1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * CALIPSO - Common Architecture Label IPv6 Security Option
5 * This is an implementation of the CALIPSO protocol as specified in
8 * Authors: Paul Moore <paul.moore@hp.com>
9 * Huw Davies <huw@codeweavers.com>
12 /* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
13 * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
16 #include <linux/init.h>
17 #include <linux/types.h>
18 #include <linux/rcupdate.h>
19 #include <linux/list.h>
20 #include <linux/spinlock.h>
21 #include <linux/string.h>
22 #include <linux/jhash.h>
23 #include <linux/audit.h>
24 #include <linux/slab.h>
28 #include <net/netlabel.h>
29 #include <net/calipso.h>
30 #include <linux/atomic.h>
31 #include <linux/bug.h>
32 #include <asm/unaligned.h>
33 #include <linux/crc-ccitt.h>
35 /* Maximium size of the calipso option including
36 * the two-byte TLV header.
38 #define CALIPSO_OPT_LEN_MAX (2 + 252)
40 /* Size of the minimum calipso option including
41 * the two-byte TLV header.
43 #define CALIPSO_HDR_LEN (2 + 8)
45 /* Maximium size of the calipso option including
46 * the two-byte TLV header and upto 3 bytes of
47 * leading pad and 7 bytes of trailing pad.
49 #define CALIPSO_OPT_LEN_MAX_WITH_PAD (3 + CALIPSO_OPT_LEN_MAX + 7)
51 /* Maximium size of u32 aligned buffer required to hold calipso
52 * option. Max of 3 initial pad bytes starting from buffer + 3.
53 * i.e. the worst case is when the previous tlv finishes on 4n + 3.
55 #define CALIPSO_MAX_BUFFER (6 + CALIPSO_OPT_LEN_MAX)
57 /* List of available DOI definitions */
58 static DEFINE_SPINLOCK(calipso_doi_list_lock
);
59 static LIST_HEAD(calipso_doi_list
);
61 /* Label mapping cache */
62 int calipso_cache_enabled
= 1;
63 int calipso_cache_bucketsize
= 10;
64 #define CALIPSO_CACHE_BUCKETBITS 7
65 #define CALIPSO_CACHE_BUCKETS BIT(CALIPSO_CACHE_BUCKETBITS)
66 #define CALIPSO_CACHE_REORDERLIMIT 10
67 struct calipso_map_cache_bkt
{
70 struct list_head list
;
73 struct calipso_map_cache_entry
{
78 struct netlbl_lsm_cache
*lsm_data
;
81 struct list_head list
;
84 static struct calipso_map_cache_bkt
*calipso_cache
;
86 static void calipso_cache_invalidate(void);
87 static void calipso_doi_putdef(struct calipso_doi
*doi_def
);
89 /* Label Mapping Cache Functions
93 * calipso_cache_entry_free - Frees a cache entry
94 * @entry: the entry to free
97 * This function frees the memory associated with a cache entry including the
98 * LSM cache data if there are no longer any users, i.e. reference count == 0.
101 static void calipso_cache_entry_free(struct calipso_map_cache_entry
*entry
)
104 netlbl_secattr_cache_free(entry
->lsm_data
);
110 * calipso_map_cache_hash - Hashing function for the CALIPSO cache
112 * @key_len: the length of the key in bytes
115 * The CALIPSO tag hashing function. Returns a 32-bit hash value.
118 static u32
calipso_map_cache_hash(const unsigned char *key
, u32 key_len
)
120 return jhash(key
, key_len
, 0);
124 * calipso_cache_init - Initialize the CALIPSO cache
127 * Initializes the CALIPSO label mapping cache, this function should be called
128 * before any of the other functions defined in this file. Returns zero on
129 * success, negative values on error.
132 static int __init
calipso_cache_init(void)
136 calipso_cache
= kcalloc(CALIPSO_CACHE_BUCKETS
,
137 sizeof(struct calipso_map_cache_bkt
),
142 for (iter
= 0; iter
< CALIPSO_CACHE_BUCKETS
; iter
++) {
143 spin_lock_init(&calipso_cache
[iter
].lock
);
144 calipso_cache
[iter
].size
= 0;
145 INIT_LIST_HEAD(&calipso_cache
[iter
].list
);
152 * calipso_cache_invalidate - Invalidates the current CALIPSO cache
155 * Invalidates and frees any entries in the CALIPSO cache. Returns zero on
156 * success and negative values on failure.
159 static void calipso_cache_invalidate(void)
161 struct calipso_map_cache_entry
*entry
, *tmp_entry
;
164 for (iter
= 0; iter
< CALIPSO_CACHE_BUCKETS
; iter
++) {
165 spin_lock_bh(&calipso_cache
[iter
].lock
);
166 list_for_each_entry_safe(entry
,
168 &calipso_cache
[iter
].list
, list
) {
169 list_del(&entry
->list
);
170 calipso_cache_entry_free(entry
);
172 calipso_cache
[iter
].size
= 0;
173 spin_unlock_bh(&calipso_cache
[iter
].lock
);
178 * calipso_cache_check - Check the CALIPSO cache for a label mapping
179 * @key: the buffer to check
180 * @key_len: buffer length in bytes
181 * @secattr: the security attribute struct to use
184 * This function checks the cache to see if a label mapping already exists for
185 * the given key. If there is a match then the cache is adjusted and the
186 * @secattr struct is populated with the correct LSM security attributes. The
187 * cache is adjusted in the following manner if the entry is not already the
188 * first in the cache bucket:
190 * 1. The cache entry's activity counter is incremented
191 * 2. The previous (higher ranking) entry's activity counter is decremented
192 * 3. If the difference between the two activity counters is geater than
193 * CALIPSO_CACHE_REORDERLIMIT the two entries are swapped
195 * Returns zero on success, -ENOENT for a cache miss, and other negative values
199 static int calipso_cache_check(const unsigned char *key
,
201 struct netlbl_lsm_secattr
*secattr
)
204 struct calipso_map_cache_entry
*entry
;
205 struct calipso_map_cache_entry
*prev_entry
= NULL
;
208 if (!calipso_cache_enabled
)
211 hash
= calipso_map_cache_hash(key
, key_len
);
212 bkt
= hash
& (CALIPSO_CACHE_BUCKETS
- 1);
213 spin_lock_bh(&calipso_cache
[bkt
].lock
);
214 list_for_each_entry(entry
, &calipso_cache
[bkt
].list
, list
) {
215 if (entry
->hash
== hash
&&
216 entry
->key_len
== key_len
&&
217 memcmp(entry
->key
, key
, key_len
) == 0) {
218 entry
->activity
+= 1;
219 refcount_inc(&entry
->lsm_data
->refcount
);
220 secattr
->cache
= entry
->lsm_data
;
221 secattr
->flags
|= NETLBL_SECATTR_CACHE
;
222 secattr
->type
= NETLBL_NLTYPE_CALIPSO
;
224 spin_unlock_bh(&calipso_cache
[bkt
].lock
);
228 if (prev_entry
->activity
> 0)
229 prev_entry
->activity
-= 1;
230 if (entry
->activity
> prev_entry
->activity
&&
231 entry
->activity
- prev_entry
->activity
>
232 CALIPSO_CACHE_REORDERLIMIT
) {
233 __list_del(entry
->list
.prev
, entry
->list
.next
);
234 __list_add(&entry
->list
,
235 prev_entry
->list
.prev
,
239 spin_unlock_bh(&calipso_cache
[bkt
].lock
);
244 spin_unlock_bh(&calipso_cache
[bkt
].lock
);
250 * calipso_cache_add - Add an entry to the CALIPSO cache
251 * @calipso_ptr: the CALIPSO option
252 * @secattr: the packet's security attributes
255 * Add a new entry into the CALIPSO label mapping cache. Add the new entry to
256 * head of the cache bucket's list, if the cache bucket is out of room remove
257 * the last entry in the list first. It is important to note that there is
258 * currently no checking for duplicate keys. Returns zero on success,
259 * negative values on failure. The key stored starts at calipso_ptr + 2,
260 * i.e. the type and length bytes are not stored, this corresponds to
261 * calipso_ptr[1] bytes of data.
