Commit b6340fcd authored by Venkat Yekkirala's avatar Venkat Yekkirala Committed by David S. Miller
Browse files

[MLSXFRM]: Add security sid to flowi 



This adds security to flow key for labeling of flows as also to allow
for making flow cache lookups based on the security label seemless.

Signed-off-by: default avatarVenkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 892c141e

Documentation/networking/secid.txt

0 → 100644
+14 −0
Original line number Diff line number Diff line 
flowi structure:



The secid member in the flow structure is used in LSMs (e.g. SELinux) to indicate

the label of the flow. This label of the flow is currently used in selecting

matching labeled xfrm(s).



If this is an outbound flow, the label is derived from the socket, if any, or

the incoming packet this flow is being generated as a response to (e.g. tcp

resets, timewait ack, etc.). It is also conceivable that the label could be

derived from other sources such as process context, device, etc., in special

cases, as may be appropriate.



If this is an inbound flow, the label is derived from the IPSec security

associations, if any, used by the packet.

include/net/flow.h

+1 −0
Original line number Diff line number Diff line
@@ -78,6 +78,7 @@ struct flowi { 
#define fl_icmp_type	uli_u.icmpt.type

#define fl_icmp_code	uli_u.icmpt.code

#define fl_ipsec_spi	uli_u.spi

	__u32           secid;	/* used by xfrm; see secid.txt */

} __attribute__((__aligned__(BITS_PER_LONG/8)));



#define FLOW_DIR_IN	0