* [PATCH] netlabel: Always remove the correct address selector
@ 2009-04-21 20:04 Paul Moore
2009-04-21 22:43 ` James Morris
2009-04-22 5:55 ` Etienne Basset
0 siblings, 2 replies; 4+ messages in thread
From: Paul Moore @ 2009-04-21 20:04 UTC (permalink / raw)
To: netdev; +Cc: linux-security-module, etienne.basset
The NetLabel address selector mechanism has a problem where it can get
mistakenly remove the wrong selector when similar addresses are used. The
problem is caused when multiple addresses are configured that have different
netmasks but the same address, e.g. 127.0.0.0/8 and 127.0.0.0/24. This patch
fixes the problem.
Reported-by: Etienne Basset <etienne.basset@numericable.fr>
Signed-off-by: Paul Moore <paul.moore@hp.com>
---
net/netlabel/netlabel_addrlist.c | 26 ++++++++++----------------
1 files changed, 10 insertions(+), 16 deletions(-)
diff --git a/net/netlabel/netlabel_addrlist.c b/net/netlabel/netlabel_addrlist.c
index 834c6eb..c051913 100644
--- a/net/netlabel/netlabel_addrlist.c
+++ b/net/netlabel/netlabel_addrlist.c
@@ -256,13 +256,11 @@ struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,
{
struct netlbl_af4list *entry;
- entry = netlbl_af4list_search(addr, head);
- if (entry != NULL && entry->addr == addr && entry->mask == mask) {
- netlbl_af4list_remove_entry(entry);
- return entry;
- }
-
- return NULL;
+ entry = netlbl_af4list_search_exact(addr, mask, head);
+ if (entry == NULL)
+ return NULL;
+ netlbl_af4list_remove_entry(entry);
+ return entry;
}
#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -299,15 +297,11 @@ struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,
{
struct netlbl_af6list *entry;
- entry = netlbl_af6list_search(addr, head);
- if (entry != NULL &&
- ipv6_addr_equal(&entry->addr, addr) &&
- ipv6_addr_equal(&entry->mask, mask)) {
- netlbl_af6list_remove_entry(entry);
- return entry;
- }
-
- return NULL;
+ entry = netlbl_af6list_search_exact(addr, mask, head);
+ if (entry == NULL)
+ return NULL;
+ netlbl_af6list_remove_entry(entry);
+ return entry;
}
#endif /* IPv6 */
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] netlabel: Always remove the correct address selector
2009-04-21 20:04 [PATCH] netlabel: Always remove the correct address selector Paul Moore
@ 2009-04-21 22:43 ` James Morris
2009-04-22 5:55 ` Etienne Basset
1 sibling, 0 replies; 4+ messages in thread
From: James Morris @ 2009-04-21 22:43 UTC (permalink / raw)
To: Paul Moore; +Cc: netdev, linux-security-module, etienne.basset
On Tue, 21 Apr 2009, Paul Moore wrote:
> The NetLabel address selector mechanism has a problem where it can get
> mistakenly remove the wrong selector when similar addresses are used. The
> problem is caused when multiple addresses are configured that have different
> netmasks but the same address, e.g. 127.0.0.0/8 and 127.0.0.0/24. This patch
> fixes the problem.
>
> Reported-by: Etienne Basset <etienne.basset@numericable.fr>
> Signed-off-by: Paul Moore <paul.moore@hp.com>
Acked-by: James Morris <jmorris@namei.org>
--
James Morris
<jmorris@namei.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netlabel: Always remove the correct address selector
2009-04-21 20:04 [PATCH] netlabel: Always remove the correct address selector Paul Moore
2009-04-21 22:43 ` James Morris
@ 2009-04-22 5:55 ` Etienne Basset
2009-04-22 7:46 ` David Miller
1 sibling, 1 reply; 4+ messages in thread
From: Etienne Basset @ 2009-04-22 5:55 UTC (permalink / raw)
To: Paul Moore; +Cc: netdev, linux-security-module
Hi,
Paul Moore wrote:
> The NetLabel address selector mechanism has a problem where it can get
> mistakenly remove the wrong selector when similar addresses are used. The
> problem is caused when multiple addresses are configured that have different
> netmasks but the same address, e.g. 127.0.0.0/8 and 127.0.0.0/24. This patch
> fixes the problem.
thanks Paul!
Tested-by: Etienne Basset <etienne.basset@numericable.fr>
>
> Reported-by: Etienne Basset <etienne.basset@numericable.fr>
> Signed-off-by: Paul Moore <paul.moore@hp.com>
> ---
>
> net/netlabel/netlabel_addrlist.c | 26 ++++++++++----------------
> 1 files changed, 10 insertions(+), 16 deletions(-)
>
> diff --git a/net/netlabel/netlabel_addrlist.c b/net/netlabel/netlabel_addrlist.c
> index 834c6eb..c051913 100644
> --- a/net/netlabel/netlabel_addrlist.c
> +++ b/net/netlabel/netlabel_addrlist.c
> @@ -256,13 +256,11 @@ struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,
> {
> struct netlbl_af4list *entry;
>
> - entry = netlbl_af4list_search(addr, head);
> - if (entry != NULL && entry->addr == addr && entry->mask == mask) {
> - netlbl_af4list_remove_entry(entry);
> - return entry;
> - }
> -
> - return NULL;
> + entry = netlbl_af4list_search_exact(addr, mask, head);
> + if (entry == NULL)
> + return NULL;
> + netlbl_af4list_remove_entry(entry);
> + return entry;
> }
>
> #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
> @@ -299,15 +297,11 @@ struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,
> {
> struct netlbl_af6list *entry;
>
> - entry = netlbl_af6list_search(addr, head);
> - if (entry != NULL &&
> - ipv6_addr_equal(&entry->addr, addr) &&
> - ipv6_addr_equal(&entry->mask, mask)) {
> - netlbl_af6list_remove_entry(entry);
> - return entry;
> - }
> -
> - return NULL;
> + entry = netlbl_af6list_search_exact(addr, mask, head);
> + if (entry == NULL)
> + return NULL;
> + netlbl_af6list_remove_entry(entry);
> + return entry;
> }
> #endif /* IPv6 */
>
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] netlabel: Always remove the correct address selector
2009-04-22 5:55 ` Etienne Basset
@ 2009-04-22 7:46 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2009-04-22 7:46 UTC (permalink / raw)
To: etienne.basset; +Cc: paul.moore, netdev, linux-security-module
From: Etienne Basset <etienne.basset@numericable.fr>
Date: Wed, 22 Apr 2009 07:55:05 +0200
> Hi,
>
> Paul Moore wrote:
>> The NetLabel address selector mechanism has a problem where it can get
>> mistakenly remove the wrong selector when similar addresses are used. The
>> problem is caused when multiple addresses are configured that have different
>> netmasks but the same address, e.g. 127.0.0.0/8 and 127.0.0.0/24. This patch
>> fixes the problem.
>
> thanks Paul!
>
> Tested-by: Etienne Basset <etienne.basset@numericable.fr>
Applied, thanks everyone.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-04-22 7:46 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-04-21 20:04 [PATCH] netlabel: Always remove the correct address selector Paul Moore
2009-04-21 22:43 ` James Morris
2009-04-22 5:55 ` Etienne Basset
2009-04-22 7:46 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).