getinfo(struct net *net, struct xfrmk_spdinfo *si);
u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq); u32 xfrm_replay_seqhi(struct xfrm_state *x, __be32 net_seq);
@ -1603,7 +1590,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark,
int *err); int *err);
struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir, struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u8, int dir,
u32 id, int delete, int *err); u32 id, int delete, int *err);
int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info); int xfrm_policy_flush(struct net *net, u8 type, bool task_valid);
u32 xfrm_get_acqseq(void); u32 xfrm_get_acqseq(void);
int verify_spi_info(u8 proto, u32 min, u32 max); int verify_spi_info(u8 proto, u32 min, u32 max);
int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi); int xfrm_alloc_spi(struct xfrm_state *x, u32 minspi, u32 maxspi);

32
net/key/af_key.c
View File

@ -1476,9 +1476,7 @@ static int pfkey_add(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
else else
err = xfrm_state_update(x); err = xfrm_state_update(x);
xfrm_audit_state_add(x, err ? 0 : 1, xfrm_audit_state_add(x, err ? 0 : 1, true);
audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err < 0) { if (err < 0) {
x->km.state = XFRM_STATE_DEAD; x->km.state = XFRM_STATE_DEAD;
@ -1532,9 +1530,7 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, const struct sadb_
c.event = XFRM_MSG_DELSA; c.event = XFRM_MSG_DELSA;
km_state_notify(x, &c); km_state_notify(x, &c);
out: out:
xfrm_audit_state_delete(x, err ? 0 : 1, xfrm_audit_state_delete(x, err ? 0 : 1, true);
audit_get_loginuid(current),
audit_get_sessionid(current), 0);
xfrm_state_put(x); xfrm_state_put(x);
return err; return err;
@ -1726,17 +1722,13 @@ static int pfkey_flush(struct sock *sk, struct sk_buff *skb, const struct sadb_m
struct net *net = sock_net(sk); struct net *net = sock_net(sk);
unsigned int proto; unsigned int proto;
struct km_event c; struct km_event c;
struct xfrm_audit audit_info;
int err, err2; int err, err2;
proto = pfkey_satype2proto(hdr->sadb_msg_satype); proto = pfkey_satype2proto(hdr->sadb_msg_satype);
if (proto == 0) if (proto == 0)
return -EINVAL; return -EINVAL;
audit_info.loginuid = audit_get_loginuid(current); err = xfrm_state_flush(net, proto, true);
audit_info.sessionid = audit_get_sessionid(current);
audit_info.secid = 0;
err = xfrm_state_flush(net, proto, &audit_info);
err2 = unicast_flush_resp(sk, hdr); err2 = unicast_flush_resp(sk, hdr);
if (err || err2) { if (err || err2) {
if (err == -ESRCH) /* empty table - go quietly */ if (err == -ESRCH) /* empty table - go quietly */
@ -2288,9 +2280,7 @@ static int pfkey_spdadd(struct sock *sk, struct sk_buff *skb, const struct sadb_
err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp, err = xfrm_policy_insert(pol->sadb_x_policy_dir-1, xp,
hdr->sadb_msg_type != SADB_X_SPDUPDATE); hdr->sadb_msg_type != SADB_X_SPDUPDATE);
xfrm_audit_policy_add(xp, err ? 0 : 1, xfrm_audit_policy_add(xp, err ? 0 : 1, true);
audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err) if (err)
goto out; goto out;
@ -2372,9 +2362,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa
if (xp == NULL) if (xp == NULL)
return -ENOENT; return -ENOENT;
xfrm_audit_policy_delete(xp, err ? 0 : 1, xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err) if (err)
goto out; goto out;
@ -2622,9 +2610,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_
return -ENOENT; return -ENOENT;
