calipso.c 38 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * CALIPSO - Common Architecture Label IPv6 Security Option
  4. *
  5. * This is an implementation of the CALIPSO protocol as specified in
  6. * RFC 5570.
  7. *
  8. * Authors: Paul Moore <paul.moore@hp.com>
  9. * Huw Davies <huw@codeweavers.com>
  10. */
  11. /* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  12. * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
  13. */
  14. #include <linux/init.h>
  15. #include <linux/types.h>
  16. #include <linux/rcupdate.h>
  17. #include <linux/list.h>
  18. #include <linux/spinlock.h>
  19. #include <linux/string.h>
  20. #include <linux/jhash.h>
  21. #include <linux/audit.h>
  22. #include <linux/slab.h>
  23. #include <net/ip.h>
  24. #include <net/icmp.h>
  25. #include <net/tcp.h>
  26. #include <net/netlabel.h>
  27. #include <net/calipso.h>
  28. #include <linux/atomic.h>
  29. #include <linux/bug.h>
  30. #include <asm/unaligned.h>
  31. #include <linux/crc-ccitt.h>
  32. /* Maximium size of the calipso option including
  33. * the two-byte TLV header.
  34. */
  35. #define CALIPSO_OPT_LEN_MAX (2 + 252)
  36. /* Size of the minimum calipso option including
  37. * the two-byte TLV header.
  38. */
  39. #define CALIPSO_HDR_LEN (2 + 8)
  40. /* Maximium size of the calipso option including
  41. * the two-byte TLV header and upto 3 bytes of
  42. * leading pad and 7 bytes of trailing pad.
  43. */
  44. #define CALIPSO_OPT_LEN_MAX_WITH_PAD (3 + CALIPSO_OPT_LEN_MAX + 7)
  45. /* Maximium size of u32 aligned buffer required to hold calipso
  46. * option. Max of 3 initial pad bytes starting from buffer + 3.
  47. * i.e. the worst case is when the previous tlv finishes on 4n + 3.
  48. */
  49. #define CALIPSO_MAX_BUFFER (6 + CALIPSO_OPT_LEN_MAX)
  50. /* List of available DOI definitions */
  51. static DEFINE_SPINLOCK(calipso_doi_list_lock);
  52. static LIST_HEAD(calipso_doi_list);
  53. /* Label mapping cache */
  54. int calipso_cache_enabled = 1;
  55. int calipso_cache_bucketsize = 10;
  56. #define CALIPSO_CACHE_BUCKETBITS 7
  57. #define CALIPSO_CACHE_BUCKETS BIT(CALIPSO_CACHE_BUCKETBITS)
  58. #define CALIPSO_CACHE_REORDERLIMIT 10
  59. struct calipso_map_cache_bkt {
  60. spinlock_t lock;
  61. u32 size;
  62. struct list_head list;
  63. };
  64. struct calipso_map_cache_entry {
  65. u32 hash;
  66. unsigned char *key;
  67. size_t key_len;
  68. struct netlbl_lsm_cache *lsm_data;
  69. u32 activity;
  70. struct list_head list;
  71. };
  72. static struct calipso_map_cache_bkt *calipso_cache;
  73. static void calipso_cache_invalidate(void);
  74. static void calipso_doi_putdef(struct calipso_doi *doi_def);
  75. /* Label Mapping Cache Functions
  76. */
  77. /**
  78. * calipso_cache_entry_free - Frees a cache entry
  79. * @entry: the entry to free
  80. *
  81. * Description:
  82. * This function frees the memory associated with a cache entry including the
  83. * LSM cache data if there are no longer any users, i.e. reference count == 0.
  84. *
  85. */
  86. static void calipso_cache_entry_free(struct calipso_map_cache_entry *entry)
  87. {
  88. if (entry->lsm_data)
  89. netlbl_secattr_cache_free(entry->lsm_data);
  90. kfree(entry->key);
  91. kfree(entry);
  92. }
  93. /**
  94. * calipso_map_cache_hash - Hashing function for the CALIPSO cache
  95. * @key: the hash key
  96. * @key_len: the length of the key in bytes
  97. *
  98. * Description:
  99. * The CALIPSO tag hashing function. Returns a 32-bit hash value.
  100. *
  101. */
  102. static u32 calipso_map_cache_hash(const unsigned char *key, u32 key_len)
  103. {
  104. return jhash(key, key_len, 0);
  105. }
  106. /**
  107. * calipso_cache_init - Initialize the CALIPSO cache
  108. *
  109. * Description:
  110. * Initializes the CALIPSO label mapping cache, this function should be called
  111. * before any of the other functions defined in this file. Returns zero on
  112. * success, negative values on error.
  113. *
  114. */
  115. static int __init calipso_cache_init(void)
  116. {
  117. u32 iter;
  118. calipso_cache = kcalloc(CALIPSO_CACHE_BUCKETS,
  119. sizeof(struct calipso_map_cache_bkt),
  120. GFP_KERNEL);
  121. if (!calipso_cache)
  122. return -ENOMEM;
  123. for (iter = 0; iter < CALIPSO_CACHE_BUCKETS; iter++) {
  124. spin_lock_init(&calipso_cache[iter].lock);
  125. calipso_cache[iter].size = 0;
  126. INIT_LIST_HEAD(&calipso_cache[iter].list);
  127. }
  128. return 0;
  129. }
  130. /**
  131. * calipso_cache_invalidate - Invalidates the current CALIPSO cache
  132. *
  133. * Description:
  134. * Invalidates and frees any entries in the CALIPSO cache. Returns zero on
  135. * success and negative values on failure.
  136. *
  137. */
  138. static void calipso_cache_invalidate(void)
  139. {
  140. struct calipso_map_cache_entry *entry, *tmp_entry;
  141. u32 iter;
  142. for (iter = 0; iter < CALIPSO_CACHE_BUCKETS; iter++) {
  143. spin_lock_bh(&calipso_cache[iter].lock);
  144. list_for_each_entry_safe(entry,
  145. tmp_entry,
  146. &calipso_cache[iter].list, list) {
  147. list_del(&entry->list);
  148. calipso_cache_entry_free(entry);
  149. }
  150. calipso_cache[iter].size = 0;
  151. spin_unlock_bh(&calipso_cache[iter].lock);
  152. }
  153. }
  154. /**
  155. * calipso_cache_check - Check the CALIPSO cache for a label mapping
  156. * @key: the buffer to check
  157. * @key_len: buffer length in bytes
  158. * @secattr: the security attribute struct to use
  159. *
  160. * Description:
  161. * This function checks the cache to see if a label mapping already exists for
  162. * the given key. If there is a match then the cache is adjusted and the
  163. * @secattr struct is populated with the correct LSM security attributes. The
  164. * cache is adjusted in the following manner if the entry is not already the
  165. * first in the cache bucket:
  166. *
  167. * 1. The cache entry's activity counter is incremented
  168. * 2. The previous (higher ranking) entry's activity counter is decremented
  169. * 3. If the difference between the two activity counters is geater than
  170. * CALIPSO_CACHE_REORDERLIMIT the two entries are swapped
  171. *
  172. * Returns zero on success, -ENOENT for a cache miss, and other negative values
  173. * on error.