264 static int calipso_cache_add(const unsigned char *calipso_ptr
,
265 const struct netlbl_lsm_secattr
*secattr
)
267 int ret_val
= -EPERM
;
269 struct calipso_map_cache_entry
*entry
= NULL
;
270 struct calipso_map_cache_entry
*old_entry
= NULL
;
273 if (!calipso_cache_enabled
|| calipso_cache_bucketsize
<= 0)
276 calipso_ptr_len
= calipso_ptr
[1];
278 entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
281 entry
->key
= kmemdup(calipso_ptr
+ 2, calipso_ptr_len
, GFP_ATOMIC
);
284 goto cache_add_failure
;
286 entry
->key_len
= calipso_ptr_len
;
287 entry
->hash
= calipso_map_cache_hash(calipso_ptr
, calipso_ptr_len
);
288 refcount_inc(&secattr
->cache
->refcount
);
289 entry
->lsm_data
= secattr
->cache
;
291 bkt
= entry
->hash
& (CALIPSO_CACHE_BUCKETS
- 1);
292 spin_lock_bh(&calipso_cache
[bkt
].lock
);
293 if (calipso_cache
[bkt
].size
< calipso_cache_bucketsize
) {
294 list_add(&entry
->list
, &calipso_cache
[bkt
].list
);
295 calipso_cache
[bkt
].size
+= 1;
297 old_entry
= list_entry(calipso_cache
[bkt
].list
.prev
,
298 struct calipso_map_cache_entry
, list
);
299 list_del(&old_entry
->list
);
300 list_add(&entry
->list
, &calipso_cache
[bkt
].list
);
301 calipso_cache_entry_free(old_entry
);
303 spin_unlock_bh(&calipso_cache
[bkt
].lock
);
309 calipso_cache_entry_free(entry
);
313 /* DOI List Functions
317 * calipso_doi_search - Searches for a DOI definition
318 * @doi: the DOI to search for
321 * Search the DOI definition list for a DOI definition with a DOI value that
322 * matches @doi. The caller is responsible for calling rcu_read_[un]lock().
323 * Returns a pointer to the DOI definition on success and NULL on failure.
325 static struct calipso_doi
*calipso_doi_search(u32 doi
)
327 struct calipso_doi
*iter
;
329 list_for_each_entry_rcu(iter
, &calipso_doi_list
, list
)
330 if (iter
->doi
== doi
&& refcount_read(&iter
->refcount
))
336 * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
337 * @doi_def: the DOI structure
338 * @audit_info: NetLabel audit information
341 * The caller defines a new DOI for use by the CALIPSO engine and calls this
342 * function to add it to the list of acceptable domains. The caller must
343 * ensure that the mapping table specified in @doi_def->map meets all of the
344 * requirements of the mapping type (see calipso.h for details). Returns
345 * zero on success and non-zero on failure.
348 static int calipso_doi_add(struct calipso_doi
*doi_def
,
349 struct netlbl_audit
*audit_info
)
351 int ret_val
= -EINVAL
;
354 struct audit_buffer
*audit_buf
;
357 doi_type
= doi_def
->type
;
359 if (doi_def
->doi
== CALIPSO_DOI_UNKNOWN
)
362 refcount_set(&doi_def
->refcount
, 1);
364 spin_lock(&calipso_doi_list_lock
);
365 if (calipso_doi_search(doi_def
->doi
)) {
366 spin_unlock(&calipso_doi_list_lock
);
370 list_add_tail_rcu(&doi_def
->list
, &calipso_doi_list
);
371 spin_unlock(&calipso_doi_list_lock
);
375 audit_buf
= netlbl_audit_start(AUDIT_MAC_CALIPSO_ADD
, audit_info
);
377 const char *type_str
;
380 case CALIPSO_MAP_PASS
:
384 type_str
= "(unknown)";
386 audit_log_format(audit_buf
,
387 " calipso_doi=%u calipso_type=%s res=%u",
388 doi
, type_str
, ret_val
== 0 ? 1 : 0);
389 audit_log_end(audit_buf
);
396 * calipso_doi_free - Frees a DOI definition
397 * @doi_def: the DOI definition
400 * This function frees all of the memory associated with a DOI definition.
