/net/netlabel/netlabel_kapi.c

http://github.com/mirrors/linux · C · 1517 lines · 959 code · 124 blank · 434 comment · 220 complexity · 7ff7ca405fbda5c8c584be7828f4a169 MD5 · raw file

  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NetLabel Kernel API
  4. *
  5. * This file defines the kernel API for the NetLabel system. The NetLabel
  6. * system manages static and dynamic label mappings for network protocols such
  7. * as CIPSO and RIPSO.
  8. *
  9. * Author: Paul Moore <paul@paul-moore.com>
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  13. */
  14. #include <linux/init.h>
  15. #include <linux/types.h>
  16. #include <linux/slab.h>
  17. #include <linux/audit.h>
  18. #include <linux/in.h>
  19. #include <linux/in6.h>
  20. #include <net/ip.h>
  21. #include <net/ipv6.h>
  22. #include <net/netlabel.h>
  23. #include <net/cipso_ipv4.h>
  24. #include <net/calipso.h>
  25. #include <asm/bug.h>
  26. #include <linux/atomic.h>
  27. #include "netlabel_domainhash.h"
  28. #include "netlabel_unlabeled.h"
  29. #include "netlabel_cipso_v4.h"
  30. #include "netlabel_calipso.h"
  31. #include "netlabel_user.h"
  32. #include "netlabel_mgmt.h"
  33. #include "netlabel_addrlist.h"
  34. /*
  35. * Configuration Functions
  36. */
  37. /**
  38. * netlbl_cfg_map_del - Remove a NetLabel/LSM domain mapping
  39. * @domain: the domain mapping to remove
  40. * @family: address family
  41. * @addr: IP address
  42. * @mask: IP address mask
  43. * @audit_info: NetLabel audit information
  44. *
  45. * Description:
  46. * Removes a NetLabel/LSM domain mapping. A @domain value of NULL causes the
  47. * default domain mapping to be removed. Returns zero on success, negative
  48. * values on failure.
  49. *
  50. */
  51. int netlbl_cfg_map_del(const char *domain,
  52. u16 family,
  53. const void *addr,
  54. const void *mask,
  55. struct netlbl_audit *audit_info)
  56. {
  57. if (addr == NULL && mask == NULL) {
  58. return netlbl_domhsh_remove(domain, family, audit_info);
  59. } else if (addr != NULL && mask != NULL) {
  60. switch (family) {
  61. case AF_INET:
  62. return netlbl_domhsh_remove_af4(domain, addr, mask,
  63. audit_info);
  64. #if IS_ENABLED(CONFIG_IPV6)
  65. case AF_INET6:
  66. return netlbl_domhsh_remove_af6(domain, addr, mask,
  67. audit_info);
  68. #endif /* IPv6 */
  69. default:
  70. return -EPFNOSUPPORT;
  71. }
  72. } else
  73. return -EINVAL;
  74. }
  75. /**
  76. * netlbl_cfg_unlbl_map_add - Add a new unlabeled mapping
  77. * @domain: the domain mapping to add
  78. * @family: address family
  79. * @addr: IP address
  80. * @mask: IP address mask
  81. * @audit_info: NetLabel audit information
  82. *
  83. * Description:
  84. * Adds a new unlabeled NetLabel/LSM domain mapping. A @domain value of NULL
  85. * causes a new default domain mapping to be added. Returns zero on success,
  86. * negative values on failure.
  87. *
  88. */
  89. int netlbl_cfg_unlbl_map_add(const char *domain,
  90. u16 family,
  91. const void *addr,
  92. const void *mask,
  93. struct netlbl_audit *audit_info)
  94. {
  95. int ret_val = -ENOMEM;
  96. struct netlbl_dom_map *entry;
  97. struct netlbl_domaddr_map *addrmap = NULL;
  98. struct netlbl_domaddr4_map *map4 = NULL;
  99. struct netlbl_domaddr6_map *map6 = NULL;
  100. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  101. if (entry == NULL)
  102. return -ENOMEM;
  103. if (domain != NULL) {
  104. entry->domain = kstrdup(domain, GFP_ATOMIC);
  105. if (entry->domain == NULL)
  106. goto cfg_unlbl_map_add_failure;
  107. }
  108. entry->family = family;
  109. if (addr == NULL && mask == NULL)
  110. entry->def.type = NETLBL_NLTYPE_UNLABELED;
  111. else if (addr != NULL && mask != NULL) {
  112. addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
  113. if (addrmap == NULL)
  114. goto cfg_unlbl_map_add_failure;
  115. INIT_LIST_HEAD(&addrmap->list4);
  116. INIT_LIST_HEAD(&addrmap->list6);
  117. switch (family) {
  118. case AF_INET: {
  119. const struct in_addr *addr4 = addr;
  120. const struct in_addr *mask4 = mask;
  121. map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
  122. if (map4 == NULL)
  123. goto cfg_unlbl_map_add_failure;
  124. map4->def.type = NETLBL_NLTYPE_UNLABELED;
  125. map4->list.addr = addr4->s_addr & mask4->s_addr;
  126. map4->list.mask = mask4->s_addr;
  127. map4->list.valid = 1;
  128. ret_val = netlbl_af4list_add(&map4->list,
  129. &addrmap->list4);
  130. if (ret_val != 0)
  131. goto cfg_unlbl_map_add_failure;
  132. break;
  133. }
  134. #if IS_ENABLED(CONFIG_IPV6)
  135. case AF_INET6: {
  136. const struct in6_addr *addr6 = addr;
  137. const struct in6_addr *mask6 = mask;
  138. map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
  139. if (map6 == NULL)
  140. goto cfg_unlbl_map_add_failure;
  141. map6->def.type = NETLBL_NLTYPE_UNLABELED;
  142. map6->list.addr = *addr6;
  143. map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
  144. map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
  145. map6->list.addr.s6_addr32[2] &= mask6->s6_addr32[2];
  146. map6->list.addr.s6_addr32[3] &= mask6->s6_addr32[3];
  147. map6->list.mask = *mask6;
  148. map6->list.valid = 1;
  149. ret_val = netlbl_af6list_add(&map6->list,
  150. &addrmap->list6);
  151. if (ret_val != 0)
  152. goto cfg_unlbl_map_add_failure;
  153. break;
  154. }
  155. #endif /* IPv6 */
  156. default:
  157. goto cfg_unlbl_map_add_failure;
  158. }
  159. entry->def.addrsel = addrmap;
  160. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  161. } else {
  162. ret_val = -EINVAL;
  163. goto cfg_unlbl_map_add_failure;
  164. }
  165. ret_val = netlbl_domhsh_add(entry, audit_info);
  166. if (ret_val != 0)
  167. goto cfg_unlbl_map_add_failure;
  168. return 0;
  169. cfg_unlbl_map_add_failure:
  170. kfree(entry->domain);
  171. kfree(entry);
  172. kfree(addrmap);
  173. kfree(map4);
  174. kfree(map6);
  175. return ret_val;
  176. }
  177. /**
  178. * netlbl_cfg_unlbl_static_add - Adds a new static label
  179. * @net: network namespace
  180. * @dev_name: interface name
  181. * @addr: IP address in network byte order (struct in[6]_addr)
  182. * @mask: address mask in network byte order (struct in[6]_addr)
  183. * @family: address family
  184. * @secid: LSM secid value for the entry
  185. * @audit_info: NetLabel audit information
  186. *
  187. * Description:
  188. * Adds a new NetLabel static label to be used when protocol provided labels
  189. * are not present on incoming traffic. If @dev_name is NULL then the default
  190. * interface will be used. Returns zero on success, negative values on failure.
