]>
Commit | Line | Data |
---|---|---|
446fda4f PM |
1 | /* |
2 | * CIPSO - Commercial IP Security Option | |
3 | * | |
4 | * This is an implementation of the CIPSO 2.2 protocol as specified in | |
5 | * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in | |
6 | * FIPS-188, copies of both documents can be found in the Documentation | |
7 | * directory. While CIPSO never became a full IETF RFC standard many vendors | |
8 | * have chosen to adopt the protocol and over the years it has become a | |
9 | * de-facto standard for labeled networking. | |
10 | * | |
11 | * Author: Paul Moore <paul.moore@hp.com> | |
12 | * | |
13 | */ | |
14 | ||
15 | /* | |
16 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 | |
17 | * | |
18 | * This program is free software; you can redistribute it and/or modify | |
19 | * it under the terms of the GNU General Public License as published by | |
20 | * the Free Software Foundation; either version 2 of the License, or | |
21 | * (at your option) any later version. | |
22 | * | |
23 | * This program is distributed in the hope that it will be useful, | |
24 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
25 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See | |
26 | * the GNU General Public License for more details. | |
27 | * | |
28 | * You should have received a copy of the GNU General Public License | |
29 | * along with this program; if not, write to the Free Software | |
30 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
31 | * | |
32 | */ | |
33 | ||
34 | #include <linux/init.h> | |
35 | #include <linux/types.h> | |
36 | #include <linux/rcupdate.h> | |
37 | #include <linux/list.h> | |
38 | #include <linux/spinlock.h> | |
39 | #include <linux/string.h> | |
40 | #include <linux/jhash.h> | |
41 | #include <net/ip.h> | |
42 | #include <net/icmp.h> | |
43 | #include <net/tcp.h> | |
44 | #include <net/netlabel.h> | |
45 | #include <net/cipso_ipv4.h> | |
ffb733c6 | 46 | #include <asm/atomic.h> |
446fda4f PM |
47 | #include <asm/bug.h> |
48 | ||
49 | struct cipso_v4_domhsh_entry { | |
50 | char *domain; | |
51 | u32 valid; | |
52 | struct list_head list; | |
53 | struct rcu_head rcu; | |
54 | }; | |
55 | ||
56 | /* List of available DOI definitions */ | |
57 | /* XXX - Updates should be minimal so having a single lock for the | |
58 | * cipso_v4_doi_list and the cipso_v4_doi_list->dom_list should be | |
59 | * okay. */ | |
60 | /* XXX - This currently assumes a minimal number of different DOIs in use, | |
61 | * if in practice there are a lot of different DOIs this list should | |
62 | * probably be turned into a hash table or something similar so we | |
63 | * can do quick lookups. */ | |
8ce11e6a | 64 | static DEFINE_SPINLOCK(cipso_v4_doi_list_lock); |
446fda4f PM |
65 | static struct list_head cipso_v4_doi_list = LIST_HEAD_INIT(cipso_v4_doi_list); |
66 | ||
67 | /* Label mapping cache */ | |
68 | int cipso_v4_cache_enabled = 1; | |
69 | int cipso_v4_cache_bucketsize = 10; | |
70 | #define CIPSO_V4_CACHE_BUCKETBITS 7 | |
71 | #define CIPSO_V4_CACHE_BUCKETS (1 << CIPSO_V4_CACHE_BUCKETBITS) | |
72 | #define CIPSO_V4_CACHE_REORDERLIMIT 10 | |
73 | struct cipso_v4_map_cache_bkt { | |
74 | spinlock_t lock; | |
75 | u32 size; | |
76 | struct list_head list; | |
77 | }; | |
78 | struct cipso_v4_map_cache_entry { | |
79 | u32 hash; | |
80 | unsigned char *key; | |
81 | size_t key_len; | |
82 | ||
ffb733c6 | 83 | struct netlbl_lsm_cache *lsm_data; |
446fda4f PM |
84 | |
85 | u32 activity; | |
86 | struct list_head list; | |
87 | }; | |
88 | static struct cipso_v4_map_cache_bkt *cipso_v4_cache = NULL; | |
89 | ||
90 | /* Restricted bitmap (tag #1) flags */ | |
91 | int cipso_v4_rbm_optfmt = 0; | |
92 | int cipso_v4_rbm_strictvalid = 1; | |
93 | ||
94 | /* | |
95 | * Helper Functions | |
96 | */ | |
97 | ||
98 | /** | |
99 | * cipso_v4_bitmap_walk - Walk a bitmap looking for a bit | |
100 | * @bitmap: the bitmap | |
101 | * @bitmap_len: length in bits | |
102 | * @offset: starting offset | |
103 | * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit | |
104 | * | |
105 | * Description: | |
106 | * Starting at @offset, walk the bitmap from left to right until either the | |
107 | * desired bit is found or we reach the end. Return the bit offset, -1 if | |
108 | * not found, or -2 if error. | |
109 | */ | |
110 | static int cipso_v4_bitmap_walk(const unsigned char *bitmap, | |
111 | u32 bitmap_len, | |
112 | u32 offset, | |
113 | u8 state) | |
114 | { | |
115 | u32 bit_spot; | |
116 | u32 byte_offset; | |
117 | unsigned char bitmask; | |
118 | unsigned char byte; | |
119 | ||
120 | /* gcc always rounds to zero when doing integer division */ | |
121 | byte_offset = offset / 8; | |
122 | byte = bitmap[byte_offset]; | |
123 | bit_spot = offset; | |
124 | bitmask = 0x80 >> (offset % 8); | |
125 | ||
126 | while (bit_spot < bitmap_len) { | |
127 | if ((state && (byte & bitmask) == bitmask) || | |
128 | (state == 0 && (byte & bitmask) == 0)) | |
129 | return bit_spot; | |
130 | ||
131 | bit_spot++; | |
132 | bitmask >>= 1; | |
133 | if (bitmask == 0) { | |
134 | byte = bitmap[++byte_offset]; | |
135 | bitmask = 0x80; | |
136 | } | |
137 | } | |
138 | ||
139 | return -1; | |
140 | } | |
141 | ||
142 | /** | |
143 | * cipso_v4_bitmap_setbit - Sets a single bit in a bitmap | |
144 | * @bitmap: the bitmap | |
145 | * @bit: the bit | |
146 | * @state: if non-zero, set the bit (1) else clear the bit (0) | |
147 | * | |
148 | * Description: | |
149 | * Set a single bit in the bitmask. Returns zero on success, negative values | |
150 | * on error. | |
151 | */ | |
152 | static void cipso_v4_bitmap_setbit(unsigned char *bitmap, | |
153 | u32 bit, | |
154 | u8 state) | |
155 | { | |
156 | u32 byte_spot; | |
157 | u8 bitmask; | |
158 | ||
159 | /* gcc always rounds to zero when doing integer division */ | |
160 | byte_spot = bit / 8; | |
161 | bitmask = 0x80 >> (bit % 8); | |
162 | if (state) | |
163 | bitmap[byte_spot] |= bitmask; | |
164 | else | |
165 | bitmap[byte_spot] &= ~bitmask; | |
166 | } | |
167 | ||
168 | /** | |
169 | * cipso_v4_doi_domhsh_free - Frees a domain list entry | |
170 | * @entry: the entry's RCU field | |
171 | * | |
172 | * Description: | |
173 | * This function is designed to be used as a callback to the call_rcu() | |
174 | * function so that the memory allocated to a domain list entry can be released | |
175 | * safely. | |
176 | * | |
177 | */ | |
178 | static void cipso_v4_doi_domhsh_free(struct rcu_head *entry) | |
179 | { | |
180 | struct cipso_v4_domhsh_entry *ptr; | |
181 | ||
182 | ptr = container_of(entry, struct cipso_v4_domhsh_entry, rcu); | |
183 | kfree(ptr->domain); | |
184 | kfree(ptr); | |
185 | } | |
186 | ||
187 | /** | |
188 | * cipso_v4_cache_entry_free - Frees a cache entry | |
189 | * @entry: the entry to free | |
190 | * | |
191 | * Description: | |
ffb733c6 | 192 | * This function frees the memory associated with a cache entry including the |