403 static void calipso_doi_free(struct calipso_doi
*doi_def
)
409 * calipso_doi_free_rcu - Frees a DOI definition via the RCU pointer
410 * @entry: the entry's RCU field
413 * This function is designed to be used as a callback to the call_rcu()
414 * function so that the memory allocated to the DOI definition can be released
418 static void calipso_doi_free_rcu(struct rcu_head
*entry
)
420 struct calipso_doi
*doi_def
;
422 doi_def
= container_of(entry
, struct calipso_doi
, rcu
);
423 calipso_doi_free(doi_def
);
427 * calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine
428 * @doi: the DOI value
429 * @audit_info: NetLabel audit information
432 * Removes a DOI definition from the CALIPSO engine. The NetLabel routines will
433 * be called to release their own LSM domain mappings as well as our own
434 * domain list. Returns zero on success and negative values on failure.
437 static int calipso_doi_remove(u32 doi
, struct netlbl_audit
*audit_info
)
440 struct calipso_doi
*doi_def
;
441 struct audit_buffer
*audit_buf
;
443 spin_lock(&calipso_doi_list_lock
);
444 doi_def
= calipso_doi_search(doi
);
446 spin_unlock(&calipso_doi_list_lock
);
448 goto doi_remove_return
;
450 list_del_rcu(&doi_def
->list
);
451 spin_unlock(&calipso_doi_list_lock
);
453 calipso_doi_putdef(doi_def
);
457 audit_buf
= netlbl_audit_start(AUDIT_MAC_CALIPSO_DEL
, audit_info
);
459 audit_log_format(audit_buf
,
460 " calipso_doi=%u res=%u",
461 doi
, ret_val
== 0 ? 1 : 0);
462 audit_log_end(audit_buf
);
469 * calipso_doi_getdef - Returns a reference to a valid DOI definition
470 * @doi: the DOI value
473 * Searches for a valid DOI definition and if one is found it is returned to
474 * the caller. Otherwise NULL is returned. The caller must ensure that
475 * calipso_doi_putdef() is called when the caller is done.
478 static struct calipso_doi
*calipso_doi_getdef(u32 doi
)
480 struct calipso_doi
*doi_def
;
483 doi_def
= calipso_doi_search(doi
);
485 goto doi_getdef_return
;
486 if (!refcount_inc_not_zero(&doi_def
->refcount
))
495 * calipso_doi_putdef - Releases a reference for the given DOI definition
496 * @doi_def: the DOI definition
499 * Releases a DOI definition reference obtained from calipso_doi_getdef().
502 static void calipso_doi_putdef(struct calipso_doi
*doi_def
)
507 if (!refcount_dec_and_test(&doi_def
->refcount
))
510 calipso_cache_invalidate();
511 call_rcu(&doi_def
->rcu
, calipso_doi_free_rcu
);
515 * calipso_doi_walk - Iterate through the DOI definitions
516 * @skip_cnt: skip past this number of DOI definitions, updated
517 * @callback: callback for each DOI definition
518 * @cb_arg: argument for the callback function
521 * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
522 * For each entry call @callback, if @callback returns a negative value stop
523 * 'walking' through the list and return. Updates the value in @skip_cnt upon
524 * return. Returns zero on success, negative values on failure.
527 static int calipso_doi_walk(u32
*skip_cnt
,
528 int (*callback
)(struct calipso_doi
*doi_def
,
532 int ret_val
= -ENOENT
;
534 struct calipso_doi
*iter_doi
;
537 list_for_each_entry_rcu(iter_doi
, &calipso_doi_list
, list
)
538 if (refcount_read(&iter_doi
->refcount
) > 0) {
539 if (doi_cnt
++ < *skip_cnt
)
541 ret_val
= callback(iter_doi
, cb_arg
);
544 goto doi_walk_return
;
555 * calipso_validate - Validate a CALIPSO option
557 * @option: the start of the option
560 * This routine is called to validate a CALIPSO option.
561 * If the option is valid then %true is returned, otherwise
562 * %false is returned.
564 * The caller should have already checked that the length of the
565 * option (including the TLV header) is >= 10 and that the catmap
566 * length is consistent with the option length.
568 * We leave checks on the level and categories to the socket layer.