  191. *
  192. */
  193. int netlbl_cfg_unlbl_static_add(struct net *net,
  194. const char *dev_name,
  195. const void *addr,
  196. const void *mask,
  197. u16 family,
  198. u32 secid,
  199. struct netlbl_audit *audit_info)
  200. {
  201. u32 addr_len;
  202. switch (family) {
  203. case AF_INET:
  204. addr_len = sizeof(struct in_addr);
  205. break;
  206. #if IS_ENABLED(CONFIG_IPV6)
  207. case AF_INET6:
  208. addr_len = sizeof(struct in6_addr);
  209. break;
  210. #endif /* IPv6 */
  211. default:
  212. return -EPFNOSUPPORT;
  213. }
  214. return netlbl_unlhsh_add(net,
  215. dev_name, addr, mask, addr_len,
  216. secid, audit_info);
  217. }
  218. /**
  219. * netlbl_cfg_unlbl_static_del - Removes an existing static label
  220. * @net: network namespace
  221. * @dev_name: interface name
  222. * @addr: IP address in network byte order (struct in[6]_addr)
  223. * @mask: address mask in network byte order (struct in[6]_addr)
  224. * @family: address family
  225. * @audit_info: NetLabel audit information
  226. *
  227. * Description:
  228. * Removes an existing NetLabel static label used when protocol provided labels
  229. * are not present on incoming traffic. If @dev_name is NULL then the default
  230. * interface will be used. Returns zero on success, negative values on failure.
  231. *
  232. */
  233. int netlbl_cfg_unlbl_static_del(struct net *net,
  234. const char *dev_name,
  235. const void *addr,
  236. const void *mask,
  237. u16 family,
  238. struct netlbl_audit *audit_info)
  239. {
  240. u32 addr_len;
  241. switch (family) {
  242. case AF_INET:
  243. addr_len = sizeof(struct in_addr);
  244. break;
  245. #if IS_ENABLED(CONFIG_IPV6)
  246. case AF_INET6:
  247. addr_len = sizeof(struct in6_addr);
  248. break;
  249. #endif /* IPv6 */
  250. default:
  251. return -EPFNOSUPPORT;
  252. }
  253. return netlbl_unlhsh_remove(net,
  254. dev_name, addr, mask, addr_len,
  255. audit_info);
  256. }
  257. /**
  258. * netlbl_cfg_cipsov4_add - Add a new CIPSOv4 DOI definition
  259. * @doi_def: CIPSO DOI definition
  260. * @audit_info: NetLabel audit information
  261. *
  262. * Description:
  263. * Add a new CIPSO DOI definition as defined by @doi_def. Returns zero on
  264. * success and negative values on failure.
  265. *
  266. */
  267. int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
  268. struct netlbl_audit *audit_info)
  269. {
  270. return cipso_v4_doi_add(doi_def, audit_info);
  271. }
  272. /**
  273. * netlbl_cfg_cipsov4_del - Remove an existing CIPSOv4 DOI definition
  274. * @doi: CIPSO DOI
  275. * @audit_info: NetLabel audit information
  276. *
  277. * Description:
  278. * Remove an existing CIPSO DOI definition matching @doi. Returns zero on
  279. * success and negative values on failure.
  280. *
  281. */
  282. void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info)
  283. {
  284. cipso_v4_doi_remove(doi, audit_info);
  285. }
  286. /**
  287. * netlbl_cfg_cipsov4_map_add - Add a new CIPSOv4 DOI mapping
  288. * @doi: the CIPSO DOI
  289. * @domain: the domain mapping to add
  290. * @addr: IP address
  291. * @mask: IP address mask
  292. * @audit_info: NetLabel audit information
  293. *
  294. * Description:
  295. * Add a new NetLabel/LSM domain mapping for the given CIPSO DOI to the NetLabel
  296. * subsystem. A @domain value of NULL adds a new default domain mapping.
  297. * Returns zero on success, negative values on failure.
  298. *
  299. */
  300. int netlbl_cfg_cipsov4_map_add(u32 doi,
  301. const char *domain,
  302. const struct in_addr *addr,
  303. const struct in_addr *mask,
  304. struct netlbl_audit *audit_info)
  305. {
  306. int ret_val = -ENOMEM;
  307. struct cipso_v4_doi *doi_def;
  308. struct netlbl_dom_map *entry;
  309. struct netlbl_domaddr_map *addrmap = NULL;
  310. struct netlbl_domaddr4_map *addrinfo = NULL;
  311. doi_def = cipso_v4_doi_getdef(doi);
  312. if (doi_def == NULL)
  313. return -ENOENT;
  314. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  315. if (entry == NULL)
  316. goto out_entry;
  317. entry->family = AF_INET;
  318. if (domain != NULL) {
  319. entry->domain = kstrdup(domain, GFP_ATOMIC);
  320. if (entry->domain == NULL)
  321. goto out_domain;
  322. }
  323. if (addr == NULL && mask == NULL) {
  324. entry->def.cipso = doi_def;
  325. entry->def.type = NETLBL_NLTYPE_CIPSOV4;
  326. } else if (addr != NULL && mask != NULL) {
  327. addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
  328. if (addrmap == NULL)
  329. goto out_addrmap;
  330. INIT_LIST_HEAD(&addrmap->list4);
  331. INIT_LIST_HEAD(&addrmap->list6);
  332. addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
  333. if (addrinfo == NULL)
  334. goto out_addrinfo;
  335. addrinfo->def.cipso = doi_def;
  336. addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4;
  337. addrinfo->list.addr = addr->s_addr & mask->s_addr;
  338. addrinfo->list.mask = mask->s_addr;
  339. addrinfo->list.valid = 1;
  340. ret_val = netlbl_af4list_add(&addrinfo->list, &addrmap->list4);
  341. if (ret_val != 0)
  342. goto cfg_cipsov4_map_add_failure;
  343. entry->def.addrsel = addrmap;
  344. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  345. } else {
  346. ret_val = -EINVAL;
  347. goto out_addrmap;
  348. }
  349. ret_val = netlbl_domhsh_add(entry, audit_info);
  350. if (ret_val != 0)
  351. goto cfg_cipsov4_map_add_failure;
  352. return 0;
  353. cfg_cipsov4_map_add_failure:
  354. kfree(addrinfo);
  355. out_addrinfo:
  356. kfree(addrmap);
  357. out_addrmap:
  358. kfree(entry->domain);
  359. out_domain:
  360. kfree(entry);
  361. out_entry:
  362. cipso_v4_doi_putdef(doi_def);
  363. return ret_val;
  364. }
  365. /**
  366. * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition
  367. * @doi_def: CALIPSO DOI definition
  368. * @audit_info: NetLabel audit information
  369. *
  370. * Description:
  371. * Add a new CALIPSO DOI definition as defined by @doi_def. Returns zero on
  372. * success and negative values on failure.
