| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20120601.141810.1973076676004541876.davem@davemloft.net> Date: Fri, 01 Jun 2012 14:18:10 -0400 (EDT) From: David Miller <davem@...emloft.net> To: pmoore@...hat.com Cc: netdev@...r.kernel.org, linux-security-module@...r.kernel.org Subject: Re: [PATCH v2] cipso: handle CIPSO options correctly when NetLabel is disabled From: Paul Moore <pmoore@...hat.com> Date: Fri, 01 Jun 2012 11:54:56 -0400 > When NetLabel is not enabled, e.g. CONFIG_NETLABEL=n, and the system > receives a CIPSO tagged packet it is dropped (cipso_v4_validate() > returns non-zero). In most cases this is the correct and desired > behavior, however, in the case where we are simply forwarding the > traffic, e.g. acting as a network bridge, this becomes a problem. > > This patch fixes the forwarding problem by providing the basic CIPSO > validation code directly in ip_options_compile() without the need for > the NetLabel or CIPSO code. The new validation code can not perform > any of the CIPSO option label/value verification that > cipso_v4_validate() does, but it can verify the basic CIPSO option > format. > > The behavior when NetLabel is enabled is unchanged. > > CC: stable@...r.kernel.org > Signed-off-by: Paul Moore <pmoore@...hat.com> > I like this a lot better, applied, thanks Paul. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists