netlabel_domainhash.c 27 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NetLabel Domain Hash Table
  4. *
  5. * This file manages the domain hash table that NetLabel uses to determine
  6. * which network labeling protocol to use for a given domain. The NetLabel
  7. * system manages static and dynamic label mappings for network protocols such
  8. * as CIPSO and RIPSO.
  9. *
  10. * Author: Paul Moore <paul@paul-moore.com>
  11. */
  12. /*
  13. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  14. */
  15. #include <linux/types.h>
  16. #include <linux/rculist.h>
  17. #include <linux/skbuff.h>
  18. #include <linux/spinlock.h>
  19. #include <linux/string.h>
  20. #include <linux/audit.h>
  21. #include <linux/slab.h>
  22. #include <net/netlabel.h>
  23. #include <net/cipso_ipv4.h>
  24. #include <net/calipso.h>
  25. #include <asm/bug.h>
  26. #include "netlabel_mgmt.h"
  27. #include "netlabel_addrlist.h"
  28. #include "netlabel_calipso.h"
  29. #include "netlabel_domainhash.h"
  30. #include "netlabel_user.h"
  31. struct netlbl_domhsh_tbl {
  32. struct list_head *tbl;
  33. u32 size;
  34. };
  35. /* Domain hash table */
  36. /* updates should be so rare that having one spinlock for the entire hash table
  37. * should be okay */
  38. static DEFINE_SPINLOCK(netlbl_domhsh_lock);
  39. #define netlbl_domhsh_rcu_deref(p) \
  40. rcu_dereference_check(p, lockdep_is_held(&netlbl_domhsh_lock))
  41. static struct netlbl_domhsh_tbl __rcu *netlbl_domhsh;
  42. static struct netlbl_dom_map __rcu *netlbl_domhsh_def_ipv4;
  43. static struct netlbl_dom_map __rcu *netlbl_domhsh_def_ipv6;
  44. /*
  45. * Domain Hash Table Helper Functions
  46. */
  47. /**
  48. * netlbl_domhsh_free_entry - Frees a domain hash table entry
  49. * @entry: the entry's RCU field
  50. *
  51. * Description:
  52. * This function is designed to be used as a callback to the call_rcu()
  53. * function so that the memory allocated to a hash table entry can be released
  54. * safely.
  55. *
  56. */
  57. static void netlbl_domhsh_free_entry(struct rcu_head *entry)
  58. {
  59. struct netlbl_dom_map *ptr;
  60. struct netlbl_af4list *iter4;
  61. struct netlbl_af4list *tmp4;
  62. #if IS_ENABLED(CONFIG_IPV6)
  63. struct netlbl_af6list *iter6;
  64. struct netlbl_af6list *tmp6;
  65. #endif /* IPv6 */
  66. ptr = container_of(entry, struct netlbl_dom_map, rcu);
  67. if (ptr->def.type == NETLBL_NLTYPE_ADDRSELECT) {
  68. netlbl_af4list_foreach_safe(iter4, tmp4,
  69. &ptr->def.addrsel->list4) {
  70. netlbl_af4list_remove_entry(iter4);
  71. kfree(netlbl_domhsh_addr4_entry(iter4));
  72. }
  73. #if IS_ENABLED(CONFIG_IPV6)
  74. netlbl_af6list_foreach_safe(iter6, tmp6,
  75. &ptr->def.addrsel->list6) {
  76. netlbl_af6list_remove_entry(iter6);
  77. kfree(netlbl_domhsh_addr6_entry(iter6));
  78. }
  79. #endif /* IPv6 */
  80. kfree(ptr->def.addrsel);
  81. }
  82. kfree(ptr->domain);
  83. kfree(ptr);
  84. }
  85. /**
  86. * netlbl_domhsh_hash - Hashing function for the domain hash table
  87. * @key: the domain name to hash
  88. *
  89. * Description:
  90. * This is the hashing function for the domain hash table, it returns the
  91. * correct bucket number for the domain. The caller is responsible for
  92. * ensuring that the hash table is protected with either a RCU read lock or the
  93. * hash table lock.
  94. *
  95. */
  96. static u32 netlbl_domhsh_hash(const char *key)
  97. {
  98. u32 iter;
  99. u32 val;
  100. u32 len;
  101. /* This is taken (with slight modification) from
  102. * security/selinux/ss/symtab.c:symhash() */
  103. for (iter = 0, val = 0, len = strlen(key); iter < len; iter++)
  104. val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];
  105. return val & (netlbl_domhsh_rcu_deref(netlbl_domhsh)->size - 1);
  106. }
  107. static bool netlbl_family_match(u16 f1, u16 f2)
  108. {
  109. return (f1 == f2) || (f1 == AF_UNSPEC) || (f2 == AF_UNSPEC);
  110. }
  111. /**
  112. * netlbl_domhsh_search - Search for a domain entry
  113. * @domain: the domain
  114. * @family: the address family
  115. *
  116. * Description:
  117. * Searches the domain hash table and returns a pointer to the hash table
  118. * entry if found, otherwise NULL is returned. @family may be %AF_UNSPEC
  119. * which matches any address family entries. The caller is responsible for
  120. * ensuring that the hash table is protected with either a RCU read lock or the
  121. * hash table lock.