  373. *
  374. */
  375. int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
  376. struct netlbl_audit *audit_info)
  377. {
  378. #if IS_ENABLED(CONFIG_IPV6)
  379. return calipso_doi_add(doi_def, audit_info);
  380. #else /* IPv6 */
  381. return -ENOSYS;
  382. #endif /* IPv6 */
  383. }
  384. /**
  385. * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition
  386. * @doi: CALIPSO DOI
  387. * @audit_info: NetLabel audit information
  388. *
  389. * Description:
  390. * Remove an existing CALIPSO DOI definition matching @doi. Returns zero on
  391. * success and negative values on failure.
  392. *
  393. */
  394. void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
  395. {
  396. #if IS_ENABLED(CONFIG_IPV6)
  397. calipso_doi_remove(doi, audit_info);
  398. #endif /* IPv6 */
  399. }
  400. /**
  401. * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping
  402. * @doi: the CALIPSO DOI
  403. * @domain: the domain mapping to add
  404. * @addr: IP address
  405. * @mask: IP address mask
  406. * @audit_info: NetLabel audit information
  407. *
  408. * Description:
  409. * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the
  410. * NetLabel subsystem. A @domain value of NULL adds a new default domain
  411. * mapping. Returns zero on success, negative values on failure.
  412. *
  413. */
  414. int netlbl_cfg_calipso_map_add(u32 doi,
  415. const char *domain,
  416. const struct in6_addr *addr,
  417. const struct in6_addr *mask,
  418. struct netlbl_audit *audit_info)
  419. {
  420. #if IS_ENABLED(CONFIG_IPV6)
  421. int ret_val = -ENOMEM;
  422. struct calipso_doi *doi_def;
  423. struct netlbl_dom_map *entry;
  424. struct netlbl_domaddr_map *addrmap = NULL;
  425. struct netlbl_domaddr6_map *addrinfo = NULL;
  426. doi_def = calipso_doi_getdef(doi);
  427. if (doi_def == NULL)
  428. return -ENOENT;
  429. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  430. if (entry == NULL)
  431. goto out_entry;
  432. entry->family = AF_INET6;
  433. if (domain != NULL) {
  434. entry->domain = kstrdup(domain, GFP_ATOMIC);
  435. if (entry->domain == NULL)
  436. goto out_domain;
  437. }
  438. if (addr == NULL && mask == NULL) {
  439. entry->def.calipso = doi_def;
  440. entry->def.type = NETLBL_NLTYPE_CALIPSO;
  441. } else if (addr != NULL && mask != NULL) {
  442. addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
  443. if (addrmap == NULL)
  444. goto out_addrmap;
  445. INIT_LIST_HEAD(&addrmap->list4);
  446. INIT_LIST_HEAD(&addrmap->list6);
  447. addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
  448. if (addrinfo == NULL)
  449. goto out_addrinfo;
  450. addrinfo->def.calipso = doi_def;
  451. addrinfo->def.type = NETLBL_NLTYPE_CALIPSO;
  452. addrinfo->list.addr = *addr;
  453. addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
  454. addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
  455. addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
  456. addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
  457. addrinfo->list.mask = *mask;
  458. addrinfo->list.valid = 1;
  459. ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6);
  460. if (ret_val != 0)
  461. goto cfg_calipso_map_add_failure;
  462. entry->def.addrsel = addrmap;
  463. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  464. } else {
  465. ret_val = -EINVAL;
  466. goto out_addrmap;
  467. }
  468. ret_val = netlbl_domhsh_add(entry, audit_info);
  469. if (ret_val != 0)
  470. goto cfg_calipso_map_add_failure;
  471. return 0;
  472. cfg_calipso_map_add_failure:
  473. kfree(addrinfo);
  474. out_addrinfo:
  475. kfree(addrmap);
  476. out_addrmap:
  477. kfree(entry->domain);
  478. out_domain:
  479. kfree(entry);
  480. out_entry:
  481. calipso_doi_putdef(doi_def);
  482. return ret_val;
  483. #else /* IPv6 */
  484. return -ENOSYS;
  485. #endif /* IPv6 */
  486. }
  487. /*
  488. * Security Attribute Functions
  489. */
  490. #define _CM_F_NONE 0x00000000
  491. #define _CM_F_ALLOC 0x00000001
  492. #define _CM_F_WALK 0x00000002
  493. /**
  494. * _netlbl_catmap_getnode - Get a individual node from a catmap
  495. * @catmap: pointer to the category bitmap
  496. * @offset: the requested offset
  497. * @cm_flags: catmap flags, see _CM_F_*
  498. * @gfp_flags: memory allocation flags
  499. *
  500. * Description:
  501. * Iterate through the catmap looking for the node associated with @offset.
  502. * If the _CM_F_ALLOC flag is set in @cm_flags and there is no associated node,
  503. * one will be created and inserted into the catmap. If the _CM_F_WALK flag is
  504. * set in @cm_flags and there is no associated node, the next highest node will
  505. * be returned. Returns a pointer to the node on success, NULL on failure.