  174. *
  175. */
  176. static int calipso_cache_check(const unsigned char *key,
  177. u32 key_len,
  178. struct netlbl_lsm_secattr *secattr)
  179. {
  180. u32 bkt;
  181. struct calipso_map_cache_entry *entry;
  182. struct calipso_map_cache_entry *prev_entry = NULL;
  183. u32 hash;
  184. if (!calipso_cache_enabled)
  185. return -ENOENT;
  186. hash = calipso_map_cache_hash(key, key_len);
  187. bkt = hash & (CALIPSO_CACHE_BUCKETS - 1);
  188. spin_lock_bh(&calipso_cache[bkt].lock);
  189. list_for_each_entry(entry, &calipso_cache[bkt].list, list) {
  190. if (entry->hash == hash &&
  191. entry->key_len == key_len &&
  192. memcmp(entry->key, key, key_len) == 0) {
  193. entry->activity += 1;
  194. refcount_inc(&entry->lsm_data->refcount);
  195. secattr->cache = entry->lsm_data;
  196. secattr->flags |= NETLBL_SECATTR_CACHE;
  197. secattr->type = NETLBL_NLTYPE_CALIPSO;
  198. if (!prev_entry) {
  199. spin_unlock_bh(&calipso_cache[bkt].lock);
  200. return 0;
  201. }
  202. if (prev_entry->activity > 0)
  203. prev_entry->activity -= 1;
  204. if (entry->activity > prev_entry->activity &&
  205. entry->activity - prev_entry->activity >
  206. CALIPSO_CACHE_REORDERLIMIT) {
  207. __list_del(entry->list.prev, entry->list.next);
  208. __list_add(&entry->list,
  209. prev_entry->list.prev,
  210. &prev_entry->list);
  211. }
  212. spin_unlock_bh(&calipso_cache[bkt].lock);
  213. return 0;
  214. }
  215. prev_entry = entry;
  216. }
  217. spin_unlock_bh(&calipso_cache[bkt].lock);
  218. return -ENOENT;
  219. }
  220. /**
  221. * calipso_cache_add - Add an entry to the CALIPSO cache
  222. * @calipso_ptr: the CALIPSO option
  223. * @secattr: the packet's security attributes
  224. *
  225. * Description:
  226. * Add a new entry into the CALIPSO label mapping cache. Add the new entry to
  227. * head of the cache bucket's list, if the cache bucket is out of room remove
  228. * the last entry in the list first. It is important to note that there is
  229. * currently no checking for duplicate keys. Returns zero on success,
  230. * negative values on failure. The key stored starts at calipso_ptr + 2,
  231. * i.e. the type and length bytes are not stored, this corresponds to
  232. * calipso_ptr[1] bytes of data.
  233. *
  234. */
  235. static int calipso_cache_add(const unsigned char *calipso_ptr,
  236. const struct netlbl_lsm_secattr *secattr)
  237. {
  238. int ret_val = -EPERM;
  239. u32 bkt;
  240. struct calipso_map_cache_entry *entry = NULL;
  241. struct calipso_map_cache_entry *old_entry = NULL;
  242. u32 calipso_ptr_len;
  243. if (!calipso_cache_enabled || calipso_cache_bucketsize <= 0)
  244. return 0;
  245. calipso_ptr_len = calipso_ptr[1];
  246. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  247. if (!entry)
  248. return -ENOMEM;
  249. entry->key = kmemdup(calipso_ptr + 2, calipso_ptr_len, GFP_ATOMIC);
  250. if (!entry->key) {
  251. ret_val = -ENOMEM;
  252. goto cache_add_failure;
  253. }
  254. entry->key_len = calipso_ptr_len;
  255. entry->hash = calipso_map_cache_hash(calipso_ptr, calipso_ptr_len);
  256. refcount_inc(&secattr->cache->refcount);
  257. entry->lsm_data = secattr->cache;
  258. bkt = entry->hash & (CALIPSO_CACHE_BUCKETS - 1);
  259. spin_lock_bh(&calipso_cache[bkt].lock);
  260. if (calipso_cache[bkt].size < calipso_cache_bucketsize) {
  261. list_add(&entry->list, &calipso_cache[bkt].list);
  262. calipso_cache[bkt].size += 1;
  263. } else {
  264. old_entry = list_entry(calipso_cache[bkt].list.prev,
  265. struct calipso_map_cache_entry, list);
  266. list_del(&old_entry->list);
  267. list_add(&entry->list, &calipso_cache[bkt].list);
  268. calipso_cache_entry_free(old_entry);
  269. }
  270. spin_unlock_bh(&calipso_cache[bkt].lock);
  271. return 0;
  272. cache_add_failure:
  273. if (entry)
  274. calipso_cache_entry_free(entry);
  275. return ret_val;
  276. }
  277. /* DOI List Functions
  278. */
  279. /**
  280. * calipso_doi_search - Searches for a DOI definition
  281. * @doi: the DOI to search for
  282. *
  283. * Description:
  284. * Search the DOI definition list for a DOI definition with a DOI value that
  285. * matches @doi. The caller is responsible for calling rcu_read_[un]lock().
  286. * Returns a pointer to the DOI definition on success and NULL on failure.
  287. */
  288. static struct calipso_doi *calipso_doi_search(u32 doi)
  289. {
  290. struct calipso_doi *iter;
  291. list_for_each_entry_rcu(iter, &calipso_doi_list, list)
  292. if (iter->doi == doi && refcount_read(&iter->refcount))
  293. return iter;
  294. return NULL;
  295. }
  296. /**
  297. * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
  298. * @doi_def: the DOI structure
  299. * @audit_info: NetLabel audit information
  300. *
  301. * Description:
  302. * The caller defines a new DOI for use by the CALIPSO engine and calls this
  303. * function to add it to the list of acceptable domains. The caller must
  304. * ensure that the mapping table specified in @doi_def->map meets all of the
  305. * requirements of the mapping type (see calipso.h for details). Returns
  306. * zero on success and non-zero on failure.
