netlabel_kapi.c 37 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NetLabel Kernel API
  4. *
  5. * This file defines the kernel API for the NetLabel system. The NetLabel
  6. * system manages static and dynamic label mappings for network protocols such
  7. * as CIPSO and RIPSO.
  8. *
  9. * Author: Paul Moore <paul@paul-moore.com>
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  13. */
  14. #include <linux/init.h>
  15. #include <linux/types.h>
  16. #include <linux/slab.h>
  17. #include <linux/audit.h>
  18. #include <linux/in.h>
  19. #include <linux/in6.h>
  20. #include <net/ip.h>
  21. #include <net/ipv6.h>
  22. #include <net/netlabel.h>
  23. #include <net/cipso_ipv4.h>
  24. #include <net/calipso.h>
  25. #include <asm/bug.h>
  26. #include <linux/atomic.h>
  27. #include "netlabel_domainhash.h"
  28. #include "netlabel_unlabeled.h"
  29. #include "netlabel_cipso_v4.h"
  30. #include "netlabel_calipso.h"
  31. #include "netlabel_user.h"
  32. #include "netlabel_mgmt.h"
  33. #include "netlabel_addrlist.h"
  34. /*
  35. * Configuration Functions
  36. */
  37. /**
  38. * netlbl_cfg_map_del - Remove a NetLabel/LSM domain mapping
  39. * @domain: the domain mapping to remove
  40. * @family: address family
  41. * @addr: IP address
  42. * @mask: IP address mask
  43. * @audit_info: NetLabel audit information
  44. *
  45. * Description:
  46. * Removes a NetLabel/LSM domain mapping. A @domain value of NULL causes the
  47. * default domain mapping to be removed. Returns zero on success, negative
  48. * values on failure.
  49. *
  50. */
  51. int netlbl_cfg_map_del(const char *domain,
  52. u16 family,
  53. const void *addr,
  54. const void *mask,
  55. struct netlbl_audit *audit_info)
  56. {
  57. if (addr == NULL && mask == NULL) {
  58. return netlbl_domhsh_remove(domain, family, audit_info);
  59. } else if (addr != NULL && mask != NULL) {
  60. switch (family) {
  61. case AF_INET:
  62. return netlbl_domhsh_remove_af4(domain, addr, mask,
  63. audit_info);
  64. #if IS_ENABLED(CONFIG_IPV6)
  65. case AF_INET6:
  66. return netlbl_domhsh_remove_af6(domain, addr, mask,
  67. audit_info);
  68. #endif /* IPv6 */
  69. default:
  70. return -EPFNOSUPPORT;
  71. }
  72. } else
  73. return -EINVAL;
  74. }
  75. /**
  76. * netlbl_cfg_unlbl_map_add - Add a new unlabeled mapping
  77. * @domain: the domain mapping to add
  78. * @family: address family
  79. * @addr: IP address
  80. * @mask: IP address mask
  81. * @audit_info: NetLabel audit information
  82. *
  83. * Description:
  84. * Adds a new unlabeled NetLabel/LSM domain mapping. A @domain value of NULL
  85. * causes a new default domain mapping to be added. Returns zero on success,
  86. * negative values on failure.
  87. *
  88. */
  89. int netlbl_cfg_unlbl_map_add(const char *domain,
  90. u16 family,
  91. const void *addr,
  92. const void *mask,
  93. struct netlbl_audit *audit_info)
  94. {
  95. int ret_val = -ENOMEM;
  96. struct netlbl_dom_map *entry;
  97. struct netlbl_domaddr_map *addrmap = NULL;
  98. struct netlbl_domaddr4_map *map4 = NULL;
  99. struct netlbl_domaddr6_map *map6 = NULL;
  100. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  101. if (entry == NULL)
  102. return -ENOMEM;
  103. if (domain != NULL) {
  104. entry->domain = kstrdup(domain, GFP_ATOMIC);
  105. if (entry->domain == NULL)
  106. goto cfg_unlbl_map_add_failure;
  107. }
  108. entry->family = family;
  109. if (addr == NULL && mask == NULL)
  110. entry->def.type = NETLBL_NLTYPE_UNLABELED;
  111. else if (addr != NULL && mask != NULL) {
  112. addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
  113. if (addrmap == NULL)
  114. goto cfg_unlbl_map_add_failure;
  115. INIT_LIST_HEAD(&addrmap->list4);
  116. INIT_LIST_HEAD(&addrmap->list6);
  117. switch (family) {
  118. case AF_INET: {
  119. const struct in_addr *addr4 = addr;
  120. const struct in_addr *mask4 = mask;
  121. map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
  122. if (map4 == NULL)
  123. goto cfg_unlbl_map_add_failure;
  124. map4->def.type = NETLBL_NLTYPE_UNLABELED;
  125. map4->list.addr = addr4->s_addr & mask4->s_addr;
  126. map4->list.mask = mask4->s_addr;
  127. map4->list.valid = 1;
  128. ret_val = netlbl_af4list_add(&map4->list,
  129. &addrmap->list4);
  130. if (ret_val != 0)
  131. goto cfg_unlbl_map_add_failure;
  132. break;
  133. }
  134. #if IS_ENABLED(CONFIG_IPV6)
  135. case AF_INET6: {
  136. const struct in6_addr *addr6 = addr;
  137. const struct in6_addr *mask6 = mask;
  138. map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
  139. if (map6 == NULL)
  140. goto cfg_unlbl_map_add_failure;
  141. map6->def.type = NETLBL_NLTYPE_UNLABELED;
  142. map6->list.addr = *addr6;
  143. map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
  144. map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
  145. map6->list.addr.s6_addr32[2] &= mask6->s6_addr32[2];
  146. map6->list.addr.s6_addr32[3] &= mask6->s6_addr32[3];
  147. map6->list.mask = *mask6;
  148. map6->list.valid = 1;
  149. ret_val = netlbl_af6list_add(&map6->list,
  150. &addrmap->list6);
  151. if (ret_val != 0)
  152. goto cfg_unlbl_map_add_failure;
  153. break;
  154. }
  155. #endif /* IPv6 */
  156. default:
  157. goto cfg_unlbl_map_add_failure;
  158. }
  159. entry->def.addrsel = addrmap;
  160. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  161. } else {
  162. ret_val = -EINVAL;
  163. goto cfg_unlbl_map_add_failure;
  164. }
  165. ret_val = netlbl_domhsh_add(entry, audit_info);
  166. if (ret_val != 0)
  167. goto cfg_unlbl_map_add_failure;
  168. return 0;
  169. cfg_unlbl_map_add_failure:
  170. kfree(entry->domain);
  171. kfree(entry);
  172. kfree(addrmap);
  173. kfree(map4);
  174. kfree(map6);
  175. return ret_val;
  176. }
  177. /**
  178. * netlbl_cfg_unlbl_static_add - Adds a new static label
  179. * @net: network namespace
  180. * @dev_name: interface name
  181. * @addr: IP address in network byte order (struct in[6]_addr)
  182. * @mask: address mask in network byte order (struct in[6]_addr)
  183. * @family: address family
  184. * @secid: LSM secid value for the entry
  185. * @audit_info: NetLabel audit information
  186. *
  187. * Description:
  188. * Adds a new NetLabel static label to be used when protocol provided labels
  189. * are not present on incoming traffic. If @dev_name is NULL then the default
  190. * interface will be used. Returns zero on success, negative values on failure.
  191. *
  192. */
  193. int netlbl_cfg_unlbl_static_add(struct net *net,
  194. const char *dev_name,
  195. const void *addr,
  196. const void *mask,
  197. u16 family,
  198. u32 secid,
  199. struct netlbl_audit *audit_info)
  200. {
  201. u32 addr_len;
  202. switch (family) {
  203. case AF_INET:
  204. addr_len = sizeof(struct in_addr);
  205. break;
  206. #if IS_ENABLED(CONFIG_IPV6)
  207. case AF_INET6:
  208. addr_len = sizeof(struct in6_addr);
  209. break;
  210. #endif /* IPv6 */
  211. default:
  212. return -EPFNOSUPPORT;
  213. }
  214. return netlbl_unlhsh_add(net,
  215. dev_name, addr, mask, addr_len,
  216. secid, audit_info);
  217. }
  218. /**
  219. * netlbl_cfg_unlbl_static_del - Removes an existing static label
  220. * @net: network namespace
  221. * @dev_name: interface name
  222. * @addr: IP address in network byte order (struct in[6]_addr)
  223. * @mask: address mask in network byte order (struct in[6]_addr)
  224. * @family: address family
  225. * @audit_info: NetLabel audit information
  226. *
  227. * Description:
  228. * Removes an existing NetLabel static label used when protocol provided labels
  229. * are not present on incoming traffic. If @dev_name is NULL then the default
  230. * interface will be used. Returns zero on success, negative values on failure.
  231. *
  232. */
  233. int netlbl_cfg_unlbl_static_del(struct net *net,
  234. const char *dev_name,
  235. const void *addr,
  236. const void *mask,
  237. u16 family,
  238. struct netlbl_audit *audit_info)
  239. {
  240. u32 addr_len;
  241. switch (family) {
  242. case AF_INET:
  243. addr_len = sizeof(struct in_addr);
  244. break;
  245. #if IS_ENABLED(CONFIG_IPV6)
  246. case AF_INET6:
  247. addr_len = sizeof(struct in6_addr);
  248. break;
  249. #endif /* IPv6 */
  250. default:
  251. return -EPFNOSUPPORT;
  252. }
  253. return netlbl_unlhsh_remove(net,
  254. dev_name, addr, mask, addr_len,
  255. audit_info);
  256. }
  257. /**
  258. * netlbl_cfg_cipsov4_add - Add a new CIPSOv4 DOI definition
  259. * @doi_def: CIPSO DOI definition
  260. * @audit_info: NetLabel audit information
  261. *
  262. * Description:
  263. * Add a new CIPSO DOI definition as defined by @doi_def. Returns zero on
  264. * success and negative values on failure.
  265. *
  266. */
  267. int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
  268. struct netlbl_audit *audit_info)
  269. {
  270. return cipso_v4_doi_add(doi_def, audit_info);
  271. }
  272. /**
  273. * netlbl_cfg_cipsov4_del - Remove an existing CIPSOv4 DOI definition
  274. * @doi: CIPSO DOI
  275. * @audit_info: NetLabel audit information
  276. *
  277. * Description:
  278. * Remove an existing CIPSO DOI definition matching @doi. Returns zero on
  279. * success and negative values on failure.
  280. *
  281. */
  282. void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info)
  283. {
  284. cipso_v4_doi_remove(doi, audit_info);
  285. }
  286. /**
  287. * netlbl_cfg_cipsov4_map_add - Add a new CIPSOv4 DOI mapping
  288. * @doi: the CIPSO DOI
  289. * @domain: the domain mapping to add
  290. * @addr: IP address
  291. * @mask: IP address mask
  292. * @audit_info: NetLabel audit information
  293. *
  294. * Description:
  295. * Add a new NetLabel/LSM domain mapping for the given CIPSO DOI to the NetLabel
  296. * subsystem. A @domain value of NULL adds a new default domain mapping.
  297. * Returns zero on success, negative values on failure.
  298. *
  299. */
  300. int netlbl_cfg_cipsov4_map_add(u32 doi,
  301. const char *domain,
  302. const struct in_addr *addr,
  303. const struct in_addr *mask,
  304. struct netlbl_audit *audit_info)
  305. {
  306. int ret_val = -ENOMEM;
  307. struct cipso_v4_doi *doi_def;
  308. struct netlbl_dom_map *entry;
  309. struct netlbl_domaddr_map *addrmap = NULL;
  310. struct netlbl_domaddr4_map *addrinfo = NULL;
  311. doi_def = cipso_v4_doi_getdef(doi);
  312. if (doi_def == NULL)
  313. return -ENOENT;
  314. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  315. if (entry == NULL)
  316. goto out_entry;
  317. entry->family = AF_INET;
  318. if (domain != NULL) {
  319. entry->domain = kstrdup(domain, GFP_ATOMIC);
  320. if (entry->domain == NULL)
  321. goto out_domain;
  322. }
  323. if (addr == NULL && mask == NULL) {
  324. entry->def.cipso = doi_def;
  325. entry->def.type = NETLBL_NLTYPE_CIPSOV4;
  326. } else if (addr != NULL && mask != NULL) {
  327. addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
  328. if (addrmap == NULL)
  329. goto out_addrmap;
  330. INIT_LIST_HEAD(&addrmap->list4);
  331. INIT_LIST_HEAD(&addrmap->list6);
  332. addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
  333. if (addrinfo == NULL)
  334. goto out_addrinfo;
  335. addrinfo->def.cipso = doi_def;
  336. addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4;
  337. addrinfo->list.addr = addr->s_addr & mask->s_addr;
  338. addrinfo->list.mask = mask->s_addr;
  339. addrinfo->list.valid = 1;
  340. ret_val = netlbl_af4list_add(&addrinfo->list, &addrmap->list4);
  341. if (ret_val != 0)
  342. goto cfg_cipsov4_map_add_failure;
  343. entry->def.addrsel = addrmap;
  344. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  345. } else {
  346. ret_val = -EINVAL;
  347. goto out_addrmap;
  348. }
  349. ret_val = netlbl_domhsh_add(entry, audit_info);
  350. if (ret_val != 0)
  351. goto cfg_cipsov4_map_add_failure;
  352. return 0;
  353. cfg_cipsov4_map_add_failure:
  354. kfree(addrinfo);
  355. out_addrinfo:
  356. kfree(addrmap);
  357. out_addrmap:
  358. kfree(entry->domain);
  359. out_domain:
  360. kfree(entry);
  361. out_entry:
  362. cipso_v4_doi_putdef(doi_def);
  363. return ret_val;
  364. }
  365. /**
  366. * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition
  367. * @doi_def: CALIPSO DOI definition
  368. * @audit_info: NetLabel audit information
  369. *
  370. * Description:
  371. * Add a new CALIPSO DOI definition as defined by @doi_def. Returns zero on
  372. * success and negative values on failure.
