netlabel_domainhash.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444
  1. /*
  2. * NetLabel Domain Hash Table
  3. *
  4. * This file manages the domain hash table that NetLabel uses to determine
  5. * which network labeling protocol to use for a given domain. The NetLabel
  6. * system manages static and dynamic label mappings for network protocols such
  7. * as CIPSO and RIPSO.
  8. *
  9. * Author: Paul Moore <paul.moore@hp.com>
  10. *
  11. */
  12. /*
  13. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14. *
  15. * This program is free software; you can redistribute it and/or modify
  16. * it under the terms of the GNU General Public License as published by
  17. * the Free Software Foundation; either version 2 of the License, or
  18. * (at your option) any later version.
  19. *
  20. * This program is distributed in the hope that it will be useful,
  21. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
  23. * the GNU General Public License for more details.
  24. *
  25. * You should have received a copy of the GNU General Public License
  26. * along with this program; if not, write to the Free Software
  27. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28. *
  29. */
  30. #include <linux/types.h>
  31. #include <linux/rcupdate.h>
  32. #include <linux/list.h>
  33. #include <linux/skbuff.h>
  34. #include <linux/spinlock.h>
  35. #include <linux/string.h>
  36. #include <linux/audit.h>
  37. #include <net/netlabel.h>
  38. #include <net/cipso_ipv4.h>
  39. #include <asm/bug.h>
  40. #include "netlabel_mgmt.h"
  41. #include "netlabel_domainhash.h"
  42. #include "netlabel_user.h"
  43. struct netlbl_domhsh_tbl {
  44. struct list_head *tbl;
  45. u32 size;
  46. };
  47. /* Domain hash table */
  48. /* XXX - updates should be so rare that having one spinlock for the entire
  49. * hash table should be okay */
  50. static DEFINE_SPINLOCK(netlbl_domhsh_lock);
  51. static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
  52. /* Default domain mapping */
  53. static DEFINE_SPINLOCK(netlbl_domhsh_def_lock);
  54. static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
  55. /*
  56. * Domain Hash Table Helper Functions
  57. */
  58. /**
  59. * netlbl_domhsh_free_entry - Frees a domain hash table entry
  60. * @entry: the entry's RCU field
  61. *
  62. * Description:
  63. * This function is designed to be used as a callback to the call_rcu()
  64. * function so that the memory allocated to a hash table entry can be released
  65. * safely.
  66. *
  67. */
  68. static void netlbl_domhsh_free_entry(struct rcu_head *entry)
  69. {
  70. struct netlbl_dom_map *ptr;
  71. ptr = container_of(entry, struct netlbl_dom_map, rcu);
  72. kfree(ptr->domain);
  73. kfree(ptr);
  74. }
  75. /**
  76. * netlbl_domhsh_hash - Hashing function for the domain hash table
  77. * @domain: the domain name to hash
  78. *
  79. * Description:
  80. * This is the hashing function for the domain hash table, it returns the
  81. * correct bucket number for the domain. The caller is responsibile for
  82. * calling the rcu_read_[un]lock() functions.
  83. *
  84. */
  85. static u32 netlbl_domhsh_hash(const char *key)
  86. {
  87. u32 iter;
  88. u32 val;
  89. u32 len;
  90. /* This is taken (with slight modification) from
  91. * security/selinux/ss/symtab.c:symhash() */
  92. for (iter = 0, val = 0, len = strlen(key); iter < len; iter++)
  93. val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];
  94. return val & (rcu_dereference(netlbl_domhsh)->size - 1);
  95. }
  96. /**
  97. * netlbl_domhsh_search - Search for a domain entry
  98. * @domain: the domain
  99. * @def: return default if no match is found
  100. *
  101. * Description:
  102. * Searches the domain hash table and returns a pointer to the hash table
  103. * entry if found, otherwise NULL is returned. If @def is non-zero and a
  104. * match is not found in the domain hash table the default mapping is returned
  105. * if it exists. The caller is responsibile for the rcu hash table locks
  106. * (i.e. the caller much call rcu_read_[un]lock()).
  107. *
  108. */
  109. static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain, u32 def)
  110. {
  111. u32 bkt;
  112. struct netlbl_dom_map *iter;
  113. if (domain != NULL) {
  114. bkt = netlbl_domhsh_hash(domain);
  115. list_for_each_entry_rcu(iter, &netlbl_domhsh->tbl[bkt], list)
  116. if (iter->valid && strcmp(iter->domain, domain) == 0)
  117. return iter;
  118. }
  119. if (def != 0) {
  120. iter = rcu_dereference(netlbl_domhsh_def);
  121. if (iter != NULL && iter->valid)
  122. return iter;
  123. }
  124. return NULL;
  125. }
  126. /*
  127. * Domain Hash Table Functions
  128. */
  129. /**
  130. * netlbl_domhsh_init - Init for the domain hash
  131. * @size: the number of bits to use for the hash buckets
  132. *
  133. * Description:
  134. * Initializes the domain hash table, should be called only by
  135. * netlbl_user_init() during initialization. Returns zero on success, non-zero
  136. * values on error.