  307. *
  308. */
  309. static int calipso_doi_add(struct calipso_doi *doi_def,
  310. struct netlbl_audit *audit_info)
  311. {
  312. int ret_val = -EINVAL;
  313. u32 doi;
  314. u32 doi_type;
  315. struct audit_buffer *audit_buf;
  316. doi = doi_def->doi;
  317. doi_type = doi_def->type;
  318. if (doi_def->doi == CALIPSO_DOI_UNKNOWN)
  319. goto doi_add_return;
  320. refcount_set(&doi_def->refcount, 1);
  321. spin_lock(&calipso_doi_list_lock);
  322. if (calipso_doi_search(doi_def->doi)) {
  323. spin_unlock(&calipso_doi_list_lock);
  324. ret_val = -EEXIST;
  325. goto doi_add_return;
  326. }
  327. list_add_tail_rcu(&doi_def->list, &calipso_doi_list);
  328. spin_unlock(&calipso_doi_list_lock);
  329. ret_val = 0;
  330. doi_add_return:
  331. audit_buf = netlbl_audit_start(AUDIT_MAC_CALIPSO_ADD, audit_info);
  332. if (audit_buf) {
  333. const char *type_str;
  334. switch (doi_type) {
  335. case CALIPSO_MAP_PASS:
  336. type_str = "pass";
  337. break;
  338. default:
  339. type_str = "(unknown)";
  340. }
  341. audit_log_format(audit_buf,
  342. " calipso_doi=%u calipso_type=%s res=%u",
  343. doi, type_str, ret_val == 0 ? 1 : 0);
  344. audit_log_end(audit_buf);
  345. }
  346. return ret_val;
  347. }
  348. /**
  349. * calipso_doi_free - Frees a DOI definition
  350. * @doi_def: the DOI definition
  351. *
  352. * Description:
  353. * This function frees all of the memory associated with a DOI definition.
  354. *
  355. */
  356. static void calipso_doi_free(struct calipso_doi *doi_def)
  357. {
  358. kfree(doi_def);
  359. }
  360. /**
  361. * calipso_doi_free_rcu - Frees a DOI definition via the RCU pointer
  362. * @entry: the entry's RCU field
  363. *
  364. * Description:
  365. * This function is designed to be used as a callback to the call_rcu()
  366. * function so that the memory allocated to the DOI definition can be released
  367. * safely.
  368. *
  369. */
  370. static void calipso_doi_free_rcu(struct rcu_head *entry)
  371. {
  372. struct calipso_doi *doi_def;
  373. doi_def = container_of(entry, struct calipso_doi, rcu);
  374. calipso_doi_free(doi_def);
  375. }
  376. /**
  377. * calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine
  378. * @doi: the DOI value
  379. * @audit_secid: the LSM secid to use in the audit message
  380. *
  381. * Description:
  382. * Removes a DOI definition from the CALIPSO engine. The NetLabel routines will
  383. * be called to release their own LSM domain mappings as well as our own
  384. * domain list. Returns zero on success and negative values on failure.
  385. *
  386. */
  387. static int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info)
  388. {
  389. int ret_val;
  390. struct calipso_doi *doi_def;
  391. struct audit_buffer *audit_buf;
  392. spin_lock(&calipso_doi_list_lock);
  393. doi_def = calipso_doi_search(doi);
  394. if (!doi_def) {
  395. spin_unlock(&calipso_doi_list_lock);
  396. ret_val = -ENOENT;
  397. goto doi_remove_return;
  398. }
  399. list_del_rcu(&doi_def->list);
  400. spin_unlock(&calipso_doi_list_lock);
  401. calipso_doi_putdef(doi_def);
  402. ret_val = 0;
  403. doi_remove_return:
  404. audit_buf = netlbl_audit_start(AUDIT_MAC_CALIPSO_DEL, audit_info);
  405. if (audit_buf) {
  406. audit_log_format(audit_buf,
  407. " calipso_doi=%u res=%u",
  408. doi, ret_val == 0 ? 1 : 0);
  409. audit_log_end(audit_buf);
  410. }
  411. return ret_val;
  412. }
  413. /**
  414. * calipso_doi_getdef - Returns a reference to a valid DOI definition
  415. * @doi: the DOI value
  416. *
  417. * Description:
  418. * Searches for a valid DOI definition and if one is found it is returned to
  419. * the caller. Otherwise NULL is returned. The caller must ensure that
  420. * calipso_doi_putdef() is called when the caller is done.
  421. *
  422. */
  423. static struct calipso_doi *calipso_doi_getdef(u32 doi)
  424. {
  425. struct calipso_doi *doi_def;
  426. rcu_read_lock();
  427. doi_def = calipso_doi_search(doi);
  428. if (!doi_def)
  429. goto doi_getdef_return;
  430. if (!refcount_inc_not_zero(&doi_def->refcount))
  431. doi_def = NULL;
  432. doi_getdef_return:
  433. rcu_read_unlock();
  434. return doi_def;
  435. }
  436. /**
  437. * calipso_doi_putdef - Releases a reference for the given DOI definition
  438. * @doi_def: the DOI definition
  439. *
  440. * Description:
  441. * Releases a DOI definition reference obtained from calipso_doi_getdef().
  442. *
  443. */
  444. static void calipso_doi_putdef(struct calipso_doi *doi_def)
  445. {
  446. if (!doi_def)
  447. return;
  448. if (!refcount_dec_and_test(&doi_def->refcount))
  449. return;
  450. calipso_cache_invalidate();
  451. call_rcu(&doi_def->rcu, calipso_doi_free_rcu);
  452. }
  453. /**
  454. * calipso_doi_walk - Iterate through the DOI definitions
  455. * @skip_cnt: skip past this number of DOI definitions, updated
  456. * @callback: callback for each DOI definition
  457. * @cb_arg: argument for the callback function
  458. *
  459. * Description:
  460. * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
  461. * For each entry call @callback, if @callback returns a negative value stop
  462. * 'walking' through the list and return. Updates the value in @skip_cnt upon
  463. * return. Returns zero on success, negative values on failure.
  464. *
  465. */
  466. static int calipso_doi_walk(u32 *skip_cnt,
  467. int (*callback)(struct calipso_doi *doi_def,
  468. void *arg),
  469. void *cb_arg)
  470. {
  471. int ret_val = -ENOENT;
  472. u32 doi_cnt = 0;
  473. struct calipso_doi *iter_doi;
  474. rcu_read_lock();
  475. list_for_each_entry_rcu(iter_doi, &calipso_doi_list, list)
  476. if (refcount_read(&iter_doi->refcount) > 0) {
  477. if (doi_cnt++ < *skip_cnt)
  478. continue;
  479. ret_val = callback(iter_doi, cb_arg);
  480. if (ret_val < 0) {
  481. doi_cnt--;
  482. goto doi_walk_return;
  483. }
  484. }
  485. doi_walk_return:
  486. rcu_read_unlock();
  487. *skip_cnt = doi_cnt;
  488. return ret_val;
  489. }
  490. /**
  491. * calipso_validate - Validate a CALIPSO option
  492. * @skb: the packet
  493. * @option: the start of the option
  494. *
  495. * Description:
  496. * This routine is called to validate a CALIPSO option.