  373. *
  374. */
  375. int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
  376. struct netlbl_audit *audit_info)
  377. {
  378. #if IS_ENABLED(CONFIG_IPV6)
  379. return calipso_doi_add(doi_def, audit_info);
  380. #else /* IPv6 */
  381. return -ENOSYS;
  382. #endif /* IPv6 */
  383. }
  384. /**
  385. * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition
  386. * @doi: CALIPSO DOI
  387. * @audit_info: NetLabel audit information
  388. *
  389. * Description:
  390. * Remove an existing CALIPSO DOI definition matching @doi. Returns zero on
  391. * success and negative values on failure.
  392. *
  393. */
  394. void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
  395. {
  396. #if IS_ENABLED(CONFIG_IPV6)
  397. calipso_doi_remove(doi, audit_info);
  398. #endif /* IPv6 */
  399. }
  400. /**
  401. * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping
  402. * @doi: the CALIPSO DOI
  403. * @domain: the domain mapping to add
  404. * @addr: IP address
  405. * @mask: IP address mask
  406. * @audit_info: NetLabel audit information
  407. *
  408. * Description:
  409. * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the
  410. * NetLabel subsystem. A @domain value of NULL adds a new default domain
  411. * mapping. Returns zero on success, negative values on failure.
  412. *
  413. */
  414. int netlbl_cfg_calipso_map_add(u32 doi,
  415. const char *domain,
  416. const struct in6_addr *addr,
  417. const struct in6_addr *mask,
  418. struct netlbl_audit *audit_info)
  419. {
  420. #if IS_ENABLED(CONFIG_IPV6)
  421. int ret_val = -ENOMEM;
  422. struct calipso_doi *doi_def;
  423. struct netlbl_dom_map *entry;
  424. struct netlbl_domaddr_map *addrmap = NULL;
  425. struct netlbl_domaddr6_map *addrinfo = NULL;
  426. doi_def = calipso_doi_getdef(doi);
  427. if (doi_def == NULL)
  428. return -ENOENT;
  429. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  430. if (entry == NULL)
  431. goto out_entry;
  432. entry->family = AF_INET6;
  433. if (domain != NULL) {
  434. entry->domain = kstrdup(domain, GFP_ATOMIC);
  435. if (entry->domain == NULL)
  436. goto out_domain;
  437. }
  438. if (addr == NULL && mask == NULL) {
  439. entry->def.calipso = doi_def;
  440. entry->def.type = NETLBL_NLTYPE_CALIPSO;
  441. } else if (addr != NULL && mask != NULL) {
  442. addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
  443. if (addrmap == NULL)
  444. goto out_addrmap;
  445. INIT_LIST_HEAD(&addrmap->list4);
  446. INIT_LIST_HEAD(&addrmap->list6);
  447. addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
  448. if (addrinfo == NULL)
  449. goto out_addrinfo;
  450. addrinfo->def.calipso = doi_def;
  451. addrinfo->def.type = NETLBL_NLTYPE_CALIPSO;
  452. addrinfo->list.addr = *addr;
  453. addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
  454. addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
  455. addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
  456. addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
  457. addrinfo->list.mask = *mask;
  458. addrinfo->list.valid = 1;
  459. ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6);
  460. if (ret_val != 0)
  461. goto cfg_calipso_map_add_failure;
  462. entry->def.addrsel = addrmap;
  463. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  464. } else {
  465. ret_val = -EINVAL;
  466. goto out_addrmap;
  467. }
  468. ret_val = netlbl_domhsh_add(entry, audit_info);
  469. if (ret_val != 0)
  470. goto cfg_calipso_map_add_failure;
  471. return 0;
  472. cfg_calipso_map_add_failure:
  473. kfree(addrinfo);
  474. out_addrinfo:
  475. kfree(addrmap);
  476. out_addrmap:
  477. kfree(entry->domain);
  478. out_domain:
  479. kfree(entry);
  480. out_entry:
  481. calipso_doi_putdef(doi_def);
  482. return ret_val;
  483. #else /* IPv6 */
  484. return -ENOSYS;
  485. #endif /* IPv6 */
  486. }
  487. /*
  488. * Security Attribute Functions
  489. */
  490. #define _CM_F_NONE 0x00000000
  491. #define _CM_F_ALLOC 0x00000001
  492. #define _CM_F_WALK 0x00000002
  493. /**
  494. * _netlbl_catmap_getnode - Get a individual node from a catmap
  495. * @catmap: pointer to the category bitmap
  496. * @offset: the requested offset
  497. * @cm_flags: catmap flags, see _CM_F_*
  498. * @gfp_flags: memory allocation flags
  499. *
  500. * Description:
  501. * Iterate through the catmap looking for the node associated with @offset.
  502. * If the _CM_F_ALLOC flag is set in @cm_flags and there is no associated node,
  503. * one will be created and inserted into the catmap. If the _CM_F_WALK flag is
  504. * set in @cm_flags and there is no associated node, the next highest node will
  505. * be returned. Returns a pointer to the node on success, NULL on failure.