if (delete) { if (delete) {
xfrm_audit_policy_delete(xp, err ? 0 : 1, xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
audit_get_loginuid(current),
audit_get_sessionid(current), 0);
if (err) if (err)
goto out; goto out;
@ -2733,13 +2719,9 @@ static int pfkey_spdflush(struct sock *sk, struct sk_buff *skb, const struct sad
{ {
struct net *net = sock_net(sk); struct net *net = sock_net(sk);
struct km_event c; struct km_event c;
struct xfrm_audit audit_info;
int err, err2; int err, err2;
audit_info.loginuid = audit_get_loginuid(current); err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, true);
audit_info.sessionid = audit_get_sessionid(current);
audit_info.secid = 0;
err = xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);
err2 = unicast_flush_resp(sk, hdr); err2 = unicast_flush_resp(sk, hdr);
if (err || err2) { if (err || err2) {
if (err == -ESRCH) /* empty table - old silent behavior */ if (err == -ESRCH) /* empty table - old silent behavior */

5
net/xfrm/xfrm_output.c
View File

@ -199,6 +199,7 @@ int xfrm_output(struct sk_buff *skb)
return xfrm_output2(skb); return xfrm_output2(skb);
} }
EXPORT_SYMBOL_GPL(xfrm_output);
int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb) int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
{ {
@ -213,6 +214,7 @@ int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb)
return -EAFNOSUPPORT; return -EAFNOSUPPORT;
return inner_mode->afinfo->extract_output(x, skb); return inner_mode->afinfo->extract_output(x, skb);
} }
EXPORT_SYMBOL_GPL(xfrm_inner_extract_output);
void xfrm_local_error(struct sk_buff *skb, int mtu) void xfrm_local_error(struct sk_buff *skb, int mtu)
{ {
@ -233,7 +235,4 @@ void xfrm_local_error(struct sk_buff *skb, int mtu)
afinfo->local_error(skb, mtu); afinfo->local_error(skb, mtu);
xfrm_state_put_afinfo(afinfo); xfrm_state_put_afinfo(afinfo);
} }
EXPORT_SYMBOL_GPL(xfrm_output);
EXPORT_SYMBOL_GPL(xfrm_inner_extract_output);
EXPORT_SYMBOL_GPL(xfrm_local_error); EXPORT_SYMBOL_GPL(xfrm_local_error);

46
net/xfrm/xfrm_policy.c
View File

@ -769,7 +769,7 @@ EXPORT_SYMBOL(xfrm_policy_byid);
#ifdef CONFIG_SECURITY_NETWORK_XFRM #ifdef CONFIG_SECURITY_NETWORK_XFRM
static inline int static inline int
xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info) xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
{ {
int dir, err = 0; int dir, err = 0;
@ -783,10 +783,7 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
continue; continue;
err = security_xfrm_policy_delete(pol->security); err = security_xfrm_policy_delete(pol->security);
if (err) { if (err) {
xfrm_audit_policy_delete(pol, 0, xfrm_audit_policy_delete(pol, 0, task_valid);
audit_info->loginuid,
audit_info->sessionid,
audit_info->secid);
return err; return err;
} }
} }
@ -800,9 +797,7 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
pol->security); pol->security);
if (err) { if (err) {
xfrm_audit_policy_delete(pol, 0, xfrm_audit_policy_delete(pol, 0,
audit_info->loginuid, task_valid);
audit_info->sessionid,
audit_info->secid);
return err; return err;
} }
} }
@ -812,19 +807,19 @@ xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audi
} }
#else #else
static inline int static inline int
xfrm_policy_flush_secctx_check(struct net *net, u8 type, struct xfrm_audit *audit_info) xfrm_policy_flush_secctx_check(struct net *net, u8 type, bool task_valid)
{ {
return 0; return 0;
} }
#endif #endif
int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info) int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
