redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

selinux: fix a problem with IPv6 traffic denials in selinux_ip_postroute() 

A previous commit c0828e5048 ("selinux:
process labeled IPsec TCP SYN-ACK packets properly in
selinux_ip_postroute()") mistakenly left out a 'break' from a switch
statement which caused problems with IPv6 traffic.

Thanks to Florian Westphal for reporting and debugging the issue.

Reported-by: Florian Westphal <fwestpha@redhat.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
hifive-unleashed-5.1
Paul Moore 2014-09-03 10:51:59 -04:00
parent 7b0d0b40cd
commit a7a91a1928
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
security/selinux/hooks.c
View File

@ -4993,6 +4993,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
case PF_INET6:
if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
return NF_ACCEPT;
break;
default:
return NF_DROP_ERR(-ECONNREFUSED);
}