Merge branch 'parisc' from /home/kyle/repos/parisc-2.6.git

[linux-2.6] / include / linux / security.h

diff --git a/include/linux/security.h b/include/linux/security.h
index a509329a669b165c52b8f8078ff9b862ea452e4f..83cdefae993165cce7e8601dc127fcb520420161 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -826,6 +826,8 @@ struct request_sock;
  *     Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
  * @inet_csk_clone:
  *     Sets the new child socket's sid to the openreq sid.
+ * @inet_conn_established:
+ *     Sets the connection's peersid to the secmark on skb.
  * @req_classify_flow:
  *     Sets the flow's sid to the openreq sid.
  *
@@ -884,11 +886,6 @@ struct request_sock;
  *     @xp contains the policy to check for a match.
  *     @fl contains the flow to check for a match.
  *     Return 1 if there is a match.
- * @xfrm_flow_state_match:
- *     @fl contains the flow key to match.
- *     @xfrm points to the xfrm_state to match.
- *     @xp points to the xfrm_policy to match.
- *     Return 1 if there is a match.
  * @xfrm_decode_session:
  *     @skb points to skb to decode.
  *     @secid points to the flow key secid to set.
@@ -1368,6 +1365,7 @@ struct security_operations {
        int (*inet_conn_request)(struct sock *sk, struct sk_buff *skb,
                                        struct request_sock *req);
        void (*inet_csk_clone)(struct sock *newsk, const struct request_sock *req);
+       void (*inet_conn_established)(struct sock *sk, struct sk_buff *skb);
        void (*req_classify_flow)(const struct request_sock *req, struct flowi *fl);
 #endif /* CONFIG_SECURITY_NETWORK */
 
@@ -1385,8 +1383,6 @@ struct security_operations {
        int (*xfrm_policy_lookup)(struct xfrm_policy *xp, u32 fl_secid, u8 dir);
        int (*xfrm_state_pol_flow_match)(struct xfrm_state *x,
                        struct xfrm_policy *xp, struct flowi *fl);
-       int (*xfrm_flow_state_match)(struct flowi *fl, struct xfrm_state *xfrm,
-                       struct xfrm_policy *xp);
        int (*xfrm_decode_session)(struct sk_buff *skb, u32 *secid, int ckall);
 #endif /* CONFIG_SECURITY_NETWORK_XFRM */
 
@@ -2961,9 +2957,15 @@ static inline void security_inet_csk_clone(struct sock *newsk,
 {
        security_ops->inet_csk_clone(newsk, req);
 }
+
+static inline void security_inet_conn_established(struct sock *sk,
+                       struct sk_buff *skb)
+{
+       security_ops->inet_conn_established(sk, skb);
+}
 #else  /* CONFIG_SECURITY_NETWORK */
 static inline int security_unix_stream_connect(struct socket * sock,
-                                              struct socket * other, 
+                                              struct socket * other,
                                               struct sock * newsk)
 {
        return 0;
@@ -3110,6 +3112,11 @@ static inline void security_inet_csk_clone(struct sock *newsk,
                        const struct request_sock *req)
 {
 }
+
+static inline void security_inet_conn_established(struct sock *sk,
+                       struct sk_buff *skb)
+{
+}
 #endif /* CONFIG_SECURITY_NETWORK */
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM
@@ -3172,12 +3179,6 @@ static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
        return security_ops->xfrm_state_pol_flow_match(x, xp, fl);
 }
 
-static inline int security_xfrm_flow_state_match(struct flowi *fl,
-                       struct xfrm_state *xfrm, struct xfrm_policy *xp)
-{
-       return security_ops->xfrm_flow_state_match(fl, xfrm, xp);
-}
-
 static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
 {
        return security_ops->xfrm_decode_session(skb, secid, 1);
@@ -3241,12 +3242,6 @@ static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
        return 1;
 }
 
-static inline int security_xfrm_flow_state_match(struct flowi *fl,
-                       struct xfrm_state *xfrm, struct xfrm_policy *xp)
-{
-       return 1;
-}
-
 static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
 {
        return 0;