{ {
int dir, err = 0, cnt = 0; int dir, err = 0, cnt = 0;
write_lock_bh(&net->xfrm.xfrm_policy_lock); write_lock_bh(&net->xfrm.xfrm_policy_lock);
err = xfrm_policy_flush_secctx_check(net, type, audit_info); err = xfrm_policy_flush_secctx_check(net, type, task_valid);
if (err) if (err)
goto out; goto out;
@ -841,9 +836,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
write_unlock_bh(&net->xfrm.xfrm_policy_lock); write_unlock_bh(&net->xfrm.xfrm_policy_lock);
cnt++; cnt++;
xfrm_audit_policy_delete(pol, 1, audit_info->loginuid, xfrm_audit_policy_delete(pol, 1, task_valid);
audit_info->sessionid,
audit_info->secid);
xfrm_policy_kill(pol); xfrm_policy_kill(pol);
@ -862,10 +855,7 @@ int xfrm_policy_flush(struct net *net, u8 type, struct xfrm_audit *audit_info)
write_unlock_bh(&net->xfrm.xfrm_policy_lock); write_unlock_bh(&net->xfrm.xfrm_policy_lock);
cnt++; cnt++;
xfrm_audit_policy_delete(pol, 1, xfrm_audit_policy_delete(pol, 1, task_valid);
audit_info->loginuid,
audit_info->sessionid,
audit_info->secid);
xfrm_policy_kill(pol); xfrm_policy_kill(pol);
write_lock_bh(&net->xfrm.xfrm_policy_lock); write_lock_bh(&net->xfrm.xfrm_policy_lock);
@ -2860,21 +2850,14 @@ static int __net_init xfrm_policy_init(struct net *net)
static void xfrm_policy_fini(struct net *net) static void xfrm_policy_fini(struct net *net)
{ {
struct xfrm_audit audit_info;
unsigned int sz; unsigned int sz;
int dir; int dir;
flush_work(&net->xfrm.policy_hash_work); flush_work(&net->xfrm.policy_hash_work);
#ifdef CONFIG_XFRM_SUB_POLICY #ifdef CONFIG_XFRM_SUB_POLICY
audit_info.loginuid = INVALID_UID; xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, false);
audit_info.sessionid = (unsigned int)-1;
audit_info.secid = 0;
xfrm_policy_flush(net, XFRM_POLICY_TYPE_SUB, &audit_info);
#endif #endif
audit_info.loginuid = INVALID_UID; xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, false);
audit_info.sessionid = (unsigned int)-1;
audit_info.secid = 0;
xfrm_policy_flush(net, XFRM_POLICY_TYPE_MAIN, &audit_info);
WARN_ON(!list_empty(&net->xfrm.policy_all)); WARN_ON(!list_empty(&net->xfrm.policy_all));
@ -2989,15 +2972,14 @@ static void xfrm_audit_common_policyinfo(struct xfrm_policy *xp,
} }
} }
void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, void xfrm_audit_policy_add(struct xfrm_policy *xp, int result, bool task_valid)
kuid_t auid, unsigned int sessionid, u32 secid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SPD-add"); audit_buf = xfrm_audit_start("SPD-add");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); xfrm_audit_helper_usrinfo(task_valid, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
xfrm_audit_common_policyinfo(xp, audit_buf); xfrm_audit_common_policyinfo(xp, audit_buf);
audit_log_end(audit_buf); audit_log_end(audit_buf);
@ -3005,14 +2987,14 @@ void xfrm_audit_policy_add(struct xfrm_policy *xp, int result,
EXPORT_SYMBOL_GPL(xfrm_audit_policy_add); EXPORT_SYMBOL_GPL(xfrm_audit_policy_add);
void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, void xfrm_audit_policy_delete(struct xfrm_policy *xp, int result,
kuid_t auid, unsigned int sessionid, u32 secid) bool task_valid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SPD-delete"); audit_buf = xfrm_audit_start("SPD-delete");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); xfrm_audit_helper_usrinfo(task_valid, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