  122. *
  123. */
  124. static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain,
  125. u16 family)
  126. {
  127. u32 bkt;
  128. struct list_head *bkt_list;
  129. struct netlbl_dom_map *iter;
  130. if (domain != NULL) {
  131. bkt = netlbl_domhsh_hash(domain);
  132. bkt_list = &netlbl_domhsh_rcu_deref(netlbl_domhsh)->tbl[bkt];
  133. list_for_each_entry_rcu(iter, bkt_list, list,
  134. lockdep_is_held(&netlbl_domhsh_lock))
  135. if (iter->valid &&
  136. netlbl_family_match(iter->family, family) &&
  137. strcmp(iter->domain, domain) == 0)
  138. return iter;
  139. }
  140. return NULL;
  141. }
  142. /**
  143. * netlbl_domhsh_search_def - Search for a domain entry
  144. * @domain: the domain
  145. * @family: the address family
  146. *
  147. * Description:
  148. * Searches the domain hash table and returns a pointer to the hash table
  149. * entry if an exact match is found, if an exact match is not present in the
  150. * hash table then the default entry is returned if valid otherwise NULL is
  151. * returned. @family may be %AF_UNSPEC which matches any address family
  152. * entries. The caller is responsible ensuring that the hash table is
  153. * protected with either a RCU read lock or the hash table lock.
  154. *
  155. */
  156. static struct netlbl_dom_map *netlbl_domhsh_search_def(const char *domain,
  157. u16 family)
  158. {
  159. struct netlbl_dom_map *entry;
  160. entry = netlbl_domhsh_search(domain, family);
  161. if (entry != NULL)
  162. return entry;
  163. if (family == AF_INET || family == AF_UNSPEC) {
  164. entry = netlbl_domhsh_rcu_deref(netlbl_domhsh_def_ipv4);
  165. if (entry != NULL && entry->valid)
  166. return entry;
  167. }
  168. if (family == AF_INET6 || family == AF_UNSPEC) {
  169. entry = netlbl_domhsh_rcu_deref(netlbl_domhsh_def_ipv6);
  170. if (entry != NULL && entry->valid)
  171. return entry;
  172. }
  173. return NULL;
  174. }
  175. /**
  176. * netlbl_domhsh_audit_add - Generate an audit entry for an add event
  177. * @entry: the entry being added
  178. * @addr4: the IPv4 address information
  179. * @addr6: the IPv6 address information
  180. * @result: the result code
  181. * @audit_info: NetLabel audit information
  182. *
  183. * Description:
  184. * Generate an audit record for adding a new NetLabel/LSM mapping entry with
  185. * the given information. Caller is responsible for holding the necessary
  186. * locks.
  187. *
  188. */
  189. static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry,
  190. struct netlbl_af4list *addr4,
  191. struct netlbl_af6list *addr6,
  192. int result,
  193. struct netlbl_audit *audit_info)
  194. {
  195. struct audit_buffer *audit_buf;
  196. struct cipso_v4_doi *cipsov4 = NULL;
  197. struct calipso_doi *calipso = NULL;
  198. u32 type;
  199. audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info);
  200. if (audit_buf != NULL) {
  201. audit_log_format(audit_buf, " nlbl_domain=%s",
  202. entry->domain ? entry->domain : "(default)");
  203. if (addr4 != NULL) {
  204. struct netlbl_domaddr4_map *map4;
  205. map4 = netlbl_domhsh_addr4_entry(addr4);
  206. type = map4->def.type;
  207. cipsov4 = map4->def.cipso;
  208. netlbl_af4list_audit_addr(audit_buf, 0, NULL,
  209. addr4->addr, addr4->mask);
  210. #if IS_ENABLED(CONFIG_IPV6)
  211. } else if (addr6 != NULL) {
  212. struct netlbl_domaddr6_map *map6;
  213. map6 = netlbl_domhsh_addr6_entry(addr6);
  214. type = map6->def.type;
  215. calipso = map6->def.calipso;
  216. netlbl_af6list_audit_addr(audit_buf, 0, NULL,
  217. &addr6->addr, &addr6->mask);
  218. #endif /* IPv6 */
  219. } else {
  220. type = entry->def.type;
  221. cipsov4 = entry->def.cipso;
  222. calipso = entry->def.calipso;
  223. }
  224. switch (type) {
  225. case NETLBL_NLTYPE_UNLABELED:
  226. audit_log_format(audit_buf, " nlbl_protocol=unlbl");
  227. break;
  228. case NETLBL_NLTYPE_CIPSOV4:
  229. BUG_ON(cipsov4 == NULL);
  230. audit_log_format(audit_buf,
  231. " nlbl_protocol=cipsov4 cipso_doi=%u",
  232. cipsov4->doi);
  233. break;
  234. case NETLBL_NLTYPE_CALIPSO:
  235. BUG_ON(calipso == NULL);
  236. audit_log_format(audit_buf,
  237. " nlbl_protocol=calipso calipso_doi=%u",
  238. calipso->doi);
  239. break;
  240. }
  241. audit_log_format(audit_buf, " res=%u", result == 0 ? 1 : 0);
  242. audit_log_end(audit_buf);
  243. }
  244. }
  245. /**
  246. * netlbl_domhsh_validate - Validate a new domain mapping entry
  247. * @entry: the entry to validate
  248. *
  249. * This function validates the new domain mapping entry to ensure that it is
  250. * a valid entry. Returns zero on success, negative values on failure.