  497. * If the option is valid then %true is returned, otherwise
  498. * %false is returned.
  499. *
  500. * The caller should have already checked that the length of the
  501. * option (including the TLV header) is >= 10 and that the catmap
  502. * length is consistent with the option length.
  503. *
  504. * We leave checks on the level and categories to the socket layer.
  505. */
  506. bool calipso_validate(const struct sk_buff *skb, const unsigned char *option)
  507. {
  508. struct calipso_doi *doi_def;
  509. bool ret_val;
  510. u16 crc, len = option[1] + 2;
  511. static const u8 zero[2];
  512. /* The original CRC runs over the option including the TLV header
  513. * with the CRC-16 field (at offset 8) zeroed out. */
  514. crc = crc_ccitt(0xffff, option, 8);
  515. crc = crc_ccitt(crc, zero, sizeof(zero));
  516. if (len > 10)
  517. crc = crc_ccitt(crc, option + 10, len - 10);
  518. crc = ~crc;
  519. if (option[8] != (crc & 0xff) || option[9] != ((crc >> 8) & 0xff))
  520. return false;
  521. rcu_read_lock();
  522. doi_def = calipso_doi_search(get_unaligned_be32(option + 2));
  523. ret_val = !!doi_def;
  524. rcu_read_unlock();
  525. return ret_val;
  526. }
  527. /**
  528. * calipso_map_cat_hton - Perform a category mapping from host to network
  529. * @doi_def: the DOI definition
  530. * @secattr: the security attributes
  531. * @net_cat: the zero'd out category bitmap in network/CALIPSO format
  532. * @net_cat_len: the length of the CALIPSO bitmap in bytes
  533. *
  534. * Description:
  535. * Perform a label mapping to translate a local MLS category bitmap to the
  536. * correct CALIPSO bitmap using the given DOI definition. Returns the minimum
  537. * size in bytes of the network bitmap on success, negative values otherwise.
  538. *
  539. */
  540. static int calipso_map_cat_hton(const struct calipso_doi *doi_def,
  541. const struct netlbl_lsm_secattr *secattr,
  542. unsigned char *net_cat,
  543. u32 net_cat_len)
  544. {
  545. int spot = -1;
  546. u32 net_spot_max = 0;
  547. u32 net_clen_bits = net_cat_len * 8;
  548. for (;;) {
  549. spot = netlbl_catmap_walk(secattr->attr.mls.cat,
  550. spot + 1);
  551. if (spot < 0)
  552. break;
  553. if (spot >= net_clen_bits)
  554. return -ENOSPC;
  555. netlbl_bitmap_setbit(net_cat, spot, 1);
  556. if (spot > net_spot_max)
  557. net_spot_max = spot;
  558. }
  559. return (net_spot_max / 32 + 1) * 4;
  560. }
  561. /**
  562. * calipso_map_cat_ntoh - Perform a category mapping from network to host
  563. * @doi_def: the DOI definition
  564. * @net_cat: the category bitmap in network/CALIPSO format
  565. * @net_cat_len: the length of the CALIPSO bitmap in bytes
  566. * @secattr: the security attributes
  567. *
  568. * Description:
  569. * Perform a label mapping to translate a CALIPSO bitmap to the correct local
  570. * MLS category bitmap using the given DOI definition. Returns zero on
  571. * success, negative values on failure.
  572. *
  573. */
  574. static int calipso_map_cat_ntoh(const struct calipso_doi *doi_def,
  575. const unsigned char *net_cat,
  576. u32 net_cat_len,
  577. struct netlbl_lsm_secattr *secattr)
  578. {
  579. int ret_val;
  580. int spot = -1;
  581. u32 net_clen_bits = net_cat_len * 8;
  582. for (;;) {
  583. spot = netlbl_bitmap_walk(net_cat,
  584. net_clen_bits,
  585. spot + 1,
  586. 1);
  587. if (spot < 0) {
  588. if (spot == -2)
  589. return -EFAULT;
  590. return 0;
  591. }
  592. ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
  593. spot,
  594. GFP_ATOMIC);
  595. if (ret_val != 0)
  596. return ret_val;
  597. }
  598. return -EINVAL;
  599. }
  600. /**
  601. * calipso_pad_write - Writes pad bytes in TLV format
  602. * @buf: the buffer
  603. * @offset: offset from start of buffer to write padding
  604. * @count: number of pad bytes to write
  605. *
  606. * Description:
  607. * Write @count bytes of TLV padding into @buffer starting at offset @offset.
  608. * @count should be less than 8 - see RFC 4942.
  609. *
  610. */
  611. static int calipso_pad_write(unsigned char *buf, unsigned int offset,
  612. unsigned int count)
  613. {
  614. if (WARN_ON_ONCE(count >= 8))
  615. return -EINVAL;
  616. switch (count) {
  617. case 0:
  618. break;
  619. case 1:
  620. buf[offset] = IPV6_TLV_PAD1;
  621. break;
  622. default:
  623. buf[offset] = IPV6_TLV_PADN;
  624. buf[offset + 1] = count - 2;
  625. if (count > 2)
  626. memset(buf + offset + 2, 0, count - 2);
  627. break;
  628. }
  629. return 0;
  630. }
  631. /**
  632. * calipso_genopt - Generate a CALIPSO option
  633. * @buf: the option buffer
  634. * @start: offset from which to write
  635. * @buf_len: the size of opt_buf
  636. * @doi_def: the CALIPSO DOI to use
  637. * @secattr: the security attributes
  638. *
  639. * Description:
  640. * Generate a CALIPSO option using the DOI definition and security attributes
  641. * passed to the function. This also generates upto three bytes of leading
  642. * padding that ensures that the option is 4n + 2 aligned. It returns the
  643. * number of bytes written (including any initial padding).