  506. *
  507. */
  508. static struct netlbl_lsm_catmap *_netlbl_catmap_getnode(
  509. struct netlbl_lsm_catmap **catmap,
  510. u32 offset,
  511. unsigned int cm_flags,
  512. gfp_t gfp_flags)
  513. {
  514. struct netlbl_lsm_catmap *iter = *catmap;
  515. struct netlbl_lsm_catmap *prev = NULL;
  516. if (iter == NULL)
  517. goto catmap_getnode_alloc;
  518. if (offset < iter->startbit)
  519. goto catmap_getnode_walk;
  520. while (iter && offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
  521. prev = iter;
  522. iter = iter->next;
  523. }
  524. if (iter == NULL || offset < iter->startbit)
  525. goto catmap_getnode_walk;
  526. return iter;
  527. catmap_getnode_walk:
  528. if (cm_flags & _CM_F_WALK)
  529. return iter;
  530. catmap_getnode_alloc:
  531. if (!(cm_flags & _CM_F_ALLOC))
  532. return NULL;
  533. iter = netlbl_catmap_alloc(gfp_flags);
  534. if (iter == NULL)
  535. return NULL;
  536. iter->startbit = offset & ~(NETLBL_CATMAP_SIZE - 1);
  537. if (prev == NULL) {
  538. iter->next = *catmap;
  539. *catmap = iter;
  540. } else {
  541. iter->next = prev->next;
  542. prev->next = iter;
  543. }
  544. return iter;
  545. }
  546. /**
  547. * netlbl_catmap_walk - Walk a LSM secattr catmap looking for a bit
  548. * @catmap: the category bitmap
  549. * @offset: the offset to start searching at, in bits
  550. *
  551. * Description:
  552. * This function walks a LSM secattr category bitmap starting at @offset and
  553. * returns the spot of the first set bit or -ENOENT if no bits are set.
  554. *
  555. */
  556. int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset)
  557. {
  558. struct netlbl_lsm_catmap *iter;
  559. u32 idx;
  560. u32 bit;
  561. NETLBL_CATMAP_MAPTYPE bitmap;
  562. iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0);
  563. if (iter == NULL)
  564. return -ENOENT;
  565. if (offset > iter->startbit) {
  566. offset -= iter->startbit;
  567. idx = offset / NETLBL_CATMAP_MAPSIZE;
  568. bit = offset % NETLBL_CATMAP_MAPSIZE;
  569. } else {
  570. idx = 0;
  571. bit = 0;
  572. }
  573. bitmap = iter->bitmap[idx] >> bit;
  574. for (;;) {
  575. if (bitmap != 0) {
  576. while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
  577. bitmap >>= 1;
  578. bit++;
  579. }
  580. return iter->startbit +
  581. (NETLBL_CATMAP_MAPSIZE * idx) + bit;
  582. }
  583. if (++idx >= NETLBL_CATMAP_MAPCNT) {
  584. if (iter->next != NULL) {
  585. iter = iter->next;
  586. idx = 0;
  587. } else
  588. return -ENOENT;
  589. }
  590. bitmap = iter->bitmap[idx];
  591. bit = 0;
  592. }
  593. return -ENOENT;
  594. }
  595. EXPORT_SYMBOL(netlbl_catmap_walk);
  596. /**
  597. * netlbl_catmap_walkrng - Find the end of a string of set bits
  598. * @catmap: the category bitmap
  599. * @offset: the offset to start searching at, in bits
  600. *
  601. * Description:
  602. * This function walks a LSM secattr category bitmap starting at @offset and
  603. * returns the spot of the first cleared bit or -ENOENT if the offset is past
  604. * the end of the bitmap.
  605. *
  606. */
  607. int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset)
  608. {
  609. struct netlbl_lsm_catmap *iter;
  610. struct netlbl_lsm_catmap *prev = NULL;
  611. u32 idx;
  612. u32 bit;
  613. NETLBL_CATMAP_MAPTYPE bitmask;
  614. NETLBL_CATMAP_MAPTYPE bitmap;
  615. iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0);
  616. if (iter == NULL)
  617. return -ENOENT;
  618. if (offset > iter->startbit) {
  619. offset -= iter->startbit;
  620. idx = offset / NETLBL_CATMAP_MAPSIZE;
  621. bit = offset % NETLBL_CATMAP_MAPSIZE;
  622. } else {
  623. idx = 0;
  624. bit = 0;
  625. }
  626. bitmask = NETLBL_CATMAP_BIT << bit;
  627. for (;;) {
  628. bitmap = iter->bitmap[idx];
  629. while (bitmask != 0 && (bitmap & bitmask) != 0) {
  630. bitmask <<= 1;
  631. bit++;
  632. }
  633. if (prev && idx == 0 && bit == 0)
  634. return prev->startbit + NETLBL_CATMAP_SIZE - 1;
  635. else if (bitmask != 0)
  636. return iter->startbit +
  637. (NETLBL_CATMAP_MAPSIZE * idx) + bit - 1;
  638. else if (++idx >= NETLBL_CATMAP_MAPCNT) {
  639. if (iter->next == NULL)
  640. return iter->startbit + NETLBL_CATMAP_SIZE - 1;
  641. prev = iter;
  642. iter = iter->next;
  643. idx = 0;
  644. }
  645. bitmask = NETLBL_CATMAP_BIT;
  646. bit = 0;
  647. }
  648. return -ENOENT;
  649. }
  650. /**
  651. * netlbl_catmap_getlong - Export an unsigned long bitmap
  652. * @catmap: pointer to the category bitmap
  653. * @offset: pointer to the requested offset
  654. * @bitmap: the exported bitmap
  655. *
  656. * Description:
  657. * Export a bitmap with an offset greater than or equal to @offset and return
  658. * it in @bitmap. The @offset must be aligned to an unsigned long and will be
  659. * updated on return if different from what was requested; if the catmap is
  660. * empty at the requested offset and beyond, the @offset is set to (u32)-1.
  661. * Returns zero on sucess, negative values on failure.
  662. *
  663. */
  664. int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
  665. u32 *offset,
  666. unsigned long *bitmap)
  667. {
  668. struct netlbl_lsm_catmap *iter;
  669. u32 off = *offset;
  670. u32 idx;
  671. /* only allow aligned offsets */
  672. if ((off & (BITS_PER_LONG - 1)) != 0)
  673. return -EINVAL;
  674. if (off < catmap->startbit) {
  675. off = catmap->startbit;
  676. *offset = off;
  677. }
  678. iter = _netlbl_catmap_getnode(&catmap, off, _CM_F_WALK, 0);
  679. if (iter == NULL) {
  680. *offset = (u32)-1;
  681. return 0;
  682. }
  683. if (off < iter->startbit) {
  684. *offset = iter->startbit;
  685. off = 0;
  686. } else
  687. off -= iter->startbit;
  688. idx = off / NETLBL_CATMAP_MAPSIZE;
  689. *bitmap = iter->bitmap[idx] >> (off % NETLBL_CATMAP_MAPSIZE);
  690. return 0;
  691. }
  692. /**
  693. * netlbl_catmap_setbit - Set a bit in a LSM secattr catmap
  694. * @catmap: pointer to the category bitmap
  695. * @bit: the bit to set
  696. * @flags: memory allocation flags
  697. *
  698. * Description:
  699. * Set the bit specified by @bit in @catmap. Returns zero on success,
  700. * negative values on failure.
  701. *
  702. */
  703. int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
  704. u32 bit,
  705. gfp_t flags)
  706. {
  707. struct netlbl_lsm_catmap *iter;
  708. u32 idx;
  709. iter = _netlbl_catmap_getnode(catmap, bit, _CM_F_ALLOC, flags);
  710. if (iter == NULL)
  711. return -ENOMEM;
  712. bit -= iter->startbit;
  713. idx = bit / NETLBL_CATMAP_MAPSIZE;
  714. iter->bitmap[idx] |= NETLBL_CATMAP_BIT << (bit % NETLBL_CATMAP_MAPSIZE);
  715. return 0;
  716. }
  717. EXPORT_SYMBOL(netlbl_catmap_setbit);
  718. /**
  719. * netlbl_catmap_setrng - Set a range of bits in a LSM secattr catmap
  720. * @catmap: pointer to the category bitmap
  721. * @start: the starting bit
  722. * @end: the last bit in the string
  723. * @flags: memory allocation flags
  724. *
  725. * Description:
  726. * Set a range of bits, starting at @start and ending with @end. Returns zero
  727. * on success, negative values on failure.
  728. *
  729. */
  730. int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap,
  731. u32 start,
  732. u32 end,
  733. gfp_t flags)
  734. {
  735. int rc = 0;
  736. u32 spot = start;
  737. while (rc == 0 && spot <= end) {
  738. if (((spot & (BITS_PER_LONG - 1)) == 0) &&
  739. ((end - spot) > BITS_PER_LONG)) {
  740. rc = netlbl_catmap_setlong(catmap,
  741. spot,
  742. (unsigned long)-1,
  743. flags);
  744. spot += BITS_PER_LONG;
  745. } else
  746. rc = netlbl_catmap_setbit(catmap, spot++, flags);
  747. }
  748. return rc;
  749. }
  750. /**
  751. * netlbl_catmap_setlong - Import an unsigned long bitmap
  752. * @catmap: pointer to the category bitmap
  753. * @offset: offset to the start of the imported bitmap
  754. * @bitmap: the bitmap to import
  755. * @flags: memory allocation flags
  756. *
  757. * Description:
  758. * Import the bitmap specified in @bitmap into @catmap, using the offset
  759. * in @offset. The offset must be aligned to an unsigned long. Returns zero
  760. * on success, negative values on failure.
  761. *
  762. */
  763. int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
  764. u32 offset,
  765. unsigned long bitmap,
  766. gfp_t flags)
  767. {
  768. struct netlbl_lsm_catmap *iter;
  769. u32 idx;
  770. /* only allow aligned offsets */
  771. if ((offset & (BITS_PER_LONG - 1)) != 0)
  772. return -EINVAL;
  773. iter = _netlbl_catmap_getnode(catmap, offset, _CM_F_ALLOC, flags);
  774. if (iter == NULL)
  775. return -ENOMEM;
  776. offset -= iter->startbit;
  777. idx = offset / NETLBL_CATMAP_MAPSIZE;
  778. iter->bitmap[idx] |= bitmap << (offset % NETLBL_CATMAP_MAPSIZE);
  779. return 0;
  780. }
  781. /* Bitmap functions
  782. */
  783. /**
  784. * netlbl_bitmap_walk - Walk a bitmap looking for a bit
  785. * @bitmap: the bitmap
  786. * @bitmap_len: length in bits
  787. * @offset: starting offset
  788. * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
  789. *
  790. * Description:
  791. * Starting at @offset, walk the bitmap from left to right until either the
  792. * desired bit is found or we reach the end. Return the bit offset, -1 if
  793. * not found, or -2 if error.
  794. */
  795. int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len,
  796. u32 offset, u8 state)
  797. {
  798. u32 bit_spot;
  799. u32 byte_offset;
  800. unsigned char bitmask;
  801. unsigned char byte;
  802. byte_offset = offset / 8;
  803. byte = bitmap[byte_offset];
  804. bit_spot = offset;
  805. bitmask = 0x80 >> (offset % 8);
  806. while (bit_spot < bitmap_len) {
  807. if ((state && (byte & bitmask) == bitmask) ||
  808. (state == 0 && (byte & bitmask) == 0))
  809. return bit_spot;
  810. if (++bit_spot >= bitmap_len)
  811. return -1;
  812. bitmask >>= 1;
  813. if (bitmask == 0) {
  814. byte = bitmap[++byte_offset];
  815. bitmask = 0x80;
  816. }
  817. }
  818. return -1;
  819. }
  820. EXPORT_SYMBOL(netlbl_bitmap_walk);
  821. /**
  822. * netlbl_bitmap_setbit - Sets a single bit in a bitmap
  823. * @bitmap: the bitmap
  824. * @bit: the bit
  825. * @state: if non-zero, set the bit (1) else clear the bit (0)
  826. *
  827. * Description:
  828. * Set a single bit in the bitmask. Returns zero on success, negative values
  829. * on error.
  830. */
  831. void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state)
  832. {
  833. u32 byte_spot;
  834. u8 bitmask;
  835. /* gcc always rounds to zero when doing integer division */
  836. byte_spot = bit / 8;
  837. bitmask = 0x80 >> (bit % 8);
  838. if (state)
  839. bitmap[byte_spot] |= bitmask;
  840. else
  841. bitmap[byte_spot] &= ~bitmask;
  842. }
  843. EXPORT_SYMBOL(netlbl_bitmap_setbit);
  844. /*
  845. * LSM Functions
  846. */
  847. /**
  848. * netlbl_enabled - Determine if the NetLabel subsystem is enabled
  849. *
  850. * Description:
  851. * The LSM can use this function to determine if it should use NetLabel
  852. * security attributes in it's enforcement mechanism. Currently, NetLabel is
  853. * considered to be enabled when it's configuration contains a valid setup for
  854. * at least one labeled protocol (i.e. NetLabel can understand incoming
  855. * labeled packets of at least one type); otherwise NetLabel is considered to
  856. * be disabled.
  857. *
  858. */
  859. int netlbl_enabled(void)
  860. {
  861. /* At some point we probably want to expose this mechanism to the user
  862. * as well so that admins can toggle NetLabel regardless of the
  863. * configuration */
  864. return (atomic_read(&netlabel_mgmt_protocount) > 0);
  865. }
  866. /**
  867. * netlbl_sock_setattr - Label a socket using the correct protocol
  868. * @sk: the socket to label
  869. * @family: protocol family
  870. * @secattr: the security attributes
  871. *
  872. * Description:
  873. * Attach the correct label to the given socket using the security attributes
  874. * specified in @secattr. This function requires exclusive access to @sk,
  875. * which means it either needs to be in the process of being created or locked.
  876. * Returns zero on success, -EDESTADDRREQ if the domain is configured to use
  877. * network address selectors (can't blindly label the socket), and negative
  878. * values on all other failures.
  879. *
  880. */
  881. int netlbl_sock_setattr(struct sock *sk,
  882. u16 family,
  883. const struct netlbl_lsm_secattr *secattr)
  884. {
  885. int ret_val;
  886. struct netlbl_dom_map *dom_entry;
  887. rcu_read_lock();
  888. dom_entry = netlbl_domhsh_getentry(secattr->domain, family);
  889. if (dom_entry == NULL) {
  890. ret_val = -ENOENT;
  891. goto socket_setattr_return;
  892. }
  893. switch (family) {
  894. case AF_INET:
  895. switch (dom_entry->def.type) {
  896. case NETLBL_NLTYPE_ADDRSELECT:
  897. ret_val = -EDESTADDRREQ;
  898. break;
  899. case NETLBL_NLTYPE_CIPSOV4:
  900. ret_val = cipso_v4_sock_setattr(sk,
  901. dom_entry->def.cipso,
  902. secattr);
  903. break;
  904. case NETLBL_NLTYPE_UNLABELED:
  905. ret_val = 0;
  906. break;
  907. default:
  908. ret_val = -ENOENT;
  909. }
  910. break;
  911. #if IS_ENABLED(CONFIG_IPV6)
  912. case AF_INET6:
  913. switch (dom_entry->def.type) {
  914. case NETLBL_NLTYPE_ADDRSELECT:
  915. ret_val = -EDESTADDRREQ;
  916. break;
  917. case NETLBL_NLTYPE_CALIPSO:
  918. ret_val = calipso_sock_setattr(sk,
  919. dom_entry->def.calipso,
  920. secattr);
  921. break;
  922. case NETLBL_NLTYPE_UNLABELED:
  923. ret_val = 0;
  924. break;
  925. default:
  926. ret_val = -ENOENT;
  927. }
  928. break;
  929. #endif /* IPv6 */
  930. default:
  931. ret_val = -EPROTONOSUPPORT;
  932. }
  933. socket_setattr_return:
  934. rcu_read_unlock();
  935. return ret_val;
  936. }
  937. /**
  938. * netlbl_sock_delattr - Delete all the NetLabel labels on a socket
  939. * @sk: the socket
  940. *
  941. * Description:
  942. * Remove all the NetLabel labeling from @sk. The caller is responsible for
  943. * ensuring that @sk is locked.
  944. *
  945. */
  946. void netlbl_sock_delattr(struct sock *sk)
  947. {
  948. switch (sk->sk_family) {
  949. case AF_INET:
  950. cipso_v4_sock_delattr(sk);
  951. break;
  952. #if IS_ENABLED(CONFIG_IPV6)
  953. case AF_INET6:
  954. calipso_sock_delattr(sk);
  955. break;
  956. #endif /* IPv6 */
  957. }
  958. }
  959. /**
  960. * netlbl_sock_getattr - Determine the security attributes of a sock
  961. * @sk: the sock
  962. * @secattr: the security attributes
  963. *
  964. * Description:
  965. * Examines the given sock to see if any NetLabel style labeling has been
  966. * applied to the sock, if so it parses the socket label and returns the
  967. * security attributes in @secattr. Returns zero on success, negative values
  968. * on failure.
  969. *
  970. */
  971. int netlbl_sock_getattr(struct sock *sk,
  972. struct netlbl_lsm_secattr *secattr)
  973. {
  974. int ret_val;
  975. switch (sk->sk_family) {
  976. case AF_INET:
  977. ret_val = cipso_v4_sock_getattr(sk, secattr);
  978. break;
  979. #if IS_ENABLED(CONFIG_IPV6)
  980. case AF_INET6:
  981. ret_val = calipso_sock_getattr(sk, secattr);
  982. break;
  983. #endif /* IPv6 */
  984. default:
  985. ret_val = -EPROTONOSUPPORT;
  986. }
  987. return ret_val;
  988. }
  989. /**
  990. * netlbl_conn_setattr - Label a connected socket using the correct protocol
  991. * @sk: the socket to label
  992. * @addr: the destination address
  993. * @secattr: the security attributes
  994. *
  995. * Description:
  996. * Attach the correct label to the given connected socket using the security
  997. * attributes specified in @secattr. The caller is responsible for ensuring
  998. * that @sk is locked. Returns zero on success, negative values on failure.
  999. *
  1000. */
  1001. int netlbl_conn_setattr(struct sock *sk,
  1002. struct sockaddr *addr,
  1003. const struct netlbl_lsm_secattr *secattr)
  1004. {
  1005. int ret_val;
  1006. struct sockaddr_in *addr4;
  1007. #if IS_ENABLED(CONFIG_IPV6)
  1008. struct sockaddr_in6 *addr6;
  1009. #endif
  1010. struct netlbl_dommap_def *entry;
  1011. rcu_read_lock();
  1012. switch (addr->sa_family) {
  1013. case AF_INET:
  1014. addr4 = (struct sockaddr_in *)addr;
  1015. entry = netlbl_domhsh_getentry_af4(secattr->domain,
  1016. addr4->sin_addr.s_addr);
  1017. if (entry == NULL) {
  1018. ret_val = -ENOENT;
  1019. goto conn_setattr_return;
  1020. }
  1021. switch (entry->type) {
  1022. case NETLBL_NLTYPE_CIPSOV4:
  1023. ret_val = cipso_v4_sock_setattr(sk,
  1024. entry->cipso, secattr);
  1025. break;
  1026. case NETLBL_NLTYPE_UNLABELED:
  1027. /* just delete the protocols we support for right now
  1028. * but we could remove other protocols if needed */
  1029. netlbl_sock_delattr(sk);
  1030. ret_val = 0;
  1031. break;
  1032. default:
  1033. ret_val = -ENOENT;
  1034. }
  1035. break;
  1036. #if IS_ENABLED(CONFIG_IPV6)
  1037. case AF_INET6:
  1038. addr6 = (struct sockaddr_in6 *)addr;
  1039. entry = netlbl_domhsh_getentry_af6(secattr->domain,
  1040. &addr6->sin6_addr);
  1041. if (entry == NULL) {
  1042. ret_val = -ENOENT;
  1043. goto conn_setattr_return;
  1044. }
  1045. switch (entry->type) {
  1046. case NETLBL_NLTYPE_CALIPSO:
  1047. ret_val = calipso_sock_setattr(sk,
  1048. entry->calipso, secattr);
  1049. break;
  1050. case NETLBL_NLTYPE_UNLABELED:
  1051. /* just delete the protocols we support for right now
  1052. * but we could remove other protocols if needed */
  1053. netlbl_sock_delattr(sk);
  1054. ret_val = 0;
  1055. break;
  1056. default:
  1057. ret_val = -ENOENT;
  1058. }
  1059. break;
  1060. #endif /* IPv6 */
  1061. default:
  1062. ret_val = -EPROTONOSUPPORT;
  1063. }
  1064. conn_setattr_return:
  1065. rcu_read_unlock();
  1066. return ret_val;
  1067. }
  1068. /**
  1069. * netlbl_req_setattr - Label a request socket using the correct protocol
  1070. * @req: the request socket to label
  1071. * @secattr: the security attributes
  1072. *
  1073. * Description:
  1074. * Attach the correct label to the given socket using the security attributes
  1075. * specified in @secattr. Returns zero on success, negative values on failure.