  251. *
  252. */
  253. static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)
  254. {
  255. struct netlbl_af4list *iter4;
  256. struct netlbl_domaddr4_map *map4;
  257. #if IS_ENABLED(CONFIG_IPV6)
  258. struct netlbl_af6list *iter6;
  259. struct netlbl_domaddr6_map *map6;
  260. #endif /* IPv6 */
  261. if (entry == NULL)
  262. return -EINVAL;
  263. if (entry->family != AF_INET && entry->family != AF_INET6 &&
  264. (entry->family != AF_UNSPEC ||
  265. entry->def.type != NETLBL_NLTYPE_UNLABELED))
  266. return -EINVAL;
  267. switch (entry->def.type) {
  268. case NETLBL_NLTYPE_UNLABELED:
  269. if (entry->def.cipso != NULL || entry->def.calipso != NULL ||
  270. entry->def.addrsel != NULL)
  271. return -EINVAL;
  272. break;
  273. case NETLBL_NLTYPE_CIPSOV4:
  274. if (entry->family != AF_INET ||
  275. entry->def.cipso == NULL)
  276. return -EINVAL;
  277. break;
  278. case NETLBL_NLTYPE_CALIPSO:
  279. if (entry->family != AF_INET6 ||
  280. entry->def.calipso == NULL)
  281. return -EINVAL;
  282. break;
  283. case NETLBL_NLTYPE_ADDRSELECT:
  284. netlbl_af4list_foreach(iter4, &entry->def.addrsel->list4) {
  285. map4 = netlbl_domhsh_addr4_entry(iter4);
  286. switch (map4->def.type) {
  287. case NETLBL_NLTYPE_UNLABELED:
  288. if (map4->def.cipso != NULL)
  289. return -EINVAL;
  290. break;
  291. case NETLBL_NLTYPE_CIPSOV4:
  292. if (map4->def.cipso == NULL)
  293. return -EINVAL;
  294. break;
  295. default:
  296. return -EINVAL;
  297. }
  298. }
  299. #if IS_ENABLED(CONFIG_IPV6)
  300. netlbl_af6list_foreach(iter6, &entry->def.addrsel->list6) {
  301. map6 = netlbl_domhsh_addr6_entry(iter6);
  302. switch (map6->def.type) {
  303. case NETLBL_NLTYPE_UNLABELED:
  304. if (map6->def.calipso != NULL)
  305. return -EINVAL;
  306. break;
  307. case NETLBL_NLTYPE_CALIPSO:
  308. if (map6->def.calipso == NULL)
  309. return -EINVAL;
  310. break;
  311. default:
  312. return -EINVAL;
  313. }
  314. }
  315. #endif /* IPv6 */
  316. break;
  317. default:
  318. return -EINVAL;
  319. }
  320. return 0;
  321. }
  322. /*
  323. * Domain Hash Table Functions
  324. */
  325. /**
  326. * netlbl_domhsh_init - Init for the domain hash
  327. * @size: the number of bits to use for the hash buckets
  328. *
  329. * Description:
  330. * Initializes the domain hash table, should be called only by
  331. * netlbl_user_init() during initialization. Returns zero on success, non-zero
  332. * values on error.
