cipso_ipv4.c 52 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972
  1. /*
  2. * CIPSO - Commercial IP Security Option
  3. *
  4. * This is an implementation of the CIPSO 2.2 protocol as specified in
  5. * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
  6. * FIPS-188, copies of both documents can be found in the Documentation
  7. * directory. While CIPSO never became a full IETF RFC standard many vendors
  8. * have chosen to adopt the protocol and over the years it has become a
  9. * de-facto standard for labeled networking.
  10. *
  11. * Author: Paul Moore <paul.moore@hp.com>
  12. *
  13. */
  14. /*
  15. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  16. *
  17. * This program is free software; you can redistribute it and/or modify
  18. * it under the terms of the GNU General Public License as published by
  19. * the Free Software Foundation; either version 2 of the License, or
  20. * (at your option) any later version.
  21. *
  22. * This program is distributed in the hope that it will be useful,
  23. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
  25. * the GNU General Public License for more details.
  26. *
  27. * You should have received a copy of the GNU General Public License
  28. * along with this program; if not, write to the Free Software
  29. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  30. *
  31. */
  32. #include <linux/init.h>
  33. #include <linux/types.h>
  34. #include <linux/rcupdate.h>
  35. #include <linux/list.h>
  36. #include <linux/spinlock.h>
  37. #include <linux/string.h>
  38. #include <linux/jhash.h>
  39. #include <net/ip.h>
  40. #include <net/icmp.h>
  41. #include <net/tcp.h>
  42. #include <net/netlabel.h>
  43. #include <net/cipso_ipv4.h>
  44. #include <asm/atomic.h>
  45. #include <asm/bug.h>
  46. struct cipso_v4_domhsh_entry {
  47. char *domain;
  48. u32 valid;
  49. struct list_head list;
  50. struct rcu_head rcu;
  51. };
  52. /* List of available DOI definitions */
  53. /* XXX - Updates should be minimal so having a single lock for the
  54. * cipso_v4_doi_list and the cipso_v4_doi_list->dom_list should be
  55. * okay. */
  56. /* XXX - This currently assumes a minimal number of different DOIs in use,
  57. * if in practice there are a lot of different DOIs this list should
  58. * probably be turned into a hash table or something similar so we
  59. * can do quick lookups. */
  60. static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
  61. static struct list_head cipso_v4_doi_list = LIST_HEAD_INIT(cipso_v4_doi_list);
  62. /* Label mapping cache */
  63. int cipso_v4_cache_enabled = 1;
  64. int cipso_v4_cache_bucketsize = 10;
  65. #define CIPSO_V4_CACHE_BUCKETBITS 7
  66. #define CIPSO_V4_CACHE_BUCKETS (1 << CIPSO_V4_CACHE_BUCKETBITS)
  67. #define CIPSO_V4_CACHE_REORDERLIMIT 10
  68. struct cipso_v4_map_cache_bkt {
  69. spinlock_t lock;
  70. u32 size;
  71. struct list_head list;
  72. };
  73. struct cipso_v4_map_cache_entry {
  74. u32 hash;
  75. unsigned char *key;
  76. size_t key_len;
  77. struct netlbl_lsm_cache *lsm_data;
  78. u32 activity;
  79. struct list_head list;
  80. };
  81. static struct cipso_v4_map_cache_bkt *cipso_v4_cache = NULL;
  82. /* Restricted bitmap (tag #1) flags */
  83. int cipso_v4_rbm_optfmt = 0;
  84. int cipso_v4_rbm_strictvalid = 1;
  85. /*
  86. * Helper Functions
  87. */
  88. /**
  89. * cipso_v4_bitmap_walk - Walk a bitmap looking for a bit
  90. * @bitmap: the bitmap
  91. * @bitmap_len: length in bits
  92. * @offset: starting offset
  93. * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
  94. *
  95. * Description:
  96. * Starting at @offset, walk the bitmap from left to right until either the
  97. * desired bit is found or we reach the end. Return the bit offset, -1 if
  98. * not found, or -2 if error.
  99. */
  100. static int cipso_v4_bitmap_walk(const unsigned char *bitmap,
  101. u32 bitmap_len,
  102. u32 offset,
  103. u8 state)
  104. {
  105. u32 bit_spot;
  106. u32 byte_offset;
  107. unsigned char bitmask;
  108. unsigned char byte;
  109. /* gcc always rounds to zero when doing integer division */
  110. byte_offset = offset / 8;
  111. byte = bitmap[byte_offset];
  112. bit_spot = offset;
  113. bitmask = 0x80 >> (offset % 8);
  114. while (bit_spot < bitmap_len) {
  115. if ((state && (byte & bitmask) == bitmask) ||
  116. (state == 0 && (byte & bitmask) == 0))
  117. return bit_spot;
  118. bit_spot++;
  119. bitmask >>= 1;
  120. if (bitmask == 0) {
  121. byte = bitmap[++byte_offset];
  122. bitmask = 0x80;
  123. }
  124. }
  125. return -1;
  126. }
  127. /**
  128. * cipso_v4_bitmap_setbit - Sets a single bit in a bitmap
  129. * @bitmap: the bitmap
  130. * @bit: the bit
  131. * @state: if non-zero, set the bit (1) else clear the bit (0)
  132. *
  133. * Description:
  134. * Set a single bit in the bitmask. Returns zero on success, negative values
  135. * on error.
  136. */
  137. static void cipso_v4_bitmap_setbit(unsigned char *bitmap,
  138. u32 bit,
  139. u8 state)
  140. {
  141. u32 byte_spot;
  142. u8 bitmask;
  143. /* gcc always rounds to zero when doing integer division */
  144. byte_spot = bit / 8;
  145. bitmask = 0x80 >> (bit % 8);
  146. if (state)
  147. bitmap[byte_spot] |= bitmask;
  148. else
  149. bitmap[byte_spot] &= ~bitmask;
  150. }
  151. /**
  152. * cipso_v4_doi_domhsh_free - Frees a domain list entry
  153. * @entry: the entry's RCU field
  154. *
  155. * Description:
  156. * This function is designed to be used as a callback to the call_rcu()
  157. * function so that the memory allocated to a domain list entry can be released
  158. * safely.
  159. *
  160. */
  161. static void cipso_v4_doi_domhsh_free(struct rcu_head *entry)
  162. {
  163. struct cipso_v4_domhsh_entry *ptr;
  164. ptr = container_of(entry, struct cipso_v4_domhsh_entry, rcu);
  165. kfree(ptr->domain);
  166. kfree(ptr);
  167. }
  168. /**
  169. * cipso_v4_cache_entry_free - Frees a cache entry
  170. * @entry: the entry to free
  171. *
  172. * Description:
  173. * This function frees the memory associated with a cache entry including the
  174. * LSM cache data if there are no longer any users, i.e. reference count == 0.
  175. *
  176. */
  177. static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
  178. {
  179. if (entry->lsm_data)
  180. netlbl_secattr_cache_free(entry->lsm_data);
  181. kfree(entry->key);
  182. kfree(entry);
  183. }
  184. /**
  185. * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
  186. * @key: the hash key
  187. * @key_len: the length of the key in bytes
  188. *
  189. * Description:
  190. * The CIPSO tag hashing function. Returns a 32-bit hash value.
  191. *
  192. */
  193. static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
  194. {
  195. return jhash(key, key_len, 0);
  196. }
  197. /*
  198. * Label Mapping Cache Functions
  199. */
  200. /**
  201. * cipso_v4_cache_init - Initialize the CIPSO cache
  202. *
  203. * Description:
  204. * Initializes the CIPSO label mapping cache, this function should be called
  205. * before any of the other functions defined in this file. Returns zero on
  206. * success, negative values on error.
  207. *
  208. */
  209. static int cipso_v4_cache_init(void)
  210. {
  211. u32 iter;
  212. cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
  213. sizeof(struct cipso_v4_map_cache_bkt),
  214. GFP_KERNEL);
  215. if (cipso_v4_cache == NULL)
  216. return -ENOMEM;
  217. for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
  218. spin_lock_init(&cipso_v4_cache[iter].lock);
  219. cipso_v4_cache[iter].size = 0;
  220. INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
  221. }
  222. return 0;
  223. }
  224. /**
  225. * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
  226. *
  227. * Description:
  228. * Invalidates and frees any entries in the CIPSO cache. Returns zero on
  229. * success and negative values on failure.