  1076. *
  1077. */
  1078. int netlbl_req_setattr(struct request_sock *req,
  1079. const struct netlbl_lsm_secattr *secattr)
  1080. {
  1081. int ret_val;
  1082. struct netlbl_dommap_def *entry;
  1083. struct inet_request_sock *ireq = inet_rsk(req);
  1084. rcu_read_lock();
  1085. switch (req->rsk_ops->family) {
  1086. case AF_INET:
  1087. entry = netlbl_domhsh_getentry_af4(secattr->domain,
  1088. ireq->ir_rmt_addr);
  1089. if (entry == NULL) {
  1090. ret_val = -ENOENT;
  1091. goto req_setattr_return;
  1092. }
  1093. switch (entry->type) {
  1094. case NETLBL_NLTYPE_CIPSOV4:
  1095. ret_val = cipso_v4_req_setattr(req,
  1096. entry->cipso, secattr);
  1097. break;
  1098. case NETLBL_NLTYPE_UNLABELED:
  1099. netlbl_req_delattr(req);
  1100. ret_val = 0;
  1101. break;
  1102. default:
  1103. ret_val = -ENOENT;
  1104. }
  1105. break;
  1106. #if IS_ENABLED(CONFIG_IPV6)
  1107. case AF_INET6:
  1108. entry = netlbl_domhsh_getentry_af6(secattr->domain,
  1109. &ireq->ir_v6_rmt_addr);
  1110. if (entry == NULL) {
  1111. ret_val = -ENOENT;
  1112. goto req_setattr_return;
  1113. }
  1114. switch (entry->type) {
  1115. case NETLBL_NLTYPE_CALIPSO:
  1116. ret_val = calipso_req_setattr(req,
  1117. entry->calipso, secattr);
  1118. break;
  1119. case NETLBL_NLTYPE_UNLABELED:
  1120. netlbl_req_delattr(req);
  1121. ret_val = 0;
  1122. break;
  1123. default:
  1124. ret_val = -ENOENT;
  1125. }
  1126. break;
  1127. #endif /* IPv6 */
  1128. default:
  1129. ret_val = -EPROTONOSUPPORT;
  1130. }
  1131. req_setattr_return:
  1132. rcu_read_unlock();
  1133. return ret_val;
  1134. }
  1135. /**
  1136. * netlbl_req_delattr - Delete all the NetLabel labels on a socket
  1137. * @req: the socket
  1138. *
  1139. * Description:
  1140. * Remove all the NetLabel labeling from @req.
  1141. *
  1142. */
  1143. void netlbl_req_delattr(struct request_sock *req)
  1144. {
  1145. switch (req->rsk_ops->family) {
  1146. case AF_INET:
  1147. cipso_v4_req_delattr(req);
  1148. break;
  1149. #if IS_ENABLED(CONFIG_IPV6)
  1150. case AF_INET6:
  1151. calipso_req_delattr(req);
  1152. break;
  1153. #endif /* IPv6 */
  1154. }
  1155. }
  1156. /**
  1157. * netlbl_skbuff_setattr - Label a packet using the correct protocol
  1158. * @skb: the packet
  1159. * @family: protocol family
  1160. * @secattr: the security attributes
  1161. *
  1162. * Description:
  1163. * Attach the correct label to the given packet using the security attributes
  1164. * specified in @secattr. Returns zero on success, negative values on failure.
  1165. *
  1166. */
  1167. int netlbl_skbuff_setattr(struct sk_buff *skb,
  1168. u16 family,
  1169. const struct netlbl_lsm_secattr *secattr)
  1170. {
  1171. int ret_val;
  1172. struct iphdr *hdr4;
  1173. #if IS_ENABLED(CONFIG_IPV6)
  1174. struct ipv6hdr *hdr6;
  1175. #endif
  1176. struct netlbl_dommap_def *entry;
  1177. rcu_read_lock();
  1178. switch (family) {
  1179. case AF_INET:
  1180. hdr4 = ip_hdr(skb);
  1181. entry = netlbl_domhsh_getentry_af4(secattr->domain,
  1182. hdr4->daddr);
  1183. if (entry == NULL) {
  1184. ret_val = -ENOENT;
  1185. goto skbuff_setattr_return;
  1186. }
  1187. switch (entry->type) {
  1188. case NETLBL_NLTYPE_CIPSOV4:
  1189. ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso,
  1190. secattr);
  1191. break;
  1192. case NETLBL_NLTYPE_UNLABELED:
  1193. /* just delete the protocols we support for right now
  1194. * but we could remove other protocols if needed */
  1195. ret_val = cipso_v4_skbuff_delattr(skb);
  1196. break;
  1197. default:
  1198. ret_val = -ENOENT;
  1199. }
  1200. break;
  1201. #if IS_ENABLED(CONFIG_IPV6)
  1202. case AF_INET6:
  1203. hdr6 = ipv6_hdr(skb);
  1204. entry = netlbl_domhsh_getentry_af6(secattr->domain,
  1205. &hdr6->daddr);
  1206. if (entry == NULL) {
  1207. ret_val = -ENOENT;
  1208. goto skbuff_setattr_return;
  1209. }
  1210. switch (entry->type) {
  1211. case NETLBL_NLTYPE_CALIPSO:
  1212. ret_val = calipso_skbuff_setattr(skb, entry->calipso,
  1213. secattr);
  1214. break;
  1215. case NETLBL_NLTYPE_UNLABELED:
  1216. /* just delete the protocols we support for right now
  1217. * but we could remove other protocols if needed */
  1218. ret_val = calipso_skbuff_delattr(skb);
  1219. break;
  1220. default:
  1221. ret_val = -ENOENT;
  1222. }
  1223. break;
  1224. #endif /* IPv6 */
  1225. default:
  1226. ret_val = -EPROTONOSUPPORT;
  1227. }
  1228. skbuff_setattr_return:
  1229. rcu_read_unlock();
  1230. return ret_val;
  1231. }
  1232. /**
  1233. * netlbl_skbuff_getattr - Determine the security attributes of a packet
  1234. * @skb: the packet
  1235. * @family: protocol family
  1236. * @secattr: the security attributes
  1237. *
  1238. * Description:
  1239. * Examines the given packet to see if a recognized form of packet labeling
  1240. * is present, if so it parses the packet label and returns the security
  1241. * attributes in @secattr. Returns zero on success, negative values on
  1242. * failure.
