Commit 4342f705 authored by Florian Westphal's avatar Florian Westphal Committed by Paul Moore
Browse files

selinux: remove unneeded ipv6 hook wrappers 



Netfilter places the protocol number the hook function is getting called
from in state->pf, so we can use that instead of an extra wrapper.

While at it, remove one-line wrappers too and make
selinux_ip_{out,forward,postroute} useable as hook function.

Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Message-Id: <20211011202229.28289-1-fw@strlen.de>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent f5d0e5e9

security/selinux/hooks.c

+18 −62
Original line number Diff line number Diff line
@@ -5689,10 +5689,11 @@ static int selinux_tun_dev_open(void *security) 


#ifdef CONFIG_NETFILTER



static unsigned int selinux_ip_forward(struct sk_buff *skb,

				       const struct net_device *indev,

				       u16 family)

static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,

				       const struct nf_hook_state *state)

{

	const struct net_device *indev = state->in;

	u16 family = state->pf;

	int err;

	char *addrp;

	u32 peer_sid;
@@ -5747,25 +5748,10 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, 
	return NF_ACCEPT;

}



static unsigned int selinux_ipv4_forward(void *priv,

					 struct sk_buff *skb,

static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,

				      const struct nf_hook_state *state)

{

	return selinux_ip_forward(skb, state->in, PF_INET);

}



#if IS_ENABLED(CONFIG_IPV6)

static unsigned int selinux_ipv6_forward(void *priv,

					 struct sk_buff *skb,

					 const struct nf_hook_state *state)

{

	return selinux_ip_forward(skb, state->in, PF_INET6);

}

#endif	/* IPV6 */



static unsigned int selinux_ip_output(struct sk_buff *skb,

				      u16 family)

{

	u16 family = state->pf;

	struct sock *sk;

	u32 sid;
@@ -5805,21 +5791,6 @@ static unsigned int selinux_ip_output(struct sk_buff *skb, 
	return NF_ACCEPT;

}



static unsigned int selinux_ipv4_output(void *priv,

					struct sk_buff *skb,

					const struct nf_hook_state *state)

{

	return selinux_ip_output(skb, PF_INET);

}



#if IS_ENABLED(CONFIG_IPV6)

static unsigned int selinux_ipv6_output(void *priv,

					struct sk_buff *skb,

					const struct nf_hook_state *state)

{

	return selinux_ip_output(skb, PF_INET6);

}

#endif	/* IPV6 */



static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,

						int ifindex,
@@ -5855,10 +5826,12 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, 
	return NF_ACCEPT;

}



static unsigned int selinux_ip_postroute(struct sk_buff *skb,

					 const struct net_device *outdev,

					 u16 family)

static unsigned int selinux_ip_postroute(void *priv,

					 struct sk_buff *skb,

					 const struct nf_hook_state *state)

{

	const struct net_device *outdev = state->out;

	u16 family = state->pf;

	u32 secmark_perm;

	u32 peer_sid;

	int ifindex = outdev->ifindex;
@@ -5994,23 +5967,6 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, 


	return NF_ACCEPT;

}



static unsigned int selinux_ipv4_postroute(void *priv,

					   struct sk_buff *skb,

					   const struct nf_hook_state *state)

{

	return selinux_ip_postroute(skb, state->out, PF_INET);

}



#if IS_ENABLED(CONFIG_IPV6)

static unsigned int selinux_ipv6_postroute(void *priv,

					   struct sk_buff *skb,

					   const struct nf_hook_state *state)

{

	return selinux_ip_postroute(skb, state->out, PF_INET6);

}

#endif	/* IPV6 */



#endif	/* CONFIG_NETFILTER */



static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
@@ -7475,38 +7431,38 @@ DEFINE_LSM(selinux) = { 


static const struct nf_hook_ops selinux_nf_ops[] = {

	{

		.hook =		selinux_ipv4_postroute,

		.hook =		selinux_ip_postroute,

		.pf =		NFPROTO_IPV4,

		.hooknum =	NF_INET_POST_ROUTING,

		.priority =	NF_IP_PRI_SELINUX_LAST,

	},

	{

		.hook =		selinux_ipv4_forward,

		.hook =		selinux_ip_forward,

		.pf =		NFPROTO_IPV4,

		.hooknum =	NF_INET_FORWARD,

		.priority =	NF_IP_PRI_SELINUX_FIRST,

	},

	{

		.hook =		selinux_ipv4_output,

		.hook =		selinux_ip_output,

		.pf =		NFPROTO_IPV4,

		.hooknum =	NF_INET_LOCAL_OUT,

		.priority =	NF_IP_PRI_SELINUX_FIRST,

	},

#if IS_ENABLED(CONFIG_IPV6)

	{

		.hook =		selinux_ipv6_postroute,

		.hook =		selinux_ip_postroute,

		.pf =		NFPROTO_IPV6,

		.hooknum =	NF_INET_POST_ROUTING,

		.priority =	NF_IP6_PRI_SELINUX_LAST,

	},

	{

		.hook =		selinux_ipv6_forward,

		.hook =		selinux_ip_forward,

		.pf =		NFPROTO_IPV6,

		.hooknum =	NF_INET_FORWARD,

		.priority =	NF_IP6_PRI_SELINUX_FIRST,

	},

	{

		.hook =		selinux_ipv6_output,

		.hook =		selinux_ip_output,

		.pf =		NFPROTO_IPV6,

		.hooknum =	NF_INET_LOCAL_OUT,

		.priority =	NF_IP6_PRI_SELINUX_FIRST,