diff options
author | Pablo Neira Ayuso <pablo@netfilter.org> | 2011-01-06 11:25:00 -0800 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2011-01-06 11:25:00 -0800 |
commit | cba85b532e4aabdb97f44c18987d45141fd93faa (patch) | |
tree | 785e2a715a922c36b15e1929473498e3b3aae724 /drivers/net/cnic.c | |
parent | f682cefa5ad204d3bfaa54a58046c66d2d035ac1 (diff) | |
download | op-kernel-dev-cba85b532e4aabdb97f44c18987d45141fd93faa.zip op-kernel-dev-cba85b532e4aabdb97f44c18987d45141fd93faa.tar.gz |
netfilter: fix export secctx error handling
In 1ae4de0cdf855305765592647025bde55e85e451, the secctx was exported
via the /proc/net/netfilter/nf_conntrack and ctnetlink interfaces
instead of the secmark.
That patch introduced the use of security_secid_to_secctx() which may
return a non-zero value on error.
In one of my setups, I have NF_CONNTRACK_SECMARK enabled but no
security modules. Thus, security_secid_to_secctx() returns a negative
value that results in the breakage of the /proc and `conntrack -L'
outputs. To fix this, we skip the inclusion of secctx if the
aforementioned function fails.
This patch also fixes the dynamic netlink message size calculation
if security_secid_to_secctx() returns an error, since its logic is
also wrong.
This problem exists in Linux kernel >= 2.6.37.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/cnic.c')
0 files changed, 0 insertions, 0 deletions