  230. *
  231. */
  232. void cipso_v4_cache_invalidate(void)
  233. {
  234. struct cipso_v4_map_cache_entry *entry, *tmp_entry;
  235. u32 iter;
  236. for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
  237. spin_lock_bh(&cipso_v4_cache[iter].lock);
  238. list_for_each_entry_safe(entry,
  239. tmp_entry,
  240. &cipso_v4_cache[iter].list, list) {
  241. list_del(&entry->list);
  242. cipso_v4_cache_entry_free(entry);
  243. }
  244. cipso_v4_cache[iter].size = 0;
  245. spin_unlock_bh(&cipso_v4_cache[iter].lock);
  246. }
  247. return;
  248. }
  249. /**
  250. * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
  251. * @key: the buffer to check
  252. * @key_len: buffer length in bytes
  253. * @secattr: the security attribute struct to use
  254. *
  255. * Description:
  256. * This function checks the cache to see if a label mapping already exists for
  257. * the given key. If there is a match then the cache is adjusted and the
  258. * @secattr struct is populated with the correct LSM security attributes. The
  259. * cache is adjusted in the following manner if the entry is not already the
  260. * first in the cache bucket:
  261. *
  262. * 1. The cache entry's activity counter is incremented
  263. * 2. The previous (higher ranking) entry's activity counter is decremented
  264. * 3. If the difference between the two activity counters is geater than
  265. * CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
  266. *
  267. * Returns zero on success, -ENOENT for a cache miss, and other negative values
  268. * on error.
  269. *
  270. */
  271. static int cipso_v4_cache_check(const unsigned char *key,
  272. u32 key_len,
  273. struct netlbl_lsm_secattr *secattr)
  274. {
  275. u32 bkt;
  276. struct cipso_v4_map_cache_entry *entry;
  277. struct cipso_v4_map_cache_entry *prev_entry = NULL;
  278. u32 hash;
  279. if (!cipso_v4_cache_enabled)
  280. return -ENOENT;
  281. hash = cipso_v4_map_cache_hash(key, key_len);
  282. bkt = hash & (CIPSO_V4_CACHE_BUCKETBITS - 1);
  283. spin_lock_bh(&cipso_v4_cache[bkt].lock);
  284. list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
  285. if (entry->hash == hash &&
  286. entry->key_len == key_len &&
  287. memcmp(entry->key, key, key_len) == 0) {
  288. entry->activity += 1;
  289. atomic_inc(&entry->lsm_data->refcount);
  290. secattr->cache = entry->lsm_data;
  291. secattr->flags |= NETLBL_SECATTR_CACHE;
  292. if (prev_entry == NULL) {
  293. spin_unlock_bh(&cipso_v4_cache[bkt].lock);
  294. return 0;
  295. }
  296. if (prev_entry->activity > 0)
  297. prev_entry->activity -= 1;
  298. if (entry->activity > prev_entry->activity &&
  299. entry->activity - prev_entry->activity >
  300. CIPSO_V4_CACHE_REORDERLIMIT) {
  301. __list_del(entry->list.prev, entry->list.next);
  302. __list_add(&entry->list,
  303. prev_entry->list.prev,
  304. &prev_entry->list);
  305. }
  306. spin_unlock_bh(&cipso_v4_cache[bkt].lock);
  307. return 0;
  308. }
  309. prev_entry = entry;
  310. }
  311. spin_unlock_bh(&cipso_v4_cache[bkt].lock);
  312. return -ENOENT;
  313. }
  314. /**
  315. * cipso_v4_cache_add - Add an entry to the CIPSO cache
  316. * @skb: the packet
  317. * @secattr: the packet's security attributes
  318. *
  319. * Description:
  320. * Add a new entry into the CIPSO label mapping cache. Add the new entry to
  321. * head of the cache bucket's list, if the cache bucket is out of room remove
  322. * the last entry in the list first. It is important to note that there is
  323. * currently no checking for duplicate keys. Returns zero on success,
  324. * negative values on failure.
  325. *
  326. */
  327. int cipso_v4_cache_add(const struct sk_buff *skb,
  328. const struct netlbl_lsm_secattr *secattr)
  329. {
  330. int ret_val = -EPERM;
  331. u32 bkt;
  332. struct cipso_v4_map_cache_entry *entry = NULL;
  333. struct cipso_v4_map_cache_entry *old_entry = NULL;
  334. unsigned char *cipso_ptr;
  335. u32 cipso_ptr_len;
  336. if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
  337. return 0;
  338. cipso_ptr = CIPSO_V4_OPTPTR(skb);
  339. cipso_ptr_len = cipso_ptr[1];
  340. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  341. if (entry == NULL)
  342. return -ENOMEM;
  343. entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
  344. if (entry->key == NULL) {
  345. ret_val = -ENOMEM;
  346. goto cache_add_failure;
  347. }
  348. entry->key_len = cipso_ptr_len;
  349. entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
  350. atomic_inc(&secattr->cache->refcount);
  351. entry->lsm_data = secattr->cache;
  352. bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETBITS - 1);
  353. spin_lock_bh(&cipso_v4_cache[bkt].lock);
  354. if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
  355. list_add(&entry->list, &cipso_v4_cache[bkt].list);
  356. cipso_v4_cache[bkt].size += 1;
  357. } else {
  358. old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
  359. struct cipso_v4_map_cache_entry, list);
  360. list_del(&old_entry->list);
  361. list_add(&entry->list, &cipso_v4_cache[bkt].list);
  362. cipso_v4_cache_entry_free(old_entry);
  363. }
  364. spin_unlock_bh(&cipso_v4_cache[bkt].lock);
  365. return 0;
  366. cache_add_failure:
  367. if (entry)
  368. cipso_v4_cache_entry_free(entry);
  369. return ret_val;
  370. }
  371. /*
  372. * DOI List Functions
  373. */
  374. /**
  375. * cipso_v4_doi_search - Searches for a DOI definition
  376. * @doi: the DOI to search for
  377. *
  378. * Description:
  379. * Search the DOI definition list for a DOI definition with a DOI value that
  380. * matches @doi. The caller is responsibile for calling rcu_read_[un]lock().
  381. * Returns a pointer to the DOI definition on success and NULL on failure.
  382. */
  383. static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
  384. {
  385. struct cipso_v4_doi *iter;
  386. list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
  387. if (iter->doi == doi && iter->valid)
  388. return iter;
  389. return NULL;
  390. }
  391. /**
  392. * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
  393. * @doi_def: the DOI structure
  394. *
  395. * Description:
  396. * The caller defines a new DOI for use by the CIPSO engine and calls this
  397. * function to add it to the list of acceptable domains. The caller must
  398. * ensure that the mapping table specified in @doi_def->map meets all of the
  399. * requirements of the mapping type (see cipso_ipv4.h for details). Returns
  400. * zero on success and non-zero on failure.
  401. *
  402. */
  403. int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
  404. {
  405. u32 iter;
  406. if (doi_def == NULL || doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
  407. return -EINVAL;
  408. for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
  409. switch (doi_def->tags[iter]) {
  410. case CIPSO_V4_TAG_RBITMAP:
  411. break;
  412. case CIPSO_V4_TAG_RANGE:
  413. if (doi_def->type != CIPSO_V4_MAP_PASS)
  414. return -EINVAL;
  415. break;
  416. case CIPSO_V4_TAG_INVALID:
  417. if (iter == 0)
  418. return -EINVAL;
  419. break;
  420. case CIPSO_V4_TAG_ENUM:
  421. if (doi_def->type != CIPSO_V4_MAP_PASS)
  422. return -EINVAL;
  423. break;
  424. default:
  425. return -EINVAL;
  426. }
  427. }
  428. doi_def->valid = 1;
  429. INIT_RCU_HEAD(&doi_def->rcu);
  430. INIT_LIST_HEAD(&doi_def->dom_list);
  431. rcu_read_lock();
  432. if (cipso_v4_doi_search(doi_def->doi) != NULL)
  433. goto doi_add_failure_rlock;
  434. spin_lock(&cipso_v4_doi_list_lock);
  435. if (cipso_v4_doi_search(doi_def->doi) != NULL)
  436. goto doi_add_failure_slock;
  437. list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
  438. spin_unlock(&cipso_v4_doi_list_lock);
  439. rcu_read_unlock();
  440. return 0;
  441. doi_add_failure_slock:
  442. spin_unlock(&cipso_v4_doi_list_lock);
  443. doi_add_failure_rlock:
  444. rcu_read_unlock();
  445. return -EEXIST;
  446. }
  447. /**
  448. * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
  449. * @doi: the DOI value
  450. * @audit_secid: the LSM secid to use in the audit message
  451. * @callback: the DOI cleanup/free callback
  452. *
  453. * Description:
  454. * Removes a DOI definition from the CIPSO engine, @callback is called to
  455. * free any memory. The NetLabel routines will be called to release their own
  456. * LSM domain mappings as well as our own domain list. Returns zero on
  457. * success and negative values on failure.