  137. *
  138. */
  139. int netlbl_domhsh_init(u32 size)
  140. {
  141. u32 iter;
  142. struct netlbl_domhsh_tbl *hsh_tbl;
  143. if (size == 0)
  144. return -EINVAL;
  145. hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
  146. if (hsh_tbl == NULL)
  147. return -ENOMEM;
  148. hsh_tbl->size = 1 << size;
  149. hsh_tbl->tbl = kcalloc(hsh_tbl->size,
  150. sizeof(struct list_head),
  151. GFP_KERNEL);
  152. if (hsh_tbl->tbl == NULL) {
  153. kfree(hsh_tbl);
  154. return -ENOMEM;
  155. }
  156. for (iter = 0; iter < hsh_tbl->size; iter++)
  157. INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
  158. rcu_read_lock();
  159. spin_lock(&netlbl_domhsh_lock);
  160. rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
  161. spin_unlock(&netlbl_domhsh_lock);
  162. rcu_read_unlock();
  163. return 0;
  164. }
  165. /**
  166. * netlbl_domhsh_add - Adds a entry to the domain hash table
  167. * @entry: the entry to add
  168. * @audit_info: NetLabel audit information
  169. *
  170. * Description:
  171. * Adds a new entry to the domain hash table and handles any updates to the
  172. * lower level protocol handler (i.e. CIPSO). Returns zero on success,
  173. * negative on failure.
  174. *
  175. */
  176. int netlbl_domhsh_add(struct netlbl_dom_map *entry,
  177. struct netlbl_audit *audit_info)
  178. {
  179. int ret_val;
  180. u32 bkt;
  181. struct audit_buffer *audit_buf;
  182. switch (entry->type) {
  183. case NETLBL_NLTYPE_UNLABELED:
  184. ret_val = 0;
  185. break;
  186. case NETLBL_NLTYPE_CIPSOV4:
  187. ret_val = cipso_v4_doi_domhsh_add(entry->type_def.cipsov4,
  188. entry->domain);
  189. break;
  190. default:
  191. return -EINVAL;
  192. }
  193. if (ret_val != 0)
  194. return ret_val;
  195. entry->valid = 1;
  196. INIT_RCU_HEAD(&entry->rcu);
  197. ret_val = 0;
  198. rcu_read_lock();
  199. if (entry->domain != NULL) {
  200. bkt = netlbl_domhsh_hash(entry->domain);
  201. spin_lock(&netlbl_domhsh_lock);
  202. if (netlbl_domhsh_search(entry->domain, 0) == NULL)
  203. list_add_tail_rcu(&entry->list,
  204. &netlbl_domhsh->tbl[bkt]);
  205. else
  206. ret_val = -EEXIST;
  207. spin_unlock(&netlbl_domhsh_lock);
  208. } else if (entry->domain == NULL) {
  209. INIT_LIST_HEAD(&entry->list);
  210. spin_lock(&netlbl_domhsh_def_lock);
  211. if (rcu_dereference(netlbl_domhsh_def) == NULL)
  212. rcu_assign_pointer(netlbl_domhsh_def, entry);
  213. else
  214. ret_val = -EEXIST;
  215. spin_unlock(&netlbl_domhsh_def_lock);
  216. } else
  217. ret_val = -EINVAL;
  218. audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info);
  219. if (audit_buf != NULL) {
  220. audit_log_format(audit_buf,
  221. " nlbl_domain=%s",
  222. entry->domain ? entry->domain : "(default)");
  223. switch (entry->type) {
  224. case NETLBL_NLTYPE_UNLABELED:
  225. audit_log_format(audit_buf, " nlbl_protocol=unlbl");
  226. break;
  227. case NETLBL_NLTYPE_CIPSOV4:
  228. audit_log_format(audit_buf,
  229. " nlbl_protocol=cipsov4 cipso_doi=%u",
  230. entry->type_def.cipsov4->doi);
  231. break;
  232. }
  233. audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
  234. audit_log_end(audit_buf);
  235. }
  236. rcu_read_unlock();
  237. if (ret_val != 0) {
  238. switch (entry->type) {
  239. case NETLBL_NLTYPE_CIPSOV4:
  240. if (cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
  241. entry->domain) != 0)
  242. BUG();
  243. break;
  244. }
  245. }
  246. return ret_val;
  247. }
  248. /**
  249. * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
  250. * @entry: the entry to add
  251. * @audit_info: NetLabel audit information
  252. *
  253. * Description:
  254. * Adds a new default entry to the domain hash table and handles any updates
  255. * to the lower level protocol handler (i.e. CIPSO). Returns zero on success,
  256. * negative on failure.
  257. *
  258. */
  259. int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,
  260. struct netlbl_audit *audit_info)
  261. {
  262. return netlbl_domhsh_add(entry, audit_info);
  263. }
  264. /**
  265. * netlbl_domhsh_remove - Removes an entry from the domain hash table
  266. * @domain: the domain to remove
  267. * @audit_info: NetLabel audit information
  268. *
  269. * Description:
  270. * Removes an entry from the domain hash table and handles any updates to the
  271. * lower level protocol handler (i.e. CIPSO). Returns zero on success,
  272. * negative on failure.
