* [PATCH 07/10] MLSXFRM: Add security context to acquire messages using PF_KEY
@ 2006-07-12 21:14 Venkat Yekkirala
0 siblings, 0 replies; 2+ messages in thread
From: Venkat Yekkirala @ 2006-07-12 21:14 UTC (permalink / raw)
To: netdev; +Cc: jmorris, sds, tjaeger, selinux
This includes the security context of a security association created for use by IKE
in the acquire messages sent to IKE daemons using PF_KEY. This would allow
the daemons to include the security context in the negotiation, so that the resultant
association is unique to that security context.
Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
---
net/key/af_key.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- linux-2.6.17.xfrm_user/net/key/af_key.c 2006-07-11 16:04:20.000000000 -0500
+++ linux-2.6.17/net/key/af_key.c 2006-07-11 20:59:42.000000000 -0500
@@ -2708,6 +2708,9 @@ static int pfkey_send_acquire(struct xfr
#endif
int sockaddr_size;
int size;
+ struct sadb_x_sec_ctx *sec_ctx;
+ struct xfrm_sec_ctx *xfrm_ctx;
+ int ctx_size = 0;
sockaddr_size = pfkey_sockaddr_size(x->props.family);
if (!sockaddr_size)
@@ -2723,6 +2726,11 @@ static int pfkey_send_acquire(struct xfr
else if (x->id.proto == IPPROTO_ESP)
size += count_esp_combs(t);
+ if ((xfrm_ctx = x->security)) {
+ ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
+ size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
+ }
+
skb = alloc_skb(size + 16, GFP_ATOMIC);
if (skb == NULL)
return -ENOMEM;
@@ -2818,6 +2826,20 @@ static int pfkey_send_acquire(struct xfr
else if (x->id.proto == IPPROTO_ESP)
dump_esp_combs(skb, t);
+ /* security context */
+ if (xfrm_ctx) {
+ sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
+ sizeof(struct sadb_x_sec_ctx) + ctx_size);
+ sec_ctx->sadb_x_sec_len =
+ (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
+ sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
+ sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
+ sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
+ sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
+ memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
+ xfrm_ctx->ctx_len);
+ }
+
return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
}
^ permalink raw reply [flat|nested] 2+ messages in thread* [PATCH 07/10] MLSXFRM: Add security context to acquire messages using PF_KEY
@ 2006-07-18 17:24 Venkat Yekkirala
0 siblings, 0 replies; 2+ messages in thread
From: Venkat Yekkirala @ 2006-07-18 17:24 UTC (permalink / raw)
To: netdev, selinux; +Cc: jmorris, sds, tjaeger
This includes the security context of a security association created for use by IKE
in the acquire messages sent to IKE daemons using PF_KEY. This would allow
the daemons to include the security context in the negotiation, so that the resultant
association is unique to that security context.
Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
---
net/key/af_key.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- linux-2.6.17.xfrm_user/net/key/af_key.c 2006-07-14 09:28:36.000000000 -0500
+++ linux-2.6.17/net/key/af_key.c 2006-07-17 15:03:05.000000000 -0500
@@ -2708,6 +2708,9 @@ static int pfkey_send_acquire(struct xfr
#endif
int sockaddr_size;
int size;
+ struct sadb_x_sec_ctx *sec_ctx;
+ struct xfrm_sec_ctx *xfrm_ctx;
+ int ctx_size = 0;
sockaddr_size = pfkey_sockaddr_size(x->props.family);
if (!sockaddr_size)
@@ -2723,6 +2726,11 @@ static int pfkey_send_acquire(struct xfr
else if (x->id.proto == IPPROTO_ESP)
size += count_esp_combs(t);
+ if ((xfrm_ctx = x->security)) {
+ ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
+ size += sizeof(struct sadb_x_sec_ctx) + ctx_size;
+ }
+
skb = alloc_skb(size + 16, GFP_ATOMIC);
if (skb == NULL)
return -ENOMEM;
@@ -2818,6 +2826,20 @@ static int pfkey_send_acquire(struct xfr
else if (x->id.proto == IPPROTO_ESP)
dump_esp_combs(skb, t);
+ /* security context */
+ if (xfrm_ctx) {
+ sec_ctx = (struct sadb_x_sec_ctx *) skb_put(skb,
+ sizeof(struct sadb_x_sec_ctx) + ctx_size);
+ sec_ctx->sadb_x_sec_len =
+ (sizeof(struct sadb_x_sec_ctx) + ctx_size) / sizeof(uint64_t);
+ sec_ctx->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
+ sec_ctx->sadb_x_ctx_doi = xfrm_ctx->ctx_doi;
+ sec_ctx->sadb_x_ctx_alg = xfrm_ctx->ctx_alg;
+ sec_ctx->sadb_x_ctx_len = xfrm_ctx->ctx_len;
+ memcpy(sec_ctx + 1, xfrm_ctx->ctx_str,
+ xfrm_ctx->ctx_len);
+ }
+
return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL);
}
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-07-18 17:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-07-12 21:14 [PATCH 07/10] MLSXFRM: Add security context to acquire messages using PF_KEY Venkat Yekkirala
-- strict thread matches above, loose matches on Subject: below --
2006-07-18 17:24 Venkat Yekkirala
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).