  458. *
  459. */
  460. int cipso_v4_doi_remove(u32 doi,
  461. struct netlbl_audit *audit_info,
  462. void (*callback) (struct rcu_head * head))
  463. {
  464. struct cipso_v4_doi *doi_def;
  465. struct cipso_v4_domhsh_entry *dom_iter;
  466. rcu_read_lock();
  467. if (cipso_v4_doi_search(doi) != NULL) {
  468. spin_lock(&cipso_v4_doi_list_lock);
  469. doi_def = cipso_v4_doi_search(doi);
  470. if (doi_def == NULL) {
  471. spin_unlock(&cipso_v4_doi_list_lock);
  472. rcu_read_unlock();
  473. return -ENOENT;
  474. }
  475. doi_def->valid = 0;
  476. list_del_rcu(&doi_def->list);
  477. spin_unlock(&cipso_v4_doi_list_lock);
  478. list_for_each_entry_rcu(dom_iter, &doi_def->dom_list, list)
  479. if (dom_iter->valid)
  480. netlbl_domhsh_remove(dom_iter->domain,
  481. audit_info);
  482. cipso_v4_cache_invalidate();
  483. rcu_read_unlock();
  484. call_rcu(&doi_def->rcu, callback);
  485. return 0;
  486. }
  487. rcu_read_unlock();
  488. return -ENOENT;
  489. }
  490. /**
  491. * cipso_v4_doi_getdef - Returns a pointer to a valid DOI definition
  492. * @doi: the DOI value
  493. *
  494. * Description:
  495. * Searches for a valid DOI definition and if one is found it is returned to
  496. * the caller. Otherwise NULL is returned. The caller must ensure that
  497. * rcu_read_lock() is held while accessing the returned definition.
  498. *
  499. */
  500. struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
  501. {
  502. return cipso_v4_doi_search(doi);
  503. }
  504. /**
  505. * cipso_v4_doi_walk - Iterate through the DOI definitions
  506. * @skip_cnt: skip past this number of DOI definitions, updated
  507. * @callback: callback for each DOI definition
  508. * @cb_arg: argument for the callback function
  509. *
  510. * Description:
  511. * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
  512. * For each entry call @callback, if @callback returns a negative value stop
  513. * 'walking' through the list and return. Updates the value in @skip_cnt upon
  514. * return. Returns zero on success, negative values on failure.
  515. *
  516. */
  517. int cipso_v4_doi_walk(u32 *skip_cnt,
  518. int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
  519. void *cb_arg)
  520. {
  521. int ret_val = -ENOENT;
  522. u32 doi_cnt = 0;
  523. struct cipso_v4_doi *iter_doi;
  524. rcu_read_lock();
  525. list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
  526. if (iter_doi->valid) {
  527. if (doi_cnt++ < *skip_cnt)
  528. continue;
  529. ret_val = callback(iter_doi, cb_arg);
  530. if (ret_val < 0) {
  531. doi_cnt--;
  532. goto doi_walk_return;
  533. }
  534. }
  535. doi_walk_return:
  536. rcu_read_unlock();
  537. *skip_cnt = doi_cnt;
  538. return ret_val;
  539. }
  540. /**
  541. * cipso_v4_doi_domhsh_add - Adds a domain entry to a DOI definition
  542. * @doi_def: the DOI definition
  543. * @domain: the domain to add
  544. *
  545. * Description:
  546. * Adds the @domain to the the DOI specified by @doi_def, this function
  547. * should only be called by external functions (i.e. NetLabel). This function
  548. * does allocate memory. Returns zero on success, negative values on failure.
  549. *
  550. */
  551. int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def, const char *domain)
  552. {
  553. struct cipso_v4_domhsh_entry *iter;
  554. struct cipso_v4_domhsh_entry *new_dom;
  555. new_dom = kzalloc(sizeof(*new_dom), GFP_KERNEL);
  556. if (new_dom == NULL)
  557. return -ENOMEM;
  558. if (domain) {
  559. new_dom->domain = kstrdup(domain, GFP_KERNEL);
  560. if (new_dom->domain == NULL) {
  561. kfree(new_dom);
  562. return -ENOMEM;
  563. }
  564. }
  565. new_dom->valid = 1;
  566. INIT_RCU_HEAD(&new_dom->rcu);
  567. rcu_read_lock();
  568. spin_lock(&cipso_v4_doi_list_lock);
  569. list_for_each_entry_rcu(iter, &doi_def->dom_list, list)
  570. if (iter->valid &&
  571. ((domain != NULL && iter->domain != NULL &&
  572. strcmp(iter->domain, domain) == 0) ||
  573. (domain == NULL && iter->domain == NULL))) {
  574. spin_unlock(&cipso_v4_doi_list_lock);
  575. rcu_read_unlock();
  576. kfree(new_dom->domain);
  577. kfree(new_dom);
  578. return -EEXIST;
  579. }
  580. list_add_tail_rcu(&new_dom->list, &doi_def->dom_list);
  581. spin_unlock(&cipso_v4_doi_list_lock);
  582. rcu_read_unlock();
  583. return 0;
  584. }
  585. /**
  586. * cipso_v4_doi_domhsh_remove - Removes a domain entry from a DOI definition
  587. * @doi_def: the DOI definition
  588. * @domain: the domain to remove
  589. *
  590. * Description:
  591. * Removes the @domain from the DOI specified by @doi_def, this function
  592. * should only be called by external functions (i.e. NetLabel). Returns zero
  593. * on success and negative values on error.
  594. *
  595. */
  596. int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
  597. const char *domain)
  598. {
  599. struct cipso_v4_domhsh_entry *iter;
  600. rcu_read_lock();
  601. spin_lock(&cipso_v4_doi_list_lock);
  602. list_for_each_entry_rcu(iter, &doi_def->dom_list, list)
  603. if (iter->valid &&
  604. ((domain != NULL && iter->domain != NULL &&
  605. strcmp(iter->domain, domain) == 0) ||
  606. (domain == NULL && iter->domain == NULL))) {
  607. iter->valid = 0;
  608. list_del_rcu(&iter->list);
  609. spin_unlock(&cipso_v4_doi_list_lock);
  610. rcu_read_unlock();
  611. call_rcu(&iter->rcu, cipso_v4_doi_domhsh_free);
  612. return 0;
  613. }
  614. spin_unlock(&cipso_v4_doi_list_lock);
  615. rcu_read_unlock();
  616. return -ENOENT;
  617. }
  618. /*
  619. * Label Mapping Functions
  620. */
  621. /**
  622. * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
  623. * @doi_def: the DOI definition
  624. * @level: the level to check
  625. *
  626. * Description:
  627. * Checks the given level against the given DOI definition and returns a
  628. * negative value if the level does not have a valid mapping and a zero value
  629. * if the level is defined by the DOI.
  630. *
  631. */
  632. static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
  633. {
  634. switch (doi_def->type) {
  635. case CIPSO_V4_MAP_PASS:
  636. return 0;
  637. case CIPSO_V4_MAP_STD:
  638. if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
  639. return 0;
  640. break;
  641. }
  642. return -EFAULT;
  643. }
  644. /**
  645. * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
  646. * @doi_def: the DOI definition
  647. * @host_lvl: the host MLS level
  648. * @net_lvl: the network/CIPSO MLS level
  649. *
  650. * Description:
  651. * Perform a label mapping to translate a local MLS level to the correct
  652. * CIPSO level using the given DOI definition. Returns zero on success,
  653. * negative values otherwise.