  506. *
  507. */
  508. static struct netlbl_lsm_catmap *_netlbl_catmap_getnode(
  509. struct netlbl_lsm_catmap **catmap,
  510. u32 offset,
  511. unsigned int cm_flags,
  512. gfp_t gfp_flags)
  513. {
  514. struct netlbl_lsm_catmap *iter = *catmap;
  515. struct netlbl_lsm_catmap *prev = NULL;
  516. if (iter == NULL)
  517. goto catmap_getnode_alloc;
  518. if (offset < iter->startbit)
  519. goto catmap_getnode_walk;
  520. while (iter && offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
  521. prev = iter;
  522. iter = iter->next;
  523. }
  524. if (iter == NULL || offset < iter->startbit)
  525. goto catmap_getnode_walk;
  526. return iter;
  527. catmap_getnode_walk:
  528. if (cm_flags & _CM_F_WALK)
  529. return iter;
  530. catmap_getnode_alloc:
  531. if (!(cm_flags & _CM_F_ALLOC))
  532. return NULL;
  533. iter = netlbl_catmap_alloc(gfp_flags);
  534. if (iter == NULL)
  535. return NULL;
  536. iter->startbit = offset & ~(NETLBL_CATMAP_SIZE - 1);
  537. if (prev == NULL) {
  538. iter->next = *catmap;
  539. *catmap = iter;
  540. } else {
  541. iter->next = prev->next;
  542. prev->next = iter;
  543. }
  544. return iter;
  545. }
  546. /**
  547. * netlbl_catmap_walk - Walk a LSM secattr catmap looking for a bit
  548. * @catmap: the category bitmap
  549. * @offset: the offset to start searching at, in bits
  550. *
  551. * Description:
  552. * This function walks a LSM secattr category bitmap starting at @offset and
  553. * returns the spot of the first set bit or -ENOENT if no bits are set.
  554. *
  555. */
  556. int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset)
  557. {
  558. struct netlbl_lsm_catmap *iter;
  559. u32 idx;
  560. u32 bit;
  561. NETLBL_CATMAP_MAPTYPE bitmap;
  562. iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0);
  563. if (iter == NULL)
  564. return -ENOENT;
  565. if (offset > iter->startbit) {
  566. offset -= iter->startbit;
  567. idx = offset / NETLBL_CATMAP_MAPSIZE;
  568. bit = offset % NETLBL_CATMAP_MAPSIZE;
  569. } else {
  570. idx = 0;
  571. bit = 0;
  572. }
  573. bitmap = iter->bitmap[idx] >> bit;
  574. for (;;) {
  575. if (bitmap != 0) {
  576. while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
  577. bitmap >>= 1;
  578. bit++;
  579. }
  580. return iter->startbit +
  581. (NETLBL_CATMAP_MAPSIZE * idx) + bit;
  582. }
  583. if (++idx >= NETLBL_CATMAP_MAPCNT) {
  584. if (iter->next != NULL) {
  585. iter = iter->next;
  586. idx = 0;
  587. } else
  588. return -ENOENT;
  589. }
  590. bitmap = iter->bitmap[idx];
  591. bit = 0;
  592. }
  593. return -ENOENT;
  594. }
  595. EXPORT_SYMBOL(netlbl_catmap_walk);
  596. /**
  597. * netlbl_catmap_walkrng - Find the end of a string of set bits
  598. * @catmap: the category bitmap
  599. * @offset: the offset to start searching at, in bits
  600. *
  601. * Description:
  602. * This function walks a LSM secattr category bitmap starting at @offset and
  603. * returns the spot of the first cleared bit or -ENOENT if the offset is past
  604. * the end of the bitmap.
  605. *
  606. */
  607. int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset)
  608. {
  609. struct netlbl_lsm_catmap *iter;
  610. struct netlbl_lsm_catmap *prev = NULL;
  611. u32 idx;
  612. u32 bit;
  613. NETLBL_CATMAP_MAPTYPE bitmask;
  614. NETLBL_CATMAP_MAPTYPE bitmap;
  615. iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0);
  616. if (iter == NULL)
  617. return -ENOENT;
  618. if (offset > iter->startbit) {
  619. offset -= iter->startbit;
  620. idx = offset / NETLBL_CATMAP_MAPSIZE;
  621. bit = offset % NETLBL_CATMAP_MAPSIZE;
  622. } else {
  623. idx = 0;
  624. bit = 0;
  625. }
  626. bitmask = NETLBL_CATMAP_BIT << bit;
  627. for (;;) {
  628. bitmap = iter->bitmap[idx];
  629. while (bitmask != 0 && (bitmap & bitmask) != 0) {
  630. bitmask <<= 1;
  631. bit++;
  632. }
  633. if (prev && idx == 0 && bit == 0)
  634. return prev->startbit + NETLBL_CATMAP_SIZE - 1;
  635. else if (bitmask != 0)
  636. return iter->startbit +
  637. (NETLBL_CATMAP_MAPSIZE * idx) + bit - 1;
  638. else if (++idx >= NETLBL_CATMAP_MAPCNT) {
  639. if (iter->next == NULL)
  640. return iter->startbit + NETLBL_CATMAP_SIZE - 1;
  641. prev = iter;
  642. iter = iter->next;
  643. idx = 0;
  644. }
  645. bitmask = NETLBL_CATMAP_BIT;
  646. bit = 0;
  647. }
  648. return -ENOENT;
  649. }
  650. /**
  651. * netlbl_catmap_getlong - Export an unsigned long bitmap
  652. * @catmap: pointer to the category bitmap
  653. * @offset: pointer to the requested offset
  654. * @bitmap: the exported bitmap
  655. *
  656. * Description:
  657. * Export a bitmap with an offset greater than or equal to @offset and return
  658. * it in @bitmap. The @offset must be aligned to an unsigned long and will be
  659. * updated on return if different from what was requested; if the catmap is
  660. * empty at the requested offset and beyond, the @offset is set to (u32)-1.
  661. * Returns zero on sucess, negative values on failure.
  662. *
  663. */
  664. int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
  665. u32 *offset,
  666. unsigned long *bitmap)
  667. {
  668. struct netlbl_lsm_catmap *iter;
  669. u32 off = *offset;
  670. u32 idx;
  671. /* only allow aligned offsets */
  672. if ((off & (BITS_PER_LONG - 1)) != 0)
  673. return -EINVAL;
  674. /* a null catmap is equivalent to an empty one */
  675. if (!catmap) {
  676. *offset = (u32)-1;
  677. return 0;
  678. }
  679. if (off < catmap->startbit) {
  680. off = catmap->startbit;
  681. *offset = off;
  682. }
  683. iter = _netlbl_catmap_getnode(&catmap, off, _CM_F_WALK, 0);
  684. if (iter == NULL) {
  685. *offset = (u32)-1;
  686. return 0;
  687. }
  688. if (off < iter->startbit) {
  689. *offset = iter->startbit;
  690. off = 0;
  691. } else
  692. off -= iter->startbit;
  693. idx = off / NETLBL_CATMAP_MAPSIZE;
  694. *bitmap = iter->bitmap[idx] >> (off % NETLBL_CATMAP_MAPSIZE);
  695. return 0;
  696. }
  697. /**
  698. * netlbl_catmap_setbit - Set a bit in a LSM secattr catmap
  699. * @catmap: pointer to the category bitmap
  700. * @bit: the bit to set
  701. * @flags: memory allocation flags
  702. *
  703. * Description:
  704. * Set the bit specified by @bit in @catmap. Returns zero on success,
  705. * negative values on failure.