  644. */
  645. static int calipso_genopt(unsigned char *buf, u32 start, u32 buf_len,
  646. const struct calipso_doi *doi_def,
  647. const struct netlbl_lsm_secattr *secattr)
  648. {
  649. int ret_val;
  650. u32 len, pad;
  651. u16 crc;
  652. static const unsigned char padding[4] = {2, 1, 0, 3};
  653. unsigned char *calipso;
  654. /* CALIPSO has 4n + 2 alignment */
  655. pad = padding[start & 3];
  656. if (buf_len <= start + pad + CALIPSO_HDR_LEN)
  657. return -ENOSPC;
  658. if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
  659. return -EPERM;
  660. len = CALIPSO_HDR_LEN;
  661. if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
  662. ret_val = calipso_map_cat_hton(doi_def,
  663. secattr,
  664. buf + start + pad + len,
  665. buf_len - start - pad - len);
  666. if (ret_val < 0)
  667. return ret_val;
  668. len += ret_val;
  669. }
  670. calipso_pad_write(buf, start, pad);
  671. calipso = buf + start + pad;
  672. calipso[0] = IPV6_TLV_CALIPSO;
  673. calipso[1] = len - 2;
  674. *(__be32 *)(calipso + 2) = htonl(doi_def->doi);
  675. calipso[6] = (len - CALIPSO_HDR_LEN) / 4;
  676. calipso[7] = secattr->attr.mls.lvl;
  677. crc = ~crc_ccitt(0xffff, calipso, len);
  678. calipso[8] = crc & 0xff;
  679. calipso[9] = (crc >> 8) & 0xff;
  680. return pad + len;
  681. }
  682. /* Hop-by-hop hdr helper functions
  683. */
  684. /**
  685. * calipso_opt_update - Replaces socket's hop options with a new set
  686. * @sk: the socket
  687. * @hop: new hop options
  688. *
  689. * Description:
  690. * Replaces @sk's hop options with @hop. @hop may be NULL to leave
  691. * the socket with no hop options.
  692. *
  693. */
  694. static int calipso_opt_update(struct sock *sk, struct ipv6_opt_hdr *hop)
  695. {
  696. struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
  697. txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
  698. txopt_put(old);
  699. if (IS_ERR(txopts))
  700. return PTR_ERR(txopts);
  701. txopts = ipv6_update_options(sk, txopts);
  702. if (txopts) {
  703. atomic_sub(txopts->tot_len, &sk->sk_omem_alloc);
  704. txopt_put(txopts);
  705. }
  706. return 0;
  707. }
  708. /**
  709. * calipso_tlv_len - Returns the length of the TLV
  710. * @opt: the option header
  711. * @offset: offset of the TLV within the header
  712. *
  713. * Description:
  714. * Returns the length of the TLV option at offset @offset within
  715. * the option header @opt. Checks that the entire TLV fits inside
  716. * the option header, returns a negative value if this is not the case.
  717. */
  718. static int calipso_tlv_len(struct ipv6_opt_hdr *opt, unsigned int offset)
  719. {
  720. unsigned char *tlv = (unsigned char *)opt;
  721. unsigned int opt_len = ipv6_optlen(opt), tlv_len;
  722. if (offset < sizeof(*opt) || offset >= opt_len)
  723. return -EINVAL;
  724. if (tlv[offset] == IPV6_TLV_PAD1)
  725. return 1;
  726. if (offset + 1 >= opt_len)
  727. return -EINVAL;
  728. tlv_len = tlv[offset + 1] + 2;
  729. if (offset + tlv_len > opt_len)
  730. return -EINVAL;
  731. return tlv_len;
  732. }
  733. /**
  734. * calipso_opt_find - Finds the CALIPSO option in an IPv6 hop options header
  735. * @hop: the hop options header
  736. * @start: on return holds the offset of any leading padding
  737. * @end: on return holds the offset of the first non-pad TLV after CALIPSO
  738. *
  739. * Description:
  740. * Finds the space occupied by a CALIPSO option (including any leading and
  741. * trailing padding).
  742. *
  743. * If a CALIPSO option exists set @start and @end to the
  744. * offsets within @hop of the start of padding before the first
  745. * CALIPSO option and the end of padding after the first CALIPSO
  746. * option. In this case the function returns 0.
  747. *
  748. * In the absence of a CALIPSO option, @start and @end will be
  749. * set to the start and end of any trailing padding in the header.
  750. * This is useful when appending a new option, as the caller may want
  751. * to overwrite some of this padding. In this case the function will
  752. * return -ENOENT.
  753. */
  754. static int calipso_opt_find(struct ipv6_opt_hdr *hop, unsigned int *start,
  755. unsigned int *end)
  756. {
  757. int ret_val = -ENOENT, tlv_len;
  758. unsigned int opt_len, offset, offset_s = 0, offset_e = 0;
  759. unsigned char *opt = (unsigned char *)hop;
  760. opt_len = ipv6_optlen(hop);
  761. offset = sizeof(*hop);
  762. while (offset < opt_len) {
  763. tlv_len = calipso_tlv_len(hop, offset);
  764. if (tlv_len < 0)
  765. return tlv_len;
  766. switch (opt[offset]) {
  767. case IPV6_TLV_PAD1:
  768. case IPV6_TLV_PADN:
  769. if (offset_e)
  770. offset_e = offset;
  771. break;
  772. case IPV6_TLV_CALIPSO:
  773. ret_val = 0;
  774. offset_e = offset;
  775. break;
  776. default:
  777. if (offset_e == 0)
  778. offset_s = offset;
  779. else
  780. goto out;
  781. }
  782. offset += tlv_len;
  783. }
  784. out:
  785. if (offset_s)
  786. *start = offset_s + calipso_tlv_len(hop, offset_s);
  787. else
  788. *start = sizeof(*hop);
  789. if (offset_e)
  790. *end = offset_e + calipso_tlv_len(hop, offset_e);
  791. else
  792. *end = opt_len;
  793. return ret_val;
  794. }
  795. /**
  796. * calipso_opt_insert - Inserts a CALIPSO option into an IPv6 hop opt hdr
  797. * @hop: the original hop options header
  798. * @doi_def: the CALIPSO DOI to use
  799. * @secattr: the specific security attributes of the socket
  800. *
  801. * Description:
  802. * Creates a new hop options header based on @hop with a
  803. * CALIPSO option added to it. If @hop already contains a CALIPSO
  804. * option this is overwritten, otherwise the new option is appended
  805. * after any existing options. If @hop is NULL then the new header
  806. * will contain just the CALIPSO option and any needed padding.