  654. *
  655. */
  656. static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
  657. u32 host_lvl,
  658. u32 *net_lvl)
  659. {
  660. switch (doi_def->type) {
  661. case CIPSO_V4_MAP_PASS:
  662. *net_lvl = host_lvl;
  663. return 0;
  664. case CIPSO_V4_MAP_STD:
  665. if (host_lvl < doi_def->map.std->lvl.local_size &&
  666. doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
  667. *net_lvl = doi_def->map.std->lvl.local[host_lvl];
  668. return 0;
  669. }
  670. return -EPERM;
  671. }
  672. return -EINVAL;
  673. }
  674. /**
  675. * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
  676. * @doi_def: the DOI definition
  677. * @net_lvl: the network/CIPSO MLS level
  678. * @host_lvl: the host MLS level
  679. *
  680. * Description:
  681. * Perform a label mapping to translate a CIPSO level to the correct local MLS
  682. * level using the given DOI definition. Returns zero on success, negative
  683. * values otherwise.
  684. *
  685. */
  686. static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
  687. u32 net_lvl,
  688. u32 *host_lvl)
  689. {
  690. struct cipso_v4_std_map_tbl *map_tbl;
  691. switch (doi_def->type) {
  692. case CIPSO_V4_MAP_PASS:
  693. *host_lvl = net_lvl;
  694. return 0;
  695. case CIPSO_V4_MAP_STD:
  696. map_tbl = doi_def->map.std;
  697. if (net_lvl < map_tbl->lvl.cipso_size &&
  698. map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
  699. *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
  700. return 0;
  701. }
  702. return -EPERM;
  703. }
  704. return -EINVAL;
  705. }
  706. /**
  707. * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
  708. * @doi_def: the DOI definition
  709. * @bitmap: category bitmap
  710. * @bitmap_len: bitmap length in bytes
  711. *
  712. * Description:
  713. * Checks the given category bitmap against the given DOI definition and
  714. * returns a negative value if any of the categories in the bitmap do not have
  715. * a valid mapping and a zero value if all of the categories are valid.
  716. *
  717. */
  718. static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
  719. const unsigned char *bitmap,
  720. u32 bitmap_len)
  721. {
  722. int cat = -1;
  723. u32 bitmap_len_bits = bitmap_len * 8;
  724. u32 cipso_cat_size;
  725. u32 *cipso_array;
  726. switch (doi_def->type) {
  727. case CIPSO_V4_MAP_PASS:
  728. return 0;
  729. case CIPSO_V4_MAP_STD:
  730. cipso_cat_size = doi_def->map.std->cat.cipso_size;
  731. cipso_array = doi_def->map.std->cat.cipso;
  732. for (;;) {
  733. cat = cipso_v4_bitmap_walk(bitmap,
  734. bitmap_len_bits,
  735. cat + 1,
  736. 1);
  737. if (cat < 0)
  738. break;
  739. if (cat >= cipso_cat_size ||
  740. cipso_array[cat] >= CIPSO_V4_INV_CAT)
  741. return -EFAULT;
  742. }
  743. if (cat == -1)
  744. return 0;
  745. break;
  746. }
  747. return -EFAULT;
  748. }
  749. /**
  750. * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
  751. * @doi_def: the DOI definition
  752. * @secattr: the security attributes
  753. * @net_cat: the zero'd out category bitmap in network/CIPSO format
  754. * @net_cat_len: the length of the CIPSO bitmap in bytes
  755. *
  756. * Description:
  757. * Perform a label mapping to translate a local MLS category bitmap to the
  758. * correct CIPSO bitmap using the given DOI definition. Returns the minimum
  759. * size in bytes of the network bitmap on success, negative values otherwise.
  760. *
  761. */
  762. static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
  763. const struct netlbl_lsm_secattr *secattr,
  764. unsigned char *net_cat,
  765. u32 net_cat_len)
  766. {
  767. int host_spot = -1;
  768. u32 net_spot = CIPSO_V4_INV_CAT;
  769. u32 net_spot_max = 0;
  770. u32 net_clen_bits = net_cat_len * 8;
  771. u32 host_cat_size = 0;
  772. u32 *host_cat_array = NULL;
  773. if (doi_def->type == CIPSO_V4_MAP_STD) {
  774. host_cat_size = doi_def->map.std->cat.local_size;
  775. host_cat_array = doi_def->map.std->cat.local;
  776. }
  777. for (;;) {
  778. host_spot = netlbl_secattr_catmap_walk(secattr->mls_cat,
  779. host_spot + 1);
  780. if (host_spot < 0)
  781. break;
  782. switch (doi_def->type) {
  783. case CIPSO_V4_MAP_PASS:
  784. net_spot = host_spot;
  785. break;
  786. case CIPSO_V4_MAP_STD:
  787. if (host_spot >= host_cat_size)
  788. return -EPERM;
  789. net_spot = host_cat_array[host_spot];
  790. if (net_spot >= CIPSO_V4_INV_CAT)
  791. return -EPERM;
  792. break;
  793. }
  794. if (net_spot >= net_clen_bits)
  795. return -ENOSPC;
  796. cipso_v4_bitmap_setbit(net_cat, net_spot, 1);
  797. if (net_spot > net_spot_max)
  798. net_spot_max = net_spot;
  799. }
  800. if (++net_spot_max % 8)
  801. return net_spot_max / 8 + 1;
  802. return net_spot_max / 8;
  803. }
  804. /**
  805. * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
  806. * @doi_def: the DOI definition
  807. * @net_cat: the category bitmap in network/CIPSO format
  808. * @net_cat_len: the length of the CIPSO bitmap in bytes
  809. * @secattr: the security attributes
  810. *
  811. * Description:
  812. * Perform a label mapping to translate a CIPSO bitmap to the correct local
  813. * MLS category bitmap using the given DOI definition. Returns zero on
  814. * success, negative values on failure.
  815. *
  816. */
  817. static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
  818. const unsigned char *net_cat,
  819. u32 net_cat_len,
  820. struct netlbl_lsm_secattr *secattr)
  821. {
  822. int ret_val;
  823. int net_spot = -1;
  824. u32 host_spot = CIPSO_V4_INV_CAT;
  825. u32 net_clen_bits = net_cat_len * 8;
  826. u32 net_cat_size = 0;
  827. u32 *net_cat_array = NULL;
  828. if (doi_def->type == CIPSO_V4_MAP_STD) {
  829. net_cat_size = doi_def->map.std->cat.cipso_size;
  830. net_cat_array = doi_def->map.std->cat.cipso;
  831. }
  832. for (;;) {
  833. net_spot = cipso_v4_bitmap_walk(net_cat,
  834. net_clen_bits,
  835. net_spot + 1,
  836. 1);
  837. if (net_spot < 0) {
  838. if (net_spot == -2)
  839. return -EFAULT;
  840. return 0;
  841. }
  842. switch (doi_def->type) {
  843. case CIPSO_V4_MAP_PASS:
  844. host_spot = net_spot;
  845. break;
  846. case CIPSO_V4_MAP_STD:
  847. if (net_spot >= net_cat_size)
  848. return -EPERM;
  849. host_spot = net_cat_array[net_spot];
  850. if (host_spot >= CIPSO_V4_INV_CAT)
  851. return -EPERM;
  852. break;
  853. }
  854. ret_val = netlbl_secattr_catmap_setbit(secattr->mls_cat,
  855. host_spot,
  856. GFP_ATOMIC);
  857. if (ret_val != 0)
  858. return ret_val;
  859. }
  860. return -EINVAL;
  861. }
  862. /**
  863. * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
  864. * @doi_def: the DOI definition
  865. * @enumcat: category list
  866. * @enumcat_len: length of the category list in bytes
  867. *
  868. * Description:
  869. * Checks the given categories against the given DOI definition and returns a
  870. * negative value if any of the categories do not have a valid mapping and a
  871. * zero value if all of the categories are valid.
  872. *
  873. */
  874. static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
  875. const unsigned char *enumcat,
  876. u32 enumcat_len)
  877. {
  878. u16 cat;
  879. int cat_prev = -1;
  880. u32 iter;
  881. if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
  882. return -EFAULT;
  883. for (iter = 0; iter < enumcat_len; iter += 2) {
  884. cat = ntohs(*((__be16 *)&enumcat[iter]));
  885. if (cat <= cat_prev)
  886. return -EFAULT;
  887. cat_prev = cat;
  888. }
  889. return 0;
  890. }
  891. /**
  892. * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
  893. * @doi_def: the DOI definition
  894. * @secattr: the security attributes
  895. * @net_cat: the zero'd out category list in network/CIPSO format
  896. * @net_cat_len: the length of the CIPSO category list in bytes
  897. *
  898. * Description:
  899. * Perform a label mapping to translate a local MLS category bitmap to the
  900. * correct CIPSO category list using the given DOI definition. Returns the
  901. * size in bytes of the network category bitmap on success, negative values
  902. * otherwise.