  706. *
  707. */
  708. int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
  709. u32 bit,
  710. gfp_t flags)
  711. {
  712. struct netlbl_lsm_catmap *iter;
  713. u32 idx;
  714. iter = _netlbl_catmap_getnode(catmap, bit, _CM_F_ALLOC, flags);
  715. if (iter == NULL)
  716. return -ENOMEM;
  717. bit -= iter->startbit;
  718. idx = bit / NETLBL_CATMAP_MAPSIZE;
  719. iter->bitmap[idx] |= NETLBL_CATMAP_BIT << (bit % NETLBL_CATMAP_MAPSIZE);
  720. return 0;
  721. }
  722. EXPORT_SYMBOL(netlbl_catmap_setbit);
  723. /**
  724. * netlbl_catmap_setrng - Set a range of bits in a LSM secattr catmap
  725. * @catmap: pointer to the category bitmap
  726. * @start: the starting bit
  727. * @end: the last bit in the string
  728. * @flags: memory allocation flags
  729. *
  730. * Description:
  731. * Set a range of bits, starting at @start and ending with @end. Returns zero
  732. * on success, negative values on failure.
  733. *
  734. */
  735. int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap,
  736. u32 start,
  737. u32 end,
  738. gfp_t flags)
  739. {
  740. int rc = 0;
  741. u32 spot = start;
  742. while (rc == 0 && spot <= end) {
  743. if (((spot & (BITS_PER_LONG - 1)) == 0) &&
  744. ((end - spot) > BITS_PER_LONG)) {
  745. rc = netlbl_catmap_setlong(catmap,
  746. spot,
  747. (unsigned long)-1,
  748. flags);
  749. spot += BITS_PER_LONG;
  750. } else
  751. rc = netlbl_catmap_setbit(catmap, spot++, flags);
  752. }
  753. return rc;
  754. }
  755. /**
  756. * netlbl_catmap_setlong - Import an unsigned long bitmap
  757. * @catmap: pointer to the category bitmap
  758. * @offset: offset to the start of the imported bitmap
  759. * @bitmap: the bitmap to import
  760. * @flags: memory allocation flags
  761. *
  762. * Description:
  763. * Import the bitmap specified in @bitmap into @catmap, using the offset
  764. * in @offset. The offset must be aligned to an unsigned long. Returns zero
  765. * on success, negative values on failure.
  766. *
  767. */
  768. int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
  769. u32 offset,
  770. unsigned long bitmap,
  771. gfp_t flags)
  772. {
  773. struct netlbl_lsm_catmap *iter;
  774. u32 idx;
  775. /* only allow aligned offsets */
  776. if ((offset & (BITS_PER_LONG - 1)) != 0)
  777. return -EINVAL;
  778. iter = _netlbl_catmap_getnode(catmap, offset, _CM_F_ALLOC, flags);
  779. if (iter == NULL)
  780. return -ENOMEM;
  781. offset -= iter->startbit;
  782. idx = offset / NETLBL_CATMAP_MAPSIZE;
  783. iter->bitmap[idx] |= bitmap << (offset % NETLBL_CATMAP_MAPSIZE);
  784. return 0;
  785. }
  786. /* Bitmap functions
  787. */
  788. /**
  789. * netlbl_bitmap_walk - Walk a bitmap looking for a bit
  790. * @bitmap: the bitmap
  791. * @bitmap_len: length in bits
  792. * @offset: starting offset
  793. * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
  794. *
  795. * Description:
  796. * Starting at @offset, walk the bitmap from left to right until either the
  797. * desired bit is found or we reach the end. Return the bit offset, -1 if
  798. * not found, or -2 if error.
  799. */
  800. int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len,
  801. u32 offset, u8 state)
  802. {
  803. u32 bit_spot;
  804. u32 byte_offset;
  805. unsigned char bitmask;
  806. unsigned char byte;
  807. if (offset >= bitmap_len)
  808. return -1;
  809. byte_offset = offset / 8;
  810. byte = bitmap[byte_offset];
  811. bit_spot = offset;
  812. bitmask = 0x80 >> (offset % 8);
  813. while (bit_spot < bitmap_len) {
  814. if ((state && (byte & bitmask) == bitmask) ||
  815. (state == 0 && (byte & bitmask) == 0))
  816. return bit_spot;
  817. if (++bit_spot >= bitmap_len)
  818. return -1;
  819. bitmask >>= 1;
  820. if (bitmask == 0) {
  821. byte = bitmap[++byte_offset];
  822. bitmask = 0x80;
  823. }
  824. }
  825. return -1;
  826. }
  827. EXPORT_SYMBOL(netlbl_bitmap_walk);
  828. /**
  829. * netlbl_bitmap_setbit - Sets a single bit in a bitmap
  830. * @bitmap: the bitmap
  831. * @bit: the bit
  832. * @state: if non-zero, set the bit (1) else clear the bit (0)
  833. *
  834. * Description:
  835. * Set a single bit in the bitmask. Returns zero on success, negative values
  836. * on error.
  837. */
  838. void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state)
  839. {
  840. u32 byte_spot;
  841. u8 bitmask;
  842. /* gcc always rounds to zero when doing integer division */
  843. byte_spot = bit / 8;
  844. bitmask = 0x80 >> (bit % 8);
  845. if (state)
  846. bitmap[byte_spot] |= bitmask;
  847. else
  848. bitmap[byte_spot] &= ~bitmask;
  849. }
  850. EXPORT_SYMBOL(netlbl_bitmap_setbit);
  851. /*
  852. * LSM Functions
  853. */
  854. /**
  855. * netlbl_enabled - Determine if the NetLabel subsystem is enabled
  856. *
  857. * Description:
  858. * The LSM can use this function to determine if it should use NetLabel
  859. * security attributes in it's enforcement mechanism. Currently, NetLabel is
  860. * considered to be enabled when it's configuration contains a valid setup for
  861. * at least one labeled protocol (i.e. NetLabel can understand incoming
  862. * labeled packets of at least one type); otherwise NetLabel is considered to
  863. * be disabled.