  333. *
  334. */
  335. int __init netlbl_domhsh_init(u32 size)
  336. {
  337. u32 iter;
  338. struct netlbl_domhsh_tbl *hsh_tbl;
  339. if (size == 0)
  340. return -EINVAL;
  341. hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
  342. if (hsh_tbl == NULL)
  343. return -ENOMEM;
  344. hsh_tbl->size = 1 << size;
  345. hsh_tbl->tbl = kcalloc(hsh_tbl->size,
  346. sizeof(struct list_head),
  347. GFP_KERNEL);
  348. if (hsh_tbl->tbl == NULL) {
  349. kfree(hsh_tbl);
  350. return -ENOMEM;
  351. }
  352. for (iter = 0; iter < hsh_tbl->size; iter++)
  353. INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
  354. spin_lock(&netlbl_domhsh_lock);
  355. rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
  356. spin_unlock(&netlbl_domhsh_lock);
  357. return 0;
  358. }
  359. /**
  360. * netlbl_domhsh_add - Adds a entry to the domain hash table
  361. * @entry: the entry to add
  362. * @audit_info: NetLabel audit information
  363. *
  364. * Description:
  365. * Adds a new entry to the domain hash table and handles any updates to the
  366. * lower level protocol handler (i.e. CIPSO). @entry->family may be set to
  367. * %AF_UNSPEC which will add an entry that matches all address families. This
  368. * is only useful for the unlabelled type and will only succeed if there is no
  369. * existing entry for any address family with the same domain. Returns zero
  370. * on success, negative on failure.
  371. *
  372. */
  373. int netlbl_domhsh_add(struct netlbl_dom_map *entry,
  374. struct netlbl_audit *audit_info)
  375. {
  376. int ret_val = 0;
  377. struct netlbl_dom_map *entry_old, *entry_b;
  378. struct netlbl_af4list *iter4;
  379. struct netlbl_af4list *tmp4;
  380. #if IS_ENABLED(CONFIG_IPV6)
  381. struct netlbl_af6list *iter6;
  382. struct netlbl_af6list *tmp6;
  383. #endif /* IPv6 */
  384. ret_val = netlbl_domhsh_validate(entry);
  385. if (ret_val != 0)
  386. return ret_val;
  387. /* XXX - we can remove this RCU read lock as the spinlock protects the
  388. * entire function, but before we do we need to fixup the
  389. * netlbl_af[4,6]list RCU functions to do "the right thing" with
  390. * respect to rcu_dereference() when only a spinlock is held. */
  391. rcu_read_lock();
  392. spin_lock(&netlbl_domhsh_lock);
  393. if (entry->domain != NULL)
  394. entry_old = netlbl_domhsh_search(entry->domain, entry->family);
  395. else
  396. entry_old = netlbl_domhsh_search_def(entry->domain,
  397. entry->family);
  398. if (entry_old == NULL) {
  399. entry->valid = 1;
  400. if (entry->domain != NULL) {
  401. u32 bkt = netlbl_domhsh_hash(entry->domain);
  402. list_add_tail_rcu(&entry->list,
  403. &rcu_dereference(netlbl_domhsh)->tbl[bkt]);
  404. } else {
  405. INIT_LIST_HEAD(&entry->list);
  406. switch (entry->family) {
  407. case AF_INET:
  408. rcu_assign_pointer(netlbl_domhsh_def_ipv4,
  409. entry);
  410. break;
  411. case AF_INET6:
  412. rcu_assign_pointer(netlbl_domhsh_def_ipv6,
  413. entry);
  414. break;
  415. case AF_UNSPEC:
  416. if (entry->def.type !=
  417. NETLBL_NLTYPE_UNLABELED) {
  418. ret_val = -EINVAL;
  419. goto add_return;
  420. }
  421. entry_b = kzalloc(sizeof(*entry_b), GFP_ATOMIC);
  422. if (entry_b == NULL) {
  423. ret_val = -ENOMEM;
  424. goto add_return;
  425. }
  426. entry_b->family = AF_INET6;
  427. entry_b->def.type = NETLBL_NLTYPE_UNLABELED;
  428. entry_b->valid = 1;
  429. entry->family = AF_INET;
  430. rcu_assign_pointer(netlbl_domhsh_def_ipv4,
  431. entry);
  432. rcu_assign_pointer(netlbl_domhsh_def_ipv6,
  433. entry_b);
  434. break;
  435. default:
  436. /* Already checked in