  903. *
  904. */
  905. static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
  906. const struct netlbl_lsm_secattr *secattr,
  907. unsigned char *net_cat,
  908. u32 net_cat_len)
  909. {
  910. int cat = -1;
  911. u32 cat_iter = 0;
  912. for (;;) {
  913. cat = netlbl_secattr_catmap_walk(secattr->mls_cat, cat + 1);
  914. if (cat < 0)
  915. break;
  916. if ((cat_iter + 2) > net_cat_len)
  917. return -ENOSPC;
  918. *((__be16 *)&net_cat[cat_iter]) = htons(cat);
  919. cat_iter += 2;
  920. }
  921. return cat_iter;
  922. }
  923. /**
  924. * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
  925. * @doi_def: the DOI definition
  926. * @net_cat: the category list in network/CIPSO format
  927. * @net_cat_len: the length of the CIPSO bitmap in bytes
  928. * @secattr: the security attributes
  929. *
  930. * Description:
  931. * Perform a label mapping to translate a CIPSO category list to the correct
  932. * local MLS category bitmap using the given DOI definition. Returns zero on
  933. * success, negative values on failure.
  934. *
  935. */
  936. static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
  937. const unsigned char *net_cat,
  938. u32 net_cat_len,
  939. struct netlbl_lsm_secattr *secattr)
  940. {
  941. int ret_val;
  942. u32 iter;
  943. for (iter = 0; iter < net_cat_len; iter += 2) {
  944. ret_val = netlbl_secattr_catmap_setbit(secattr->mls_cat,
  945. ntohs(*((__be16 *)&net_cat[iter])),
  946. GFP_ATOMIC);
  947. if (ret_val != 0)
  948. return ret_val;
  949. }
  950. return 0;
  951. }
  952. /**
  953. * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
  954. * @doi_def: the DOI definition
  955. * @rngcat: category list
  956. * @rngcat_len: length of the category list in bytes
  957. *
  958. * Description:
  959. * Checks the given categories against the given DOI definition and returns a
  960. * negative value if any of the categories do not have a valid mapping and a
  961. * zero value if all of the categories are valid.
  962. *
  963. */
  964. static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
  965. const unsigned char *rngcat,
  966. u32 rngcat_len)
  967. {
  968. u16 cat_high;
  969. u16 cat_low;
  970. u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
  971. u32 iter;
  972. if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
  973. return -EFAULT;
  974. for (iter = 0; iter < rngcat_len; iter += 4) {
  975. cat_high = ntohs(*((__be16 *)&rngcat[iter]));
  976. if ((iter + 4) <= rngcat_len)
  977. cat_low = ntohs(*((__be16 *)&rngcat[iter + 2]));
  978. else
  979. cat_low = 0;
  980. if (cat_high > cat_prev)
  981. return -EFAULT;
  982. cat_prev = cat_low;
  983. }
  984. return 0;
  985. }
  986. /**
  987. * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
  988. * @doi_def: the DOI definition
  989. * @secattr: the security attributes
  990. * @net_cat: the zero'd out category list in network/CIPSO format
  991. * @net_cat_len: the length of the CIPSO category list in bytes
  992. *
  993. * Description:
  994. * Perform a label mapping to translate a local MLS category bitmap to the
  995. * correct CIPSO category list using the given DOI definition. Returns the
  996. * size in bytes of the network category bitmap on success, negative values
  997. * otherwise.
  998. *
  999. */
  1000. static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
  1001. const struct netlbl_lsm_secattr *secattr,
  1002. unsigned char *net_cat,
  1003. u32 net_cat_len)
  1004. {
  1005. /* The constant '16' is not random, it is the maximum number of
  1006. * high/low category range pairs as permitted by the CIPSO draft based
  1007. * on a maximum IPv4 header length of 60 bytes - the BUG_ON() assertion
  1008. * does a sanity check to make sure we don't overflow the array. */
  1009. int iter = -1;
  1010. u16 array[16];
  1011. u32 array_cnt = 0;
  1012. u32 cat_size = 0;
  1013. BUG_ON(net_cat_len > 30);
  1014. for (;;) {
  1015. iter = netlbl_secattr_catmap_walk(secattr->mls_cat, iter + 1);
  1016. if (iter < 0)
  1017. break;
  1018. cat_size += (iter == 0 ? 0 : sizeof(u16));
  1019. if (cat_size > net_cat_len)
  1020. return -ENOSPC;
  1021. array[array_cnt++] = iter;
  1022. iter = netlbl_secattr_catmap_walk_rng(secattr->mls_cat, iter);
  1023. if (iter < 0)
  1024. return -EFAULT;
  1025. cat_size += sizeof(u16);
  1026. if (cat_size > net_cat_len)
  1027. return -ENOSPC;
  1028. array[array_cnt++] = iter;
  1029. }
  1030. for (iter = 0; array_cnt > 0;) {
  1031. *((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
  1032. iter += 2;
  1033. array_cnt--;
  1034. if (array[array_cnt] != 0) {
  1035. *((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
  1036. iter += 2;
  1037. }
  1038. }
  1039. return cat_size;
  1040. }
  1041. /**
  1042. * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
  1043. * @doi_def: the DOI definition
  1044. * @net_cat: the category list in network/CIPSO format
  1045. * @net_cat_len: the length of the CIPSO bitmap in bytes
  1046. * @secattr: the security attributes
  1047. *
  1048. * Description:
  1049. * Perform a label mapping to translate a CIPSO category list to the correct
  1050. * local MLS category bitmap using the given DOI definition. Returns zero on
  1051. * success, negative values on failure.
  1052. *
  1053. */
  1054. static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
  1055. const unsigned char *net_cat,
  1056. u32 net_cat_len,
  1057. struct netlbl_lsm_secattr *secattr)
  1058. {
  1059. int ret_val;
  1060. u32 net_iter;
  1061. u16 cat_low;
  1062. u16 cat_high;
  1063. for(net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
  1064. cat_high = ntohs(*((__be16 *)&net_cat[net_iter]));
  1065. if ((net_iter + 4) <= net_cat_len)
  1066. cat_low = ntohs(*((__be16 *)&net_cat[net_iter + 2]));
  1067. else
  1068. cat_low = 0;
  1069. ret_val = netlbl_secattr_catmap_setrng(secattr->mls_cat,
  1070. cat_low,
  1071. cat_high,
  1072. GFP_ATOMIC);
  1073. if (ret_val != 0)
  1074. return ret_val;
  1075. }
  1076. return 0;
  1077. }
  1078. /*
  1079. * Protocol Handling Functions
  1080. */
  1081. #define CIPSO_V4_OPT_LEN_MAX 40
  1082. #define CIPSO_V4_HDR_LEN 6
  1083. /**
  1084. * cipso_v4_gentag_hdr - Generate a CIPSO option header
  1085. * @doi_def: the DOI definition
  1086. * @len: the total tag length in bytes, not including this header
  1087. * @buf: the CIPSO option buffer
  1088. *
  1089. * Description:
  1090. * Write a CIPSO header into the beginning of @buffer.
  1091. *
  1092. */
  1093. static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
  1094. unsigned char *buf,
  1095. u32 len)
  1096. {
  1097. buf[0] = IPOPT_CIPSO;
  1098. buf[1] = CIPSO_V4_HDR_LEN + len;
  1099. *(__be32 *)&buf[2] = htonl(doi_def->doi);
  1100. }
  1101. /**
  1102. * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
  1103. * @doi_def: the DOI definition
  1104. * @secattr: the security attributes
  1105. * @buffer: the option buffer
  1106. * @buffer_len: length of buffer in bytes
  1107. *
  1108. * Description:
  1109. * Generate a CIPSO option using the restricted bitmap tag, tag type #1. The
  1110. * actual buffer length may be larger than the indicated size due to
  1111. * translation between host and network category bitmaps. Returns the size of
  1112. * the tag on success, negative values on failure.