  807. *
  808. */
  809. static struct ipv6_opt_hdr *
  810. calipso_opt_insert(struct ipv6_opt_hdr *hop,
  811. const struct calipso_doi *doi_def,
  812. const struct netlbl_lsm_secattr *secattr)
  813. {
  814. unsigned int start, end, buf_len, pad, hop_len;
  815. struct ipv6_opt_hdr *new;
  816. int ret_val;
  817. if (hop) {
  818. hop_len = ipv6_optlen(hop);
  819. ret_val = calipso_opt_find(hop, &start, &end);
  820. if (ret_val && ret_val != -ENOENT)
  821. return ERR_PTR(ret_val);
  822. } else {
  823. hop_len = 0;
  824. start = sizeof(*hop);
  825. end = 0;
  826. }
  827. buf_len = hop_len + start - end + CALIPSO_OPT_LEN_MAX_WITH_PAD;
  828. new = kzalloc(buf_len, GFP_ATOMIC);
  829. if (!new)
  830. return ERR_PTR(-ENOMEM);
  831. if (start > sizeof(*hop))
  832. memcpy(new, hop, start);
  833. ret_val = calipso_genopt((unsigned char *)new, start, buf_len, doi_def,
  834. secattr);
  835. if (ret_val < 0) {
  836. kfree(new);
  837. return ERR_PTR(ret_val);
  838. }
  839. buf_len = start + ret_val;
  840. /* At this point buf_len aligns to 4n, so (buf_len & 4) pads to 8n */
  841. pad = ((buf_len & 4) + (end & 7)) & 7;
  842. calipso_pad_write((unsigned char *)new, buf_len, pad);
  843. buf_len += pad;
  844. if (end != hop_len) {
  845. memcpy((char *)new + buf_len, (char *)hop + end, hop_len - end);
  846. buf_len += hop_len - end;
  847. }
  848. new->nexthdr = 0;
  849. new->hdrlen = buf_len / 8 - 1;
  850. return new;
  851. }
  852. /**
  853. * calipso_opt_del - Removes the CALIPSO option from an option header
  854. * @hop: the original header
  855. * @new: the new header
  856. *
  857. * Description:
  858. * Creates a new header based on @hop without any CALIPSO option. If @hop
  859. * doesn't contain a CALIPSO option it returns -ENOENT. If @hop contains
  860. * no other non-padding options, it returns zero with @new set to NULL.
  861. * Otherwise it returns zero, creates a new header without the CALIPSO
  862. * option (and removing as much padding as possible) and returns with
  863. * @new set to that header.
  864. *
  865. */
  866. static int calipso_opt_del(struct ipv6_opt_hdr *hop,
  867. struct ipv6_opt_hdr **new)
  868. {
  869. int ret_val;
  870. unsigned int start, end, delta, pad, hop_len;
  871. ret_val = calipso_opt_find(hop, &start, &end);
  872. if (ret_val)
  873. return ret_val;
  874. hop_len = ipv6_optlen(hop);
  875. if (start == sizeof(*hop) && end == hop_len) {
  876. /* There's no other option in the header so return NULL */
  877. *new = NULL;
  878. return 0;
  879. }
  880. delta = (end - start) & ~7;
  881. *new = kzalloc(hop_len - delta, GFP_ATOMIC);
  882. if (!*new)
  883. return -ENOMEM;
  884. memcpy(*new, hop, start);
  885. (*new)->hdrlen -= delta / 8;
  886. pad = (end - start) & 7;
  887. calipso_pad_write((unsigned char *)*new, start, pad);
  888. if (end != hop_len)
  889. memcpy((char *)*new + start + pad, (char *)hop + end,
  890. hop_len - end);
  891. return 0;
  892. }
  893. /**
  894. * calipso_opt_getattr - Get the security attributes from a memory block
  895. * @calipso: the CALIPSO option
  896. * @secattr: the security attributes
  897. *
  898. * Description:
  899. * Inspect @calipso and return the security attributes in @secattr.
  900. * Returns zero on success and negative values on failure.
  901. *
  902. */
  903. static int calipso_opt_getattr(const unsigned char *calipso,
  904. struct netlbl_lsm_secattr *secattr)
  905. {
  906. int ret_val = -ENOMSG;
  907. u32 doi, len = calipso[1], cat_len = calipso[6] * 4;
  908. struct calipso_doi *doi_def;
  909. if (cat_len + 8 > len)
  910. return -EINVAL;
  911. if (calipso_cache_check(calipso + 2, calipso[1], secattr) == 0)
  912. return 0;
  913. doi = get_unaligned_be32(calipso + 2);
  914. rcu_read_lock();
  915. doi_def = calipso_doi_search(doi);
  916. if (!doi_def)
  917. goto getattr_return;
  918. secattr->attr.mls.lvl = calipso[7];
  919. secattr->flags |= NETLBL_SECATTR_MLS_LVL;
  920. if (cat_len) {
  921. ret_val = calipso_map_cat_ntoh(doi_def,
  922. calipso + 10,
  923. cat_len,
  924. secattr);
  925. if (ret_val != 0) {
  926. netlbl_catmap_free(secattr->attr.mls.cat);
  927. goto getattr_return;
  928. }
  929. if (secattr->attr.mls.cat)
  930. secattr->flags |= NETLBL_SECATTR_MLS_CAT;
  931. }
  932. secattr->type = NETLBL_NLTYPE_CALIPSO;
  933. getattr_return:
  934. rcu_read_unlock();
  935. return ret_val;
  936. }
  937. /* sock functions.
  938. */
  939. /**
  940. * calipso_sock_getattr - Get the security attributes from a sock
  941. * @sk: the sock
  942. * @secattr: the security attributes
  943. *
  944. * Description:
  945. * Query @sk to see if there is a CALIPSO option attached to the sock and if
  946. * there is return the CALIPSO security attributes in @secattr. This function
  947. * requires that @sk be locked, or privately held, but it does not do any
  948. * locking itself. Returns zero on success and negative values on failure.
  949. *
  950. */
  951. static int calipso_sock_getattr(struct sock *sk,
  952. struct netlbl_lsm_secattr *secattr)
  953. {
  954. struct ipv6_opt_hdr *hop;
  955. int opt_len, len, ret_val = -ENOMSG, offset;
  956. unsigned char *opt;
  957. struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk));
  958. if (!txopts || !txopts->hopopt)
  959. goto done;
  960. hop = txopts->hopopt;
  961. opt = (unsigned char *)hop;
  962. opt_len = ipv6_optlen(hop);
  963. offset = sizeof(*hop);
  964. while (offset < opt_len) {
  965. len = calipso_tlv_len(hop, offset);
  966. if (len < 0) {
  967. ret_val = len;
  968. goto done;
  969. }
  970. switch (opt[offset]) {
  971. case IPV6_TLV_CALIPSO:
  972. if (len < CALIPSO_HDR_LEN)
  973. ret_val = -EINVAL;
  974. else
  975. ret_val = calipso_opt_getattr(&opt[offset],
  976. secattr);
  977. goto done;
  978. default:
  979. offset += len;
  980. break;
  981. }
  982. }
  983. done:
  984. txopt_put(txopts);
  985. return ret_val;
  986. }
  987. /**
  988. * calipso_sock_setattr - Add a CALIPSO option to a socket
  989. * @sk: the socket
  990. * @doi_def: the CALIPSO DOI to use
  991. * @secattr: the specific security attributes of the socket
  992. *
  993. * Description:
  994. * Set the CALIPSO option on the given socket using the DOI definition and
  995. * security attributes passed to the function. This function requires
  996. * exclusive access to @sk, which means it either needs to be in the
  997. * process of being created or locked. Returns zero on success and negative
  998. * values on failure.