  437. * netlbl_domhsh_validate(). */
  438. ret_val = -EINVAL;
  439. goto add_return;
  440. }
  441. }
  442. if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
  443. netlbl_af4list_foreach_rcu(iter4,
  444. &entry->def.addrsel->list4)
  445. netlbl_domhsh_audit_add(entry, iter4, NULL,
  446. ret_val, audit_info);
  447. #if IS_ENABLED(CONFIG_IPV6)
  448. netlbl_af6list_foreach_rcu(iter6,
  449. &entry->def.addrsel->list6)
  450. netlbl_domhsh_audit_add(entry, NULL, iter6,
  451. ret_val, audit_info);
  452. #endif /* IPv6 */
  453. } else
  454. netlbl_domhsh_audit_add(entry, NULL, NULL,
  455. ret_val, audit_info);
  456. } else if (entry_old->def.type == NETLBL_NLTYPE_ADDRSELECT &&
  457. entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {
  458. struct list_head *old_list4;
  459. struct list_head *old_list6;
  460. old_list4 = &entry_old->def.addrsel->list4;
  461. old_list6 = &entry_old->def.addrsel->list6;
  462. /* we only allow the addition of address selectors if all of
  463. * the selectors do not exist in the existing domain map */
  464. netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4)
  465. if (netlbl_af4list_search_exact(iter4->addr,
  466. iter4->mask,
  467. old_list4)) {
  468. ret_val = -EEXIST;
  469. goto add_return;
  470. }
  471. #if IS_ENABLED(CONFIG_IPV6)
  472. netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6)
  473. if (netlbl_af6list_search_exact(&iter6->addr,
  474. &iter6->mask,
  475. old_list6)) {
  476. ret_val = -EEXIST;
  477. goto add_return;
  478. }
  479. #endif /* IPv6 */
  480. netlbl_af4list_foreach_safe(iter4, tmp4,
  481. &entry->def.addrsel->list4) {
  482. netlbl_af4list_remove_entry(iter4);
  483. iter4->valid = 1;
  484. ret_val = netlbl_af4list_add(iter4, old_list4);
  485. netlbl_domhsh_audit_add(entry_old, iter4, NULL,
  486. ret_val, audit_info);
  487. if (ret_val != 0)
  488. goto add_return;
  489. }
  490. #if IS_ENABLED(CONFIG_IPV6)
  491. netlbl_af6list_foreach_safe(iter6, tmp6,
  492. &entry->def.addrsel->list6) {
  493. netlbl_af6list_remove_entry(iter6);
  494. iter6->valid = 1;
  495. ret_val = netlbl_af6list_add(iter6, old_list6);
  496. netlbl_domhsh_audit_add(entry_old, NULL, iter6,
  497. ret_val, audit_info);
  498. if (ret_val != 0)
  499. goto add_return;
  500. }
  501. #endif /* IPv6 */
  502. /* cleanup the new entry since we've moved everything over */
  503. netlbl_domhsh_free_entry(&entry->rcu);
  504. } else
  505. ret_val = -EINVAL;
  506. add_return:
  507. spin_unlock(&netlbl_domhsh_lock);
  508. rcu_read_unlock();
  509. return ret_val;
  510. }
  511. /**
  512. * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
  513. * @entry: the entry to add
  514. * @audit_info: NetLabel audit information
  515. *
  516. * Description:
  517. * Adds a new default entry to the domain hash table and handles any updates
  518. * to the lower level protocol handler (i.e. CIPSO). Returns zero on success,
  519. * negative on failure.
  520. *
  521. */
  522. int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,
  523. struct netlbl_audit *audit_info)
  524. {
  525. return netlbl_domhsh_add(entry, audit_info);
  526. }
  527. /**
  528. * netlbl_domhsh_remove_entry - Removes a given entry from the domain table
  529. * @entry: the entry to remove
  530. * @audit_info: NetLabel audit information
  531. *
  532. * Description:
  533. * Removes an entry from the domain hash table and handles any updates to the
  534. * lower level protocol handler (i.e. CIPSO). Caller is responsible for
  535. * ensuring that the RCU read lock is held. Returns zero on success, negative
  536. * on failure.
