You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Paul Moore 20e2a86485 cipso: handle CIPSO options correctly when NetLabel is disabled ... When NetLabel is not enabled, e.g. CONFIG_NETLABEL=n, and the system receives a CIPSO tagged packet it is dropped (cipso_v4_validate() returns non-zero). In most cases this is the correct and desired behavior, however, in the case where we are simply forwarding the traffic, e.g. acting as a network bridge, this becomes a problem. This patch fixes the forwarding problem by providing the basic CIPSO validation code directly in ip_options_compile() without the need for the NetLabel or CIPSO code. The new validation code can not perform any of the CIPSO option label/value verification that cipso_v4_validate() does, but it can verify the basic CIPSO option format. The behavior when NetLabel is enabled is unchanged. Signed-off-by: Paul Moore <pmoore@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		13 years ago
..
9p	9p: Reduce object size with CONFIG_NET_9P_DEBUG	13 years ago
bluetooth	Bluetooth: Create flags for bt_sk()	13 years ago
caif	caif-hsi: robust frame aggregation for HSI	13 years ago
irda	…
iucv	af_iucv: add shutdown for HS transport	13 years ago
netfilter	netfilter: nf_conntrack: use this_cpu_inc()	13 years ago
netns	netfilter: nf_ct_helper: allow to disable automatic helper assignment	13 years ago
nfc	NFC: HCI drivers don't have to keep track of polling state	13 years ago
phonet	…
sctp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	13 years ago
tc_act	…
act_api.h	net: sched: constify tcf_proto and tc_action	14 years ago
addrconf.h	ipv6: bool/const conversions phase2	13 years ago
af_ieee802154.h	…
af_rxrpc.h	…
af_unix.h	net: cleanup unsigned to unsigned int	13 years ago
ah.h	…
arp.h	ipv4: Eliminate spurious argument to __ipv4_neigh_lookup	13 years ago
atmclip.h	atm: clip: Use device neigh support on top of "arp_tbl".	13 years ago
ax25.h	net ax25: Fix the build when sysctl support is disabled.	13 years ago
ax88796.h	…
cfg80211-wext.h	cfg80211: remove unused wext handler exports	14 years ago
cfg80211.h	cfg80211: fix cfg80211_can_beacon_sec_chan prototype	13 years ago
checksum.h	…
cipso_ipv4.h	cipso: handle CIPSO options correctly when NetLabel is disabled	13 years ago
cls_cgroup.h	…
codel.h	fq_codel: should use qdisc backlog as threshold	13 years ago
compat.h	net: cleanup unsigned to unsigned int	13 years ago
datalink.h	…
dcbevent.h	dcb: Add stub routines for !CONFIG_DCB	14 years ago
dcbnl.h	net/dcb: Add an optional max rate attribute	13 years ago
dn.h	net: cleanup unsigned to unsigned int	13 years ago
dn_dev.h	…
dn_fib.h	net: cleanup unsigned to unsigned int	13 years ago
dn_neigh.h	…
dn_nsp.h	…
dn_route.h	net: cleanup unsigned to unsigned int	13 years ago
dsa.h	dsa: Include linux/if_ether.h to fix build error	13 years ago
dsfield.h	…
dst.h	ipv6: fix incorrect ipsec fragment	13 years ago
dst_ops.h	net: cleanup unsigned to unsigned int	13 years ago
esp.h	…
ethoc.h	…
fib_rules.h	…
flow.h	ipv4: reset flowi parameters on route connect	13 years ago
flow_keys.h	flow_dissector: use a 64bit load/store	13 years ago
garp.h	…
gen_stats.h	…
genetlink.h	net: Deinline __nlmsg_put and genlmsg_put. -7k code on i386 defconfig.	13 years ago
gre.h	…
icmp.h	net: cleanup unsigned to unsigned int	13 years ago
ieee80211_radiotap.h	wireless: move ieee80211chan2mhz macro	13 years ago
ieee802154.h	6LoWPAN: add fragmentation support	13 years ago
ieee802154_netdev.h	mac802154: declare reduced mlme operations	13 years ago
if_inet6.h	net: delete all instances of special processing for token ring	13 years ago
inet6_connection_sock.h	tcp: bind() use stronger condition for bind_conflict	13 years ago
inet6_hashtables.h	net: use IS_ENABLED(CONFIG_IPV6)	13 years ago
inet_common.h	…
inet_connection_sock.h	ipv6: RTAX_FEATURE_ALLFRAG causes inefficient TCP segment sizing	13 years ago