193 | * LSM cache data if there are no longer any users, i.e. reference count == 0. | |
446fda4f PM |
194 | * |
195 | */ | |
196 | static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry) | |
197 | { | |
ffb733c6 | 198 | if (entry->lsm_data) |
199 | netlbl_secattr_cache_free(entry->lsm_data); | |
446fda4f PM |
200 | kfree(entry->key); |
201 | kfree(entry); | |
202 | } | |
203 | ||
204 | /** | |
205 | * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache | |
206 | * @key: the hash key | |
207 | * @key_len: the length of the key in bytes | |
208 | * | |
209 | * Description: | |
210 | * The CIPSO tag hashing function. Returns a 32-bit hash value. | |
211 | * | |
212 | */ | |
213 | static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len) | |
214 | { | |
215 | return jhash(key, key_len, 0); | |
216 | } | |
217 | ||
218 | /* | |
219 | * Label Mapping Cache Functions | |
220 | */ | |
221 | ||
222 | /** | |
223 | * cipso_v4_cache_init - Initialize the CIPSO cache | |
224 | * | |
225 | * Description: | |
226 | * Initializes the CIPSO label mapping cache, this function should be called | |
227 | * before any of the other functions defined in this file. Returns zero on | |
228 | * success, negative values on error. | |
229 | * | |
230 | */ | |
231 | static int cipso_v4_cache_init(void) | |
232 | { | |
233 | u32 iter; | |
234 | ||
235 | cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS, | |
236 | sizeof(struct cipso_v4_map_cache_bkt), | |
237 | GFP_KERNEL); | |
238 | if (cipso_v4_cache == NULL) | |
239 | return -ENOMEM; | |
240 | ||
241 | for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) { | |
242 | spin_lock_init(&cipso_v4_cache[iter].lock); | |
243 | cipso_v4_cache[iter].size = 0; | |
244 | INIT_LIST_HEAD(&cipso_v4_cache[iter].list); | |
245 | } | |
246 | ||
247 | return 0; | |
248 | } | |
249 | ||
250 | /** | |
251 | * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache | |
252 | * | |
253 | * Description: | |
254 | * Invalidates and frees any entries in the CIPSO cache. Returns zero on | |
255 | * success and negative values on failure. | |
256 | * | |
257 | */ | |
258 | void cipso_v4_cache_invalidate(void) | |
259 | { | |
260 | struct cipso_v4_map_cache_entry *entry, *tmp_entry; | |
261 | u32 iter; | |
262 | ||
263 | for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) { | |
609c92fe | 264 | spin_lock_bh(&cipso_v4_cache[iter].lock); |
446fda4f PM |
265 | list_for_each_entry_safe(entry, |
266 | tmp_entry, | |
267 | &cipso_v4_cache[iter].list, list) { | |
268 | list_del(&entry->list); | |
269 | cipso_v4_cache_entry_free(entry); | |
270 | } | |
271 | cipso_v4_cache[iter].size = 0; | |
609c92fe | 272 | spin_unlock_bh(&cipso_v4_cache[iter].lock); |
446fda4f PM |
273 | } |
274 | ||
275 | return; | |
276 | } | |
277 | ||
278 | /** | |
279 | * cipso_v4_cache_check - Check the CIPSO cache for a label mapping | |
280 | * @key: the buffer to check | |
281 | * @key_len: buffer length in bytes | |
282 | * @secattr: the security attribute struct to use | |
283 | * | |
284 | * Description: | |
285 | * This function checks the cache to see if a label mapping already exists for | |
286 | * the given key. If there is a match then the cache is adjusted and the | |
287 | * @secattr struct is populated with the correct LSM security attributes. The | |
288 | * cache is adjusted in the following manner if the entry is not already the | |
289 | * first in the cache bucket: | |
290 | * | |
291 | * 1. The cache entry's activity counter is incremented | |
292 | * 2. The previous (higher ranking) entry's activity counter is decremented | |
293 | * 3. If the difference between the two activity counters is geater than | |
294 | * CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped | |
295 | * | |
296 | * Returns zero on success, -ENOENT for a cache miss, and other negative values | |
297 | * on error. | |
298 | * | |
299 | */ | |
300 | static int cipso_v4_cache_check(const unsigned char *key, | |
301 | u32 key_len, | |
302 | struct netlbl_lsm_secattr *secattr) | |
303 | { | |
304 | u32 bkt; | |
305 | struct cipso_v4_map_cache_entry *entry; | |
306 | struct cipso_v4_map_cache_entry *prev_entry = NULL; | |
307 | u32 hash; | |
308 | ||
309 | if (!cipso_v4_cache_enabled) | |
310 | return -ENOENT; | |
311 | ||
312 | hash = cipso_v4_map_cache_hash(key, key_len); | |
313 | bkt = hash & (CIPSO_V4_CACHE_BUCKETBITS - 1); | |
609c92fe | 314 | spin_lock_bh(&cipso_v4_cache[bkt].lock); |
446fda4f PM |
315 | list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) { |
316 | if (entry->hash == hash && | |
317 | entry->key_len == key_len && | |
318 | memcmp(entry->key, key, key_len) == 0) { | |
319 | entry->activity += 1; | |
ffb733c6 | 320 | atomic_inc(&entry->lsm_data->refcount); |
321 | secattr->cache = entry->lsm_data; | |
701a90ba | 322 | secattr->flags |= NETLBL_SECATTR_CACHE; |
446fda4f | 323 | if (prev_entry == NULL) { |
609c92fe | 324 | spin_unlock_bh(&cipso_v4_cache[bkt].lock); |
446fda4f PM |
325 | return 0; |
326 | } | |
327 | ||
328 | if (prev_entry->activity > 0) | |
329 | prev_entry->activity -= 1; | |
330 | if (entry->activity > prev_entry->activity && | |
331 | entry->activity - prev_entry->activity > | |
332 | CIPSO_V4_CACHE_REORDERLIMIT) { | |
333 | __list_del(entry->list.prev, entry->list.next); | |
334 | __list_add(&entry->list, | |
335 | prev_entry->list.prev, | |
336 | &prev_entry->list); | |
337 | } | |
338 | ||
609c92fe | 339 | spin_unlock_bh(&cipso_v4_cache[bkt].lock); |
446fda4f PM |
340 | return 0; |
341 | } | |
342 | prev_entry = entry; | |
343 | } | |
609c92fe | 344 | spin_unlock_bh(&cipso_v4_cache[bkt].lock); |
446fda4f PM |
345 | |
346 | return -ENOENT; | |
347 | } | |
348 | ||
349 | /** | |
350 | * cipso_v4_cache_add - Add an entry to the CIPSO cache | |
351 | * @skb: the packet | |
352 | * @secattr: the packet's security attributes | |
353 | * | |
354 | * Description: | |
355 | * Add a new entry into the CIPSO label mapping cache. Add the new entry to | |
356 | * head of the cache bucket's list, if the cache bucket is out of room remove | |
357 | * the last entry in the list first. It is important to note that there is | |
358 | * currently no checking for duplicate keys. Returns zero on success, | |
359 | * negative values on failure. | |
360 | * | |
361 | */ | |
362 | int cipso_v4_cache_add(const struct sk_buff *skb, | |
363 | const struct netlbl_lsm_secattr *secattr) | |
364 | { | |
365 | int ret_val = -EPERM; | |
366 | u32 bkt; | |
367 | struct cipso_v4_map_cache_entry *entry = NULL; | |
368 | struct cipso_v4_map_cache_entry *old_entry = NULL; | |
369 | unsigned char *cipso_ptr; | |
370 | u32 cipso_ptr_len; | |
371 | ||
372 | if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0) | |
373 | return 0; | |
374 | ||
375 | cipso_ptr = CIPSO_V4_OPTPTR(skb); | |
376 | cipso_ptr_len = cipso_ptr[1]; | |
377 | ||
378 | entry = kzalloc(sizeof(*entry), GFP_ATOMIC); | |
379 | if (entry == NULL) | |