  537. *
  538. */
  539. int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,
  540. struct netlbl_audit *audit_info)
  541. {
  542. int ret_val = 0;
  543. struct audit_buffer *audit_buf;
  544. struct netlbl_af4list *iter4;
  545. struct netlbl_domaddr4_map *map4;
  546. #if IS_ENABLED(CONFIG_IPV6)
  547. struct netlbl_af6list *iter6;
  548. struct netlbl_domaddr6_map *map6;
  549. #endif /* IPv6 */
  550. if (entry == NULL)
  551. return -ENOENT;
  552. spin_lock(&netlbl_domhsh_lock);
  553. if (entry->valid) {
  554. entry->valid = 0;
  555. if (entry == rcu_dereference(netlbl_domhsh_def_ipv4))
  556. RCU_INIT_POINTER(netlbl_domhsh_def_ipv4, NULL);
  557. else if (entry == rcu_dereference(netlbl_domhsh_def_ipv6))
  558. RCU_INIT_POINTER(netlbl_domhsh_def_ipv6, NULL);
  559. else
  560. list_del_rcu(&entry->list);
  561. } else
  562. ret_val = -ENOENT;
  563. spin_unlock(&netlbl_domhsh_lock);
  564. if (ret_val)
  565. return ret_val;
  566. audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
  567. if (audit_buf != NULL) {
  568. audit_log_format(audit_buf,
  569. " nlbl_domain=%s res=1",
  570. entry->domain ? entry->domain : "(default)");
  571. audit_log_end(audit_buf);
  572. }
  573. switch (entry->def.type) {
  574. case NETLBL_NLTYPE_ADDRSELECT:
  575. netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
  576. map4 = netlbl_domhsh_addr4_entry(iter4);
  577. cipso_v4_doi_putdef(map4->def.cipso);
  578. }
  579. #if IS_ENABLED(CONFIG_IPV6)
  580. netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
  581. map6 = netlbl_domhsh_addr6_entry(iter6);
  582. calipso_doi_putdef(map6->def.calipso);
  583. }
  584. #endif /* IPv6 */
  585. break;
  586. case NETLBL_NLTYPE_CIPSOV4:
  587. cipso_v4_doi_putdef(entry->def.cipso);
  588. break;
  589. #if IS_ENABLED(CONFIG_IPV6)
  590. case NETLBL_NLTYPE_CALIPSO:
  591. calipso_doi_putdef(entry->def.calipso);
  592. break;
  593. #endif /* IPv6 */
  594. }
  595. call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
  596. return ret_val;
  597. }
  598. /**
  599. * netlbl_domhsh_remove_af4 - Removes an address selector entry
  600. * @domain: the domain
  601. * @addr: IPv4 address
  602. * @mask: IPv4 address mask
  603. * @audit_info: NetLabel audit information
  604. *
  605. * Description:
  606. * Removes an individual address selector from a domain mapping and potentially
  607. * the entire mapping if it is empty. Returns zero on success, negative values
  608. * on failure.
  609. *
  610. */
  611. int netlbl_domhsh_remove_af4(const char *domain,
  612. const struct in_addr *addr,
  613. const struct in_addr *mask,
  614. struct netlbl_audit *audit_info)
  615. {
  616. struct netlbl_dom_map *entry_map;
  617. struct netlbl_af4list *entry_addr;
  618. struct netlbl_af4list *iter4;
  619. #if IS_ENABLED(CONFIG_IPV6)
  620. struct netlbl_af6list *iter6;
  621. #endif /* IPv6 */
  622. struct netlbl_domaddr4_map *entry;
  623. rcu_read_lock();
  624. if (domain)
  625. entry_map = netlbl_domhsh_search(domain, AF_INET);
  626. else
  627. entry_map = netlbl_domhsh_search_def(domain, AF_INET);
  628. if (entry_map == NULL ||
  629. entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)
  630. goto remove_af4_failure;
  631. spin_lock(&netlbl_domhsh_lock);
  632. entry_addr = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
  633. &entry_map->def.addrsel->list4);
  634. spin_unlock(&netlbl_domhsh_lock);
  635. if (entry_addr == NULL)
  636. goto remove_af4_failure;
  637. netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)
  638. goto remove_af4_single_addr;
  639. #if IS_ENABLED(CONFIG_IPV6)
  640. netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)
  641. goto remove_af4_single_addr;
  642. #endif /* IPv6 */
  643. /* the domain mapping is empty so remove it from the mapping table */
  644. netlbl_domhsh_remove_entry(entry_map, audit_info);
  645. remove_af4_single_addr:
  646. rcu_read_unlock();
  647. /* yick, we can't use call_rcu here because we don't have a rcu head
  648. * pointer but hopefully this should be a rare case so the pause
  649. * shouldn't be a problem */
  650. synchronize_rcu();
  651. entry = netlbl_domhsh_addr4_entry(entry_addr);
  652. cipso_v4_doi_putdef(entry->def.cipso);
  653. kfree(entry);
  654. return 0;
  655. remove_af4_failure:
  656. rcu_read_unlock();
  657. return -ENOENT;
  658. }
  659. #if IS_ENABLED(CONFIG_IPV6)
  660. /**
  661. * netlbl_domhsh_remove_af6 - Removes an address selector entry
  662. * @domain: the domain
  663. * @addr: IPv6 address
  664. * @mask: IPv6 address mask
  665. * @audit_info: NetLabel audit information
  666. *
  667. * Description:
  668. * Removes an individual address selector from a domain mapping and potentially
  669. * the entire mapping if it is empty. Returns zero on success, negative values
  670. * on failure.