xfrm_audit_common_policyinfo(xp, audit_buf); xfrm_audit_common_policyinfo(xp, audit_buf);
audit_log_end(audit_buf); audit_log_end(audit_buf);

37
net/xfrm/xfrm_state.c
View File

@ -463,9 +463,7 @@ static enum hrtimer_restart xfrm_timer_handler(struct hrtimer *me)
if (!err) if (!err)
km_state_expired(x, 1, 0); km_state_expired(x, 1, 0);
xfrm_audit_state_delete(x, err ? 0 : 1, xfrm_audit_state_delete(x, err ? 0 : 1, true);
audit_get_loginuid(current),
audit_get_sessionid(current), 0);
out: out:
spin_unlock(&x->lock); spin_unlock(&x->lock);
@ -562,7 +560,7 @@ EXPORT_SYMBOL(xfrm_state_delete);
#ifdef CONFIG_SECURITY_NETWORK_XFRM #ifdef CONFIG_SECURITY_NETWORK_XFRM
static inline int static inline int
xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info) xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
{ {
int i, err = 0; int i, err = 0;
@ -572,10 +570,7 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audi
hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) { hlist_for_each_entry(x, net->xfrm.state_bydst+i, bydst) {
if (xfrm_id_proto_match(x->id.proto, proto) && if (xfrm_id_proto_match(x->id.proto, proto) &&
(err = security_xfrm_state_delete(x)) != 0) { (err = security_xfrm_state_delete(x)) != 0) {
xfrm_audit_state_delete(x, 0, xfrm_audit_state_delete(x, 0, task_valid);
audit_info->loginuid,
audit_info->sessionid,
audit_info->secid);
return err; return err;
} }
} }
@ -585,18 +580,18 @@ xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audi
} }
#else #else
static inline int static inline int
xfrm_state_flush_secctx_check(struct net *net, u8 proto, struct xfrm_audit *audit_info) xfrm_state_flush_secctx_check(struct net *net, u8 proto, bool task_valid)
{ {
return 0; return 0;
} }
#endif #endif
int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info) int xfrm_state_flush(struct net *net, u8 proto, bool task_valid)
{ {
int i, err = 0, cnt = 0; int i, err = 0, cnt = 0;
spin_lock_bh(&net->xfrm.xfrm_state_lock); spin_lock_bh(&net->xfrm.xfrm_state_lock);
err = xfrm_state_flush_secctx_check(net, proto, audit_info); err = xfrm_state_flush_secctx_check(net, proto, task_valid);
if (err) if (err)
goto out; goto out;
@ -612,9 +607,7 @@ int xfrm_state_flush(struct net *net, u8 proto, struct xfrm_audit *audit_info)
err = xfrm_state_delete(x); err = xfrm_state_delete(x);
xfrm_audit_state_delete(x, err ? 0 : 1, xfrm_audit_state_delete(x, err ? 0 : 1,
audit_info->loginuid, task_valid);
audit_info->sessionid,
audit_info->secid);
xfrm_state_put(x); xfrm_state_put(x);
if (!err) if (!err)
cnt++; cnt++;
@ -2128,14 +2121,10 @@ int __net_init xfrm_state_init(struct net *net)
void xfrm_state_fini(struct net *net) void xfrm_state_fini(struct net *net)
{ {
struct xfrm_audit audit_info;
unsigned int sz; unsigned int sz;
flush_work(&net->xfrm.state_hash_work); flush_work(&net->xfrm.state_hash_work);
audit_info.loginuid = INVALID_UID; xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
audit_info.sessionid = (unsigned int)-1;
audit_info.secid = 0;
xfrm_state_flush(net, IPSEC_PROTO_ANY, &audit_info);
flush_work(&net->xfrm.state_gc_work); flush_work(&net->xfrm.state_gc_work);
WARN_ON(!list_empty(&net->xfrm.state_all)); WARN_ON(!list_empty(&net->xfrm.state_all));
@ -2198,30 +2187,28 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
} }
} }
void xfrm_audit_state_add(struct xfrm_state *x, int result, void xfrm_audit_state_add(struct xfrm_state *x, int result, bool task_valid)