  999. *
  1000. */
  1001. static int calipso_sock_setattr(struct sock *sk,
  1002. const struct calipso_doi *doi_def,
  1003. const struct netlbl_lsm_secattr *secattr)
  1004. {
  1005. int ret_val;
  1006. struct ipv6_opt_hdr *old, *new;
  1007. struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk));
  1008. old = NULL;
  1009. if (txopts)
  1010. old = txopts->hopopt;
  1011. new = calipso_opt_insert(old, doi_def, secattr);
  1012. txopt_put(txopts);
  1013. if (IS_ERR(new))
  1014. return PTR_ERR(new);
  1015. ret_val = calipso_opt_update(sk, new);
  1016. kfree(new);
  1017. return ret_val;
  1018. }
  1019. /**
  1020. * calipso_sock_delattr - Delete the CALIPSO option from a socket
  1021. * @sk: the socket
  1022. *
  1023. * Description:
  1024. * Removes the CALIPSO option from a socket, if present.
  1025. *
  1026. */
  1027. static void calipso_sock_delattr(struct sock *sk)
  1028. {
  1029. struct ipv6_opt_hdr *new_hop;
  1030. struct ipv6_txoptions *txopts = txopt_get(inet6_sk(sk));
  1031. if (!txopts || !txopts->hopopt)
  1032. goto done;
  1033. if (calipso_opt_del(txopts->hopopt, &new_hop))
  1034. goto done;
  1035. calipso_opt_update(sk, new_hop);
  1036. kfree(new_hop);
  1037. done:
  1038. txopt_put(txopts);
  1039. }
  1040. /* request sock functions.
  1041. */
  1042. /**
  1043. * calipso_req_setattr - Add a CALIPSO option to a connection request socket
  1044. * @req: the connection request socket
  1045. * @doi_def: the CALIPSO DOI to use
  1046. * @secattr: the specific security attributes of the socket
  1047. *
  1048. * Description:
  1049. * Set the CALIPSO option on the given socket using the DOI definition and
  1050. * security attributes passed to the function. Returns zero on success and
  1051. * negative values on failure.
  1052. *
  1053. */
  1054. static int calipso_req_setattr(struct request_sock *req,
  1055. const struct calipso_doi *doi_def,
  1056. const struct netlbl_lsm_secattr *secattr)
  1057. {
  1058. struct ipv6_txoptions *txopts;
  1059. struct inet_request_sock *req_inet = inet_rsk(req);
  1060. struct ipv6_opt_hdr *old, *new;
  1061. struct sock *sk = sk_to_full_sk(req_to_sk(req));
  1062. if (req_inet->ipv6_opt && req_inet->ipv6_opt->hopopt)
  1063. old = req_inet->ipv6_opt->hopopt;
  1064. else
  1065. old = NULL;
  1066. new = calipso_opt_insert(old, doi_def, secattr);
  1067. if (IS_ERR(new))
  1068. return PTR_ERR(new);
  1069. txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
  1070. kfree(new);
  1071. if (IS_ERR(txopts))
  1072. return PTR_ERR(txopts);
  1073. txopts = xchg(&req_inet->ipv6_opt, txopts);
  1074. if (txopts) {
  1075. atomic_sub(txopts->tot_len, &sk->sk_omem_alloc);
  1076. txopt_put(txopts);
  1077. }
  1078. return 0;
  1079. }
  1080. /**
  1081. * calipso_req_delattr - Delete the CALIPSO option from a request socket
  1082. * @reg: the request socket
  1083. *
  1084. * Description:
  1085. * Removes the CALIPSO option from a request socket, if present.
  1086. *
  1087. */
  1088. static void calipso_req_delattr(struct request_sock *req)
  1089. {
  1090. struct inet_request_sock *req_inet = inet_rsk(req);
  1091. struct ipv6_opt_hdr *new;
  1092. struct ipv6_txoptions *txopts;
  1093. struct sock *sk = sk_to_full_sk(req_to_sk(req));
  1094. if (!req_inet->ipv6_opt || !req_inet->ipv6_opt->hopopt)
  1095. return;
  1096. if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
  1097. return; /* Nothing to do */
  1098. txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
  1099. if (!IS_ERR(txopts)) {
  1100. txopts = xchg(&req_inet->ipv6_opt, txopts);
  1101. if (txopts) {
  1102. atomic_sub(txopts->tot_len, &sk->sk_omem_alloc);
  1103. txopt_put(txopts);
  1104. }
  1105. }
  1106. kfree(new);
  1107. }
  1108. /* skbuff functions.
  1109. */
  1110. /**
  1111. * calipso_skbuff_optptr - Find the CALIPSO option in the packet
  1112. * @skb: the packet
  1113. *
  1114. * Description:
  1115. * Parse the packet's IP header looking for a CALIPSO option. Returns a pointer
  1116. * to the start of the CALIPSO option on success, NULL if one if not found.
  1117. *
  1118. */
  1119. static unsigned char *calipso_skbuff_optptr(const struct sk_buff *skb)
  1120. {
  1121. const struct ipv6hdr *ip6_hdr = ipv6_hdr(skb);
  1122. int offset;
  1123. if (ip6_hdr->nexthdr != NEXTHDR_HOP)
  1124. return NULL;
  1125. offset = ipv6_find_tlv(skb, sizeof(*ip6_hdr), IPV6_TLV_CALIPSO);
  1126. if (offset >= 0)
  1127. return (unsigned char *)ip6_hdr + offset;
  1128. return NULL;
  1129. }
  1130. /**
  1131. * calipso_skbuff_setattr - Set the CALIPSO option on a packet
  1132. * @skb: the packet
  1133. * @doi_def: the CALIPSO DOI to use
  1134. * @secattr: the security attributes
  1135. *
  1136. * Description:
  1137. * Set the CALIPSO option on the given packet based on the security attributes.
  1138. * Returns a pointer to the IP header on success and NULL on failure.