  864. *
  865. */
  866. int netlbl_enabled(void)
  867. {
  868. /* At some point we probably want to expose this mechanism to the user
  869. * as well so that admins can toggle NetLabel regardless of the
  870. * configuration */
  871. return (atomic_read(&netlabel_mgmt_protocount) > 0);
  872. }
  873. /**
  874. * netlbl_sock_setattr - Label a socket using the correct protocol
  875. * @sk: the socket to label
  876. * @family: protocol family
  877. * @secattr: the security attributes
  878. *
  879. * Description:
  880. * Attach the correct label to the given socket using the security attributes
  881. * specified in @secattr. This function requires exclusive access to @sk,
  882. * which means it either needs to be in the process of being created or locked.
  883. * Returns zero on success, -EDESTADDRREQ if the domain is configured to use
  884. * network address selectors (can't blindly label the socket), and negative
  885. * values on all other failures.
  886. *
  887. */
  888. int netlbl_sock_setattr(struct sock *sk,
  889. u16 family,
  890. const struct netlbl_lsm_secattr *secattr)
  891. {
  892. int ret_val;
  893. struct netlbl_dom_map *dom_entry;
  894. rcu_read_lock();
  895. dom_entry = netlbl_domhsh_getentry(secattr->domain, family);
  896. if (dom_entry == NULL) {
  897. ret_val = -ENOENT;
  898. goto socket_setattr_return;
  899. }
  900. switch (family) {
  901. case AF_INET:
  902. switch (dom_entry->def.type) {
  903. case NETLBL_NLTYPE_ADDRSELECT:
  904. ret_val = -EDESTADDRREQ;
  905. break;
  906. case NETLBL_NLTYPE_CIPSOV4:
  907. ret_val = cipso_v4_sock_setattr(sk,
  908. dom_entry->def.cipso,
  909. secattr);
  910. break;
  911. case NETLBL_NLTYPE_UNLABELED:
  912. ret_val = 0;
  913. break;
  914. default:
  915. ret_val = -ENOENT;
  916. }
  917. break;
  918. #if IS_ENABLED(CONFIG_IPV6)
  919. case AF_INET6:
  920. switch (dom_entry->def.type) {
  921. case NETLBL_NLTYPE_ADDRSELECT:
  922. ret_val = -EDESTADDRREQ;
  923. break;
  924. case NETLBL_NLTYPE_CALIPSO:
  925. ret_val = calipso_sock_setattr(sk,
  926. dom_entry->def.calipso,
  927. secattr);
  928. break;
  929. case NETLBL_NLTYPE_UNLABELED:
  930. ret_val = 0;
  931. break;
  932. default:
  933. ret_val = -ENOENT;
  934. }
  935. break;
  936. #endif /* IPv6 */
  937. default:
  938. ret_val = -EPROTONOSUPPORT;
  939. }
  940. socket_setattr_return:
  941. rcu_read_unlock();
  942. return ret_val;
  943. }
  944. /**
  945. * netlbl_sock_delattr - Delete all the NetLabel labels on a socket
  946. * @sk: the socket
  947. *
  948. * Description:
  949. * Remove all the NetLabel labeling from @sk. The caller is responsible for
  950. * ensuring that @sk is locked.
  951. *
  952. */
  953. void netlbl_sock_delattr(struct sock *sk)
  954. {
  955. switch (sk->sk_family) {
  956. case AF_INET:
  957. cipso_v4_sock_delattr(sk);
  958. break;
  959. #if IS_ENABLED(CONFIG_IPV6)
  960. case AF_INET6:
  961. calipso_sock_delattr(sk);
  962. break;
  963. #endif /* IPv6 */
  964. }
  965. }
  966. /**
  967. * netlbl_sock_getattr - Determine the security attributes of a sock
  968. * @sk: the sock
  969. * @secattr: the security attributes
  970. *
  971. * Description:
  972. * Examines the given sock to see if any NetLabel style labeling has been
  973. * applied to the sock, if so it parses the socket label and returns the
  974. * security attributes in @secattr. Returns zero on success, negative values
  975. * on failure.
  976. *
  977. */
  978. int netlbl_sock_getattr(struct sock *sk,
  979. struct netlbl_lsm_secattr *secattr)
  980. {
  981. int ret_val;
  982. switch (sk->sk_family) {
  983. case AF_INET:
  984. ret_val = cipso_v4_sock_getattr(sk, secattr);
  985. break;
  986. #if IS_ENABLED(CONFIG_IPV6)
  987. case AF_INET6:
  988. ret_val = calipso_sock_getattr(sk, secattr);
  989. break;
  990. #endif /* IPv6 */
  991. default:
  992. ret_val = -EPROTONOSUPPORT;
  993. }
  994. return ret_val;
  995. }
  996. /**
  997. * netlbl_conn_setattr - Label a connected socket using the correct protocol
  998. * @sk: the socket to label
  999. * @addr: the destination address
  1000. * @secattr: the security attributes
  1001. *
  1002. * Description:
  1003. * Attach the correct label to the given connected socket using the security
  1004. * attributes specified in @secattr. The caller is responsible for ensuring
  1005. * that @sk is locked. Returns zero on success, negative values on failure.
  1006. *
  1007. */
  1008. int netlbl_conn_setattr(struct sock *sk,
  1009. struct sockaddr *addr,
  1010. const struct netlbl_lsm_secattr *secattr)
  1011. {
  1012. int ret_val;
  1013. struct sockaddr_in *addr4;
  1014. #if IS_ENABLED(CONFIG_IPV6)
  1015. struct sockaddr_in6 *addr6;
  1016. #endif
  1017. struct netlbl_dommap_def *entry;
  1018. rcu_read_lock();
  1019. switch (addr->sa_family) {
  1020. case AF_INET:
  1021. addr4 = (struct sockaddr_in *)addr;
  1022. entry = netlbl_domhsh_getentry_af4(secattr->domain,
  1023. addr4->sin_addr.s_addr);
  1024. if (entry == NULL) {
  1025. ret_val = -ENOENT;
  1026. goto conn_setattr_return;
  1027. }
  1028. switch (entry->type) {
  1029. case NETLBL_NLTYPE_CIPSOV4:
  1030. ret_val = cipso_v4_sock_setattr(sk,
  1031. entry->cipso, secattr);
  1032. break;
  1033. case NETLBL_NLTYPE_UNLABELED:
  1034. /* just delete the protocols we support for right now
  1035. * but we could remove other protocols if needed */
  1036. netlbl_sock_delattr(sk);
  1037. ret_val = 0;
  1038. break;
  1039. default:
  1040. ret_val = -ENOENT;
  1041. }
  1042. break;
  1043. #if IS_ENABLED(CONFIG_IPV6)
  1044. case AF_INET6:
  1045. addr6 = (struct sockaddr_in6 *)addr;
  1046. entry = netlbl_domhsh_getentry_af6(secattr->domain,
  1047. &addr6->sin6_addr);
  1048. if (entry == NULL) {
  1049. ret_val = -ENOENT;
  1050. goto conn_setattr_return;
  1051. }
  1052. switch (entry->type) {
  1053. case NETLBL_NLTYPE_CALIPSO:
  1054. ret_val = calipso_sock_setattr(sk,
  1055. entry->calipso, secattr);
  1056. break;
  1057. case NETLBL_NLTYPE_UNLABELED:
  1058. /* just delete the protocols we support for right now
  1059. * but we could remove other protocols if needed */
  1060. netlbl_sock_delattr(sk);
  1061. ret_val = 0;
  1062. break;
  1063. default:
  1064. ret_val = -ENOENT;
  1065. }
  1066. break;
  1067. #endif /* IPv6 */
  1068. default:
  1069. ret_val = -EPROTONOSUPPORT;
  1070. }
  1071. conn_setattr_return:
  1072. rcu_read_unlock();
  1073. return ret_val;
  1074. }
  1075. /**
  1076. * netlbl_req_setattr - Label a request socket using the correct protocol
  1077. * @req: the request socket to label
  1078. * @secattr: the security attributes
  1079. *
  1080. * Description:
  1081. * Attach the correct label to the given socket using the security attributes
  1082. * specified in @secattr. Returns zero on success, negative values on failure.
