netlabel_unlabeled.c 42 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NetLabel Unlabeled Support
  4. *
  5. * This file defines functions for dealing with unlabeled packets for the
  6. * NetLabel system. The NetLabel system manages static and dynamic label
  7. * mappings for network protocols such as CIPSO and RIPSO.
  8. *
  9. * Author: Paul Moore <paul@paul-moore.com>
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
  13. */
  14. #include <linux/types.h>
  15. #include <linux/rcupdate.h>
  16. #include <linux/list.h>
  17. #include <linux/spinlock.h>
  18. #include <linux/socket.h>
  19. #include <linux/string.h>
  20. #include <linux/skbuff.h>
  21. #include <linux/audit.h>
  22. #include <linux/in.h>
  23. #include <linux/in6.h>
  24. #include <linux/ip.h>
  25. #include <linux/ipv6.h>
  26. #include <linux/notifier.h>
  27. #include <linux/netdevice.h>
  28. #include <linux/security.h>
  29. #include <linux/slab.h>
  30. #include <net/sock.h>
  31. #include <net/netlink.h>
  32. #include <net/genetlink.h>
  33. #include <net/ip.h>
  34. #include <net/ipv6.h>
  35. #include <net/net_namespace.h>
  36. #include <net/netlabel.h>
  37. #include <asm/bug.h>
  38. #include <linux/atomic.h>
  39. #include "netlabel_user.h"
  40. #include "netlabel_addrlist.h"
  41. #include "netlabel_domainhash.h"
  42. #include "netlabel_unlabeled.h"
  43. #include "netlabel_mgmt.h"
  44. /* NOTE: at present we always use init's network namespace since we don't
  45. * presently support different namespaces even though the majority of
  46. * the functions in this file are "namespace safe" */
  47. /* The unlabeled connection hash table which we use to map network interfaces
  48. * and addresses of unlabeled packets to a user specified secid value for the
  49. * LSM. The hash table is used to lookup the network interface entry
  50. * (struct netlbl_unlhsh_iface) and then the interface entry is used to
  51. * lookup an IP address match from an ordered list. If a network interface
  52. * match can not be found in the hash table then the default entry
  53. * (netlbl_unlhsh_def) is used. The IP address entry list
  54. * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
  55. * larger netmask come first.
  56. */
  57. struct netlbl_unlhsh_tbl {
  58. struct list_head *tbl;
  59. u32 size;
  60. };
  61. #define netlbl_unlhsh_addr4_entry(iter) \
  62. container_of(iter, struct netlbl_unlhsh_addr4, list)
  63. struct netlbl_unlhsh_addr4 {
  64. u32 secid;
  65. struct netlbl_af4list list;
  66. struct rcu_head rcu;
  67. };
  68. #define netlbl_unlhsh_addr6_entry(iter) \
  69. container_of(iter, struct netlbl_unlhsh_addr6, list)
  70. struct netlbl_unlhsh_addr6 {
  71. u32 secid;
  72. struct netlbl_af6list list;
  73. struct rcu_head rcu;
  74. };
  75. struct netlbl_unlhsh_iface {
  76. int ifindex;
  77. struct list_head addr4_list;
  78. struct list_head addr6_list;
  79. u32 valid;
  80. struct list_head list;
  81. struct rcu_head rcu;
  82. };
  83. /* Argument struct for netlbl_unlhsh_walk() */
  84. struct netlbl_unlhsh_walk_arg {
  85. struct netlink_callback *nl_cb;
  86. struct sk_buff *skb;
  87. u32 seq;
  88. };
  89. /* Unlabeled connection hash table */
  90. /* updates should be so rare that having one spinlock for the entire
  91. * hash table should be okay */
  92. static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
  93. #define netlbl_unlhsh_rcu_deref(p) \
  94. rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
  95. static struct netlbl_unlhsh_tbl __rcu *netlbl_unlhsh;
  96. static struct netlbl_unlhsh_iface __rcu *netlbl_unlhsh_def;
  97. /* Accept unlabeled packets flag */
  98. static u8 netlabel_unlabel_acceptflg;
  99. /* NetLabel Generic NETLINK unlabeled family */
  100. static struct genl_family netlbl_unlabel_gnl_family;
  101. /* NetLabel Netlink attribute policy */
  102. static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
  103. [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
  104. [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
  105. .len = sizeof(struct in6_addr) },
  106. [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
  107. .len = sizeof(struct in6_addr) },
  108. [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
  109. .len = sizeof(struct in_addr) },
  110. [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
  111. .len = sizeof(struct in_addr) },
  112. [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
  113. .len = IFNAMSIZ - 1 },
  114. [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
  115. };
  116. /*
  117. * Unlabeled Connection Hash Table Functions
  118. */
  119. /**
  120. * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
  121. * @entry: the entry's RCU field
  122. *
  123. * Description:
  124. * This function is designed to be used as a callback to the call_rcu()
  125. * function so that memory allocated to a hash table interface entry can be
  126. * released safely. It is important to note that this function does not free
  127. * the IPv4 and IPv6 address lists contained as part of an interface entry. It
  128. * is up to the rest of the code to make sure an interface entry is only freed
  129. * once it's address lists are empty.
  130. *
  131. */
  132. static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
  133. {
  134. struct netlbl_unlhsh_iface *iface;
  135. struct netlbl_af4list *iter4;
  136. struct netlbl_af4list *tmp4;
  137. #if IS_ENABLED(CONFIG_IPV6)
  138. struct netlbl_af6list *iter6;
  139. struct netlbl_af6list *tmp6;
  140. #endif /* IPv6 */
  141. iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
  142. /* no need for locks here since we are the only one with access to this
  143. * structure */
  144. netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
  145. netlbl_af4list_remove_entry(iter4);
  146. kfree(netlbl_unlhsh_addr4_entry(iter4));
  147. }
  148. #if IS_ENABLED(CONFIG_IPV6)
  149. netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
  150. netlbl_af6list_remove_entry(iter6);
  151. kfree(netlbl_unlhsh_addr6_entry(iter6));
  152. }
  153. #endif /* IPv6 */
  154. kfree(iface);
  155. }
  156. /**
  157. * netlbl_unlhsh_hash - Hashing function for the hash table
  158. * @ifindex: the network interface/device to hash
  159. *
  160. * Description:
  161. * This is the hashing function for the unlabeled hash table, it returns the
  162. * bucket number for the given device/interface. The caller is responsible for
  163. * ensuring that the hash table is protected with either a RCU read lock or
  164. * the hash table lock.