570 bool calipso_validate(const struct sk_buff
*skb
, const unsigned char *option
)
572 struct calipso_doi
*doi_def
;
574 u16 crc
, len
= option
[1] + 2;
575 static const u8 zero
[2];
577 /* The original CRC runs over the option including the TLV header
578 * with the CRC-16 field (at offset 8) zeroed out. */
579 crc
= crc_ccitt(0xffff, option
, 8);
580 crc
= crc_ccitt(crc
, zero
, sizeof(zero
));
582 crc
= crc_ccitt(crc
, option
+ 10, len
- 10);
584 if (option
[8] != (crc
& 0xff) || option
[9] != ((crc
>> 8) & 0xff))
588 doi_def
= calipso_doi_search(get_unaligned_be32(option
+ 2));
596 * calipso_map_cat_hton - Perform a category mapping from host to network
597 * @doi_def: the DOI definition
598 * @secattr: the security attributes
599 * @net_cat: the zero'd out category bitmap in network/CALIPSO format
600 * @net_cat_len: the length of the CALIPSO bitmap in bytes
603 * Perform a label mapping to translate a local MLS category bitmap to the
604 * correct CALIPSO bitmap using the given DOI definition. Returns the minimum
605 * size in bytes of the network bitmap on success, negative values otherwise.
608 static int calipso_map_cat_hton(const struct calipso_doi
*doi_def
,
609 const struct netlbl_lsm_secattr
*secattr
,
610 unsigned char *net_cat
,
614 u32 net_spot_max
= 0;
615 u32 net_clen_bits
= net_cat_len
* 8;
618 spot
= netlbl_catmap_walk(secattr
->attr
.mls
.cat
,
622 if (spot
>= net_clen_bits
)
624 netlbl_bitmap_setbit(net_cat
, spot
, 1);
626 if (spot
> net_spot_max
)
630 return (net_spot_max
/ 32 + 1) * 4;
634 * calipso_map_cat_ntoh - Perform a category mapping from network to host
635 * @doi_def: the DOI definition
636 * @net_cat: the category bitmap in network/CALIPSO format
637 * @net_cat_len: the length of the CALIPSO bitmap in bytes
638 * @secattr: the security attributes
641 * Perform a label mapping to translate a CALIPSO bitmap to the correct local
642 * MLS category bitmap using the given DOI definition. Returns zero on
643 * success, negative values on failure.
646 static int calipso_map_cat_ntoh(const struct calipso_doi
*doi_def
,
647 const unsigned char *net_cat
,
649 struct netlbl_lsm_secattr
*secattr
)
653 u32 net_clen_bits
= net_cat_len
* 8;
656 spot
= netlbl_bitmap_walk(net_cat
,
666 ret_val
= netlbl_catmap_setbit(&secattr
->attr
.mls
.cat
,
677 * calipso_pad_write - Writes pad bytes in TLV format
679 * @offset: offset from start of buffer to write padding
680 * @count: number of pad bytes to write
683 * Write @count bytes of TLV padding into @buffer starting at offset @offset.
684 * @count should be less than 8 - see RFC 4942.
687 static int calipso_pad_write(unsigned char *buf
, unsigned int offset
,
690 if (WARN_ON_ONCE(count
>= 8))
697 buf
[offset
] = IPV6_TLV_PAD1
;
700 buf
[offset
] = IPV6_TLV_PADN
;
701 buf
[offset
+ 1] = count
- 2;
703 memset(buf
+ offset
+ 2, 0, count
- 2);
710 * calipso_genopt - Generate a CALIPSO option
711 * @buf: the option buffer
712 * @start: offset from which to write
713 * @buf_len: the size of opt_buf
714 * @doi_def: the CALIPSO DOI to use
715 * @secattr: the security attributes
718 * Generate a CALIPSO option using the DOI definition and security attributes
719 * passed to the function. This also generates upto three bytes of leading
720 * padding that ensures that the option is 4n + 2 aligned. It returns the
721 * number of bytes written (including any initial padding).