  1083. *
  1084. */
  1085. int netlbl_req_setattr(struct request_sock *req,
  1086. const struct netlbl_lsm_secattr *secattr)
  1087. {
  1088. int ret_val;
  1089. struct netlbl_dommap_def *entry;
  1090. struct inet_request_sock *ireq = inet_rsk(req);
  1091. rcu_read_lock();
  1092. switch (req->rsk_ops->family) {
  1093. case AF_INET:
  1094. entry = netlbl_domhsh_getentry_af4(secattr->domain,
  1095. ireq->ir_rmt_addr);
  1096. if (entry == NULL) {
  1097. ret_val = -ENOENT;
  1098. goto req_setattr_return;
  1099. }
  1100. switch (entry->type) {
  1101. case NETLBL_NLTYPE_CIPSOV4:
  1102. ret_val = cipso_v4_req_setattr(req,
  1103. entry->cipso, secattr);
  1104. break;
  1105. case NETLBL_NLTYPE_UNLABELED:
  1106. netlbl_req_delattr(req);
  1107. ret_val = 0;
  1108. break;
  1109. default:
  1110. ret_val = -ENOENT;
  1111. }
  1112. break;
  1113. #if IS_ENABLED(CONFIG_IPV6)
  1114. case AF_INET6:
  1115. entry = netlbl_domhsh_getentry_af6(secattr->domain,
  1116. &ireq->ir_v6_rmt_addr);
  1117. if (entry == NULL) {
  1118. ret_val = -ENOENT;
  1119. goto req_setattr_return;
  1120. }
  1121. switch (entry->type) {
  1122. case NETLBL_NLTYPE_CALIPSO:
  1123. ret_val = calipso_req_setattr(req,
  1124. entry->calipso, secattr);
  1125. break;
  1126. case NETLBL_NLTYPE_UNLABELED:
  1127. netlbl_req_delattr(req);
  1128. ret_val = 0;
  1129. break;
  1130. default:
  1131. ret_val = -ENOENT;
  1132. }
  1133. break;
  1134. #endif /* IPv6 */
  1135. default:
  1136. ret_val = -EPROTONOSUPPORT;
  1137. }
  1138. req_setattr_return:
  1139. rcu_read_unlock();
  1140. return ret_val;
  1141. }
  1142. /**
  1143. * netlbl_req_delattr - Delete all the NetLabel labels on a socket
  1144. * @req: the socket
  1145. *
  1146. * Description:
  1147. * Remove all the NetLabel labeling from @req.
  1148. *
  1149. */
  1150. void netlbl_req_delattr(struct request_sock *req)
  1151. {
  1152. switch (req->rsk_ops->family) {
  1153. case AF_INET:
  1154. cipso_v4_req_delattr(req);
  1155. break;
  1156. #if IS_ENABLED(CONFIG_IPV6)
  1157. case AF_INET6:
  1158. calipso_req_delattr(req);
  1159. break;
  1160. #endif /* IPv6 */
  1161. }
  1162. }
  1163. /**
  1164. * netlbl_skbuff_setattr - Label a packet using the correct protocol
  1165. * @skb: the packet
  1166. * @family: protocol family
  1167. * @secattr: the security attributes
  1168. *
  1169. * Description:
  1170. * Attach the correct label to the given packet using the security attributes
  1171. * specified in @secattr. Returns zero on success, negative values on failure.
  1172. *
  1173. */
  1174. int netlbl_skbuff_setattr(struct sk_buff *skb,
  1175. u16 family,
  1176. const struct netlbl_lsm_secattr *secattr)
  1177. {
  1178. int ret_val;
  1179. struct iphdr *hdr4;
  1180. #if IS_ENABLED(CONFIG_IPV6)
  1181. struct ipv6hdr *hdr6;
  1182. #endif
  1183. struct netlbl_dommap_def *entry;
  1184. rcu_read_lock();
  1185. switch (family) {
  1186. case AF_INET:
  1187. hdr4 = ip_hdr(skb);
  1188. entry = netlbl_domhsh_getentry_af4(secattr->domain,
  1189. hdr4->daddr);
  1190. if (entry == NULL) {
  1191. ret_val = -ENOENT;
  1192. goto skbuff_setattr_return;
  1193. }
  1194. switch (entry->type) {
  1195. case NETLBL_NLTYPE_CIPSOV4:
  1196. ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso,
  1197. secattr);
  1198. break;
  1199. case NETLBL_NLTYPE_UNLABELED:
  1200. /* just delete the protocols we support for right now
  1201. * but we could remove other protocols if needed */
  1202. ret_val = cipso_v4_skbuff_delattr(skb);
  1203. break;
  1204. default:
  1205. ret_val = -ENOENT;
  1206. }
  1207. break;
  1208. #if IS_ENABLED(CONFIG_IPV6)
  1209. case AF_INET6:
  1210. hdr6 = ipv6_hdr(skb);
  1211. entry = netlbl_domhsh_getentry_af6(secattr->domain,
  1212. &hdr6->daddr);
  1213. if (entry == NULL) {
  1214. ret_val = -ENOENT;
  1215. goto skbuff_setattr_return;
  1216. }
  1217. switch (entry->type) {
  1218. case NETLBL_NLTYPE_CALIPSO:
  1219. ret_val = calipso_skbuff_setattr(skb, entry->calipso,
  1220. secattr);
  1221. break;
  1222. case NETLBL_NLTYPE_UNLABELED:
  1223. /* just delete the protocols we support for right now
  1224. * but we could remove other protocols if needed */
  1225. ret_val = calipso_skbuff_delattr(skb);
  1226. break;
  1227. default:
  1228. ret_val = -ENOENT;
  1229. }
  1230. break;
  1231. #endif /* IPv6 */
  1232. default:
  1233. ret_val = -EPROTONOSUPPORT;
  1234. }
  1235. skbuff_setattr_return:
  1236. rcu_read_unlock();
  1237. return ret_val;
  1238. }
  1239. /**
  1240. * netlbl_skbuff_getattr - Determine the security attributes of a packet
  1241. * @skb: the packet
  1242. * @family: protocol family
  1243. * @secattr: the security attributes
  1244. *
  1245. * Description:
  1246. * Examines the given packet to see if a recognized form of packet labeling
  1247. * is present, if so it parses the packet label and returns the security
  1248. * attributes in @secattr. Returns zero on success, negative values on
  1249. * failure.
