Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Sasha Levin <Alexander.Levin@microsoft.com>
To:     "stable@vger.kernel.org" <stable@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
CC:     Piotr Sawicki <p.sawicki2@partner.samsung.com>,
        Casey Schaufler <casey@schaufler-ca.com>,
        Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL 4.18 62/88] Smack: Fix handling of IPv4 traffic
 received by PF_INET6 sockets
Thread-Topic: [PATCH AUTOSEL 4.18 62/88] Smack: Fix handling of IPv4 traffic
 received by PF_INET6 sockets
Thread-Index: AQHURkLVVoRa9s2PDEy6SQrylBOkog==
Date:   Fri, 7 Sep 2018 00:36:37 +0000
Message-ID: <20180907003547.57567-62-alexander.levin@microsoft.com>
References: <20180907003547.57567-1-alexander.levin@microsoft.com>
In-Reply-To: <20180907003547.57567-1-alexander.levin@microsoft.com>
Accept-Language: en-US
Content-Language: en-US
received-spf: None (protection.outlook.com: microsoft.com does not designate
 permitted sender hosts)
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 4ed73b59-9185-4949-eb45-08d6145a185f
X-MS-Exchange-CrossTenant-originalarrivaltime: 07 Sep 2018 00:36:37.0268
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0118
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Piotr Sawicki <p.sawicki2@partner.samsung.com>

[ Upstream commit 129a99890936766f4b69b9da7ed88366313a9210 ]

A socket which has sk_family set to PF_INET6 is able to receive not
only IPv6 but also IPv4 traffic (IPv4-mapped IPv6 addresses).

Prior to this patch, the smk_skb_to_addr_ipv6() could have been
called for socket buffers containing IPv4 packets, in result such
traffic was allowed.

Signed-off-by: Piotr Sawicki <p.sawicki2@partner.samsung.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
 security/smack/smack_lsm.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 19de675d4504..8b6cd5a79bfa 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3924,15 +3924,19 @@ static int smack_socket_sock_rcv_skb(struct sock *s=
k, struct sk_buff *skb)
 	struct smack_known *skp =3D NULL;
 	int rc =3D 0;
 	struct smk_audit_info ad;
+	u16 family =3D sk->sk_family;
 #ifdef CONFIG_AUDIT
 	struct lsm_network_audit net;
 #endif
 #if IS_ENABLED(CONFIG_IPV6)
 	struct sockaddr_in6 sadd;
 	int proto;
+
+	if (family =3D=3D PF_INET6 && skb->protocol =3D=3D htons(ETH_P_IP))
+		family =3D PF_INET;
 #endif /* CONFIG_IPV6 */
=20
-	switch (sk->sk_family) {
+	switch (family) {
 	case PF_INET:
 #ifdef CONFIG_SECURITY_SMACK_NETFILTER
 		/*
@@ -3950,7 +3954,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk,=
 struct sk_buff *skb)
 		 */
 		netlbl_secattr_init(&secattr);
=20
-		rc =3D netlbl_skbuff_getattr(skb, sk->sk_family, &secattr);
+		rc =3D netlbl_skbuff_getattr(skb, family, &secattr);
 		if (rc =3D=3D 0)
 			skp =3D smack_from_secattr(&secattr, ssp);
 		else
@@ -3963,7 +3967,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk,=
 struct sk_buff *skb)
 #endif
 #ifdef CONFIG_AUDIT
 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
-		ad.a.u.net->family =3D sk->sk_family;
+		ad.a.u.net->family =3D family;
 		ad.a.u.net->netif =3D skb->skb_iif;
 		ipv4_skb_to_auditdata(skb, &ad.a, NULL);
 #endif
@@ -3977,7 +3981,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk,=
 struct sk_buff *skb)
 		rc =3D smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
 					MAY_WRITE, rc);
 		if (rc !=3D 0)
-			netlbl_skbuff_err(skb, sk->sk_family, rc, 0);
+			netlbl_skbuff_err(skb, family, rc, 0);
 		break;
 #if IS_ENABLED(CONFIG_IPV6)
 	case PF_INET6:
@@ -3993,7 +3997,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk,=
 struct sk_buff *skb)
 			skp =3D smack_net_ambient;
 #ifdef CONFIG_AUDIT
 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
-		ad.a.u.net->family =3D sk->sk_family;
+		ad.a.u.net->family =3D family;
 		ad.a.u.net->netif =3D skb->skb_iif;
 		ipv6_skb_to_auditdata(skb, &ad.a, NULL);
 #endif /* CONFIG_AUDIT */
--=20
2.17.1