  1113. *
  1114. */
  1115. static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
  1116. const struct netlbl_lsm_secattr *secattr,
  1117. unsigned char *buffer,
  1118. u32 buffer_len)
  1119. {
  1120. int ret_val;
  1121. u32 tag_len;
  1122. u32 level;
  1123. if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
  1124. return -EPERM;
  1125. ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
  1126. if (ret_val != 0)
  1127. return ret_val;
  1128. if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
  1129. ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
  1130. secattr,
  1131. &buffer[4],
  1132. buffer_len - 4);
  1133. if (ret_val < 0)
  1134. return ret_val;
  1135. /* This will send packets using the "optimized" format when
  1136. * possibile as specified in section 3.4.2.6 of the
  1137. * CIPSO draft. */
  1138. if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
  1139. tag_len = 14;
  1140. else
  1141. tag_len = 4 + ret_val;
  1142. } else
  1143. tag_len = 4;
  1144. buffer[0] = 0x01;
  1145. buffer[1] = tag_len;
  1146. buffer[3] = level;
  1147. return tag_len;
  1148. }
  1149. /**
  1150. * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
  1151. * @doi_def: the DOI definition
  1152. * @tag: the CIPSO tag
  1153. * @secattr: the security attributes
  1154. *
  1155. * Description:
  1156. * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
  1157. * attributes in @secattr. Return zero on success, negatives values on
  1158. * failure.
  1159. *
  1160. */
  1161. static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
  1162. const unsigned char *tag,
  1163. struct netlbl_lsm_secattr *secattr)
  1164. {
  1165. int ret_val;
  1166. u8 tag_len = tag[1];
  1167. u32 level;
  1168. ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
  1169. if (ret_val != 0)
  1170. return ret_val;
  1171. secattr->mls_lvl = level;
  1172. secattr->flags |= NETLBL_SECATTR_MLS_LVL;
  1173. if (tag_len > 4) {
  1174. secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
  1175. if (secattr->mls_cat == NULL)
  1176. return -ENOMEM;
  1177. ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
  1178. &tag[4],
  1179. tag_len - 4,
  1180. secattr);
  1181. if (ret_val != 0) {
  1182. netlbl_secattr_catmap_free(secattr->mls_cat);
  1183. return ret_val;
  1184. }
  1185. secattr->flags |= NETLBL_SECATTR_MLS_CAT;
  1186. }
  1187. return 0;
  1188. }
  1189. /**
  1190. * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
  1191. * @doi_def: the DOI definition
  1192. * @secattr: the security attributes
  1193. * @buffer: the option buffer
  1194. * @buffer_len: length of buffer in bytes
  1195. *
  1196. * Description:
  1197. * Generate a CIPSO option using the enumerated tag, tag type #2. Returns the
  1198. * size of the tag on success, negative values on failure.
  1199. *
  1200. */
  1201. static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
  1202. const struct netlbl_lsm_secattr *secattr,
  1203. unsigned char *buffer,
  1204. u32 buffer_len)
  1205. {
  1206. int ret_val;
  1207. u32 tag_len;
  1208. u32 level;
  1209. if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
  1210. return -EPERM;
  1211. ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
  1212. if (ret_val != 0)
  1213. return ret_val;
  1214. if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
  1215. ret_val = cipso_v4_map_cat_enum_hton(doi_def,
  1216. secattr,
  1217. &buffer[4],
  1218. buffer_len - 4);
  1219. if (ret_val < 0)
  1220. return ret_val;
  1221. tag_len = 4 + ret_val;
  1222. } else
  1223. tag_len = 4;
  1224. buffer[0] = 0x02;
  1225. buffer[1] = tag_len;
  1226. buffer[3] = level;
  1227. return tag_len;
  1228. }
  1229. /**
  1230. * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
  1231. * @doi_def: the DOI definition
  1232. * @tag: the CIPSO tag
  1233. * @secattr: the security attributes
  1234. *
  1235. * Description:
  1236. * Parse a CIPSO enumerated tag (tag type #2) and return the security
  1237. * attributes in @secattr. Return zero on success, negatives values on
  1238. * failure.
  1239. *
  1240. */
  1241. static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
  1242. const unsigned char *tag,
  1243. struct netlbl_lsm_secattr *secattr)
  1244. {
  1245. int ret_val;
  1246. u8 tag_len = tag[1];
  1247. u32 level;
  1248. ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
  1249. if (ret_val != 0)
  1250. return ret_val;
  1251. secattr->mls_lvl = level;
  1252. secattr->flags |= NETLBL_SECATTR_MLS_LVL;
  1253. if (tag_len > 4) {
  1254. secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
  1255. if (secattr->mls_cat == NULL)
  1256. return -ENOMEM;
  1257. ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
  1258. &tag[4],
  1259. tag_len - 4,
  1260. secattr);
  1261. if (ret_val != 0) {
  1262. netlbl_secattr_catmap_free(secattr->mls_cat);
  1263. return ret_val;
  1264. }
  1265. secattr->flags |= NETLBL_SECATTR_MLS_CAT;
  1266. }
  1267. return 0;
  1268. }
  1269. /**
  1270. * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
  1271. * @doi_def: the DOI definition
  1272. * @secattr: the security attributes
  1273. * @buffer: the option buffer
  1274. * @buffer_len: length of buffer in bytes
  1275. *
  1276. * Description:
  1277. * Generate a CIPSO option using the ranged tag, tag type #5. Returns the
  1278. * size of the tag on success, negative values on failure.
  1279. *
  1280. */
  1281. static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
  1282. const struct netlbl_lsm_secattr *secattr,
  1283. unsigned char *buffer,
  1284. u32 buffer_len)
  1285. {
  1286. int ret_val;
  1287. u32 tag_len;
  1288. u32 level;
  1289. if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
  1290. return -EPERM;
  1291. ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
  1292. if (ret_val != 0)
  1293. return ret_val;
  1294. if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
  1295. ret_val = cipso_v4_map_cat_rng_hton(doi_def,
  1296. secattr,
  1297. &buffer[4],
  1298. buffer_len - 4);
  1299. if (ret_val < 0)
  1300. return ret_val;
  1301. tag_len = 4 + ret_val;
  1302. } else
  1303. tag_len = 4;
  1304. buffer[0] = 0x05;
  1305. buffer[1] = tag_len;
  1306. buffer[3] = level;
  1307. return tag_len;
  1308. }
  1309. /**
  1310. * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
  1311. * @doi_def: the DOI definition
  1312. * @tag: the CIPSO tag
  1313. * @secattr: the security attributes
  1314. *
  1315. * Description:
  1316. * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
  1317. * in @secattr. Return zero on success, negatives values on failure.
  1318. *
  1319. */
  1320. static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
  1321. const unsigned char *tag,
  1322. struct netlbl_lsm_secattr *secattr)
  1323. {
  1324. int ret_val;
  1325. u8 tag_len = tag[1];
  1326. u32 level;
  1327. ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
  1328. if (ret_val != 0)
  1329. return ret_val;
  1330. secattr->mls_lvl = level;
  1331. secattr->flags |= NETLBL_SECATTR_MLS_LVL;
  1332. if (tag_len > 4) {
  1333. secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
  1334. if (secattr->mls_cat == NULL)
  1335. return -ENOMEM;
  1336. ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
  1337. &tag[4],
  1338. tag_len - 4,
  1339. secattr);
  1340. if (ret_val != 0) {
  1341. netlbl_secattr_catmap_free(secattr->mls_cat);
  1342. return ret_val;
  1343. }
  1344. secattr->flags |= NETLBL_SECATTR_MLS_CAT;
  1345. }
  1346. return 0;
  1347. }
  1348. /**
  1349. * cipso_v4_validate - Validate a CIPSO option
  1350. * @option: the start of the option, on error it is set to point to the error
  1351. *
  1352. * Description:
  1353. * This routine is called to validate a CIPSO option, it checks all of the
  1354. * fields to ensure that they are at least valid, see the draft snippet below
  1355. * for details. If the option is valid then a zero value is returned and
  1356. * the value of @option is unchanged. If the option is invalid then a
  1357. * non-zero value is returned and @option is adjusted to point to the
  1358. * offending portion of the option. From the IETF draft ...
  1359. *
  1360. * "If any field within the CIPSO options, such as the DOI identifier, is not
  1361. * recognized the IP datagram is discarded and an ICMP 'parameter problem'
  1362. * (type 12) is generated and returned. The ICMP code field is set to 'bad
  1363. * parameter' (code 0) and the pointer is set to the start of the CIPSO field
  1364. * that is unrecognized."
  1365. *
  1366. */
  1367. int cipso_v4_validate(unsigned char **option)
  1368. {
  1369. unsigned char *opt = *option;
  1370. unsigned char *tag;
  1371. unsigned char opt_iter;
  1372. unsigned char err_offset = 0;
  1373. u8 opt_len;
  1374. u8 tag_len;
  1375. struct cipso_v4_doi *doi_def = NULL;
  1376. u32 tag_iter;
  1377. /* caller already checks for length values that are too large */
  1378. opt_len = opt[1];
  1379. if (opt_len < 8) {
  1380. err_offset = 1;
  1381. goto validate_return;
  1382. }
  1383. rcu_read_lock();
  1384. doi_def = cipso_v4_doi_search(ntohl(*((__be32 *)&opt[2])));
  1385. if (doi_def == NULL) {
  1386. err_offset = 2;
  1387. goto validate_return_locked;
  1388. }
  1389. opt_iter = 6;
  1390. tag = opt + opt_iter;
  1391. while (opt_iter < opt_len) {
  1392. for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
  1393. if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
  1394. ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
  1395. err_offset = opt_iter;
  1396. goto validate_return_locked;
  1397. }
  1398. tag_len = tag[1];
  1399. if (tag_len > (opt_len - opt_iter)) {
  1400. err_offset = opt_iter + 1;
  1401. goto validate_return_locked;
  1402. }
  1403. switch (tag[0]) {
  1404. case CIPSO_V4_TAG_RBITMAP:
  1405. if (tag_len < 4) {
  1406. err_offset = opt_iter + 1;
  1407. goto validate_return_locked;
  1408. }
  1409. /* We are already going to do all the verification
  1410. * necessary at the socket layer so from our point of
  1411. * view it is safe to turn these checks off (and less
  1412. * work), however, the CIPSO draft says we should do
  1413. * all the CIPSO validations here but it doesn't
  1414. * really specify _exactly_ what we need to validate
  1415. * ... so, just make it a sysctl tunable. */
  1416. if (cipso_v4_rbm_strictvalid) {
  1417. if (cipso_v4_map_lvl_valid(doi_def,
  1418. tag[3]) < 0) {
  1419. err_offset = opt_iter + 3;
  1420. goto validate_return_locked;
  1421. }
  1422. if (tag_len > 4 &&
  1423. cipso_v4_map_cat_rbm_valid(doi_def,
  1424. &tag[4],
  1425. tag_len - 4) < 0) {
  1426. err_offset = opt_iter + 4;
  1427. goto validate_return_locked;
  1428. }
  1429. }
  1430. break;
  1431. case CIPSO_V4_TAG_ENUM:
  1432. if (tag_len < 4) {
  1433. err_offset = opt_iter + 1;
  1434. goto validate_return_locked;
  1435. }
  1436. if (cipso_v4_map_lvl_valid(doi_def,
  1437. tag[3]) < 0) {
  1438. err_offset = opt_iter + 3;
  1439. goto validate_return_locked;
  1440. }
  1441. if (tag_len > 4 &&
  1442. cipso_v4_map_cat_enum_valid(doi_def,
  1443. &tag[4],
  1444. tag_len - 4) < 0) {
  1445. err_offset = opt_iter + 4;
  1446. goto validate_return_locked;
  1447. }
  1448. break;
  1449. case CIPSO_V4_TAG_RANGE:
  1450. if (tag_len < 4) {
  1451. err_offset = opt_iter + 1;
  1452. goto validate_return_locked;
  1453. }
  1454. if (cipso_v4_map_lvl_valid(doi_def,
  1455. tag[3]) < 0) {
  1456. err_offset = opt_iter + 3;
  1457. goto validate_return_locked;
  1458. }
  1459. if (tag_len > 4 &&
  1460. cipso_v4_map_cat_rng_valid(doi_def,
  1461. &tag[4],
  1462. tag_len - 4) < 0) {
  1463. err_offset = opt_iter + 4;
  1464. goto validate_return_locked;
  1465. }
  1466. break;
  1467. default:
  1468. err_offset = opt_iter;
  1469. goto validate_return_locked;
  1470. }
  1471. tag += tag_len;
  1472. opt_iter += tag_len;
  1473. }
  1474. validate_return_locked:
  1475. rcu_read_unlock();
  1476. validate_return:
  1477. *option = opt + err_offset;
  1478. return err_offset;
  1479. }
  1480. /**
  1481. * cipso_v4_error - Send the correct reponse for a bad packet
  1482. * @skb: the packet
  1483. * @error: the error code
  1484. * @gateway: CIPSO gateway flag
  1485. *
  1486. * Description:
  1487. * Based on the error code given in @error, send an ICMP error message back to
  1488. * the originating host. From the IETF draft ...
  1489. *
  1490. * "If the contents of the CIPSO [option] are valid but the security label is
  1491. * outside of the configured host or port label range, the datagram is
  1492. * discarded and an ICMP 'destination unreachable' (type 3) is generated and
  1493. * returned. The code field of the ICMP is set to 'communication with
  1494. * destination network administratively prohibited' (code 9) or to
  1495. * 'communication with destination host administratively prohibited'
  1496. * (code 10). The value of the code is dependent on whether the originator
  1497. * of the ICMP message is acting as a CIPSO host or a CIPSO gateway. The
  1498. * recipient of the ICMP message MUST be able to handle either value. The
  1499. * same procedure is performed if a CIPSO [option] can not be added to an
  1500. * IP packet because it is too large to fit in the IP options area."
  1501. *
  1502. * "If the error is triggered by receipt of an ICMP message, the message is
  1503. * discarded and no response is permitted (consistent with general ICMP
  1504. * processing rules)."
  1505. *
  1506. */
  1507. void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
  1508. {
  1509. if (skb->nh.iph->protocol == IPPROTO_ICMP || error != -EACCES)
  1510. return;
  1511. if (gateway)
  1512. icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
  1513. else
  1514. icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
  1515. }
  1516. /**
  1517. * cipso_v4_socket_setattr - Add a CIPSO option to a socket
  1518. * @sock: the socket
  1519. * @doi_def: the CIPSO DOI to use
  1520. * @secattr: the specific security attributes of the socket
  1521. *
  1522. * Description:
  1523. * Set the CIPSO option on the given socket using the DOI definition and
  1524. * security attributes passed to the function. This function requires
  1525. * exclusive access to @sock->sk, which means it either needs to be in the
  1526. * process of being created or locked via lock_sock(sock->sk). Returns zero on
  1527. * success and negative values on failure.