  671. *
  672. */
  673. int netlbl_domhsh_remove_af6(const char *domain,
  674. const struct in6_addr *addr,
  675. const struct in6_addr *mask,
  676. struct netlbl_audit *audit_info)
  677. {
  678. struct netlbl_dom_map *entry_map;
  679. struct netlbl_af6list *entry_addr;
  680. struct netlbl_af4list *iter4;
  681. struct netlbl_af6list *iter6;
  682. struct netlbl_domaddr6_map *entry;
  683. rcu_read_lock();
  684. if (domain)
  685. entry_map = netlbl_domhsh_search(domain, AF_INET6);
  686. else
  687. entry_map = netlbl_domhsh_search_def(domain, AF_INET6);
  688. if (entry_map == NULL ||
  689. entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)
  690. goto remove_af6_failure;
  691. spin_lock(&netlbl_domhsh_lock);
  692. entry_addr = netlbl_af6list_remove(addr, mask,
  693. &entry_map->def.addrsel->list6);
  694. spin_unlock(&netlbl_domhsh_lock);
  695. if (entry_addr == NULL)
  696. goto remove_af6_failure;
  697. netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)
  698. goto remove_af6_single_addr;
  699. netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)
  700. goto remove_af6_single_addr;
  701. /* the domain mapping is empty so remove it from the mapping table */
  702. netlbl_domhsh_remove_entry(entry_map, audit_info);
  703. remove_af6_single_addr:
  704. rcu_read_unlock();
  705. /* yick, we can't use call_rcu here because we don't have a rcu head
  706. * pointer but hopefully this should be a rare case so the pause
  707. * shouldn't be a problem */
  708. synchronize_rcu();
  709. entry = netlbl_domhsh_addr6_entry(entry_addr);
  710. calipso_doi_putdef(entry->def.calipso);
  711. kfree(entry);
  712. return 0;
  713. remove_af6_failure:
  714. rcu_read_unlock();
  715. return -ENOENT;
  716. }
  717. #endif /* IPv6 */
  718. /**
  719. * netlbl_domhsh_remove - Removes an entry from the domain hash table
  720. * @domain: the domain to remove
  721. * @family: address family
  722. * @audit_info: NetLabel audit information
  723. *
  724. * Description:
  725. * Removes an entry from the domain hash table and handles any updates to the
  726. * lower level protocol handler (i.e. CIPSO). @family may be %AF_UNSPEC which
  727. * removes all address family entries. Returns zero on success, negative on
  728. * failure.
  729. *
  730. */
  731. int netlbl_domhsh_remove(const char *domain, u16 family,
  732. struct netlbl_audit *audit_info)
  733. {
  734. int ret_val = -EINVAL;
  735. struct netlbl_dom_map *entry;
  736. rcu_read_lock();
  737. if (family == AF_INET || family == AF_UNSPEC) {
  738. if (domain)
  739. entry = netlbl_domhsh_search(domain, AF_INET);
  740. else
  741. entry = netlbl_domhsh_search_def(domain, AF_INET);
  742. ret_val = netlbl_domhsh_remove_entry(entry, audit_info);
  743. if (ret_val && ret_val != -ENOENT)
  744. goto done;
  745. }
  746. if (family == AF_INET6 || family == AF_UNSPEC) {
  747. int ret_val2;
  748. if (domain)
  749. entry = netlbl_domhsh_search(domain, AF_INET6);
  750. else
  751. entry = netlbl_domhsh_search_def(domain, AF_INET6);
  752. ret_val2 = netlbl_domhsh_remove_entry(entry, audit_info);
  753. if (ret_val2 != -ENOENT)
  754. ret_val = ret_val2;
  755. }
  756. done:
  757. rcu_read_unlock();
  758. return ret_val;
  759. }
  760. /**
  761. * netlbl_domhsh_remove_default - Removes the default entry from the table
  762. * @family: address family
  763. * @audit_info: NetLabel audit information
  764. *
  765. * Description:
  766. * Removes/resets the default entry corresponding to @family from the domain
  767. * hash table and handles any updates to the lower level protocol handler
  768. * (i.e. CIPSO). @family may be %AF_UNSPEC which removes all address family
  769. * entries. Returns zero on success, negative on failure.
  770. *
  771. */
  772. int netlbl_domhsh_remove_default(u16 family, struct netlbl_audit *audit_info)
  773. {
  774. return netlbl_domhsh_remove(NULL, family, audit_info);
  775. }
  776. /**
  777. * netlbl_domhsh_getentry - Get an entry from the domain hash table
  778. * @domain: the domain name to search for
  779. * @family: address family
  780. *
  781. * Description:
  782. * Look through the domain hash table searching for an entry to match @domain,
  783. * with address family @family, return a pointer to a copy of the entry or
  784. * NULL. The caller is responsible for ensuring that rcu_read_[un]lock() is
  785. * called.
