lkml.org 
[lkml]   [2007]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 05/31] NetLabel: Verify sensitivity level has a valid CIPSO mapping
    -stable review patch.  If anyone has any objections, please let us know.

    ------------------

    The current CIPSO engine has a problem where it does not verify that the given
    sensitivity level has a valid CIPSO mapping when the "std" CIPSO DOI type is
    used. The end result is that bad packets are sent on the wire which should
    have never been sent in the first place. This patch corrects this problem by
    verifying the sensitivity level mapping similar to what is done with the
    category mapping. This patch also changes the returned error code in this case
    to -EPERM to better match what the category mapping verification code returns.

    Signed-off-by: Paul Moore <paul.moore@hp.com>
    Acked-by: James Morris <jmorris@namei.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>


    ---
    net/ipv4/cipso_ipv4.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    --- a/net/ipv4/cipso_ipv4.c
    +++ b/net/ipv4/cipso_ipv4.c
    @@ -732,11 +732,12 @@ static int cipso_v4_map_lvl_hton(const s
    *net_lvl = host_lvl;
    return 0;
    case CIPSO_V4_MAP_STD:
    - if (host_lvl < doi_def->map.std->lvl.local_size) {
    + if (host_lvl < doi_def->map.std->lvl.local_size &&
    + doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
    *net_lvl = doi_def->map.std->lvl.local[host_lvl];
    return 0;
    }
    - break;
    + return -EPERM;
    }

    return -EINVAL;
    @@ -771,7 +772,7 @@ static int cipso_v4_map_lvl_ntoh(const s
    *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
    return 0;
    }
    - break;
    + return -EPERM;
    }

    return -EINVAL;
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-03-19 22:43    [W:2.730 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site