inet_ecn.h	inet: add rfc 3168 extract in front of INET_ECN_encapsulate()	13 years ago
inet_frag.h	ip_frag: struct inet_frags match() method returns a bool	13 years ago
inet_hashtables.h	atomic: use <linux/atomic.h>	14 years ago
inet_sock.h	net: implement IP_RECVTOS for IP_PKTOPTIONS	13 years ago
inet_timewait_sock.h	inet: remove rcu protection on tw_net	13 years ago
inetpeer.h	route: Remove redirect_genid	13 years ago
ip.h	net: delete all instances of special processing for token ring	13 years ago
ip6_checksum.h	…
ip6_fib.h	ipv6: clean up rt6_clean_expires	13 years ago
ip6_route.h	ipv6: bool/const conversions phase2	13 years ago
ip6_tunnel.h	…
ip_fib.h	net: cleanup unsigned to unsigned int	13 years ago
ip_vs.h	ipvs: add support for sync threads	13 years ago
ipcomp.h	…
ipconfig.h	…
ipip.h	tunnel: implement 64 bits statistics	13 years ago
ipv6.h	ipv6: bool/const conversions phase2	13 years ago
ipx.h	…
iw_handler.h	…
lapb.h	lapb: Neaten debugging	13 years ago
lib80211.h	include: replace linux/module.h with "struct module" wherever possible	13 years ago
llc.h	atomic: use <linux/atomic.h>	14 years ago
llc_c_ac.h	…
llc_c_ev.h	net: cleanup unsigned to unsigned int	13 years ago
llc_c_st.h	…
llc_conn.h	…
llc_if.h	…
llc_pdu.h	net: delete all instances of special processing for token ring	13 years ago
llc_s_ac.h	…
llc_s_ev.h	…
llc_s_st.h	…
llc_sap.h	…
mac80211.h	mac80211: (selectively) add HT details in radiotap	13 years ago
mac802154.h	mac802154: RX data path	13 years ago
mip6.h	…
mld.h	…
ndisc.h	Treat ND option 31 as userland (DNSSL support)	13 years ago
neighbour.h	net: cleanup unsigned to unsigned int	13 years ago
net_namespace.h	net sysctl: Add place holder functions for when sysctl support is compiled out of the kernel.	13 years ago
net_ratelimit.h	net: Kill ratelimit.h dependency in linux/net.h	14 years ago
netdma.h	…
netevent.h	…
netlabel.h	doc: Update the email address for Paul Moore in various source files	14 years ago
netlink.h	netlink: Delete all NLA_PUT*() macros.	13 years ago
netprio_cgroup.h	netprio_cgroup: fix wrong memory access when NETPRIO_CGROUP=m	13 years ago
netrom.h	…
nexthop.h	…
nl802154.h	…
p8022.h	…
ping.h	…
pkt_cls.h	…
pkt_sched.h	net: cleanup unsigned to unsigned int	13 years ago
protocol.h	net: use IS_ENABLED(CONFIG_IPV6)	13 years ago
psnap.h	…
raw.h	…
rawv6.h	ipv6: bool/const conversions phase2	13 years ago
red.h	net_sched: red: Make minor corrections to comments	13 years ago
regulatory.h	cfg80211: pass DFS region to drivers through reg_notifier()	13 years ago
request_sock.h	tcp: Change possible SYN flooding messages	14 years ago
rose.h	…
route.h	net: cleanup unsigned to unsigned int	13 years ago
rtnetlink.h	rtnetlink: ops->get_tx_queue() cannot take a const 'tb'.	13 years ago
sch_generic.h	net: Make qdisc_skb_cb upper size bound explicit.	13 years ago
scm.h	af_unix: dont send SCM_CREDENTIALS by default	14 years ago
secure_seq.h	tcp: add const qualifiers where possible	13 years ago
slhc_vj.h	…
snmp.h	Merge branch 'for-3.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	13 years ago
sock.h	memcg: decrement static keys at real destroy time	13 years ago
stp.h	…
tcp.h	tcp: bool conversions	13 years ago
tcp_memcontrol.h	cgroup: pass struct mem_cgroup instead of struct cgroup to socket memcg	13 years ago
tcp_states.h	…
timewait_sock.h	BUG: headers with BUG/BUG_ON etc. need linux/bug.h	13 years ago
transp_v6.h	net: relax PKTINFO non local ipv6 udp xmit check	14 years ago
udp.h	net/ipv6/udp: UDP encapsulation: introduce encap_rcv hook into IPv6	13 years ago
udplite.h	net: ipv4: Standardize prefixes for message logging	13 years ago
wext.h	…
wimax.h	net: cleanup unsigned to unsigned int	13 years ago
wpan-phy.h	mac802154: monitor device support	13 years ago
x25.h	net: cleanup unsigned to unsigned int	13 years ago
x25device.h	…
xfrm.h	xfrm: Convert several xfrm policy match functions to bool.	13 years ago