380 | return -ENOMEM; | |
fac5d731 | 381 | entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC); |
446fda4f PM |
382 | if (entry->key == NULL) { |
383 | ret_val = -ENOMEM; | |
384 | goto cache_add_failure; | |
385 | } | |
446fda4f PM |
386 | entry->key_len = cipso_ptr_len; |
387 | entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len); | |
ffb733c6 | 388 | atomic_inc(&secattr->cache->refcount); |
389 | entry->lsm_data = secattr->cache; | |
446fda4f PM |
390 | |
391 | bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETBITS - 1); | |
609c92fe | 392 | spin_lock_bh(&cipso_v4_cache[bkt].lock); |
446fda4f PM |
393 | if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) { |
394 | list_add(&entry->list, &cipso_v4_cache[bkt].list); | |
395 | cipso_v4_cache[bkt].size += 1; | |
396 | } else { | |
397 | old_entry = list_entry(cipso_v4_cache[bkt].list.prev, | |
398 | struct cipso_v4_map_cache_entry, list); | |
399 | list_del(&old_entry->list); | |
400 | list_add(&entry->list, &cipso_v4_cache[bkt].list); | |
401 | cipso_v4_cache_entry_free(old_entry); | |
402 | } | |
609c92fe | 403 | spin_unlock_bh(&cipso_v4_cache[bkt].lock); |
446fda4f PM |
404 | |
405 | return 0; | |
406 | ||
407 | cache_add_failure: | |
408 | if (entry) | |
409 | cipso_v4_cache_entry_free(entry); | |
410 | return ret_val; | |
411 | } | |
412 | ||
413 | /* | |
414 | * DOI List Functions | |
415 | */ | |
416 | ||
417 | /** | |
418 | * cipso_v4_doi_search - Searches for a DOI definition | |
419 | * @doi: the DOI to search for | |
420 | * | |
421 | * Description: | |
422 | * Search the DOI definition list for a DOI definition with a DOI value that | |
423 | * matches @doi. The caller is responsibile for calling rcu_read_[un]lock(). | |
424 | * Returns a pointer to the DOI definition on success and NULL on failure. | |
425 | */ | |
426 | static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi) | |
427 | { | |
428 | struct cipso_v4_doi *iter; | |
429 | ||
430 | list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list) | |
431 | if (iter->doi == doi && iter->valid) | |
432 | return iter; | |
433 | return NULL; | |
434 | } | |
435 | ||
436 | /** | |
437 | * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine | |
438 | * @doi_def: the DOI structure | |
439 | * | |
440 | * Description: | |
441 | * The caller defines a new DOI for use by the CIPSO engine and calls this | |
442 | * function to add it to the list of acceptable domains. The caller must | |
443 | * ensure that the mapping table specified in @doi_def->map meets all of the | |
444 | * requirements of the mapping type (see cipso_ipv4.h for details). Returns | |
445 | * zero on success and non-zero on failure. | |
446 | * | |
447 | */ | |
448 | int cipso_v4_doi_add(struct cipso_v4_doi *doi_def) | |
449 | { | |
6ce61a7c PM |
450 | u32 iter; |
451 | ||
446fda4f PM |
452 | if (doi_def == NULL || doi_def->doi == CIPSO_V4_DOI_UNKNOWN) |
453 | return -EINVAL; | |
6ce61a7c PM |
454 | for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) { |
455 | switch (doi_def->tags[iter]) { | |
456 | case CIPSO_V4_TAG_RBITMAP: | |
457 | break; | |
458 | case CIPSO_V4_TAG_INVALID: | |
459 | if (iter == 0) | |
460 | return -EINVAL; | |
461 | break; | |
462 | default: | |
463 | return -EINVAL; | |
464 | } | |
465 | } | |
446fda4f PM |
466 | |
467 | doi_def->valid = 1; | |
468 | INIT_RCU_HEAD(&doi_def->rcu); | |
469 | INIT_LIST_HEAD(&doi_def->dom_list); | |
470 | ||
471 | rcu_read_lock(); | |
472 | if (cipso_v4_doi_search(doi_def->doi) != NULL) | |
473 | goto doi_add_failure_rlock; | |
474 | spin_lock(&cipso_v4_doi_list_lock); | |
475 | if (cipso_v4_doi_search(doi_def->doi) != NULL) | |
476 | goto doi_add_failure_slock; | |
477 | list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list); | |
478 | spin_unlock(&cipso_v4_doi_list_lock); | |
479 | rcu_read_unlock(); | |
480 | ||
481 | return 0; | |
482 | ||
483 | doi_add_failure_slock: | |
484 | spin_unlock(&cipso_v4_doi_list_lock); | |
485 | doi_add_failure_rlock: | |
486 | rcu_read_unlock(); | |
487 | return -EEXIST; | |
488 | } | |
489 | ||
490 | /** | |
491 | * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine | |
492 | * @doi: the DOI value | |
32f50cde | 493 | * @audit_secid: the LSM secid to use in the audit message |
446fda4f PM |
494 | * @callback: the DOI cleanup/free callback |
495 | * | |
496 | * Description: | |
497 | * Removes a DOI definition from the CIPSO engine, @callback is called to | |
498 | * free any memory. The NetLabel routines will be called to release their own | |
499 | * LSM domain mappings as well as our own domain list. Returns zero on | |
500 | * success and negative values on failure. | |
501 | * | |
502 | */ | |
32f50cde | 503 | int cipso_v4_doi_remove(u32 doi, |
95d4e6be | 504 | struct netlbl_audit *audit_info, |
32f50cde | 505 | void (*callback) (struct rcu_head * head)) |
446fda4f PM |
506 | { |
507 | struct cipso_v4_doi *doi_def; | |
508 | struct cipso_v4_domhsh_entry *dom_iter; | |
509 | ||
510 | rcu_read_lock(); | |
511 | if (cipso_v4_doi_search(doi) != NULL) { | |
512 | spin_lock(&cipso_v4_doi_list_lock); | |
513 | doi_def = cipso_v4_doi_search(doi); | |
514 | if (doi_def == NULL) { | |
515 | spin_unlock(&cipso_v4_doi_list_lock); | |
516 | rcu_read_unlock(); | |
517 | return -ENOENT; | |
518 | } | |
519 | doi_def->valid = 0; | |
520 | list_del_rcu(&doi_def->list); | |
521 | spin_unlock(&cipso_v4_doi_list_lock); | |
522 | list_for_each_entry_rcu(dom_iter, &doi_def->dom_list, list) | |
523 | if (dom_iter->valid) | |
32f50cde | 524 | netlbl_domhsh_remove(dom_iter->domain, |
95d4e6be | 525 | audit_info); |
446fda4f PM |
526 | cipso_v4_cache_invalidate(); |
527 | rcu_read_unlock(); | |
528 | ||
529 | call_rcu(&doi_def->rcu, callback); | |
530 | return 0; | |
531 | } | |
532 | rcu_read_unlock(); | |
533 | ||
534 | return -ENOENT; | |
535 | } | |
536 | ||
537 | /** | |
538 | * cipso_v4_doi_getdef - Returns a pointer to a valid DOI definition | |
539 | * @doi: the DOI value | |
540 | * | |
541 | * Description: | |
542 | * Searches for a valid DOI definition and if one is found it is returned to | |
543 | * the caller. Otherwise NULL is returned. The caller must ensure that | |
544 | * rcu_read_lock() is held while accessing the returned definition. | |
545 | * | |
546 | */ | |
547 | struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi) | |
548 | { | |
549 | return cipso_v4_doi_search(doi); | |
550 | } | |
551 | ||
552 | /** | |
fcd48280 PM |
553 | * cipso_v4_doi_walk - Iterate through the DOI definitions |
554 | * @skip_cnt: skip past this number of DOI definitions, updated | |
555 | * @callback: callback for each DOI definition | |
556 | * @cb_arg: argument for the callback function | |
446fda4f PM |
557 | * |
558 | * Description: | |
fcd48280 PM |
559 | * Iterate over the DOI definition list, skipping the first @skip_cnt entries. |
560 | * For each entry call @callback, if @callback returns a negative value stop | |
561 | * 'walking' through the list and return. Updates the value in @skip_cnt upon | |
562 | * return. Returns zero on success, negative values on failure. | |
446fda4f PM |
563 | * |
564 | */ | |
fcd48280 PM |
565 | int cipso_v4_doi_walk(u32 *skip_cnt, |
566 | int (*callback) (struct cipso_v4_doi *doi_def, void *arg), | |
567 | void *cb_arg) | |
446fda4f | 568 | { |
fcd48280 | 569 | int ret_val = -ENOENT; |
446fda4f | 570 | u32 doi_cnt = 0; |
fcd48280 | 571 | struct cipso_v4_doi *iter_doi; |
446fda4f | 572 | |
446fda4f | 573 | rcu_read_lock(); |
fcd48280 PM |
574 | list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list) |
575 | if (iter_doi->valid) { | |
576 | if (doi_cnt++ < *skip_cnt) | |
577 | continue; | |
578 | ret_val = callback(iter_doi, cb_arg); | |
579 | if (ret_val < 0) { | |
580 | doi_cnt--; | |
581 | goto doi_walk_return; | |
446fda4f | 582 | } |
446fda4f | 583 | } |
446fda4f | 584 | |
fcd48280 | 585 | doi_walk_return: |
446fda4f | 586 | rcu_read_unlock(); |
fcd48280 PM |
587 | *skip_cnt = doi_cnt; |
588 | return ret_val; | |
446fda4f PM |
589 | } |
590 | ||
591 | /** | |
592 | * cipso_v4_doi_domhsh_add - Adds a domain entry to a DOI definition | |
593 | * @doi_def: the DOI definition | |
594 | * @domain: the domain to add | |
595 | * | |
596 | * Description: | |
597 | * Adds the @domain to the the DOI specified by @doi_def, this function | |
598 | * should only be called by external functions (i.e. NetLabel). This function | |
599 | * does allocate memory. Returns zero on success, negative values on failure. | |
600 | * | |
601 | */ | |
602 | int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def, const char *domain) | |
603 | { | |
604 | struct cipso_v4_domhsh_entry *iter; | |
605 | struct cipso_v4_domhsh_entry *new_dom; | |
606 | ||
607 | new_dom = kzalloc(sizeof(*new_dom), GFP_KERNEL); | |
608 | if (new_dom == NULL) | |
609 | return -ENOMEM; | |
610 | if (domain) { | |
611 | new_dom->domain = kstrdup(domain, GFP_KERNEL); | |
612 | if (new_dom->domain == NULL) { | |
613 | kfree(new_dom); | |
614 | return -ENOMEM; | |
615 | } | |
616 | } | |
617 | new_dom->valid = 1; | |
618 | INIT_RCU_HEAD(&new_dom->rcu); | |
619 | ||
620 | rcu_read_lock(); | |
621 | spin_lock(&cipso_v4_doi_list_lock); | |
622 | list_for_each_entry_rcu(iter, &doi_def->dom_list, list) | |
623 | if (iter->valid && | |
624 | ((domain != NULL && iter->domain != NULL && | |
625 | strcmp(iter->domain, domain) == 0) || | |
626 | (domain == NULL && iter->domain == NULL))) { | |
627 | spin_unlock(&cipso_v4_doi_list_lock); | |
628 | rcu_read_unlock(); | |
629 | kfree(new_dom->domain); | |
630 | kfree(new_dom); | |
631 | return -EEXIST; | |
632 | } | |
633 | list_add_tail_rcu(&new_dom->list, &doi_def->dom_list); | |
634 | spin_unlock(&cipso_v4_doi_list_lock); | |
635 | rcu_read_unlock(); | |
636 | ||
637 | return 0; | |
638 | } | |
639 | ||
640 | /** | |
641 | * cipso_v4_doi_domhsh_remove - Removes a domain entry from a DOI definition | |
642 | * @doi_def: the DOI definition | |
643 | * @domain: the domain to remove | |
644 | * | |
645 | * Description: | |
646 | * Removes the @domain from the DOI specified by @doi_def, this function | |
647 | * should only be called by external functions (i.e. NetLabel). Returns zero | |
648 | * on success and negative values on error. | |
649 | * | |
650 | */ | |
651 | int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def, | |
652 | const char *domain) | |
653 | { | |
654 | struct cipso_v4_domhsh_entry *iter; | |
655 | ||
656 | rcu_read_lock(); | |
657 | spin_lock(&cipso_v4_doi_list_lock); | |
658 | list_for_each_entry_rcu(iter, &doi_def->dom_list, list) | |
659 | if (iter->valid && | |
660 | ((domain != NULL && iter->domain != NULL && | |
661 | strcmp(iter->domain, domain) == 0) || | |
662 | (domain == NULL && iter->domain == NULL))) { | |
663 | iter->valid = 0; | |
664 | list_del_rcu(&iter->list); | |
665 | spin_unlock(&cipso_v4_doi_list_lock); | |
666 | rcu_read_unlock(); | |
667 | call_rcu(&iter->rcu, cipso_v4_doi_domhsh_free); | |
668 | ||
669 | return 0; | |
670 | } | |
671 | spin_unlock(&cipso_v4_doi_list_lock); | |
672 | rcu_read_unlock(); | |
673 | ||
674 | return -ENOENT; | |
675 | } | |
676 | ||
677 | /* | |
678 | * Label Mapping Functions | |
679 | */ | |
680 | ||
681 | /** | |
682 | * cipso_v4_map_lvl_valid - Checks to see if the given level is understood | |
683 | * @doi_def: the DOI definition | |
684 | * @level: the level to check | |
685 | * | |
686 | * Description: | |
687 | * Checks the given level against the given DOI definition and returns a | |
688 | * negative value if the level does not have a valid mapping and a zero value | |
689 | * if the level is defined by the DOI. | |
690 | * | |
691 | */ | |
692 | static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level) | |
693 | { | |
694 | switch (doi_def->type) { | |
695 | case CIPSO_V4_MAP_PASS: | |
696 | return 0; | |
697 | case CIPSO_V4_MAP_STD: | |
698 | if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL) | |
699 | return 0; | |
700 | break; | |
701 | } | |
702 | ||
703 | return -EFAULT; | |
704 | } | |
705 | ||
706 | /** | |
707 | * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network | |
708 | * @doi_def: the DOI definition | |
709 | * @host_lvl: the host MLS level | |
710 | * @net_lvl: the network/CIPSO MLS level | |
711 | * | |
712 | * Description: | |
713 | * Perform a label mapping to translate a local MLS level to the correct | |
714 | * CIPSO level using the given DOI definition. Returns zero on success, | |
715 | * negative values otherwise. | |
716 | * | |
717 | */ | |
718 | static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def, | |
719 | u32 host_lvl, | |
720 | u32 *net_lvl) | |
721 | { | |
722 | switch (doi_def->type) { | |
723 | case CIPSO_V4_MAP_PASS: | |
724 | *net_lvl = host_lvl; | |
725 | return 0; | |
726 | case CIPSO_V4_MAP_STD: | |
727 | if (host_lvl < doi_def->map.std->lvl.local_size) { | |
728 | *net_lvl = doi_def->map.std->lvl.local[host_lvl]; | |
729 | return 0; | |
730 | } | |
731 | break; | |
732 | } | |
733 | ||
734 | return -EINVAL; | |
735 | } | |
736 | ||
737 | /** | |
738 | * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host | |
739 | * @doi_def: the DOI definition | |
740 | * @net_lvl: the network/CIPSO MLS level | |
741 | * @host_lvl: the host MLS level | |
742 | * | |
743 | * Description: | |
744 | * Perform a label mapping to translate a CIPSO level to the correct local MLS | |
745 | * level using the given DOI definition. Returns zero on success, negative | |
746 | * values otherwise. | |
747 | * | |
748 | */ | |
749 | static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def, | |
750 | u32 net_lvl, | |
751 | u32 *host_lvl) | |
752 | { | |
753 | struct cipso_v4_std_map_tbl *map_tbl; | |
754 | ||
755 | switch (doi_def->type) { | |
756 | case CIPSO_V4_MAP_PASS: | |
757 | *host_lvl = net_lvl; | |
758 | return 0; | |
759 | case CIPSO_V4_MAP_STD: | |