  165. *
  166. */
  167. static u32 netlbl_unlhsh_hash(int ifindex)
  168. {
  169. return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
  170. }
  171. /**
  172. * netlbl_unlhsh_search_iface - Search for a matching interface entry
  173. * @ifindex: the network interface
  174. *
  175. * Description:
  176. * Searches the unlabeled connection hash table and returns a pointer to the
  177. * interface entry which matches @ifindex, otherwise NULL is returned. The
  178. * caller is responsible for ensuring that the hash table is protected with
  179. * either a RCU read lock or the hash table lock.
  180. *
  181. */
  182. static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
  183. {
  184. u32 bkt;
  185. struct list_head *bkt_list;
  186. struct netlbl_unlhsh_iface *iter;
  187. bkt = netlbl_unlhsh_hash(ifindex);
  188. bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
  189. list_for_each_entry_rcu(iter, bkt_list, list,
  190. lockdep_is_held(&netlbl_unlhsh_lock))
  191. if (iter->valid && iter->ifindex == ifindex)
  192. return iter;
  193. return NULL;
  194. }
  195. /**
  196. * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
  197. * @iface: the associated interface entry
  198. * @addr: IPv4 address in network byte order
  199. * @mask: IPv4 address mask in network byte order
  200. * @secid: LSM secid value for entry
  201. *
  202. * Description:
  203. * Add a new address entry into the unlabeled connection hash table using the
  204. * interface entry specified by @iface. On success zero is returned, otherwise
  205. * a negative value is returned.
  206. *
  207. */
  208. static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
  209. const struct in_addr *addr,
  210. const struct in_addr *mask,
  211. u32 secid)
  212. {
  213. int ret_val;
  214. struct netlbl_unlhsh_addr4 *entry;
  215. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  216. if (entry == NULL)
  217. return -ENOMEM;
  218. entry->list.addr = addr->s_addr & mask->s_addr;
  219. entry->list.mask = mask->s_addr;
  220. entry->list.valid = 1;
  221. entry->secid = secid;
  222. spin_lock(&netlbl_unlhsh_lock);
  223. ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
  224. spin_unlock(&netlbl_unlhsh_lock);
  225. if (ret_val != 0)
  226. kfree(entry);
  227. return ret_val;
  228. }
  229. #if IS_ENABLED(CONFIG_IPV6)
  230. /**
  231. * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
  232. * @iface: the associated interface entry
  233. * @addr: IPv6 address in network byte order
  234. * @mask: IPv6 address mask in network byte order
  235. * @secid: LSM secid value for entry
  236. *
  237. * Description:
  238. * Add a new address entry into the unlabeled connection hash table using the
  239. * interface entry specified by @iface. On success zero is returned, otherwise
  240. * a negative value is returned.
  241. *
  242. */
  243. static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
  244. const struct in6_addr *addr,
  245. const struct in6_addr *mask,
  246. u32 secid)
  247. {
  248. int ret_val;
  249. struct netlbl_unlhsh_addr6 *entry;
  250. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  251. if (entry == NULL)
  252. return -ENOMEM;
  253. entry->list.addr = *addr;
  254. entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
  255. entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
  256. entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
  257. entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
  258. entry->list.mask = *mask;
  259. entry->list.valid = 1;
  260. entry->secid = secid;
  261. spin_lock(&netlbl_unlhsh_lock);
  262. ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
  263. spin_unlock(&netlbl_unlhsh_lock);
  264. if (ret_val != 0)
  265. kfree(entry);
  266. return 0;
  267. }
  268. #endif /* IPv6 */
  269. /**
  270. * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
  271. * @ifindex: network interface
  272. *
  273. * Description:
  274. * Add a new, empty, interface entry into the unlabeled connection hash table.
  275. * On success a pointer to the new interface entry is returned, on failure NULL
  276. * is returned.
  277. *
  278. */
  279. static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
  280. {
  281. u32 bkt;
  282. struct netlbl_unlhsh_iface *iface;
  283. iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
  284. if (iface == NULL)
  285. return NULL;
  286. iface->ifindex = ifindex;
  287. INIT_LIST_HEAD(&iface->addr4_list);
  288. INIT_LIST_HEAD(&iface->addr6_list);
  289. iface->valid = 1;
  290. spin_lock(&netlbl_unlhsh_lock);
  291. if (ifindex > 0) {
  292. bkt = netlbl_unlhsh_hash(ifindex);
  293. if (netlbl_unlhsh_search_iface(ifindex) != NULL)
  294. goto add_iface_failure;
  295. list_add_tail_rcu(&iface->list,
  296. &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
  297. } else {
  298. INIT_LIST_HEAD(&iface->list);
  299. if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
  300. goto add_iface_failure;
  301. rcu_assign_pointer(netlbl_unlhsh_def, iface);
  302. }
  303. spin_unlock(&netlbl_unlhsh_lock);
  304. return iface;
  305. add_iface_failure:
  306. spin_unlock(&netlbl_unlhsh_lock);
  307. kfree(iface);
  308. return NULL;
  309. }
  310. /**
  311. * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
  312. * @net: network namespace
  313. * @dev_name: interface name
  314. * @addr: IP address in network byte order
  315. * @mask: address mask in network byte order
  316. * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
  317. * @secid: LSM secid value for the entry
  318. * @audit_info: NetLabel audit information
  319. *
  320. * Description:
  321. * Adds a new entry to the unlabeled connection hash table. Returns zero on
  322. * success, negative values on failure.