kuid_t auid, unsigned int sessionid, u32 secid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SAD-add"); audit_buf = xfrm_audit_start("SAD-add");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); xfrm_audit_helper_usrinfo(task_valid, audit_buf);
xfrm_audit_helper_sainfo(x, audit_buf); xfrm_audit_helper_sainfo(x, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
audit_log_end(audit_buf); audit_log_end(audit_buf);
} }
EXPORT_SYMBOL_GPL(xfrm_audit_state_add); EXPORT_SYMBOL_GPL(xfrm_audit_state_add);
void xfrm_audit_state_delete(struct xfrm_state *x, int result, void xfrm_audit_state_delete(struct xfrm_state *x, int result, bool task_valid)
kuid_t auid, unsigned int sessionid, u32 secid)
{ {
struct audit_buffer *audit_buf; struct audit_buffer *audit_buf;
audit_buf = xfrm_audit_start("SAD-delete"); audit_buf = xfrm_audit_start("SAD-delete");
if (audit_buf == NULL) if (audit_buf == NULL)
return; return;
xfrm_audit_helper_usrinfo(auid, sessionid, secid, audit_buf); xfrm_audit_helper_usrinfo(task_valid, audit_buf);
xfrm_audit_helper_sainfo(x, audit_buf); xfrm_audit_helper_sainfo(x, audit_buf);
audit_log_format(audit_buf, " res=%u", result); audit_log_format(audit_buf, " res=%u", result);
audit_log_end(audit_buf); audit_log_end(audit_buf);

53
net/xfrm/xfrm_user.c
View File

@ -597,9 +597,6 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
struct xfrm_state *x; struct xfrm_state *x;
int err; int err;
struct km_event c; struct km_event c;
kuid_t loginuid = audit_get_loginuid(current);
unsigned int sessionid = audit_get_sessionid(current);
u32 sid;
err = verify_newsa_info(p, attrs); err = verify_newsa_info(p, attrs);
if (err) if (err)
@ -615,8 +612,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
else else
err = xfrm_state_update(x); err = xfrm_state_update(x);
security_task_getsecid(current, &sid); xfrm_audit_state_add(x, err ? 0 : 1, true);
xfrm_audit_state_add(x, err ? 0 : 1, loginuid, sessionid, sid);
if (err < 0) { if (err < 0) {
x->km.state = XFRM_STATE_DEAD; x->km.state = XFRM_STATE_DEAD;
@ -676,9 +672,6 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
int err = -ESRCH; int err = -ESRCH;
struct km_event c; struct km_event c;
struct xfrm_usersa_id *p = nlmsg_data(nlh); struct xfrm_usersa_id *p = nlmsg_data(nlh);
kuid_t loginuid = audit_get_loginuid(current);
unsigned int sessionid = audit_get_sessionid(current);
u32 sid;
x = xfrm_user_state_lookup(net, p, attrs, &err); x = xfrm_user_state_lookup(net, p, attrs, &err);
if (x == NULL) if (x == NULL)
@ -703,8 +696,7 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
km_state_notify(x, &c); km_state_notify(x, &c);
out: out:
security_task_getsecid(current, &sid); xfrm_audit_state_delete(x, err ? 0 : 1, true);
xfrm_audit_state_delete(x, err ? 0 : 1, loginuid, sessionid, sid);
xfrm_state_put(x); xfrm_state_put(x);
return err; return err;
} }
@ -1414,9 +1406,6 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
struct km_event c; struct km_event c;
int err; int err;
int excl; int excl;
kuid_t loginuid = audit_get_loginuid(current);
unsigned int sessionid = audit_get_sessionid(current);
u32 sid;
err = verify_newpolicy_info(p); err = verify_newpolicy_info(p);
if (err) if (err)
@ -1435,8 +1424,7 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
* a type XFRM_MSG_UPDPOLICY - JHS */ * a type XFRM_MSG_UPDPOLICY - JHS */
excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY; excl = nlh->nlmsg_type == XFRM_MSG_NEWPOLICY;
