Re: Networking Patch (outline)

On Wednesday, September 12 2007 1:08:39 pm Venkatesh Yekkirala wrote:
> > * Inbound packets (flow in check)
> > - add to existing security_sock_rcv_skb() hook for locally consumed
> > packets
> > - new hook in ip[6]_forward_finish(), before the call to
> > ip_forward_options() for ipv4, to catch packets not
> > destined for the
> > local machine
>
> Actually, for forward, we may be able to get away with
> using a netfilter hook, cuz, by this time the label,
> and the true source address should be in place.

Great. I was concerned about the packet having to back through the forward path if it matched a IPsec transform which resulted in a new address, but I imagine that would only affect the outbound check.

> > * Outbound packets (flow out check)
> > - new hook in ip_finish_output()/ip6_output_finish() to
> > catch all outbound
> > packets, including forwarded packets on their way out
>
> I will whip up a prototype patch and send it on in a day or two.

Excellent.

-- 
paul moore
linux security @ hp

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.