linux-stable/net/ipv6
Kuniyuki Iwashima cc0e7678af dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses.
[ Upstream commit 23be1e0e2a ]

Initially, commit 4237c75c0a ("[MLSXFRM]: Auto-labeling of child
sockets") introduced security_inet_conn_request() in some functions
where reqsk is allocated.  The hook is added just after the allocation,
so reqsk's IPv6 remote address was not initialised then.

However, SELinux/Smack started to read it in netlbl_req_setattr()
after commit e1adea9270 ("calipso: Allow request sockets to be
relabelled by the lsm.").

Commit 284904aa79 ("lsm: Relocate the IPv4 security_inet_conn_request()
hooks") fixed that kind of issue only in TCPv4 because IPv6 labeling was
not supported at that time.  Finally, the same issue was introduced again
in IPv6.

Let's apply the same fix on DCCPv6 and TCPv6.

Fixes: e1adea9270 ("calipso: Allow request sockets to be relabelled by the lsm.")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-11-20 10:27:35 +01:00
..
ila ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() 2023-03-17 08:30:37 +01:00
netfilter treewide: Remove uninitialized_var() usage 2023-08-11 11:33:32 +02:00
Kconfig net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC 2020-10-01 13:12:24 +02:00
Makefile
addrconf.c net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr 2023-09-23 10:47:02 +02:00
addrconf_core.c net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup 2020-05-20 08:17:02 +02:00
addrlabel.c ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network 2022-11-25 17:36:45 +01:00
af_inet6.c dccp: Call inet6_destroy_sock() via sk->sk_destruct(). 2023-04-26 11:18:57 +02:00
ah6.c ah6: fix error return code in ah6_input() 2020-11-24 13:05:35 +01:00
anycast.c ipv6: fix memory leaks on IPV6_ADDRFORM path 2020-08-21 09:48:00 +02:00
calipso.c cipso,calipso: resolve a number of problems with the DOI refcounts 2021-03-17 16:34:29 +01:00
datagram.c ipv6: Fix datagram socket connection with DSCP. 2023-02-22 12:46:06 +01:00
esp6.c net: ipv6: fix return value check in esp_remove_trailer 2023-10-25 11:13:32 +02:00
esp6_offload.c xfrm: Linearize the skb after offloading if needed. 2023-06-28 10:14:19 +02:00
exthdrs.c
exthdrs_core.c ipv6: Fix out-of-bounds access in ipv6_find_tlv() 2023-05-30 12:38:38 +01:00
exthdrs_offload.c
fib6_notifier.c
fib6_rules.c
fou6.c
icmp.c net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-03-03 18:22:57 +01:00
inet6_connection_sock.c net: ipv6: add net argument to ip6_dst_lookup_flow 2020-05-20 08:17:02 +02:00
inet6_hashtables.c secure_seq: use the 64 bits of the siphash for port offset calculation 2022-06-06 08:20:56 +02:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-11-04 14:52:49 +01:00
ip6_fib.c ipv6: Fix route replacement with dev-only route 2020-03-11 18:02:47 +01:00
ip6_flowlabel.c treewide: Remove uninitialized_var() usage 2023-08-11 11:33:32 +02:00
ip6_gre.c ipv6: ensure sane device mtu in tunnels 2023-02-06 07:46:35 +01:00
ip6_icmp.c net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-03-03 18:22:57 +01:00
ip6_input.c tcp/udp: Make early_demux back namespacified. 2022-11-10 15:47:22 +01:00
ip6_offload.c gso: do not skip outer ip header in case of ipip and net_failover 2022-03-02 11:33:55 +01:00
ip6_offload.h
ip6_output.c ipv6: avoid atomic fragment on GSO packets 2023-11-20 10:27:33 +01:00
ip6_tunnel.c net: tunnels: annotate lockless accesses to dev->needed_headroom 2023-03-22 13:26:14 +01:00
ip6_udp_tunnel.c ipv6: explicitly initialize udp6_addr in udp_sock_create6() 2019-01-09 17:14:43 +01:00
ip6_vti.c ip6_vti: fix slab-use-after-free in decode_session6 2023-08-30 16:35:11 +02:00
ip6mr.c ip6mr: Fix skb_under_panic in ip6mr_cache_report() 2023-08-11 11:33:55 +02:00
ipcomp6.c
ipv6_sockglue.c udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). 2023-04-26 11:18:57 +02:00
mcast.c mld: fix panic in mld_newpack() 2021-06-03 08:36:24 +02:00
mcast_snoop.c
mip6.c
ndisc.c ipv6: adjust ndisc_is_useropt() to also return true for PIO 2023-08-16 18:10:53 +02:00
netfilter.c netfilter: ipv6: Don't preserve original oif for loopback address 2019-02-27 10:08:08 +01:00
output_core.c ipv6: use prandom_u32() for ID generation 2021-07-20 16:17:43 +02:00
ping.c ping6: Fix send to link-local addresses with VRF. 2023-06-21 15:38:58 +02:00
proc.c
protocol.c
raw.c inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-04-26 11:18:57 +02:00
reassembly.c ipv6: record frag_max_size in atomic fragments in input path 2021-06-03 08:36:25 +02:00
route.c ipv6: Do cleanup if attribute validation fails in multipath route 2022-01-11 13:57:37 +01:00
seg6.c ipv6: sr: fix out-of-bounds read when setting HMAC data. 2022-09-15 12:23:52 +02:00
seg6_hmac.c net: ipv6: unexport __init-annotated seg6_hmac_net_init() 2022-07-07 17:31:17 +02:00
seg6_iptunnel.c seg6: fix skb checksum evaluation in SRH encapsulation/insertion 2022-07-21 20:42:45 +02:00
seg6_local.c seg6: fix skb checksum in SRv6 End.B6 and End.B6.Encaps behaviors 2022-07-21 20:42:45 +02:00
sit.c sit: update dev->needed_headroom in ipip6_tunnel_bind_dev() 2023-05-17 11:11:48 +02:00
syncookies.c dccp/tcp: Call security_inet_conn_request() after setting IPv6 addresses. 2023-11-20 10:27:35 +01:00
sysctl_net_ipv6.c
tcp_ipv6.c inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy(). 2023-04-26 11:18:57 +02:00
tcpv6_offload.c
tunnel6.c
udp.c udp6: fix udp6_ehashfn() typo 2023-08-11 11:33:43 +02:00
udp_impl.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2023-04-26 11:18:57 +02:00
udp_offload.c
udplite.c tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2023-04-26 11:18:57 +02:00
xfrm6_input.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-11-04 14:52:37 +01:00
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c xfrm: reset transport header back to network header after all input transforms ahave been applied 2018-11-04 14:52:37 +01:00
xfrm6_mode_tunnel.c
xfrm6_output.c net: ipv6: fix return value of ip6_skb_dst_mtu 2021-07-28 11:12:15 +02:00
xfrm6_policy.c xfrm: Fix ignored return value in xfrm6_init() 2022-12-08 11:16:30 +01:00
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c xfrm6_tunnel: Fix potential panic when unloading xfrm6_tunnel module 2019-05-25 18:25:34 +02:00