err = xfrm_policy_insert(p->dir, xp, excl); err = xfrm_policy_insert(p->dir, xp, excl);
security_task_getsecid(current, &sid); xfrm_audit_policy_add(xp, err ? 0 : 1, true);
xfrm_audit_policy_add(xp, err ? 0 : 1, loginuid, sessionid, sid);
if (err) { if (err) {
security_xfrm_policy_free(xp->security); security_xfrm_policy_free(xp->security);
@ -1673,13 +1661,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
NETLINK_CB(skb).portid); NETLINK_CB(skb).portid);
} }
} else { } else {
kuid_t loginuid = audit_get_loginuid(current); xfrm_audit_policy_delete(xp, err ? 0 : 1, true);
unsigned int sessionid = audit_get_sessionid(current);
u32 sid;
security_task_getsecid(current, &sid);
xfrm_audit_policy_delete(xp, err ? 0 : 1, loginuid, sessionid,
sid);
if (err != 0) if (err != 0)
goto out; goto out;
@ -1704,13 +1686,9 @@ static int xfrm_flush_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
struct net *net = sock_net(skb->sk); struct net *net = sock_net(skb->sk);
struct km_event c; struct km_event c;
struct xfrm_usersa_flush *p = nlmsg_data(nlh); struct xfrm_usersa_flush *p = nlmsg_data(nlh);
struct xfrm_audit audit_info;
int err; int err;
audit_info.loginuid = audit_get_loginuid(current); err = xfrm_state_flush(net, p->proto, true);
audit_info.sessionid = audit_get_sessionid(current);
security_task_getsecid(current, &audit_info.secid);
err = xfrm_state_flush(net, p->proto, &audit_info);
if (err) { if (err) {
if (err == -ESRCH) /* empty table */ if (err == -ESRCH) /* empty table */
return 0; return 0;
@ -1894,16 +1872,12 @@ static int xfrm_flush_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
struct km_event c; struct km_event c;
u8 type = XFRM_POLICY_TYPE_MAIN; u8 type = XFRM_POLICY_TYPE_MAIN;
int err; int err;
struct xfrm_audit audit_info;
err = copy_from_user_policy_type(&type, attrs); err = copy_from_user_policy_type(&type, attrs);
if (err) if (err)
return err; return err;
audit_info.loginuid = audit_get_loginuid(current); err = xfrm_policy_flush(net, type, true);
audit_info.sessionid = audit_get_sessionid(current);
security_task_getsecid(current, &audit_info.secid);
err = xfrm_policy_flush(net, type, &audit_info);
if (err) { if (err) {
if (err == -ESRCH) /* empty table */ if (err == -ESRCH) /* empty table */
return 0; return 0;
@ -1969,14 +1943,8 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
err = 0; err = 0;
if (up->hard) { if (up->hard) {
kuid_t loginuid = audit_get_loginuid(current);
unsigned int sessionid = audit_get_sessionid(current);
u32 sid;
security_task_getsecid(current, &sid);
xfrm_policy_delete(xp, p->dir); xfrm_policy_delete(xp, p->dir);
xfrm_audit_policy_delete(xp, 1, loginuid, sessionid, sid); xfrm_audit_policy_delete(xp, 1, true);
} else { } else {
// reset the timers here? // reset the timers here?
WARN(1, "Dont know what to do with soft policy expire\n"); WARN(1, "Dont know what to do with soft policy expire\n");
@ -2012,13 +1980,8 @@ static int xfrm_add_sa_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
km_state_expired(x, ue->hard, nlh->nlmsg_pid); km_state_expired(x, ue->hard, nlh->nlmsg_pid);
if (ue->hard) { if (ue->hard) {
kuid_t loginuid = audit_get_loginuid(current);
unsigned int sessionid = audit_get_sessionid(current);
u32 sid;
security_task_getsecid(current, &sid);
__xfrm_state_delete(x); __xfrm_state_delete(x);
xfrm_audit_state_delete(x, 1, loginuid, sessionid, sid); xfrm_audit_state_delete(x, 1, true);
} }
err = 0; err = 0;
out: out: