dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

IPsec: fix handling of errors for socket policies 

This treats the security errors encountered in the case of
socket policy matching, the same as how these are treated in
the case of main/sub policies, which is to return a full lookup
failure.

Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Venkat Yekkirala 2006-10-05 15:42:35 -05:00 committed by David S. Miller
parent 5b368e61c2
commit 3bccfbc7a7
1 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
net/xfrm/xfrm_policy.c
View File

@ -1016,12 +1016,16 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir, struc
sk->sk_family);
int err = 0;
if (match)
err = security_xfrm_policy_lookup(pol, fl->secid, policy_to_flow_dir(dir));
if (match && !err)
xfrm_pol_hold(pol);
else
if (match) {
err = security_xfrm_policy_lookup(pol, fl->secid,
policy_to_flow_dir(dir));
if (!err)
xfrm_pol_hold(pol);
else if (err == -ESRCH)
pol = NULL;
else
pol = ERR_PTR(err);
} else
pol = NULL;
}
read_unlock_bh(&xfrm_policy_lock);
@ -1313,8 +1317,11 @@ restart:
pol_dead = 0;
xfrm_nr = 0;
if (sk && sk->sk_policy[1])
if (sk && sk->sk_policy[1]) {
policy = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
if (IS_ERR(policy))
return PTR_ERR(policy);
}
if (!policy) {
/* To accelerate a bit... */
@ -1607,8 +1614,11 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
}
pol = NULL;
if (sk && sk->sk_policy[dir])
if (sk && sk->sk_policy[dir]) {
pol = xfrm_sk_policy_lookup(sk, dir, &fl);
if (IS_ERR(pol))
return 0;
}
if (!pol)
pol = flow_cache_lookup(&fl, family, fl_dir,