  323. *
  324. */
  325. int netlbl_unlhsh_add(struct net *net,
  326. const char *dev_name,
  327. const void *addr,
  328. const void *mask,
  329. u32 addr_len,
  330. u32 secid,
  331. struct netlbl_audit *audit_info)
  332. {
  333. int ret_val;
  334. int ifindex;
  335. struct net_device *dev;
  336. struct netlbl_unlhsh_iface *iface;
  337. struct audit_buffer *audit_buf = NULL;
  338. char *secctx = NULL;
  339. u32 secctx_len;
  340. if (addr_len != sizeof(struct in_addr) &&
  341. addr_len != sizeof(struct in6_addr))
  342. return -EINVAL;
  343. rcu_read_lock();
  344. if (dev_name != NULL) {
  345. dev = dev_get_by_name_rcu(net, dev_name);
  346. if (dev == NULL) {
  347. ret_val = -ENODEV;
  348. goto unlhsh_add_return;
  349. }
  350. ifindex = dev->ifindex;
  351. iface = netlbl_unlhsh_search_iface(ifindex);
  352. } else {
  353. ifindex = 0;
  354. iface = rcu_dereference(netlbl_unlhsh_def);
  355. }
  356. if (iface == NULL) {
  357. iface = netlbl_unlhsh_add_iface(ifindex);
  358. if (iface == NULL) {
  359. ret_val = -ENOMEM;
  360. goto unlhsh_add_return;
  361. }
  362. }
  363. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
  364. audit_info);
  365. switch (addr_len) {
  366. case sizeof(struct in_addr): {
  367. const struct in_addr *addr4 = addr;
  368. const struct in_addr *mask4 = mask;
  369. ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
  370. if (audit_buf != NULL)
  371. netlbl_af4list_audit_addr(audit_buf, 1,
  372. dev_name,
  373. addr4->s_addr,
  374. mask4->s_addr);
  375. break;
  376. }
  377. #if IS_ENABLED(CONFIG_IPV6)
  378. case sizeof(struct in6_addr): {
  379. const struct in6_addr *addr6 = addr;
  380. const struct in6_addr *mask6 = mask;
  381. ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
  382. if (audit_buf != NULL)
  383. netlbl_af6list_audit_addr(audit_buf, 1,
  384. dev_name,
  385. addr6, mask6);
  386. break;
  387. }
  388. #endif /* IPv6 */
  389. default:
  390. ret_val = -EINVAL;
  391. }
  392. if (ret_val == 0)
  393. atomic_inc(&netlabel_mgmt_protocount);
  394. unlhsh_add_return:
  395. rcu_read_unlock();
  396. if (audit_buf != NULL) {
  397. if (security_secid_to_secctx(secid,
  398. &secctx,
  399. &secctx_len) == 0) {
  400. audit_log_format(audit_buf, " sec_obj=%s", secctx);
  401. security_release_secctx(secctx, secctx_len);
  402. }
  403. audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
  404. audit_log_end(audit_buf);
  405. }
  406. return ret_val;
  407. }
  408. /**
  409. * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
  410. * @net: network namespace
  411. * @iface: interface entry
  412. * @addr: IP address
  413. * @mask: IP address mask
  414. * @audit_info: NetLabel audit information
  415. *
  416. * Description:
  417. * Remove an IP address entry from the unlabeled connection hash table.
  418. * Returns zero on success, negative values on failure.
  419. *
  420. */
  421. static int netlbl_unlhsh_remove_addr4(struct net *net,
  422. struct netlbl_unlhsh_iface *iface,
  423. const struct in_addr *addr,
  424. const struct in_addr *mask,
  425. struct netlbl_audit *audit_info)
  426. {
  427. struct netlbl_af4list *list_entry;
  428. struct netlbl_unlhsh_addr4 *entry;
  429. struct audit_buffer *audit_buf;
  430. struct net_device *dev;
  431. char *secctx;
  432. u32 secctx_len;
  433. spin_lock(&netlbl_unlhsh_lock);
  434. list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
  435. &iface->addr4_list);
  436. spin_unlock(&netlbl_unlhsh_lock);
  437. if (list_entry != NULL)
  438. entry = netlbl_unlhsh_addr4_entry(list_entry);
  439. else
  440. entry = NULL;
  441. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
  442. audit_info);
  443. if (audit_buf != NULL) {
  444. dev = dev_get_by_index(net, iface->ifindex);
  445. netlbl_af4list_audit_addr(audit_buf, 1,
  446. (dev != NULL ? dev->name : NULL),
  447. addr->s_addr, mask->s_addr);
  448. if (dev != NULL)
  449. dev_put(dev);
  450. if (entry != NULL &&
  451. security_secid_to_secctx(entry->secid,
  452. &secctx, &secctx_len) == 0) {
  453. audit_log_format(audit_buf, " sec_obj=%s", secctx);
  454. security_release_secctx(secctx, secctx_len);
  455. }
  456. audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
  457. audit_log_end(audit_buf);
  458. }
  459. if (entry == NULL)
  460. return -ENOENT;
  461. kfree_rcu(entry, rcu);
  462. return 0;
  463. }
  464. #if IS_ENABLED(CONFIG_IPV6)
  465. /**
  466. * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
  467. * @net: network namespace
  468. * @iface: interface entry
  469. * @addr: IP address
  470. * @mask: IP address mask
  471. * @audit_info: NetLabel audit information
  472. *
  473. * Description:
  474. * Remove an IP address entry from the unlabeled connection hash table.
  475. * Returns zero on success, negative values on failure.
  476. *
  477. */
  478. static int netlbl_unlhsh_remove_addr6(struct net *net,
  479. struct netlbl_unlhsh_iface *iface,
  480. const struct in6_addr *addr,
  481. const struct in6_addr *mask,
  482. struct netlbl_audit *audit_info)
  483. {
  484. struct netlbl_af6list *list_entry;
  485. struct netlbl_unlhsh_addr6 *entry;
  486. struct audit_buffer *audit_buf;
  487. struct net_device *dev;
  488. char *secctx;
  489. u32 secctx_len;
  490. spin_lock(&netlbl_unlhsh_lock);
  491. list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
  492. spin_unlock(&netlbl_unlhsh_lock);
  493. if (list_entry != NULL)
  494. entry = netlbl_unlhsh_addr6_entry(list_entry);
  495. else
  496. entry = NULL;
  497. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
  498. audit_info);
  499. if (audit_buf != NULL) {
  500. dev = dev_get_by_index(net, iface->ifindex);
  501. netlbl_af6list_audit_addr(audit_buf, 1,
  502. (dev != NULL ? dev->name : NULL),
  503. addr, mask);
  504. if (dev != NULL)
  505. dev_put(dev);
  506. if (entry != NULL &&
  507. security_secid_to_secctx(entry->secid,
  508. &secctx, &secctx_len) == 0) {
  509. audit_log_format(audit_buf, " sec_obj=%s", secctx);
  510. security_release_secctx(secctx, secctx_len);
  511. }
  512. audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
  513. audit_log_end(audit_buf);
  514. }
  515. if (entry == NULL)
  516. return -ENOENT;
  517. kfree_rcu(entry, rcu);
  518. return 0;
  519. }
  520. #endif /* IPv6 */
  521. /**
  522. * netlbl_unlhsh_condremove_iface - Remove an interface entry
  523. * @iface: the interface entry
  524. *
  525. * Description:
  526. * Remove an interface entry from the unlabeled connection hash table if it is
  527. * empty. An interface entry is considered to be empty if there are no
  528. * address entries assigned to it.