723 static int calipso_genopt(unsigned char *buf
, u32 start
, u32 buf_len
,
724 const struct calipso_doi
*doi_def
,
725 const struct netlbl_lsm_secattr
*secattr
)
730 static const unsigned char padding
[4] = {2, 1, 0, 3};
731 unsigned char *calipso
;
733 /* CALIPSO has 4n + 2 alignment */
734 pad
= padding
[start
& 3];
735 if (buf_len
<= start
+ pad
+ CALIPSO_HDR_LEN
)
738 if ((secattr
->flags
& NETLBL_SECATTR_MLS_LVL
) == 0)
741 len
= CALIPSO_HDR_LEN
;
743 if (secattr
->flags
& NETLBL_SECATTR_MLS_CAT
) {
744 ret_val
= calipso_map_cat_hton(doi_def
,
746 buf
+ start
+ pad
+ len
,
747 buf_len
- start
- pad
- len
);
753 calipso_pad_write(buf
, start
, pad
);
754 calipso
= buf
+ start
+ pad
;
756 calipso
[0] = IPV6_TLV_CALIPSO
;
757 calipso
[1] = len
- 2;
758 *(__be32
*)(calipso
+ 2) = htonl(doi_def
->doi
);
759 calipso
[6] = (len
- CALIPSO_HDR_LEN
) / 4;
760 calipso
[7] = secattr
->attr
.mls
.lvl
;
761 crc
= ~crc_ccitt(0xffff, calipso
, len
);
762 calipso
[8] = crc
& 0xff;
763 calipso
[9] = (crc
>> 8) & 0xff;
767 /* Hop-by-hop hdr helper functions
771 * calipso_opt_update - Replaces socket's hop options with a new set
773 * @hop: new hop options
776 * Replaces @sk's hop options with @hop. @hop may be NULL to leave
777 * the socket with no hop options.
780 static int calipso_opt_update(struct sock
*sk
, struct ipv6_opt_hdr
*hop
)
782 struct ipv6_txoptions
*old
= txopt_get(inet6_sk(sk
)), *txopts
;
784 txopts
= ipv6_renew_options(sk
, old
, IPV6_HOPOPTS
, hop
);
787 return PTR_ERR(txopts
);
789 txopts
= ipv6_update_options(sk
, txopts
);
791 atomic_sub(txopts
->tot_len
, &sk
->sk_omem_alloc
);
799 * calipso_tlv_len - Returns the length of the TLV
800 * @opt: the option header
801 * @offset: offset of the TLV within the header
804 * Returns the length of the TLV option at offset @offset within
805 * the option header @opt. Checks that the entire TLV fits inside
806 * the option header, returns a negative value if this is not the case.
808 static int calipso_tlv_len(struct ipv6_opt_hdr
*opt
, unsigned int offset
)
810 unsigned char *tlv
= (unsigned char *)opt
;
811 unsigned int opt_len
= ipv6_optlen(opt
), tlv_len
;
813 if (offset
< sizeof(*opt
) || offset
>= opt_len
)
815 if (tlv
[offset
] == IPV6_TLV_PAD1
)
817 if (offset
+ 1 >= opt_len
)
819 tlv_len
= tlv
[offset
+ 1] + 2;
820 if (offset
+ tlv_len
> opt_len
)
826 * calipso_opt_find - Finds the CALIPSO option in an IPv6 hop options header
827 * @hop: the hop options header
828 * @start: on return holds the offset of any leading padding
829 * @end: on return holds the offset of the first non-pad TLV after CALIPSO
832 * Finds the space occupied by a CALIPSO option (including any leading and
835 * If a CALIPSO option exists set @start and @end to the
836 * offsets within @hop of the start of padding before the first
837 * CALIPSO option and the end of padding after the first CALIPSO
838 * option. In this case the function returns 0.
840 * In the absence of a CALIPSO option, @start and @end will be
841 * set to the start and end of any trailing padding in the header.
842 * This is useful when appending a new option, as the caller may want
843 * to overwrite some of this padding. In this case the function will
846 static int calipso_opt_find(struct ipv6_opt_hdr
*hop
, unsigned int *start
,
849 int ret_val
= -ENOENT
, tlv_len
;
850 unsigned int opt_len
, offset
, offset_s
= 0, offset_e
= 0;
851 unsigned char *opt
= (unsigned char *)hop
;
853 opt_len
= ipv6_optlen(hop
);
854 offset
= sizeof(*hop
);
856 while (offset
< opt_len
) {
857 tlv_len
= calipso_tlv_len(hop
, offset
);
861 switch (opt
[offset
]) {
867 case IPV6_TLV_CALIPSO
:
882 *start
= offset_s
+ calipso_tlv_len(hop
, offset_s
);
884 *start
= sizeof(*hop
);
886 *end
= offset_e
+ calipso_tlv_len(hop
, offset_e
);
894 * calipso_opt_insert - Inserts a CALIPSO option into an IPv6 hop opt hdr
895 * @hop: the original hop options header
896 * @doi_def: the CALIPSO DOI to use
897 * @secattr: the specific security attributes of the socket
900 * Creates a new hop options header based on @hop with a
901 * CALIPSO option added to it. If @hop already contains a CALIPSO
902 * option this is overwritten, otherwise the new option is appended
903 * after any existing options. If @hop is NULL then the new header
904 * will contain just the CALIPSO option and any needed padding.