760 | map_tbl = doi_def->map.std; | |
761 | if (net_lvl < map_tbl->lvl.cipso_size && | |
762 | map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) { | |
763 | *host_lvl = doi_def->map.std->lvl.cipso[net_lvl]; | |
764 | return 0; | |
765 | } | |
766 | break; | |
767 | } | |
768 | ||
769 | return -EINVAL; | |
770 | } | |
771 | ||
772 | /** | |
773 | * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid | |
774 | * @doi_def: the DOI definition | |
775 | * @bitmap: category bitmap | |
776 | * @bitmap_len: bitmap length in bytes | |
777 | * | |
778 | * Description: | |
779 | * Checks the given category bitmap against the given DOI definition and | |
780 | * returns a negative value if any of the categories in the bitmap do not have | |
781 | * a valid mapping and a zero value if all of the categories are valid. | |
782 | * | |
783 | */ | |
784 | static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def, | |
785 | const unsigned char *bitmap, | |
786 | u32 bitmap_len) | |
787 | { | |
788 | int cat = -1; | |
789 | u32 bitmap_len_bits = bitmap_len * 8; | |
044a68ed PM |
790 | u32 cipso_cat_size; |
791 | u32 *cipso_array; | |
446fda4f PM |
792 | |
793 | switch (doi_def->type) { | |
794 | case CIPSO_V4_MAP_PASS: | |
795 | return 0; | |
796 | case CIPSO_V4_MAP_STD: | |
044a68ed PM |
797 | cipso_cat_size = doi_def->map.std->cat.cipso_size; |
798 | cipso_array = doi_def->map.std->cat.cipso; | |
446fda4f PM |
799 | for (;;) { |
800 | cat = cipso_v4_bitmap_walk(bitmap, | |
801 | bitmap_len_bits, | |
802 | cat + 1, | |
803 | 1); | |
804 | if (cat < 0) | |
805 | break; | |
806 | if (cat >= cipso_cat_size || | |
807 | cipso_array[cat] >= CIPSO_V4_INV_CAT) | |
808 | return -EFAULT; | |
809 | } | |
810 | ||
811 | if (cat == -1) | |
812 | return 0; | |
813 | break; | |
814 | } | |
815 | ||
816 | return -EFAULT; | |
817 | } | |
818 | ||
819 | /** | |
820 | * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network | |
821 | * @doi_def: the DOI definition | |
822 | * @host_cat: the category bitmap in host format | |
823 | * @host_cat_len: the length of the host's category bitmap in bytes | |
824 | * @net_cat: the zero'd out category bitmap in network/CIPSO format | |
825 | * @net_cat_len: the length of the CIPSO bitmap in bytes | |
826 | * | |
827 | * Description: | |
828 | * Perform a label mapping to translate a local MLS category bitmap to the | |
829 | * correct CIPSO bitmap using the given DOI definition. Returns the minimum | |
830 | * size in bytes of the network bitmap on success, negative values otherwise. | |
831 | * | |
832 | */ | |
833 | static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def, | |
834 | const unsigned char *host_cat, | |
835 | u32 host_cat_len, | |
836 | unsigned char *net_cat, | |
837 | u32 net_cat_len) | |
838 | { | |
839 | int host_spot = -1; | |
840 | u32 net_spot; | |
841 | u32 net_spot_max = 0; | |
842 | u32 host_clen_bits = host_cat_len * 8; | |
843 | u32 net_clen_bits = net_cat_len * 8; | |
044a68ed PM |
844 | u32 host_cat_size; |
845 | u32 *host_cat_array; | |
446fda4f PM |
846 | |
847 | switch (doi_def->type) { | |
848 | case CIPSO_V4_MAP_PASS: | |
ea614d7f PM |
849 | net_spot_max = host_cat_len; |
850 | while (net_spot_max > 0 && host_cat[net_spot_max - 1] == 0) | |
446fda4f PM |
851 | net_spot_max--; |
852 | if (net_spot_max > net_cat_len) | |
853 | return -EINVAL; | |
854 | memcpy(net_cat, host_cat, net_spot_max); | |
855 | return net_spot_max; | |
856 | case CIPSO_V4_MAP_STD: | |
044a68ed PM |
857 | host_cat_size = doi_def->map.std->cat.local_size; |
858 | host_cat_array = doi_def->map.std->cat.local; | |
446fda4f PM |
859 | for (;;) { |
860 | host_spot = cipso_v4_bitmap_walk(host_cat, | |
861 | host_clen_bits, | |
862 | host_spot + 1, | |
863 | 1); | |
864 | if (host_spot < 0) | |
865 | break; | |
866 | if (host_spot >= host_cat_size) | |
867 | return -EPERM; | |
868 | ||
869 | net_spot = host_cat_array[host_spot]; | |
9fade4bf PM |
870 | if (net_spot >= CIPSO_V4_INV_CAT) |
871 | return -EPERM; | |
446fda4f PM |
872 | if (net_spot >= net_clen_bits) |
873 | return -ENOSPC; | |
874 | cipso_v4_bitmap_setbit(net_cat, net_spot, 1); | |
875 | ||
876 | if (net_spot > net_spot_max) | |
877 | net_spot_max = net_spot; | |
878 | } | |
879 | ||
880 | if (host_spot == -2) | |
881 | return -EFAULT; | |
882 | ||
883 | if (++net_spot_max % 8) | |
884 | return net_spot_max / 8 + 1; | |
885 | return net_spot_max / 8; | |
886 | } | |
887 | ||
888 | return -EINVAL; | |
889 | } | |
890 | ||
891 | /** | |
892 | * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host | |
893 | * @doi_def: the DOI definition | |
894 | * @net_cat: the category bitmap in network/CIPSO format | |
895 | * @net_cat_len: the length of the CIPSO bitmap in bytes | |
896 | * @host_cat: the zero'd out category bitmap in host format | |
897 | * @host_cat_len: the length of the host's category bitmap in bytes | |
898 | * | |
899 | * Description: | |
900 | * Perform a label mapping to translate a CIPSO bitmap to the correct local | |
901 | * MLS category bitmap using the given DOI definition. Returns the minimum | |
902 | * size in bytes of the host bitmap on success, negative values otherwise. | |
903 | * | |
904 | */ | |
905 | static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def, | |
906 | const unsigned char *net_cat, | |
907 | u32 net_cat_len, | |
908 | unsigned char *host_cat, | |
909 | u32 host_cat_len) | |
910 | { | |
911 | u32 host_spot; | |
912 | u32 host_spot_max = 0; | |
913 | int net_spot = -1; | |
914 | u32 net_clen_bits = net_cat_len * 8; | |
915 | u32 host_clen_bits = host_cat_len * 8; | |
044a68ed PM |
916 | u32 net_cat_size; |
917 | u32 *net_cat_array; | |
446fda4f PM |
918 | |
919 | switch (doi_def->type) { | |
920 | case CIPSO_V4_MAP_PASS: | |
921 | if (net_cat_len > host_cat_len) | |
922 | return -EINVAL; | |
923 | memcpy(host_cat, net_cat, net_cat_len); | |
924 | return net_cat_len; | |
925 | case CIPSO_V4_MAP_STD: | |
044a68ed PM |
926 | net_cat_size = doi_def->map.std->cat.cipso_size; |
927 | net_cat_array = doi_def->map.std->cat.cipso; | |
446fda4f PM |
928 | for (;;) { |
929 | net_spot = cipso_v4_bitmap_walk(net_cat, | |
930 | net_clen_bits, | |
931 | net_spot + 1, | |
932 | 1); | |
933 | if (net_spot < 0) | |
934 | break; | |
935 | if (net_spot >= net_cat_size || | |
936 | net_cat_array[net_spot] >= CIPSO_V4_INV_CAT) | |
937 | return -EPERM; | |
938 | ||
939 | host_spot = net_cat_array[net_spot]; | |
9fade4bf PM |
940 | if (host_spot >= CIPSO_V4_INV_CAT) |
941 | return -EPERM; | |
446fda4f PM |
942 | if (host_spot >= host_clen_bits) |
943 | return -ENOSPC; | |
944 | cipso_v4_bitmap_setbit(host_cat, host_spot, 1); | |
945 | ||
946 | if (host_spot > host_spot_max) | |
947 | host_spot_max = host_spot; | |
948 | } | |
949 | ||
950 | if (net_spot == -2) | |
951 | return -EFAULT; | |
952 | ||
953 | if (++host_spot_max % 8) | |
954 | return host_spot_max / 8 + 1; | |
955 | return host_spot_max / 8; | |
956 | } | |
957 | ||
958 | return -EINVAL; | |
959 | } | |
960 | ||
961 | /* | |
962 | * Protocol Handling Functions | |
963 | */ | |
964 | ||
91b1ed0a | 965 | #define CIPSO_V4_OPT_LEN_MAX 40 |
446fda4f PM |
966 | #define CIPSO_V4_HDR_LEN 6 |
967 | ||
968 | /** | |
969 | * cipso_v4_gentag_hdr - Generate a CIPSO option header | |
970 | * @doi_def: the DOI definition | |
91b1ed0a | 971 | * @len: the total tag length in bytes, not including this header |
446fda4f PM |
972 | * @buf: the CIPSO option buffer |
973 | * | |
974 | * Description: | |
91b1ed0a | 975 | * Write a CIPSO header into the beginning of @buffer. |
446fda4f PM |
976 | * |
977 | */ | |
91b1ed0a PM |
978 | static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def, |
979 | unsigned char *buf, | |
980 | u32 len) | |
446fda4f | 981 | { |
446fda4f PM |
982 | buf[0] = IPOPT_CIPSO; |
983 | buf[1] = CIPSO_V4_HDR_LEN + len; | |
714e85be | 984 | *(__be32 *)&buf[2] = htonl(doi_def->doi); |
446fda4f PM |
985 | } |
986 | ||
446fda4f PM |
987 | /** |
988 | * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1) | |
989 | * @doi_def: the DOI definition | |
990 | * @secattr: the security attributes | |
991 | * @buffer: the option buffer | |
992 | * @buffer_len: length of buffer in bytes | |
993 | * | |
994 | * Description: | |
995 | * Generate a CIPSO option using the restricted bitmap tag, tag type #1. The | |
996 | * actual buffer length may be larger than the indicated size due to | |
91b1ed0a PM |
997 | * translation between host and network category bitmaps. Returns the size of |
998 | * the tag on success, negative values on failure. | |
446fda4f PM |
999 | * |
1000 | */ | |
1001 | static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def, | |
1002 | const struct netlbl_lsm_secattr *secattr, | |
91b1ed0a PM |
1003 | unsigned char *buffer, |
1004 | u32 buffer_len) | |
446fda4f | 1005 | { |
701a90ba | 1006 | int ret_val; |
91b1ed0a | 1007 | u32 tag_len; |
446fda4f PM |
1008 | u32 level; |
1009 | ||
701a90ba PM |
1010 | if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0) |
1011 | return -EPERM; | |
1012 | ||
91b1ed0a PM |
1013 | ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level); |
1014 | if (ret_val != 0) | |
1015 | return ret_val; | |
446fda4f | 1016 | |
91b1ed0a | 1017 | if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { |
446fda4f PM |
1018 | ret_val = cipso_v4_map_cat_rbm_hton(doi_def, |
1019 | secattr->mls_cat, | |
1020 | secattr->mls_cat_len, | |
91b1ed0a PM |
1021 | &buffer[4], |
1022 | buffer_len - 4); | |
446fda4f | 1023 | if (ret_val < 0) |
91b1ed0a | 1024 | return ret_val; |
446fda4f PM |
1025 | |
1026 | /* This will send packets using the "optimized" format when | |
1027 | * possibile as specified in section 3.4.2.6 of the | |
1028 | * CIPSO draft. */ | |
701a90ba | 1029 | if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10) |
91b1ed0a | 1030 | tag_len = 14; |
701a90ba | 1031 | else |
91b1ed0a PM |
1032 | tag_len = 4 + ret_val; |
1033 | } else | |
1034 | tag_len = 4; | |
446fda4f | 1035 | |
91b1ed0a PM |
1036 | buffer[0] = 0x01; |
1037 | buffer[1] = tag_len; | |
1038 | buffer[3] = level; | |
446fda4f | 1039 | |
91b1ed0a | 1040 | return tag_len; |
446fda4f PM |
1041 | } |
1042 | ||
1043 | /** | |
1044 | * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag | |
1045 | * @doi_def: the DOI definition | |
1046 | * @tag: the CIPSO tag | |
1047 | * @secattr: the security attributes | |
1048 | * | |
1049 | * Description: | |
1050 | * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security | |
1051 | * attributes in @secattr. Return zero on success, negatives values on | |
1052 | * failure. | |
1053 | * | |
1054 | */ | |
1055 | static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def, | |
1056 | const unsigned char *tag, | |
1057 | struct netlbl_lsm_secattr *secattr) | |
1058 | { | |
1059 | int ret_val; | |
1060 | u8 tag_len = tag[1]; | |
1061 | u32 level; | |
1062 | ||
1063 | ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level); | |
1064 | if (ret_val != 0) | |
1065 | return ret_val; | |
1066 | secattr->mls_lvl = level; | |
701a90ba | 1067 | secattr->flags |= NETLBL_SECATTR_MLS_LVL; |
446fda4f PM |
1068 | |
1069 | if (tag_len > 4) { | |
1070 | switch (doi_def->type) { | |
1071 | case CIPSO_V4_MAP_PASS: | |
1072 | secattr->mls_cat_len = tag_len - 4; | |
1073 | break; | |
1074 | case CIPSO_V4_MAP_STD: | |
1075 | secattr->mls_cat_len = | |
1076 | doi_def->map.std->cat.local_size; | |
1077 | break; | |
1078 | } | |
1079 | secattr->mls_cat = kzalloc(secattr->mls_cat_len, GFP_ATOMIC); | |
1080 | if (secattr->mls_cat == NULL) | |
1081 | return -ENOMEM; | |
1082 | ||
1083 | ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def, | |
1084 | &tag[4], | |
1085 | tag_len - 4, | |
1086 | secattr->mls_cat, | |
1087 | secattr->mls_cat_len); | |
1088 | if (ret_val < 0) { | |
1089 | kfree(secattr->mls_cat); | |
1090 | return ret_val; | |
701a90ba PM |
1091 | } else if (ret_val > 0) { |
1092 | secattr->mls_cat_len = ret_val; | |
1093 | secattr->flags |= NETLBL_SECATTR_MLS_CAT; | |
446fda4f | 1094 | } |
446fda4f PM |
1095 | } |
1096 | ||
1097 | return 0; | |
1098 | } | |
1099 | ||
1100 | /** | |
1101 | * cipso_v4_validate - Validate a CIPSO option | |
1102 | * @option: the start of the option, on error it is set to point to the error | |
1103 | * | |
1104 | * Description: | |
1105 | * This routine is called to validate a CIPSO option, it checks all of the | |
1106 | * fields to ensure that they are at least valid, see the draft snippet below | |
1107 | * for details. If the option is valid then a zero value is returned and | |
1108 | * the value of @option is unchanged. If the option is invalid then a | |
1109 | * non-zero value is returned and @option is adjusted to point to the | |
1110 | * offending portion of the option. From the IETF draft ... | |
1111 | * | |
1112 | * "If any field within the CIPSO options, such as the DOI identifier, is not | |
1113 | * recognized the IP datagram is discarded and an ICMP 'parameter problem' | |
1114 | * (type 12) is generated and returned. The ICMP code field is set to 'bad | |
1115 | * parameter' (code 0) and the pointer is set to the start of the CIPSO field | |
1116 | * that is unrecognized." | |
1117 | * | |
1118 | */ | |
1119 | int cipso_v4_validate(unsigned char **option) | |
1120 | { | |
1121 | unsigned char *opt = *option; | |
1122 | unsigned char *tag; | |
1123 | unsigned char opt_iter; | |
1124 | unsigned char err_offset = 0; | |
1125 | u8 opt_len; | |
1126 | u8 tag_len; | |
1127 | struct cipso_v4_doi *doi_def = NULL; | |
1128 | u32 tag_iter; | |
1129 | ||
1130 | /* caller already checks for length values that are too large */ | |
1131 | opt_len = opt[1]; | |
1132 | if (opt_len < 8) { | |
1133 | err_offset = 1; | |
1134 | goto validate_return; | |
1135 | } | |
1136 | ||
1137 | rcu_read_lock(); | |
9bb5fd2b | 1138 | doi_def = cipso_v4_doi_search(ntohl(*((u32 *)&opt[2]))); |
446fda4f PM |