  1139. *
  1140. */
  1141. static int calipso_skbuff_setattr(struct sk_buff *skb,
  1142. const struct calipso_doi *doi_def,
  1143. const struct netlbl_lsm_secattr *secattr)
  1144. {
  1145. int ret_val;
  1146. struct ipv6hdr *ip6_hdr;
  1147. struct ipv6_opt_hdr *hop;
  1148. unsigned char buf[CALIPSO_MAX_BUFFER];
  1149. int len_delta, new_end, pad, payload;
  1150. unsigned int start, end;
  1151. ip6_hdr = ipv6_hdr(skb);
  1152. if (ip6_hdr->nexthdr == NEXTHDR_HOP) {
  1153. hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
  1154. ret_val = calipso_opt_find(hop, &start, &end);
  1155. if (ret_val && ret_val != -ENOENT)
  1156. return ret_val;
  1157. } else {
  1158. start = 0;
  1159. end = 0;
  1160. }
  1161. memset(buf, 0, sizeof(buf));
  1162. ret_val = calipso_genopt(buf, start & 3, sizeof(buf), doi_def, secattr);
  1163. if (ret_val < 0)
  1164. return ret_val;
  1165. new_end = start + ret_val;
  1166. /* At this point new_end aligns to 4n, so (new_end & 4) pads to 8n */
  1167. pad = ((new_end & 4) + (end & 7)) & 7;
  1168. len_delta = new_end - (int)end + pad;
  1169. ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
  1170. if (ret_val < 0)
  1171. return ret_val;
  1172. ip6_hdr = ipv6_hdr(skb); /* Reset as skb_cow() may have moved it */
  1173. if (len_delta) {
  1174. if (len_delta > 0)
  1175. skb_push(skb, len_delta);
  1176. else
  1177. skb_pull(skb, -len_delta);
  1178. memmove((char *)ip6_hdr - len_delta, ip6_hdr,
  1179. sizeof(*ip6_hdr) + start);
  1180. skb_reset_network_header(skb);
  1181. ip6_hdr = ipv6_hdr(skb);
  1182. payload = ntohs(ip6_hdr->payload_len);
  1183. ip6_hdr->payload_len = htons(payload + len_delta);
  1184. }
  1185. hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
  1186. if (start == 0) {
  1187. struct ipv6_opt_hdr *new_hop = (struct ipv6_opt_hdr *)buf;
  1188. new_hop->nexthdr = ip6_hdr->nexthdr;
  1189. new_hop->hdrlen = len_delta / 8 - 1;
  1190. ip6_hdr->nexthdr = NEXTHDR_HOP;
  1191. } else {
  1192. hop->hdrlen += len_delta / 8;
  1193. }
  1194. memcpy((char *)hop + start, buf + (start & 3), new_end - start);
  1195. calipso_pad_write((unsigned char *)hop, new_end, pad);
  1196. return 0;
  1197. }
  1198. /**
  1199. * calipso_skbuff_delattr - Delete any CALIPSO options from a packet
  1200. * @skb: the packet
  1201. *
  1202. * Description:
  1203. * Removes any and all CALIPSO options from the given packet. Returns zero on
  1204. * success, negative values on failure.
  1205. *
  1206. */
  1207. static int calipso_skbuff_delattr(struct sk_buff *skb)
  1208. {
  1209. int ret_val;
  1210. struct ipv6hdr *ip6_hdr;
  1211. struct ipv6_opt_hdr *old_hop;
  1212. u32 old_hop_len, start = 0, end = 0, delta, size, pad;
  1213. if (!calipso_skbuff_optptr(skb))
  1214. return 0;
  1215. /* since we are changing the packet we should make a copy */
  1216. ret_val = skb_cow(skb, skb_headroom(skb));
  1217. if (ret_val < 0)
  1218. return ret_val;
  1219. ip6_hdr = ipv6_hdr(skb);
  1220. old_hop = (struct ipv6_opt_hdr *)(ip6_hdr + 1);
  1221. old_hop_len = ipv6_optlen(old_hop);
  1222. ret_val = calipso_opt_find(old_hop, &start, &end);
  1223. if (ret_val)
  1224. return ret_val;
  1225. if (start == sizeof(*old_hop) && end == old_hop_len) {
  1226. /* There's no other option in the header so we delete
  1227. * the whole thing. */
  1228. delta = old_hop_len;
  1229. size = sizeof(*ip6_hdr);
  1230. ip6_hdr->nexthdr = old_hop->nexthdr;
  1231. } else {
  1232. delta = (end - start) & ~7;
  1233. if (delta)
  1234. old_hop->hdrlen -= delta / 8;
  1235. pad = (end - start) & 7;
  1236. size = sizeof(*ip6_hdr) + start + pad;
  1237. calipso_pad_write((unsigned char *)old_hop, start, pad);
  1238. }
  1239. if (delta) {
  1240. skb_pull(skb, delta);
  1241. memmove((char *)ip6_hdr + delta, ip6_hdr, size);
  1242. skb_reset_network_header(skb);
  1243. }
  1244. return 0;
  1245. }
  1246. static const struct netlbl_calipso_ops ops = {
  1247. .doi_add = calipso_doi_add,
  1248. .doi_free = calipso_doi_free,
  1249. .doi_remove = calipso_doi_remove,
  1250. .doi_getdef = calipso_doi_getdef,
  1251. .doi_putdef = calipso_doi_putdef,
  1252. .doi_walk = calipso_doi_walk,
  1253. .sock_getattr = calipso_sock_getattr,
  1254. .sock_setattr = calipso_sock_setattr,
  1255. .sock_delattr = calipso_sock_delattr,
  1256. .req_setattr = calipso_req_setattr,
  1257. .req_delattr = calipso_req_delattr,
  1258. .opt_getattr = calipso_opt_getattr,
  1259. .skbuff_optptr = calipso_skbuff_optptr,
  1260. .skbuff_setattr = calipso_skbuff_setattr,
  1261. .skbuff_delattr = calipso_skbuff_delattr,
  1262. .cache_invalidate = calipso_cache_invalidate,
  1263. .cache_add = calipso_cache_add
  1264. };
  1265. /**
  1266. * calipso_init - Initialize the CALIPSO module
  1267. *
  1268. * Description:
  1269. * Initialize the CALIPSO module and prepare it for use. Returns zero on
  1270. * success and negative values on failure.
  1271. *
  1272. */
  1273. int __init calipso_init(void)
  1274. {
  1275. int ret_val;
  1276. ret_val = calipso_cache_init();
  1277. if (!ret_val)
  1278. netlbl_calipso_ops_register(&ops);
  1279. return ret_val;
  1280. }
  1281. void calipso_exit(void)
  1282. {
  1283. netlbl_calipso_ops_register(NULL);
  1284. calipso_cache_invalidate();
  1285. kfree(calipso_cache);
  1286. }