  1528. *
  1529. */
  1530. int cipso_v4_socket_setattr(const struct socket *sock,
  1531. const struct cipso_v4_doi *doi_def,
  1532. const struct netlbl_lsm_secattr *secattr)
  1533. {
  1534. int ret_val = -EPERM;
  1535. u32 iter;
  1536. unsigned char *buf;
  1537. u32 buf_len = 0;
  1538. u32 opt_len;
  1539. struct ip_options *opt = NULL;
  1540. struct sock *sk;
  1541. struct inet_sock *sk_inet;
  1542. struct inet_connection_sock *sk_conn;
  1543. /* In the case of sock_create_lite(), the sock->sk field is not
  1544. * defined yet but it is not a problem as the only users of these
  1545. * "lite" PF_INET sockets are functions which do an accept() call
  1546. * afterwards so we will label the socket as part of the accept(). */
  1547. sk = sock->sk;
  1548. if (sk == NULL)
  1549. return 0;
  1550. /* We allocate the maximum CIPSO option size here so we are probably
  1551. * being a little wasteful, but it makes our life _much_ easier later
  1552. * on and after all we are only talking about 40 bytes. */
  1553. buf_len = CIPSO_V4_OPT_LEN_MAX;
  1554. buf = kmalloc(buf_len, GFP_ATOMIC);
  1555. if (buf == NULL) {
  1556. ret_val = -ENOMEM;
  1557. goto socket_setattr_failure;
  1558. }
  1559. /* XXX - This code assumes only one tag per CIPSO option which isn't
  1560. * really a good assumption to make but since we only support the MAC
  1561. * tags right now it is a safe assumption. */
  1562. iter = 0;
  1563. do {
  1564. memset(buf, 0, buf_len);
  1565. switch (doi_def->tags[iter]) {
  1566. case CIPSO_V4_TAG_RBITMAP:
  1567. ret_val = cipso_v4_gentag_rbm(doi_def,
  1568. secattr,
  1569. &buf[CIPSO_V4_HDR_LEN],
  1570. buf_len - CIPSO_V4_HDR_LEN);
  1571. break;
  1572. case CIPSO_V4_TAG_ENUM:
  1573. ret_val = cipso_v4_gentag_enum(doi_def,
  1574. secattr,
  1575. &buf[CIPSO_V4_HDR_LEN],
  1576. buf_len - CIPSO_V4_HDR_LEN);
  1577. break;
  1578. case CIPSO_V4_TAG_RANGE:
  1579. ret_val = cipso_v4_gentag_rng(doi_def,
  1580. secattr,
  1581. &buf[CIPSO_V4_HDR_LEN],
  1582. buf_len - CIPSO_V4_HDR_LEN);
  1583. break;
  1584. default:
  1585. ret_val = -EPERM;
  1586. goto socket_setattr_failure;
  1587. }
  1588. iter++;
  1589. } while (ret_val < 0 &&
  1590. iter < CIPSO_V4_TAG_MAXCNT &&
  1591. doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
  1592. if (ret_val < 0)
  1593. goto socket_setattr_failure;
  1594. cipso_v4_gentag_hdr(doi_def, buf, ret_val);
  1595. buf_len = CIPSO_V4_HDR_LEN + ret_val;
  1596. /* We can't use ip_options_get() directly because it makes a call to
  1597. * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
  1598. * we won't always have CAP_NET_RAW even though we _always_ want to
  1599. * set the IPOPT_CIPSO option. */
  1600. opt_len = (buf_len + 3) & ~3;
  1601. opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
  1602. if (opt == NULL) {
  1603. ret_val = -ENOMEM;
  1604. goto socket_setattr_failure;
  1605. }
  1606. memcpy(opt->__data, buf, buf_len);
  1607. opt->optlen = opt_len;
  1608. opt->is_data = 1;
  1609. opt->cipso = sizeof(struct iphdr);
  1610. kfree(buf);
  1611. buf = NULL;
  1612. sk_inet = inet_sk(sk);
  1613. if (sk_inet->is_icsk) {
  1614. sk_conn = inet_csk(sk);
  1615. if (sk_inet->opt)
  1616. sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen;
  1617. sk_conn->icsk_ext_hdr_len += opt->optlen;
  1618. sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
  1619. }
  1620. opt = xchg(&sk_inet->opt, opt);
  1621. kfree(opt);
  1622. return 0;
  1623. socket_setattr_failure:
  1624. kfree(buf);
  1625. kfree(opt);
  1626. return ret_val;
  1627. }
  1628. /**
  1629. * cipso_v4_sock_getattr - Get the security attributes from a sock
  1630. * @sk: the sock
  1631. * @secattr: the security attributes
  1632. *
  1633. * Description:
  1634. * Query @sk to see if there is a CIPSO option attached to the sock and if
  1635. * there is return the CIPSO security attributes in @secattr. This function
  1636. * requires that @sk be locked, or privately held, but it does not do any
  1637. * locking itself. Returns zero on success and negative values on failure.
  1638. *
  1639. */
  1640. int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
  1641. {
  1642. int ret_val = -ENOMSG;
  1643. struct inet_sock *sk_inet;
  1644. unsigned char *cipso_ptr;
  1645. u32 doi;
  1646. struct cipso_v4_doi *doi_def;
  1647. sk_inet = inet_sk(sk);
  1648. if (sk_inet->opt == NULL || sk_inet->opt->cipso == 0)
  1649. return -ENOMSG;
  1650. cipso_ptr = sk_inet->opt->__data + sk_inet->opt->cipso -
  1651. sizeof(struct iphdr);
  1652. ret_val = cipso_v4_cache_check(cipso_ptr, cipso_ptr[1], secattr);
  1653. if (ret_val == 0)
  1654. return ret_val;
  1655. doi = ntohl(*(__be32 *)&cipso_ptr[2]);
  1656. rcu_read_lock();
  1657. doi_def = cipso_v4_doi_search(doi);
  1658. if (doi_def == NULL) {
  1659. rcu_read_unlock();
  1660. return -ENOMSG;
  1661. }
  1662. /* XXX - This code assumes only one tag per CIPSO option which isn't
  1663. * really a good assumption to make but since we only support the MAC
  1664. * tags right now it is a safe assumption. */
  1665. switch (cipso_ptr[6]) {
  1666. case CIPSO_V4_TAG_RBITMAP:
  1667. ret_val = cipso_v4_parsetag_rbm(doi_def,
  1668. &cipso_ptr[6],
  1669. secattr);
  1670. break;
  1671. case CIPSO_V4_TAG_ENUM:
  1672. ret_val = cipso_v4_parsetag_enum(doi_def,
  1673. &cipso_ptr[6],
  1674. secattr);
  1675. break;
  1676. case CIPSO_V4_TAG_RANGE:
  1677. ret_val = cipso_v4_parsetag_rng(doi_def,
  1678. &cipso_ptr[6],
  1679. secattr);
  1680. break;
  1681. }
  1682. rcu_read_unlock();
  1683. return ret_val;
  1684. }
  1685. /**
  1686. * cipso_v4_socket_getattr - Get the security attributes from a socket
  1687. * @sock: the socket
  1688. * @secattr: the security attributes
  1689. *
  1690. * Description:
  1691. * Query @sock to see if there is a CIPSO option attached to the socket and if
  1692. * there is return the CIPSO security attributes in @secattr. Returns zero on
  1693. * success and negative values on failure.
  1694. *
  1695. */
  1696. int cipso_v4_socket_getattr(const struct socket *sock,
  1697. struct netlbl_lsm_secattr *secattr)
  1698. {
  1699. int ret_val;
  1700. lock_sock(sock->sk);
  1701. ret_val = cipso_v4_sock_getattr(sock->sk, secattr);
  1702. release_sock(sock->sk);
  1703. return ret_val;
  1704. }
  1705. /**
  1706. * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
  1707. * @skb: the packet
  1708. * @secattr: the security attributes
  1709. *
  1710. * Description:
  1711. * Parse the given packet's CIPSO option and return the security attributes.
  1712. * Returns zero on success and negative values on failure.
  1713. *
  1714. */
  1715. int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
  1716. struct netlbl_lsm_secattr *secattr)
  1717. {
  1718. int ret_val = -ENOMSG;
  1719. unsigned char *cipso_ptr;
  1720. u32 doi;
  1721. struct cipso_v4_doi *doi_def;
  1722. cipso_ptr = CIPSO_V4_OPTPTR(skb);
  1723. if (cipso_v4_cache_check(cipso_ptr, cipso_ptr[1], secattr) == 0)
  1724. return 0;
  1725. doi = ntohl(*(__be32 *)&cipso_ptr[2]);
  1726. rcu_read_lock();
  1727. doi_def = cipso_v4_doi_search(doi);
  1728. if (doi_def == NULL)
  1729. goto skbuff_getattr_return;
  1730. /* XXX - This code assumes only one tag per CIPSO option which isn't
  1731. * really a good assumption to make but since we only support the MAC
  1732. * tags right now it is a safe assumption. */
  1733. switch (cipso_ptr[6]) {
  1734. case CIPSO_V4_TAG_RBITMAP:
  1735. ret_val = cipso_v4_parsetag_rbm(doi_def,
  1736. &cipso_ptr[6],
  1737. secattr);
  1738. break;
  1739. case CIPSO_V4_TAG_ENUM:
  1740. ret_val = cipso_v4_parsetag_enum(doi_def,
  1741. &cipso_ptr[6],
  1742. secattr);
  1743. break;
  1744. case CIPSO_V4_TAG_RANGE:
  1745. ret_val = cipso_v4_parsetag_rng(doi_def,
  1746. &cipso_ptr[6],
  1747. secattr);
  1748. break;
  1749. }
  1750. skbuff_getattr_return:
  1751. rcu_read_unlock();
  1752. return ret_val;
  1753. }
  1754. /*
  1755. * Setup Functions
  1756. */
  1757. /**
  1758. * cipso_v4_init - Initialize the CIPSO module
  1759. *
  1760. * Description:
  1761. * Initialize the CIPSO module and prepare it for use. Returns zero on success
  1762. * and negative values on failure.
  1763. *
  1764. */
  1765. static int __init cipso_v4_init(void)
  1766. {
  1767. int ret_val;
  1768. ret_val = cipso_v4_cache_init();
  1769. if (ret_val != 0)
  1770. panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
  1771. ret_val);
  1772. return 0;
  1773. }
  1774. subsys_initcall(cipso_v4_init);