  529. *
  530. */
  531. static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
  532. {
  533. struct netlbl_af4list *iter4;
  534. #if IS_ENABLED(CONFIG_IPV6)
  535. struct netlbl_af6list *iter6;
  536. #endif /* IPv6 */
  537. spin_lock(&netlbl_unlhsh_lock);
  538. netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
  539. goto unlhsh_condremove_failure;
  540. #if IS_ENABLED(CONFIG_IPV6)
  541. netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
  542. goto unlhsh_condremove_failure;
  543. #endif /* IPv6 */
  544. iface->valid = 0;
  545. if (iface->ifindex > 0)
  546. list_del_rcu(&iface->list);
  547. else
  548. RCU_INIT_POINTER(netlbl_unlhsh_def, NULL);
  549. spin_unlock(&netlbl_unlhsh_lock);
  550. call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
  551. return;
  552. unlhsh_condremove_failure:
  553. spin_unlock(&netlbl_unlhsh_lock);
  554. }
  555. /**
  556. * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
  557. * @net: network namespace
  558. * @dev_name: interface name
  559. * @addr: IP address in network byte order
  560. * @mask: address mask in network byte order
  561. * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
  562. * @audit_info: NetLabel audit information
  563. *
  564. * Description:
  565. * Removes and existing entry from the unlabeled connection hash table.
  566. * Returns zero on success, negative values on failure.
  567. *
  568. */
  569. int netlbl_unlhsh_remove(struct net *net,
  570. const char *dev_name,
  571. const void *addr,
  572. const void *mask,
  573. u32 addr_len,
  574. struct netlbl_audit *audit_info)
  575. {
  576. int ret_val;
  577. struct net_device *dev;
  578. struct netlbl_unlhsh_iface *iface;
  579. if (addr_len != sizeof(struct in_addr) &&
  580. addr_len != sizeof(struct in6_addr))
  581. return -EINVAL;
  582. rcu_read_lock();
  583. if (dev_name != NULL) {
  584. dev = dev_get_by_name_rcu(net, dev_name);
  585. if (dev == NULL) {
  586. ret_val = -ENODEV;
  587. goto unlhsh_remove_return;
  588. }
  589. iface = netlbl_unlhsh_search_iface(dev->ifindex);
  590. } else
  591. iface = rcu_dereference(netlbl_unlhsh_def);
  592. if (iface == NULL) {
  593. ret_val = -ENOENT;
  594. goto unlhsh_remove_return;
  595. }
  596. switch (addr_len) {
  597. case sizeof(struct in_addr):
  598. ret_val = netlbl_unlhsh_remove_addr4(net,
  599. iface, addr, mask,
  600. audit_info);
  601. break;
  602. #if IS_ENABLED(CONFIG_IPV6)
  603. case sizeof(struct in6_addr):
  604. ret_val = netlbl_unlhsh_remove_addr6(net,
  605. iface, addr, mask,
  606. audit_info);
  607. break;
  608. #endif /* IPv6 */
  609. default:
  610. ret_val = -EINVAL;
  611. }
  612. if (ret_val == 0) {
  613. netlbl_unlhsh_condremove_iface(iface);
  614. atomic_dec(&netlabel_mgmt_protocount);
  615. }
  616. unlhsh_remove_return:
  617. rcu_read_unlock();
  618. return ret_val;
  619. }
  620. /*
  621. * General Helper Functions
  622. */
  623. /**
  624. * netlbl_unlhsh_netdev_handler - Network device notification handler
  625. * @this: notifier block
  626. * @event: the event
  627. * @ptr: the netdevice notifier info (cast to void)
  628. *
  629. * Description:
  630. * Handle network device events, although at present all we care about is a
  631. * network device going away. In the case of a device going away we clear any
  632. * related entries from the unlabeled connection hash table.
  633. *
  634. */
  635. static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
  636. unsigned long event, void *ptr)
  637. {
  638. struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  639. struct netlbl_unlhsh_iface *iface = NULL;
  640. if (!net_eq(dev_net(dev), &init_net))
  641. return NOTIFY_DONE;
  642. /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
  643. if (event == NETDEV_DOWN) {
  644. spin_lock(&netlbl_unlhsh_lock);
  645. iface = netlbl_unlhsh_search_iface(dev->ifindex);
  646. if (iface != NULL && iface->valid) {
  647. iface->valid = 0;
  648. list_del_rcu(&iface->list);
  649. } else
  650. iface = NULL;
  651. spin_unlock(&netlbl_unlhsh_lock);
  652. }
  653. if (iface != NULL)
  654. call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
  655. return NOTIFY_DONE;
  656. }
  657. /**
  658. * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
  659. * @value: desired value
  660. * @audit_info: NetLabel audit information
  661. *
  662. * Description:
  663. * Set the value of the unlabeled accept flag to @value.
  664. *
  665. */
  666. static void netlbl_unlabel_acceptflg_set(u8 value,
  667. struct netlbl_audit *audit_info)
  668. {
  669. struct audit_buffer *audit_buf;
  670. u8 old_val;
  671. old_val = netlabel_unlabel_acceptflg;
  672. netlabel_unlabel_acceptflg = value;
  673. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
  674. audit_info);
  675. if (audit_buf != NULL) {
  676. audit_log_format(audit_buf,
  677. " unlbl_accept=%u old=%u", value, old_val);
  678. audit_log_end(audit_buf);
  679. }
  680. }
  681. /**
  682. * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
  683. * @info: the Generic NETLINK info block
  684. * @addr: the IP address
  685. * @mask: the IP address mask
  686. * @len: the address length
  687. *
  688. * Description:
  689. * Examine the Generic NETLINK message and extract the IP address information.
  690. * Returns zero on success, negative values on failure.
  691. *
  692. */
  693. static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
  694. void **addr,
  695. void **mask,
  696. u32 *len)
  697. {
  698. u32 addr_len;
  699. if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] &&
  700. info->attrs[NLBL_UNLABEL_A_IPV4MASK]) {
  701. addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
  702. if (addr_len != sizeof(struct in_addr) &&
  703. addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
  704. return -EINVAL;
  705. *len = addr_len;
  706. *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
  707. *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
  708. return 0;
  709. } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
  710. addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
  711. if (addr_len != sizeof(struct in6_addr) &&
  712. addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
  713. return -EINVAL;
  714. *len = addr_len;
  715. *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
  716. *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
  717. return 0;
  718. }
  719. return -EINVAL;
  720. }
  721. /*
  722. * NetLabel Command Handlers
  723. */
  724. /**
  725. * netlbl_unlabel_accept - Handle an ACCEPT message
  726. * @skb: the NETLINK buffer
  727. * @info: the Generic NETLINK info block
  728. *
  729. * Description:
  730. * Process a user generated ACCEPT message and set the accept flag accordingly.