  273. *
  274. */
  275. int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info)
  276. {
  277. int ret_val = -ENOENT;
  278. struct netlbl_dom_map *entry;
  279. struct audit_buffer *audit_buf;
  280. rcu_read_lock();
  281. if (domain != NULL)
  282. entry = netlbl_domhsh_search(domain, 0);
  283. else
  284. entry = netlbl_domhsh_search(domain, 1);
  285. if (entry == NULL)
  286. goto remove_return;
  287. switch (entry->type) {
  288. case NETLBL_NLTYPE_UNLABELED:
  289. break;
  290. case NETLBL_NLTYPE_CIPSOV4:
  291. ret_val = cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
  292. entry->domain);
  293. if (ret_val != 0)
  294. goto remove_return;
  295. break;
  296. }
  297. ret_val = 0;
  298. if (entry != rcu_dereference(netlbl_domhsh_def)) {
  299. spin_lock(&netlbl_domhsh_lock);
  300. if (entry->valid) {
  301. entry->valid = 0;
  302. list_del_rcu(&entry->list);
  303. } else
  304. ret_val = -ENOENT;
  305. spin_unlock(&netlbl_domhsh_lock);
  306. } else {
  307. spin_lock(&netlbl_domhsh_def_lock);
  308. if (entry->valid) {
  309. entry->valid = 0;
  310. rcu_assign_pointer(netlbl_domhsh_def, NULL);
  311. } else
  312. ret_val = -ENOENT;
  313. spin_unlock(&netlbl_domhsh_def_lock);
  314. }
  315. audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
  316. if (audit_buf != NULL) {
  317. audit_log_format(audit_buf,
  318. " nlbl_domain=%s res=%u",
  319. entry->domain ? entry->domain : "(default)",
  320. ret_val == 0 ? 1 : 0);
  321. audit_log_end(audit_buf);
  322. }
  323. if (ret_val == 0)
  324. call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
  325. remove_return:
  326. rcu_read_unlock();
  327. return ret_val;
  328. }
  329. /**
  330. * netlbl_domhsh_remove_default - Removes the default entry from the table
  331. * @audit_info: NetLabel audit information
  332. *
  333. * Description:
  334. * Removes/resets the default entry for the domain hash table and handles any
  335. * updates to the lower level protocol handler (i.e. CIPSO). Returns zero on
  336. * success, non-zero on failure.
  337. *
  338. */
  339. int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info)
  340. {
  341. return netlbl_domhsh_remove(NULL, audit_info);
  342. }
  343. /**
  344. * netlbl_domhsh_getentry - Get an entry from the domain hash table
  345. * @domain: the domain name to search for
  346. *
  347. * Description:
  348. * Look through the domain hash table searching for an entry to match @domain,
  349. * return a pointer to a copy of the entry or NULL. The caller is responsibile
  350. * for ensuring that rcu_read_[un]lock() is called.
  351. *
  352. */
  353. struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
  354. {
  355. return netlbl_domhsh_search(domain, 1);
  356. }
  357. /**
  358. * netlbl_domhsh_walk - Iterate through the domain mapping hash table
  359. * @skip_bkt: the number of buckets to skip at the start
  360. * @skip_chain: the number of entries to skip in the first iterated bucket
  361. * @callback: callback for each entry
  362. * @cb_arg: argument for the callback function
  363. *
  364. * Description:
  365. * Interate over the domain mapping hash table, skipping the first @skip_bkt
  366. * buckets and @skip_chain entries. For each entry in the table call
  367. * @callback, if @callback returns a negative value stop 'walking' through the
  368. * table and return. Updates the values in @skip_bkt and @skip_chain on
  369. * return. Returns zero on succcess, negative values on failure.
  370. *
  371. */
  372. int netlbl_domhsh_walk(u32 *skip_bkt,
  373. u32 *skip_chain,
  374. int (*callback) (struct netlbl_dom_map *entry, void *arg),
  375. void *cb_arg)
  376. {
  377. int ret_val = -ENOENT;
  378. u32 iter_bkt;
  379. struct netlbl_dom_map *iter_entry;
  380. u32 chain_cnt = 0;
  381. rcu_read_lock();
  382. for (iter_bkt = *skip_bkt;
  383. iter_bkt < rcu_dereference(netlbl_domhsh)->size;
  384. iter_bkt++, chain_cnt = 0) {
  385. list_for_each_entry_rcu(iter_entry,
  386. &netlbl_domhsh->tbl[iter_bkt],
  387. list)
  388. if (iter_entry->valid) {
  389. if (chain_cnt++ < *skip_chain)
  390. continue;
  391. ret_val = callback(iter_entry, cb_arg);
  392. if (ret_val < 0) {
  393. chain_cnt--;
  394. goto walk_return;
  395. }
  396. }
  397. }
  398. walk_return:
  399. rcu_read_unlock();
  400. *skip_bkt = iter_bkt;
  401. *skip_chain = chain_cnt;
  402. return ret_val;
  403. }