  1243. *
  1244. */
  1245. int netlbl_skbuff_getattr(const struct sk_buff *skb,
  1246. u16 family,
  1247. struct netlbl_lsm_secattr *secattr)
  1248. {
  1249. unsigned char *ptr;
  1250. switch (family) {
  1251. case AF_INET:
  1252. ptr = cipso_v4_optptr(skb);
  1253. if (ptr && cipso_v4_getattr(ptr, secattr) == 0)
  1254. return 0;
  1255. break;
  1256. #if IS_ENABLED(CONFIG_IPV6)
  1257. case AF_INET6:
  1258. ptr = calipso_optptr(skb);
  1259. if (ptr && calipso_getattr(ptr, secattr) == 0)
  1260. return 0;
  1261. break;
  1262. #endif /* IPv6 */
  1263. }
  1264. return netlbl_unlabel_getattr(skb, family, secattr);
  1265. }
  1266. /**
  1267. * netlbl_skbuff_err - Handle a LSM error on a sk_buff
  1268. * @skb: the packet
  1269. * @family: the family
  1270. * @error: the error code
  1271. * @gateway: true if host is acting as a gateway, false otherwise
  1272. *
  1273. * Description:
  1274. * Deal with a LSM problem when handling the packet in @skb, typically this is
  1275. * a permission denied problem (-EACCES). The correct action is determined
  1276. * according to the packet's labeling protocol.
  1277. *
  1278. */
  1279. void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway)
  1280. {
  1281. switch (family) {
  1282. case AF_INET:
  1283. if (cipso_v4_optptr(skb))
  1284. cipso_v4_error(skb, error, gateway);
  1285. break;
  1286. }
  1287. }
  1288. /**
  1289. * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches
  1290. *
  1291. * Description:
  1292. * For all of the NetLabel protocols that support some form of label mapping
  1293. * cache, invalidate the cache. Returns zero on success, negative values on
  1294. * error.
  1295. *
  1296. */
  1297. void netlbl_cache_invalidate(void)
  1298. {
  1299. cipso_v4_cache_invalidate();
  1300. #if IS_ENABLED(CONFIG_IPV6)
  1301. calipso_cache_invalidate();
  1302. #endif /* IPv6 */
  1303. }
  1304. /**
  1305. * netlbl_cache_add - Add an entry to a NetLabel protocol cache
  1306. * @skb: the packet
  1307. * @family: the family
  1308. * @secattr: the packet's security attributes
  1309. *
  1310. * Description:
  1311. * Add the LSM security attributes for the given packet to the underlying
  1312. * NetLabel protocol's label mapping cache. Returns zero on success, negative
  1313. * values on error.
  1314. *
  1315. */
  1316. int netlbl_cache_add(const struct sk_buff *skb, u16 family,
  1317. const struct netlbl_lsm_secattr *secattr)
  1318. {
  1319. unsigned char *ptr;
  1320. if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
  1321. return -ENOMSG;
  1322. switch (family) {
  1323. case AF_INET:
  1324. ptr = cipso_v4_optptr(skb);
  1325. if (ptr)
  1326. return cipso_v4_cache_add(ptr, secattr);
  1327. break;
  1328. #if IS_ENABLED(CONFIG_IPV6)
  1329. case AF_INET6:
  1330. ptr = calipso_optptr(skb);
  1331. if (ptr)
  1332. return calipso_cache_add(ptr, secattr);
  1333. break;
  1334. #endif /* IPv6 */
  1335. }
  1336. return -ENOMSG;
  1337. }
  1338. /*
  1339. * Protocol Engine Functions
  1340. */
  1341. /**
  1342. * netlbl_audit_start - Start an audit message
  1343. * @type: audit message type
  1344. * @audit_info: NetLabel audit information
  1345. *
  1346. * Description:
  1347. * Start an audit message using the type specified in @type and fill the audit
  1348. * message with some fields common to all NetLabel audit messages. This
  1349. * function should only be used by protocol engines, not LSMs. Returns a
  1350. * pointer to the audit buffer on success, NULL on failure.
  1351. *
  1352. */
  1353. struct audit_buffer *netlbl_audit_start(int type,
  1354. struct netlbl_audit *audit_info)
  1355. {
  1356. return netlbl_audit_start_common(type, audit_info);
  1357. }
  1358. EXPORT_SYMBOL(netlbl_audit_start);
  1359. /*
  1360. * Setup Functions
  1361. */
  1362. /**
  1363. * netlbl_init - Initialize NetLabel
  1364. *
  1365. * Description:
  1366. * Perform the required NetLabel initialization before first use.
  1367. *
  1368. */
  1369. static int __init netlbl_init(void)
  1370. {
  1371. int ret_val;
  1372. printk(KERN_INFO "NetLabel: Initializing\n");
  1373. printk(KERN_INFO "NetLabel: domain hash size = %u\n",
  1374. (1 << NETLBL_DOMHSH_BITSIZE));
  1375. printk(KERN_INFO "NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO\n");
  1376. ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
  1377. if (ret_val != 0)
  1378. goto init_failure;
  1379. ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE);
  1380. if (ret_val != 0)
  1381. goto init_failure;
  1382. ret_val = netlbl_netlink_init();
  1383. if (ret_val != 0)
  1384. goto init_failure;
  1385. ret_val = netlbl_unlabel_defconf();
  1386. if (ret_val != 0)
  1387. goto init_failure;
  1388. printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n");
  1389. return 0;
  1390. init_failure:
  1391. panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
  1392. }
  1393. subsys_initcall(netlbl_init);