  731. * Returns zero on success, negative values on failure.
  732. *
  733. */
  734. static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
  735. {
  736. u8 value;
  737. struct netlbl_audit audit_info;
  738. if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
  739. value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
  740. if (value == 1 || value == 0) {
  741. netlbl_netlink_auditinfo(skb, &audit_info);
  742. netlbl_unlabel_acceptflg_set(value, &audit_info);
  743. return 0;
  744. }
  745. }
  746. return -EINVAL;
  747. }
  748. /**
  749. * netlbl_unlabel_list - Handle a LIST message
  750. * @skb: the NETLINK buffer
  751. * @info: the Generic NETLINK info block
  752. *
  753. * Description:
  754. * Process a user generated LIST message and respond with the current status.
  755. * Returns zero on success, negative values on failure.
  756. *
  757. */
  758. static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
  759. {
  760. int ret_val = -EINVAL;
  761. struct sk_buff *ans_skb;
  762. void *data;
  763. ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  764. if (ans_skb == NULL)
  765. goto list_failure;
  766. data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
  767. 0, NLBL_UNLABEL_C_LIST);
  768. if (data == NULL) {
  769. ret_val = -ENOMEM;
  770. goto list_failure;
  771. }
  772. ret_val = nla_put_u8(ans_skb,
  773. NLBL_UNLABEL_A_ACPTFLG,
  774. netlabel_unlabel_acceptflg);
  775. if (ret_val != 0)
  776. goto list_failure;
  777. genlmsg_end(ans_skb, data);
  778. return genlmsg_reply(ans_skb, info);
  779. list_failure:
  780. kfree_skb(ans_skb);
  781. return ret_val;
  782. }
  783. /**
  784. * netlbl_unlabel_staticadd - Handle a STATICADD message
  785. * @skb: the NETLINK buffer
  786. * @info: the Generic NETLINK info block
  787. *
  788. * Description:
  789. * Process a user generated STATICADD message and add a new unlabeled
  790. * connection entry to the hash table. Returns zero on success, negative
  791. * values on failure.
  792. *
  793. */
  794. static int netlbl_unlabel_staticadd(struct sk_buff *skb,
  795. struct genl_info *info)
  796. {
  797. int ret_val;
  798. char *dev_name;
  799. void *addr;
  800. void *mask;
  801. u32 addr_len;
  802. u32 secid;
  803. struct netlbl_audit audit_info;
  804. /* Don't allow users to add both IPv4 and IPv6 addresses for a
  805. * single entry. However, allow users to create two entries, one each
  806. * for IPv4 and IPv4, with the same LSM security context which should
  807. * achieve the same result. */
  808. if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
  809. !info->attrs[NLBL_UNLABEL_A_IFACE] ||
  810. !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  811. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  812. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  813. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  814. return -EINVAL;
  815. netlbl_netlink_auditinfo(skb, &audit_info);
  816. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  817. if (ret_val != 0)
  818. return ret_val;
  819. dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
  820. ret_val = security_secctx_to_secid(
  821. nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  822. nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  823. &secid);
  824. if (ret_val != 0)
  825. return ret_val;
  826. return netlbl_unlhsh_add(&init_net,
  827. dev_name, addr, mask, addr_len, secid,
  828. &audit_info);
  829. }
  830. /**
  831. * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
  832. * @skb: the NETLINK buffer
  833. * @info: the Generic NETLINK info block
  834. *
  835. * Description:
  836. * Process a user generated STATICADDDEF message and add a new default
  837. * unlabeled connection entry. Returns zero on success, negative values on
  838. * failure.
  839. *
  840. */
  841. static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
  842. struct genl_info *info)
  843. {
  844. int ret_val;
  845. void *addr;
  846. void *mask;
  847. u32 addr_len;
  848. u32 secid;
  849. struct netlbl_audit audit_info;
  850. /* Don't allow users to add both IPv4 and IPv6 addresses for a
  851. * single entry. However, allow users to create two entries, one each
  852. * for IPv4 and IPv6, with the same LSM security context which should
  853. * achieve the same result. */
  854. if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
  855. !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  856. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  857. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  858. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  859. return -EINVAL;
  860. netlbl_netlink_auditinfo(skb, &audit_info);
  861. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  862. if (ret_val != 0)
  863. return ret_val;
  864. ret_val = security_secctx_to_secid(
  865. nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  866. nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  867. &secid);
  868. if (ret_val != 0)
  869. return ret_val;
  870. return netlbl_unlhsh_add(&init_net,
  871. NULL, addr, mask, addr_len, secid,
  872. &audit_info);
  873. }
  874. /**
  875. * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
  876. * @skb: the NETLINK buffer
  877. * @info: the Generic NETLINK info block
  878. *
  879. * Description:
  880. * Process a user generated STATICREMOVE message and remove the specified
  881. * unlabeled connection entry. Returns zero on success, negative values on
  882. * failure.
  883. *
  884. */
  885. static int netlbl_unlabel_staticremove(struct sk_buff *skb,
  886. struct genl_info *info)
  887. {
  888. int ret_val;
  889. char *dev_name;
  890. void *addr;
  891. void *mask;
  892. u32 addr_len;
  893. struct netlbl_audit audit_info;
  894. /* See the note in netlbl_unlabel_staticadd() about not allowing both
  895. * IPv4 and IPv6 in the same entry. */
  896. if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
  897. !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  898. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  899. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  900. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  901. return -EINVAL;
  902. netlbl_netlink_auditinfo(skb, &audit_info);
  903. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  904. if (ret_val != 0)
  905. return ret_val;
  906. dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
  907. return netlbl_unlhsh_remove(&init_net,
  908. dev_name, addr, mask, addr_len,
  909. &audit_info);
  910. }
  911. /**
  912. * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
  913. * @skb: the NETLINK buffer
  914. * @info: the Generic NETLINK info block
  915. *
  916. * Description:
  917. * Process a user generated STATICREMOVEDEF message and remove the default
  918. * unlabeled connection entry. Returns zero on success, negative values on
  919. * failure.