  1250. *
  1251. */
  1252. int netlbl_skbuff_getattr(const struct sk_buff *skb,
  1253. u16 family,
  1254. struct netlbl_lsm_secattr *secattr)
  1255. {
  1256. unsigned char *ptr;
  1257. switch (family) {
  1258. case AF_INET:
  1259. ptr = cipso_v4_optptr(skb);
  1260. if (ptr && cipso_v4_getattr(ptr, secattr) == 0)
  1261. return 0;
  1262. break;
  1263. #if IS_ENABLED(CONFIG_IPV6)
  1264. case AF_INET6:
  1265. ptr = calipso_optptr(skb);
  1266. if (ptr && calipso_getattr(ptr, secattr) == 0)
  1267. return 0;
  1268. break;
  1269. #endif /* IPv6 */
  1270. }
  1271. return netlbl_unlabel_getattr(skb, family, secattr);
  1272. }
  1273. /**
  1274. * netlbl_skbuff_err - Handle a LSM error on a sk_buff
  1275. * @skb: the packet
  1276. * @family: the family
  1277. * @error: the error code
  1278. * @gateway: true if host is acting as a gateway, false otherwise
  1279. *
  1280. * Description:
  1281. * Deal with a LSM problem when handling the packet in @skb, typically this is
  1282. * a permission denied problem (-EACCES). The correct action is determined
  1283. * according to the packet's labeling protocol.
  1284. *
  1285. */
  1286. void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway)
  1287. {
  1288. switch (family) {
  1289. case AF_INET:
  1290. if (cipso_v4_optptr(skb))
  1291. cipso_v4_error(skb, error, gateway);
  1292. break;
  1293. }
  1294. }
  1295. /**
  1296. * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches
  1297. *
  1298. * Description:
  1299. * For all of the NetLabel protocols that support some form of label mapping
  1300. * cache, invalidate the cache. Returns zero on success, negative values on
  1301. * error.
  1302. *
  1303. */
  1304. void netlbl_cache_invalidate(void)
  1305. {
  1306. cipso_v4_cache_invalidate();
  1307. #if IS_ENABLED(CONFIG_IPV6)
  1308. calipso_cache_invalidate();
  1309. #endif /* IPv6 */
  1310. }
  1311. /**
  1312. * netlbl_cache_add - Add an entry to a NetLabel protocol cache
  1313. * @skb: the packet
  1314. * @family: the family
  1315. * @secattr: the packet's security attributes
  1316. *
  1317. * Description:
  1318. * Add the LSM security attributes for the given packet to the underlying
  1319. * NetLabel protocol's label mapping cache. Returns zero on success, negative
  1320. * values on error.
  1321. *
  1322. */
  1323. int netlbl_cache_add(const struct sk_buff *skb, u16 family,
  1324. const struct netlbl_lsm_secattr *secattr)
  1325. {
  1326. unsigned char *ptr;
  1327. if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
  1328. return -ENOMSG;
  1329. switch (family) {
  1330. case AF_INET:
  1331. ptr = cipso_v4_optptr(skb);
  1332. if (ptr)
  1333. return cipso_v4_cache_add(ptr, secattr);
  1334. break;
  1335. #if IS_ENABLED(CONFIG_IPV6)
  1336. case AF_INET6:
  1337. ptr = calipso_optptr(skb);
  1338. if (ptr)
  1339. return calipso_cache_add(ptr, secattr);
  1340. break;
  1341. #endif /* IPv6 */
  1342. }
  1343. return -ENOMSG;
  1344. }
  1345. /*
  1346. * Protocol Engine Functions
  1347. */
  1348. /**
  1349. * netlbl_audit_start - Start an audit message
  1350. * @type: audit message type
  1351. * @audit_info: NetLabel audit information
  1352. *
  1353. * Description:
  1354. * Start an audit message using the type specified in @type and fill the audit
  1355. * message with some fields common to all NetLabel audit messages. This
  1356. * function should only be used by protocol engines, not LSMs. Returns a
  1357. * pointer to the audit buffer on success, NULL on failure.
  1358. *
  1359. */
  1360. struct audit_buffer *netlbl_audit_start(int type,
  1361. struct netlbl_audit *audit_info)
  1362. {
  1363. return netlbl_audit_start_common(type, audit_info);
  1364. }
  1365. EXPORT_SYMBOL(netlbl_audit_start);
  1366. /*
  1367. * Setup Functions
  1368. */
  1369. /**
  1370. * netlbl_init - Initialize NetLabel
  1371. *
  1372. * Description:
  1373. * Perform the required NetLabel initialization before first use.
  1374. *
  1375. */
  1376. static int __init netlbl_init(void)
  1377. {
  1378. int ret_val;
  1379. printk(KERN_INFO "NetLabel: Initializing\n");
  1380. printk(KERN_INFO "NetLabel: domain hash size = %u\n",
  1381. (1 << NETLBL_DOMHSH_BITSIZE));
  1382. printk(KERN_INFO "NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO\n");
  1383. ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
  1384. if (ret_val != 0)
  1385. goto init_failure;
  1386. ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE);
  1387. if (ret_val != 0)
  1388. goto init_failure;
  1389. ret_val = netlbl_netlink_init();
  1390. if (ret_val != 0)
  1391. goto init_failure;
  1392. ret_val = netlbl_unlabel_defconf();
  1393. if (ret_val != 0)
  1394. goto init_failure;
  1395. printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n");
  1396. return 0;
  1397. init_failure:
  1398. panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
  1399. }
  1400. subsys_initcall(netlbl_init);