tree b88badda1de339ed01149caf05601400d2e2a9dd
parent b9679a76187694138099e09d7f5091b73086e6d7
author Steffen Klassert <steffen.klassert@secunet.com> 1298462183 +0100
committer Eric Paris <eparis@redhat.com> 1298664051 -0500

selinux: Fix packet forwarding checks on postrouting

The IPSKB_FORWARDED and IP6SKB_FORWARDED flags are used only in the
multicast forwarding case to indicate that a packet looped back after
forward. So these flags are not a good indicator for packet forwarding.
A better indicator is the incoming interface. If we have no socket context,
but an incoming interface and we see the packet in the ip postroute hook,
the packet is going to be forwarded.

With this patch we use the incoming interface as an indicator on packet
forwarding.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: Eric Paris <eparis@redhat.com>