  920. *
  921. */
  922. static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
  923. struct genl_info *info)
  924. {
  925. int ret_val;
  926. void *addr;
  927. void *mask;
  928. u32 addr_len;
  929. struct netlbl_audit audit_info;
  930. /* See the note in netlbl_unlabel_staticadd() about not allowing both
  931. * IPv4 and IPv6 in the same entry. */
  932. if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  933. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  934. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  935. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  936. return -EINVAL;
  937. netlbl_netlink_auditinfo(skb, &audit_info);
  938. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  939. if (ret_val != 0)
  940. return ret_val;
  941. return netlbl_unlhsh_remove(&init_net,
  942. NULL, addr, mask, addr_len,
  943. &audit_info);
  944. }
  945. /**
  946. * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
  947. * @cmd: command/message
  948. * @iface: the interface entry
  949. * @addr4: the IPv4 address entry
  950. * @addr6: the IPv6 address entry
  951. * @arg: the netlbl_unlhsh_walk_arg structure
  952. *
  953. * Description:
  954. * This function is designed to be used to generate a response for a
  955. * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6
  956. * can be specified, not both, the other unspecified entry should be set to
  957. * NULL by the caller. Returns the size of the message on success, negative
  958. * values on failure.
  959. *
  960. */
  961. static int netlbl_unlabel_staticlist_gen(u32 cmd,
  962. const struct netlbl_unlhsh_iface *iface,
  963. const struct netlbl_unlhsh_addr4 *addr4,
  964. const struct netlbl_unlhsh_addr6 *addr6,
  965. void *arg)
  966. {
  967. int ret_val = -ENOMEM;
  968. struct netlbl_unlhsh_walk_arg *cb_arg = arg;
  969. struct net_device *dev;
  970. void *data;
  971. u32 secid;
  972. char *secctx;
  973. u32 secctx_len;
  974. data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
  975. cb_arg->seq, &netlbl_unlabel_gnl_family,
  976. NLM_F_MULTI, cmd);
  977. if (data == NULL)
  978. goto list_cb_failure;
  979. if (iface->ifindex > 0) {
  980. dev = dev_get_by_index(&init_net, iface->ifindex);
  981. if (!dev) {
  982. ret_val = -ENODEV;
  983. goto list_cb_failure;
  984. }
  985. ret_val = nla_put_string(cb_arg->skb,
  986. NLBL_UNLABEL_A_IFACE, dev->name);
  987. dev_put(dev);
  988. if (ret_val != 0)
  989. goto list_cb_failure;
  990. }
  991. if (addr4) {
  992. struct in_addr addr_struct;
  993. addr_struct.s_addr = addr4->list.addr;
  994. ret_val = nla_put_in_addr(cb_arg->skb,
  995. NLBL_UNLABEL_A_IPV4ADDR,
  996. addr_struct.s_addr);
  997. if (ret_val != 0)
  998. goto list_cb_failure;
  999. addr_struct.s_addr = addr4->list.mask;
  1000. ret_val = nla_put_in_addr(cb_arg->skb,
  1001. NLBL_UNLABEL_A_IPV4MASK,
  1002. addr_struct.s_addr);
  1003. if (ret_val != 0)
  1004. goto list_cb_failure;
  1005. secid = addr4->secid;
  1006. } else {
  1007. ret_val = nla_put_in6_addr(cb_arg->skb,
  1008. NLBL_UNLABEL_A_IPV6ADDR,
  1009. &addr6->list.addr);
  1010. if (ret_val != 0)
  1011. goto list_cb_failure;
  1012. ret_val = nla_put_in6_addr(cb_arg->skb,
  1013. NLBL_UNLABEL_A_IPV6MASK,
  1014. &addr6->list.mask);
  1015. if (ret_val != 0)
  1016. goto list_cb_failure;
  1017. secid = addr6->secid;
  1018. }
  1019. ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
  1020. if (ret_val != 0)
  1021. goto list_cb_failure;
  1022. ret_val = nla_put(cb_arg->skb,
  1023. NLBL_UNLABEL_A_SECCTX,
  1024. secctx_len,
  1025. secctx);
  1026. security_release_secctx(secctx, secctx_len);
  1027. if (ret_val != 0)
  1028. goto list_cb_failure;
  1029. cb_arg->seq++;
  1030. genlmsg_end(cb_arg->skb, data);
  1031. return 0;
  1032. list_cb_failure:
  1033. genlmsg_cancel(cb_arg->skb, data);
  1034. return ret_val;
  1035. }
  1036. /**
  1037. * netlbl_unlabel_staticlist - Handle a STATICLIST message
  1038. * @skb: the NETLINK buffer
  1039. * @cb: the NETLINK callback
  1040. *
  1041. * Description:
  1042. * Process a user generated STATICLIST message and dump the unlabeled
  1043. * connection hash table in a form suitable for use in a kernel generated
  1044. * STATICLIST message. Returns the length of @skb.
  1045. *
  1046. */
  1047. static int netlbl_unlabel_staticlist(struct sk_buff *skb,
  1048. struct netlink_callback *cb)
  1049. {
  1050. struct netlbl_unlhsh_walk_arg cb_arg;
  1051. u32 skip_bkt = cb->args[0];
  1052. u32 skip_chain = cb->args[1];
  1053. u32 skip_addr4 = cb->args[2];
  1054. u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
  1055. struct netlbl_unlhsh_iface *iface;
  1056. struct list_head *iter_list;
  1057. struct netlbl_af4list *addr4;
  1058. #if IS_ENABLED(CONFIG_IPV6)
  1059. u32 skip_addr6 = cb->args[3];
  1060. struct netlbl_af6list *addr6;
  1061. #endif
  1062. cb_arg.nl_cb = cb;
  1063. cb_arg.skb = skb;
  1064. cb_arg.seq = cb->nlh->nlmsg_seq;
  1065. rcu_read_lock();
  1066. for (iter_bkt = skip_bkt;
  1067. iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
  1068. iter_bkt++) {
  1069. iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
  1070. list_for_each_entry_rcu(iface, iter_list, list) {
  1071. if (!iface->valid ||
  1072. iter_chain++ < skip_chain)
  1073. continue;
  1074. netlbl_af4list_foreach_rcu(addr4,
  1075. &iface->addr4_list) {
  1076. if (iter_addr4++ < skip_addr4)
  1077. continue;
  1078. if (netlbl_unlabel_staticlist_gen(
  1079. NLBL_UNLABEL_C_STATICLIST,
  1080. iface,
  1081. netlbl_unlhsh_addr4_entry(addr4),
  1082. NULL,
  1083. &cb_arg) < 0) {
  1084. iter_addr4--;
  1085. iter_chain--;
  1086. goto unlabel_staticlist_return;
  1087. }
  1088. }
  1089. iter_addr4 = 0;
  1090. skip_addr4 = 0;
  1091. #if IS_ENABLED(CONFIG_IPV6)
  1092. netlbl_af6list_foreach_rcu(addr6,
  1093. &iface->addr6_list) {
  1094. if (iter_addr6++ < skip_addr6)
  1095. continue;
  1096. if (netlbl_unlabel_staticlist_gen(
  1097. NLBL_UNLABEL_C_STATICLIST,
  1098. iface,
  1099. NULL,
  1100. netlbl_unlhsh_addr6_entry(addr6),
  1101. &cb_arg) < 0) {
  1102. iter_addr6--;
  1103. iter_chain--;
  1104. goto unlabel_staticlist_return;
  1105. }
  1106. }
  1107. iter_addr6 = 0;
  1108. skip_addr6 = 0;
  1109. #endif /* IPv6 */
  1110. }
  1111. iter_chain = 0;
  1112. skip_chain = 0;
  1113. }
  1114. unlabel_staticlist_return:
  1115. rcu_read_unlock();
  1116. cb->args[0] = iter_bkt;
  1117. cb->args[1] = iter_chain;
  1118. cb->args[2] = iter_addr4;
  1119. cb->args[3] = iter_addr6;
  1120. return skb->len;
  1121. }
  1122. /**
  1123. * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
  1124. * @skb: the NETLINK buffer
  1125. * @cb: the NETLINK callback
  1126. *
  1127. * Description:
  1128. * Process a user generated STATICLISTDEF message and dump the default
  1129. * unlabeled connection entry in a form suitable for use in a kernel generated
  1130. * STATICLISTDEF message. Returns the length of @skb.
