diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-03-28 17:30:42 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-03-28 17:30:42 -0700 |
| commit | 7541bba880fb6989f489f0c68fa246a375b44035 (patch) | |
| tree | 19ce55af8e8732aa61cb8db529cf2304d9d738b5 /net/ipv4/tcp_ipv4.c | |
| parent | 795e2fe0a3b69dbc040d7efcf517e0cbad6901d0 (diff) | |
| parent | 4303154e86597885bc3cbc178a48ccbc8213875f (diff) | |
| download | kernel-crypto-7541bba880fb6989f489f0c68fa246a375b44035.tar.gz kernel-crypto-7541bba880fb6989f489f0c68fa246a375b44035.tar.xz kernel-crypto-7541bba880fb6989f489f0c68fa246a375b44035.zip | |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
smack: Add a new '-CIPSO' option to the network address label configuration
netlabel: Cleanup the Smack/NetLabel code to fix incoming TCP connections
lsm: Remove the socket_post_accept() hook
selinux: Remove the "compat_net" compatibility code
netlabel: Label incoming TCP connections correctly in SELinux
lsm: Relocate the IPv4 security_inet_conn_request() hooks
TOMOYO: Fix a typo.
smack: convert smack to standard linux lists
Diffstat (limited to 'net/ipv4/tcp_ipv4.c')
| -rw-r--r-- | net/ipv4/tcp_ipv4.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index d0a314879d8..5d427f86b41 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1230,14 +1230,15 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb) tcp_openreq_init(req, &tmp_opt, skb); - if (security_inet_conn_request(sk, skb, req)) - goto drop_and_free; - ireq = inet_rsk(req); ireq->loc_addr = daddr; ireq->rmt_addr = saddr; ireq->no_srccheck = inet_sk(sk)->transparent; ireq->opt = tcp_v4_save_options(sk, skb); + + if (security_inet_conn_request(sk, skb, req)) + goto drop_and_free; + if (!want_cookie) TCP_ECN_create_request(req, tcp_hdr(skb)); |