1139 | if (doi_def == NULL) { |
1140 | err_offset = 2; | |
1141 | goto validate_return_locked; | |
1142 | } | |
1143 | ||
1144 | opt_iter = 6; | |
1145 | tag = opt + opt_iter; | |
1146 | while (opt_iter < opt_len) { | |
1147 | for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];) | |
1148 | if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID || | |
1149 | ++tag_iter == CIPSO_V4_TAG_MAXCNT) { | |
1150 | err_offset = opt_iter; | |
1151 | goto validate_return_locked; | |
1152 | } | |
1153 | ||
1154 | tag_len = tag[1]; | |
1155 | if (tag_len > (opt_len - opt_iter)) { | |
1156 | err_offset = opt_iter + 1; | |
1157 | goto validate_return_locked; | |
1158 | } | |
1159 | ||
1160 | switch (tag[0]) { | |
1161 | case CIPSO_V4_TAG_RBITMAP: | |
1162 | if (tag_len < 4) { | |
1163 | err_offset = opt_iter + 1; | |
1164 | goto validate_return_locked; | |
1165 | } | |
1166 | ||
1167 | /* We are already going to do all the verification | |
1168 | * necessary at the socket layer so from our point of | |
1169 | * view it is safe to turn these checks off (and less | |
1170 | * work), however, the CIPSO draft says we should do | |
1171 | * all the CIPSO validations here but it doesn't | |
1172 | * really specify _exactly_ what we need to validate | |
1173 | * ... so, just make it a sysctl tunable. */ | |
1174 | if (cipso_v4_rbm_strictvalid) { | |
1175 | if (cipso_v4_map_lvl_valid(doi_def, | |
1176 | tag[3]) < 0) { | |
1177 | err_offset = opt_iter + 3; | |
1178 | goto validate_return_locked; | |
1179 | } | |
1180 | if (tag_len > 4 && | |
1181 | cipso_v4_map_cat_rbm_valid(doi_def, | |
1182 | &tag[4], | |
1183 | tag_len - 4) < 0) { | |
1184 | err_offset = opt_iter + 4; | |
1185 | goto validate_return_locked; | |
1186 | } | |
1187 | } | |
1188 | break; | |
1189 | default: | |
1190 | err_offset = opt_iter; | |
1191 | goto validate_return_locked; | |
1192 | } | |
1193 | ||
1194 | tag += tag_len; | |
1195 | opt_iter += tag_len; | |
1196 | } | |
1197 | ||
1198 | validate_return_locked: | |
1199 | rcu_read_unlock(); | |
1200 | validate_return: | |
1201 | *option = opt + err_offset; | |
1202 | return err_offset; | |
1203 | } | |
1204 | ||
1205 | /** | |
1206 | * cipso_v4_error - Send the correct reponse for a bad packet | |
1207 | * @skb: the packet | |
1208 | * @error: the error code | |
1209 | * @gateway: CIPSO gateway flag | |
1210 | * | |
1211 | * Description: | |
1212 | * Based on the error code given in @error, send an ICMP error message back to | |
1213 | * the originating host. From the IETF draft ... | |
1214 | * | |
1215 | * "If the contents of the CIPSO [option] are valid but the security label is | |
1216 | * outside of the configured host or port label range, the datagram is | |
1217 | * discarded and an ICMP 'destination unreachable' (type 3) is generated and | |
1218 | * returned. The code field of the ICMP is set to 'communication with | |
1219 | * destination network administratively prohibited' (code 9) or to | |
1220 | * 'communication with destination host administratively prohibited' | |
1221 | * (code 10). The value of the code is dependent on whether the originator | |
1222 | * of the ICMP message is acting as a CIPSO host or a CIPSO gateway. The | |
1223 | * recipient of the ICMP message MUST be able to handle either value. The | |
1224 | * same procedure is performed if a CIPSO [option] can not be added to an | |
1225 | * IP packet because it is too large to fit in the IP options area." | |
1226 | * | |
1227 | * "If the error is triggered by receipt of an ICMP message, the message is | |
1228 | * discarded and no response is permitted (consistent with general ICMP | |
1229 | * processing rules)." | |
1230 | * | |
1231 | */ | |
1232 | void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) | |
1233 | { | |
1234 | if (skb->nh.iph->protocol == IPPROTO_ICMP || error != -EACCES) | |
1235 | return; | |
1236 | ||
1237 | if (gateway) | |
1238 | icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0); | |
1239 | else | |
1240 | icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0); | |
1241 | } | |
1242 | ||
1243 | /** | |
1244 | * cipso_v4_socket_setattr - Add a CIPSO option to a socket | |
1245 | * @sock: the socket | |
1246 | * @doi_def: the CIPSO DOI to use | |
1247 | * @secattr: the specific security attributes of the socket | |
1248 | * | |
1249 | * Description: | |
1250 | * Set the CIPSO option on the given socket using the DOI definition and | |
1251 | * security attributes passed to the function. This function requires | |
1252 | * exclusive access to @sock->sk, which means it either needs to be in the | |
1253 | * process of being created or locked via lock_sock(sock->sk). Returns zero on | |
1254 | * success and negative values on failure. | |
1255 | * | |
1256 | */ | |
1257 | int cipso_v4_socket_setattr(const struct socket *sock, | |
1258 | const struct cipso_v4_doi *doi_def, | |
1259 | const struct netlbl_lsm_secattr *secattr) | |
1260 | { | |
1261 | int ret_val = -EPERM; | |
1262 | u32 iter; | |
91b1ed0a | 1263 | unsigned char *buf; |
446fda4f PM |
1264 | u32 buf_len = 0; |
1265 | u32 opt_len; | |
1266 | struct ip_options *opt = NULL; | |
1267 | struct sock *sk; | |
1268 | struct inet_sock *sk_inet; | |
1269 | struct inet_connection_sock *sk_conn; | |
1270 | ||
1271 | /* In the case of sock_create_lite(), the sock->sk field is not | |
1272 | * defined yet but it is not a problem as the only users of these | |
1273 | * "lite" PF_INET sockets are functions which do an accept() call | |
1274 | * afterwards so we will label the socket as part of the accept(). */ | |
1275 | sk = sock->sk; | |
1276 | if (sk == NULL) | |
1277 | return 0; | |
1278 | ||
91b1ed0a PM |
1279 | /* We allocate the maximum CIPSO option size here so we are probably |
1280 | * being a little wasteful, but it makes our life _much_ easier later | |
1281 | * on and after all we are only talking about 40 bytes. */ | |
1282 | buf_len = CIPSO_V4_OPT_LEN_MAX; | |
1283 | buf = kmalloc(buf_len, GFP_ATOMIC); | |
1284 | if (buf == NULL) { | |
1285 | ret_val = -ENOMEM; | |
1286 | goto socket_setattr_failure; | |
1287 | } | |
1288 | ||
446fda4f PM |
1289 | /* XXX - This code assumes only one tag per CIPSO option which isn't |
1290 | * really a good assumption to make but since we only support the MAC | |
1291 | * tags right now it is a safe assumption. */ | |
1292 | iter = 0; | |
1293 | do { | |
91b1ed0a | 1294 | memset(buf, 0, buf_len); |
446fda4f PM |
1295 | switch (doi_def->tags[iter]) { |
1296 | case CIPSO_V4_TAG_RBITMAP: | |
1297 | ret_val = cipso_v4_gentag_rbm(doi_def, | |
91b1ed0a PM |
1298 | secattr, |
1299 | &buf[CIPSO_V4_HDR_LEN], | |
1300 | buf_len - CIPSO_V4_HDR_LEN); | |
446fda4f PM |
1301 | break; |
1302 | default: | |
1303 | ret_val = -EPERM; | |
1304 | goto socket_setattr_failure; | |
1305 | } | |
1306 | ||
1307 | iter++; | |
91b1ed0a | 1308 | } while (ret_val < 0 && |
446fda4f PM |
1309 | iter < CIPSO_V4_TAG_MAXCNT && |