  1131. *
  1132. */
  1133. static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
  1134. struct netlink_callback *cb)
  1135. {
  1136. struct netlbl_unlhsh_walk_arg cb_arg;
  1137. struct netlbl_unlhsh_iface *iface;
  1138. u32 iter_addr4 = 0, iter_addr6 = 0;
  1139. struct netlbl_af4list *addr4;
  1140. #if IS_ENABLED(CONFIG_IPV6)
  1141. struct netlbl_af6list *addr6;
  1142. #endif
  1143. cb_arg.nl_cb = cb;
  1144. cb_arg.skb = skb;
  1145. cb_arg.seq = cb->nlh->nlmsg_seq;
  1146. rcu_read_lock();
  1147. iface = rcu_dereference(netlbl_unlhsh_def);
  1148. if (iface == NULL || !iface->valid)
  1149. goto unlabel_staticlistdef_return;
  1150. netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
  1151. if (iter_addr4++ < cb->args[0])
  1152. continue;
  1153. if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
  1154. iface,
  1155. netlbl_unlhsh_addr4_entry(addr4),
  1156. NULL,
  1157. &cb_arg) < 0) {
  1158. iter_addr4--;
  1159. goto unlabel_staticlistdef_return;
  1160. }
  1161. }
  1162. #if IS_ENABLED(CONFIG_IPV6)
  1163. netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
  1164. if (iter_addr6++ < cb->args[1])
  1165. continue;
  1166. if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
  1167. iface,
  1168. NULL,
  1169. netlbl_unlhsh_addr6_entry(addr6),
  1170. &cb_arg) < 0) {
  1171. iter_addr6--;
  1172. goto unlabel_staticlistdef_return;
  1173. }
  1174. }
  1175. #endif /* IPv6 */
  1176. unlabel_staticlistdef_return:
  1177. rcu_read_unlock();
  1178. cb->args[0] = iter_addr4;
  1179. cb->args[1] = iter_addr6;
  1180. return skb->len;
  1181. }
  1182. /*
  1183. * NetLabel Generic NETLINK Command Definitions
  1184. */
  1185. static const struct genl_small_ops netlbl_unlabel_genl_ops[] = {
  1186. {
  1187. .cmd = NLBL_UNLABEL_C_STATICADD,
  1188. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1189. .flags = GENL_ADMIN_PERM,
  1190. .doit = netlbl_unlabel_staticadd,
  1191. .dumpit = NULL,
  1192. },
  1193. {
  1194. .cmd = NLBL_UNLABEL_C_STATICREMOVE,
  1195. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1196. .flags = GENL_ADMIN_PERM,
  1197. .doit = netlbl_unlabel_staticremove,
  1198. .dumpit = NULL,
  1199. },
  1200. {
  1201. .cmd = NLBL_UNLABEL_C_STATICLIST,
  1202. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1203. .flags = 0,
  1204. .doit = NULL,
  1205. .dumpit = netlbl_unlabel_staticlist,
  1206. },
  1207. {
  1208. .cmd = NLBL_UNLABEL_C_STATICADDDEF,
  1209. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1210. .flags = GENL_ADMIN_PERM,
  1211. .doit = netlbl_unlabel_staticadddef,
  1212. .dumpit = NULL,
  1213. },
  1214. {
  1215. .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
  1216. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1217. .flags = GENL_ADMIN_PERM,
  1218. .doit = netlbl_unlabel_staticremovedef,
  1219. .dumpit = NULL,
  1220. },
  1221. {
  1222. .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
  1223. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1224. .flags = 0,
  1225. .doit = NULL,
  1226. .dumpit = netlbl_unlabel_staticlistdef,
  1227. },
  1228. {
  1229. .cmd = NLBL_UNLABEL_C_ACCEPT,
  1230. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1231. .flags = GENL_ADMIN_PERM,
  1232. .doit = netlbl_unlabel_accept,
  1233. .dumpit = NULL,
  1234. },
  1235. {
  1236. .cmd = NLBL_UNLABEL_C_LIST,
  1237. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  1238. .flags = 0,
  1239. .doit = netlbl_unlabel_list,
  1240. .dumpit = NULL,
  1241. },
  1242. };
  1243. static struct genl_family netlbl_unlabel_gnl_family __ro_after_init = {
  1244. .hdrsize = 0,
  1245. .name = NETLBL_NLTYPE_UNLABELED_NAME,
  1246. .version = NETLBL_PROTO_VERSION,
  1247. .maxattr = NLBL_UNLABEL_A_MAX,
  1248. .policy = netlbl_unlabel_genl_policy,
  1249. .module = THIS_MODULE,
  1250. .small_ops = netlbl_unlabel_genl_ops,
  1251. .n_small_ops = ARRAY_SIZE(netlbl_unlabel_genl_ops),
  1252. };
  1253. /*
  1254. * NetLabel Generic NETLINK Protocol Functions
  1255. */
  1256. /**
  1257. * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
  1258. *
  1259. * Description:
  1260. * Register the unlabeled packet NetLabel component with the Generic NETLINK
  1261. * mechanism. Returns zero on success, negative values on failure.