  786. *
  787. */
  788. struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain, u16 family)
  789. {
  790. if (family == AF_UNSPEC)
  791. return NULL;
  792. return netlbl_domhsh_search_def(domain, family);
  793. }
  794. /**
  795. * netlbl_domhsh_getentry_af4 - Get an entry from the domain hash table
  796. * @domain: the domain name to search for
  797. * @addr: the IP address to search for
  798. *
  799. * Description:
  800. * Look through the domain hash table searching for an entry to match @domain
  801. * and @addr, return a pointer to a copy of the entry or NULL. The caller is
  802. * responsible for ensuring that rcu_read_[un]lock() is called.
  803. *
  804. */
  805. struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain,
  806. __be32 addr)
  807. {
  808. struct netlbl_dom_map *dom_iter;
  809. struct netlbl_af4list *addr_iter;
  810. dom_iter = netlbl_domhsh_search_def(domain, AF_INET);
  811. if (dom_iter == NULL)
  812. return NULL;
  813. if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
  814. return &dom_iter->def;
  815. addr_iter = netlbl_af4list_search(addr, &dom_iter->def.addrsel->list4);
  816. if (addr_iter == NULL)
  817. return NULL;
  818. return &(netlbl_domhsh_addr4_entry(addr_iter)->def);
  819. }
  820. #if IS_ENABLED(CONFIG_IPV6)
  821. /**
  822. * netlbl_domhsh_getentry_af6 - Get an entry from the domain hash table
  823. * @domain: the domain name to search for
  824. * @addr: the IP address to search for
  825. *
  826. * Description:
  827. * Look through the domain hash table searching for an entry to match @domain
  828. * and @addr, return a pointer to a copy of the entry or NULL. The caller is
  829. * responsible for ensuring that rcu_read_[un]lock() is called.
  830. *
  831. */
  832. struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain,
  833. const struct in6_addr *addr)
  834. {
  835. struct netlbl_dom_map *dom_iter;
  836. struct netlbl_af6list *addr_iter;
  837. dom_iter = netlbl_domhsh_search_def(domain, AF_INET6);
  838. if (dom_iter == NULL)
  839. return NULL;
  840. if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)
  841. return &dom_iter->def;
  842. addr_iter = netlbl_af6list_search(addr, &dom_iter->def.addrsel->list6);
  843. if (addr_iter == NULL)
  844. return NULL;
  845. return &(netlbl_domhsh_addr6_entry(addr_iter)->def);
  846. }
  847. #endif /* IPv6 */
  848. /**
  849. * netlbl_domhsh_walk - Iterate through the domain mapping hash table
  850. * @skip_bkt: the number of buckets to skip at the start
  851. * @skip_chain: the number of entries to skip in the first iterated bucket
  852. * @callback: callback for each entry
  853. * @cb_arg: argument for the callback function
  854. *
  855. * Description:
  856. * Interate over the domain mapping hash table, skipping the first @skip_bkt
  857. * buckets and @skip_chain entries. For each entry in the table call
  858. * @callback, if @callback returns a negative value stop 'walking' through the
  859. * table and return. Updates the values in @skip_bkt and @skip_chain on
  860. * return. Returns zero on success, negative values on failure.
  861. *
  862. */
  863. int netlbl_domhsh_walk(u32 *skip_bkt,
  864. u32 *skip_chain,
  865. int (*callback) (struct netlbl_dom_map *entry, void *arg),
  866. void *cb_arg)
  867. {
  868. int ret_val = -ENOENT;
  869. u32 iter_bkt;
  870. struct list_head *iter_list;
  871. struct netlbl_dom_map *iter_entry;
  872. u32 chain_cnt = 0;
  873. rcu_read_lock();
  874. for (iter_bkt = *skip_bkt;
  875. iter_bkt < rcu_dereference(netlbl_domhsh)->size;
  876. iter_bkt++, chain_cnt = 0) {
  877. iter_list = &rcu_dereference(netlbl_domhsh)->tbl[iter_bkt];
  878. list_for_each_entry_rcu(iter_entry, iter_list, list)
  879. if (iter_entry->valid) {
  880. if (chain_cnt++ < *skip_chain)
  881. continue;
  882. ret_val = callback(iter_entry, cb_arg);
  883. if (ret_val < 0) {
  884. chain_cnt--;
  885. goto walk_return;
  886. }
  887. }
  888. }
  889. walk_return:
  890. rcu_read_unlock();
  891. *skip_bkt = iter_bkt;
  892. *skip_chain = chain_cnt;
  893. return ret_val;
  894. }