From: Paul Moore Date: Fri, 10 Oct 2008 14:16:30 +0000 (-0400) Subject: selinux: Better local/forward check in selinux_ip_postroute() X-Git-Tag: v2.6.28-rc1~609^2~1^2^2~12 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d8395c876bb8a560c8a032887e191b95499a25d6;p=pandora-kernel.git selinux: Better local/forward check in selinux_ip_postroute() It turns out that checking to see if skb->sk is NULL is not a very good indicator of a forwarded packet as some locally generated packets also have skb->sk set to NULL. Fix this by not only checking the skb->sk field but also the IP[6]CB(skb)->flags field for the IP[6]SKB_FORWARDED flag. While we are at it, we are calling selinux_parse_skb() much earlier than we really should resulting in potentially wasted cycles parsing packets for information we might no use; so shuffle the code around a bit to fix this. Signed-off-by: Paul Moore Acked-by: James Morris --- Reading git-diff-tree failed