1310 | doi_def->tags[iter] != CIPSO_V4_TAG_INVALID); | |
91b1ed0a | 1311 | if (ret_val < 0) |
446fda4f | 1312 | goto socket_setattr_failure; |
91b1ed0a PM |
1313 | cipso_v4_gentag_hdr(doi_def, buf, ret_val); |
1314 | buf_len = CIPSO_V4_HDR_LEN + ret_val; | |
446fda4f PM |
1315 | |
1316 | /* We can't use ip_options_get() directly because it makes a call to | |
1317 | * ip_options_get_alloc() which allocates memory with GFP_KERNEL and | |
f8687afe PM |
1318 | * we won't always have CAP_NET_RAW even though we _always_ want to |
1319 | * set the IPOPT_CIPSO option. */ | |
446fda4f PM |
1320 | opt_len = (buf_len + 3) & ~3; |
1321 | opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC); | |
1322 | if (opt == NULL) { | |
1323 | ret_val = -ENOMEM; | |
1324 | goto socket_setattr_failure; | |
1325 | } | |
1326 | memcpy(opt->__data, buf, buf_len); | |
1327 | opt->optlen = opt_len; | |
1328 | opt->is_data = 1; | |
f8687afe | 1329 | opt->cipso = sizeof(struct iphdr); |
446fda4f PM |
1330 | kfree(buf); |
1331 | buf = NULL; | |
446fda4f PM |
1332 | |
1333 | sk_inet = inet_sk(sk); | |
1334 | if (sk_inet->is_icsk) { | |
1335 | sk_conn = inet_csk(sk); | |
1336 | if (sk_inet->opt) | |
1337 | sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen; | |
1338 | sk_conn->icsk_ext_hdr_len += opt->optlen; | |
1339 | sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie); | |
1340 | } | |
1341 | opt = xchg(&sk_inet->opt, opt); | |
1342 | kfree(opt); | |
1343 | ||
1344 | return 0; | |
1345 | ||
1346 | socket_setattr_failure: | |
1347 | kfree(buf); | |
1348 | kfree(opt); | |
1349 | return ret_val; | |
1350 | } | |
1351 | ||
1352 | /** | |
14a72f53 PM |
1353 | * cipso_v4_sock_getattr - Get the security attributes from a sock |
1354 | * @sk: the sock | |
446fda4f PM |
1355 | * @secattr: the security attributes |
1356 | * | |
1357 | * Description: | |
14a72f53 PM |
1358 | * Query @sk to see if there is a CIPSO option attached to the sock and if |
1359 | * there is return the CIPSO security attributes in @secattr. This function | |
1360 | * requires that @sk be locked, or privately held, but it does not do any | |
1361 | * locking itself. Returns zero on success and negative values on failure. | |
446fda4f PM |
1362 | * |
1363 | */ | |
14a72f53 | 1364 | int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) |
446fda4f PM |
1365 | { |
1366 | int ret_val = -ENOMSG; | |
446fda4f PM |
1367 | struct inet_sock *sk_inet; |
1368 | unsigned char *cipso_ptr; | |
1369 | u32 doi; | |
1370 | struct cipso_v4_doi *doi_def; | |
1371 | ||
446fda4f PM |
1372 | sk_inet = inet_sk(sk); |
1373 | if (sk_inet->opt == NULL || sk_inet->opt->cipso == 0) | |
14a72f53 | 1374 | return -ENOMSG; |
446fda4f PM |
1375 | cipso_ptr = sk_inet->opt->__data + sk_inet->opt->cipso - |
1376 | sizeof(struct iphdr); | |
1377 | ret_val = cipso_v4_cache_check(cipso_ptr, cipso_ptr[1], secattr); | |
1378 | if (ret_val == 0) | |
14a72f53 | 1379 | return ret_val; |
446fda4f | 1380 | |
714e85be | 1381 | doi = ntohl(*(__be32 *)&cipso_ptr[2]); |
446fda4f | 1382 | rcu_read_lock(); |
9bb5fd2b | 1383 | doi_def = cipso_v4_doi_search(doi); |
446fda4f PM |
1384 | if (doi_def == NULL) { |
1385 | rcu_read_unlock(); | |
14a72f53 | 1386 | return -ENOMSG; |
446fda4f | 1387 | } |
91b1ed0a PM |
1388 | |
1389 | /* XXX - This code assumes only one tag per CIPSO option which isn't | |
1390 | * really a good assumption to make but since we only support the MAC | |
1391 | * tags right now it is a safe assumption. */ | |
446fda4f PM |
1392 | switch (cipso_ptr[6]) { |
1393 | case CIPSO_V4_TAG_RBITMAP: | |
1394 | ret_val = cipso_v4_parsetag_rbm(doi_def, | |
1395 | &cipso_ptr[6], | |
1396 | secattr); | |
1397 | break; | |
1398 | } | |
1399 | rcu_read_unlock(); | |
1400 | ||
14a72f53 PM |
1401 | return ret_val; |
1402 | } | |
1403 | ||
1404 | /** | |
1405 | * cipso_v4_socket_getattr - Get the security attributes from a socket | |
1406 | * @sock: the socket | |
1407 | * @secattr: the security attributes | |
1408 | * | |
1409 | * Description: | |
1410 | * Query @sock to see if there is a CIPSO option attached to the socket and if | |
1411 | * there is return the CIPSO security attributes in @secattr. Returns zero on | |
1412 | * success and negative values on failure. | |
1413 | * | |
1414 | */ | |
1415 | int cipso_v4_socket_getattr(const struct socket *sock, | |
1416 | struct netlbl_lsm_secattr *secattr) | |
1417 | { | |
1418 | int ret_val; | |
1419 | ||
1420 | lock_sock(sock->sk); | |
1421 | ret_val = cipso_v4_sock_getattr(sock->sk, secattr); | |
1422 | release_sock(sock->sk); | |
1423 | ||
446fda4f PM |
1424 | return ret_val; |
1425 | } | |
1426 | ||
1427 | /** | |
1428 | * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option | |
1429 | * @skb: the packet | |
1430 | * @secattr: the security attributes | |
1431 | * | |
1432 | * Description: | |
1433 | * Parse the given packet's CIPSO option and return the security attributes. | |
1434 | * Returns zero on success and negative values on failure. | |
1435 | * | |
1436 | */ | |
1437 | int cipso_v4_skbuff_getattr(const struct sk_buff *skb, | |
1438 | struct netlbl_lsm_secattr *secattr) | |
1439 | { | |
1440 | int ret_val = -ENOMSG; | |
1441 | unsigned char *cipso_ptr; | |
1442 | u32 doi; | |
1443 | struct cipso_v4_doi *doi_def; | |
1444 | ||
446fda4f PM |
1445 | cipso_ptr = CIPSO_V4_OPTPTR(skb); |
1446 | if (cipso_v4_cache_check(cipso_ptr, cipso_ptr[1], secattr) == 0) | |
1447 | return 0; | |
1448 | ||
714e85be | 1449 | doi = ntohl(*(__be32 *)&cipso_ptr[2]); |
446fda4f | 1450 | rcu_read_lock(); |
9bb5fd2b | 1451 | doi_def = cipso_v4_doi_search(doi); |
446fda4f PM |
1452 | if (doi_def == NULL) |
1453 | goto skbuff_getattr_return; | |
91b1ed0a PM |
1454 | |
1455 | /* XXX - This code assumes only one tag per CIPSO option which isn't | |
1456 | * really a good assumption to make but since we only support the MAC | |
1457 | * tags right now it is a safe assumption. */ | |
446fda4f PM |
1458 | switch (cipso_ptr[6]) { |
1459 | case CIPSO_V4_TAG_RBITMAP: | |
1460 | ret_val = cipso_v4_parsetag_rbm(doi_def, | |
1461 | &cipso_ptr[6], | |
1462 | secattr); | |
1463 | break; | |
1464 | } | |
1465 | ||
1466 | skbuff_getattr_return: | |
1467 | rcu_read_unlock(); | |
1468 | return ret_val; | |
1469 | } | |
1470 | ||
1471 | /* | |
1472 | * Setup Functions | |
1473 | */ | |
1474 | ||
1475 | /** | |
1476 | * cipso_v4_init - Initialize the CIPSO module | |
1477 | * | |
1478 | * Description: | |
1479 | * Initialize the CIPSO module and prepare it for use. Returns zero on success | |
1480 | * and negative values on failure. | |
1481 | * | |
1482 | */ | |
1483 | static int __init cipso_v4_init(void) | |
1484 | { | |
1485 | int ret_val; | |
1486 | ||
1487 | ret_val = cipso_v4_cache_init(); | |
1488 | if (ret_val != 0) | |
1489 | panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n", | |
1490 | ret_val); | |
1491 | ||
1492 | return 0; | |
1493 | } | |
1494 | ||
1495 | subsys_initcall(cipso_v4_init); |