  1262. *
  1263. */
  1264. int __init netlbl_unlabel_genl_init(void)
  1265. {
  1266. return genl_register_family(&netlbl_unlabel_gnl_family);
  1267. }
  1268. /*
  1269. * NetLabel KAPI Hooks
  1270. */
  1271. static struct notifier_block netlbl_unlhsh_netdev_notifier = {
  1272. .notifier_call = netlbl_unlhsh_netdev_handler,
  1273. };
  1274. /**
  1275. * netlbl_unlabel_init - Initialize the unlabeled connection hash table
  1276. * @size: the number of bits to use for the hash buckets
  1277. *
  1278. * Description:
  1279. * Initializes the unlabeled connection hash table and registers a network
  1280. * device notification handler. This function should only be called by the
  1281. * NetLabel subsystem itself during initialization. Returns zero on success,
  1282. * non-zero values on error.
  1283. *
  1284. */
  1285. int __init netlbl_unlabel_init(u32 size)
  1286. {
  1287. u32 iter;
  1288. struct netlbl_unlhsh_tbl *hsh_tbl;
  1289. if (size == 0)
  1290. return -EINVAL;
  1291. hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
  1292. if (hsh_tbl == NULL)
  1293. return -ENOMEM;
  1294. hsh_tbl->size = 1 << size;
  1295. hsh_tbl->tbl = kcalloc(hsh_tbl->size,
  1296. sizeof(struct list_head),
  1297. GFP_KERNEL);
  1298. if (hsh_tbl->tbl == NULL) {
  1299. kfree(hsh_tbl);
  1300. return -ENOMEM;
  1301. }
  1302. for (iter = 0; iter < hsh_tbl->size; iter++)
  1303. INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
  1304. spin_lock(&netlbl_unlhsh_lock);
  1305. rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
  1306. spin_unlock(&netlbl_unlhsh_lock);
  1307. register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
  1308. return 0;
  1309. }
  1310. /**
  1311. * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
  1312. * @skb: the packet
  1313. * @family: protocol family
  1314. * @secattr: the security attributes
  1315. *
  1316. * Description:
  1317. * Determine the security attributes, if any, for an unlabled packet and return
  1318. * them in @secattr. Returns zero on success and negative values on failure.
  1319. *
  1320. */
  1321. int netlbl_unlabel_getattr(const struct sk_buff *skb,
  1322. u16 family,
  1323. struct netlbl_lsm_secattr *secattr)
  1324. {
  1325. struct netlbl_unlhsh_iface *iface;
  1326. rcu_read_lock();
  1327. iface = netlbl_unlhsh_search_iface(skb->skb_iif);
  1328. if (iface == NULL)
  1329. iface = rcu_dereference(netlbl_unlhsh_def);
  1330. if (iface == NULL || !iface->valid)
  1331. goto unlabel_getattr_nolabel;
  1332. #if IS_ENABLED(CONFIG_IPV6)
  1333. /* When resolving a fallback label, check the sk_buff version as
  1334. * it is possible (e.g. SCTP) to have family = PF_INET6 while
  1335. * receiving ip_hdr(skb)->version = 4.
  1336. */
  1337. if (family == PF_INET6 && ip_hdr(skb)->version == 4)
  1338. family = PF_INET;
  1339. #endif /* IPv6 */
  1340. switch (family) {
  1341. case PF_INET: {
  1342. struct iphdr *hdr4;
  1343. struct netlbl_af4list *addr4;
  1344. hdr4 = ip_hdr(skb);
  1345. addr4 = netlbl_af4list_search(hdr4->saddr,
  1346. &iface->addr4_list);
  1347. if (addr4 == NULL)
  1348. goto unlabel_getattr_nolabel;
  1349. secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
  1350. break;
  1351. }
  1352. #if IS_ENABLED(CONFIG_IPV6)
  1353. case PF_INET6: {
  1354. struct ipv6hdr *hdr6;
  1355. struct netlbl_af6list *addr6;
  1356. hdr6 = ipv6_hdr(skb);
  1357. addr6 = netlbl_af6list_search(&hdr6->saddr,
  1358. &iface->addr6_list);
  1359. if (addr6 == NULL)
  1360. goto unlabel_getattr_nolabel;
  1361. secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
  1362. break;
  1363. }
  1364. #endif /* IPv6 */
  1365. default:
  1366. goto unlabel_getattr_nolabel;
  1367. }
  1368. rcu_read_unlock();
  1369. secattr->flags |= NETLBL_SECATTR_SECID;
  1370. secattr->type = NETLBL_NLTYPE_UNLABELED;
  1371. return 0;
  1372. unlabel_getattr_nolabel:
  1373. rcu_read_unlock();
  1374. if (netlabel_unlabel_acceptflg == 0)
  1375. return -ENOMSG;
  1376. secattr->type = NETLBL_NLTYPE_UNLABELED;
  1377. return 0;
  1378. }
  1379. /**
  1380. * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
  1381. *
  1382. * Description:
  1383. * Set the default NetLabel configuration to allow incoming unlabeled packets
  1384. * and to send unlabeled network traffic by default.
  1385. *
  1386. */
  1387. int __init netlbl_unlabel_defconf(void)
  1388. {
  1389. int ret_val;
  1390. struct netlbl_dom_map *entry;
  1391. struct netlbl_audit audit_info;
  1392. /* Only the kernel is allowed to call this function and the only time
  1393. * it is called is at bootup before the audit subsystem is reporting
  1394. * messages so don't worry to much about these values. */
  1395. security_task_getsecid(current, &audit_info.secid);
  1396. audit_info.loginuid = GLOBAL_ROOT_UID;
  1397. audit_info.sessionid = 0;
  1398. entry = kzalloc(sizeof(*entry), GFP_KERNEL);
  1399. if (entry == NULL)
  1400. return -ENOMEM;
  1401. entry->family = AF_UNSPEC;
  1402. entry->def.type = NETLBL_NLTYPE_UNLABELED;
  1403. ret_val = netlbl_domhsh_add_default(entry, &audit_info);
  1404. if (ret_val != 0)
  1405. return ret_val;
  1406. netlbl_unlabel_acceptflg_set(1, &audit_info);
  1407. return 0;
  1408. }