907 static struct ipv6_opt_hdr
*
908 calipso_opt_insert(struct ipv6_opt_hdr
*hop
,
909 const struct calipso_doi
*doi_def
,
910 const struct netlbl_lsm_secattr
*secattr
)
912 unsigned int start
, end
, buf_len
, pad
, hop_len
;
913 struct ipv6_opt_hdr
*new;
917 hop_len
= ipv6_optlen(hop
);
918 ret_val
= calipso_opt_find(hop
, &start
, &end
);
919 if (ret_val
&& ret_val
!= -ENOENT
)
920 return ERR_PTR(ret_val
);
923 start
= sizeof(*hop
);
927 buf_len
= hop_len
+ start
- end
+ CALIPSO_OPT_LEN_MAX_WITH_PAD
;
928 new = kzalloc(buf_len
, GFP_ATOMIC
);
930 return ERR_PTR(-ENOMEM
);
932 if (start
> sizeof(*hop
))
933 memcpy(new, hop
, start
);
934 ret_val
= calipso_genopt((unsigned char *)new, start
, buf_len
, doi_def
,
938 return ERR_PTR(ret_val
);
941 buf_len
= start
+ ret_val
;
942 /* At this point buf_len aligns to 4n, so (buf_len & 4) pads to 8n */
943 pad
= ((buf_len
& 4) + (end
& 7)) & 7;
944 calipso_pad_write((unsigned char *)new, buf_len
, pad
);
947 if (end
!= hop_len
) {
948 memcpy((char *)new + buf_len
, (char *)hop
+ end
, hop_len
- end
);
949 buf_len
+= hop_len
- end
;
952 new->hdrlen
= buf_len
/ 8 - 1;
958 * calipso_opt_del - Removes the CALIPSO option from an option header
959 * @hop: the original header
960 * @new: the new header
963 * Creates a new header based on @hop without any CALIPSO option. If @hop
964 * doesn't contain a CALIPSO option it returns -ENOENT. If @hop contains
965 * no other non-padding options, it returns zero with @new set to NULL.
966 * Otherwise it returns zero, creates a new header without the CALIPSO
967 * option (and removing as much padding as possible) and returns with
968 * @new set to that header.
971 static int calipso_opt_del(struct ipv6_opt_hdr
*hop
,
972 struct ipv6_opt_hdr
**new)
975 unsigned int start
, end
, delta
, pad
, hop_len
;
977 ret_val
= calipso_opt_find(hop
, &start
, &end
);
981 hop_len
= ipv6_optlen(hop
);
982 if (start
== sizeof(*hop
) && end
== hop_len
) {
983 /* There's no other option in the header so return NULL */
988 delta
= (end
- start
) & ~7;
989 *new = kzalloc(hop_len
- delta
, GFP_ATOMIC
);
993 memcpy(*new, hop
, start
);
994 (*new)->hdrlen
-= delta
/ 8;
995 pad
= (end
- start
) & 7;
996 calipso_pad_write((unsigned char *)*new, start
, pad
);
998 memcpy((char *)*new + start
+ pad
, (char *)hop
+ end
,
1005 * calipso_opt_getattr - Get the security attributes from a memory block
1006 * @calipso: the CALIPSO option
1007 * @secattr: the security attributes
1010 * Inspect @calipso and return the security attributes in @secattr.
1011 * Returns zero on success and negative values on failure.
1014 static int calipso_opt_getattr(const unsigned char *calipso
,
1015 struct netlbl_lsm_secattr
*secattr
)
1017 int ret_val
= -ENOMSG
;
1018 u32 doi
, len
= calipso
[1], cat_len
= calipso
[6] * 4;
1019 struct calipso_doi
*doi_def
;
1021 if (cat_len
+ 8 > len
)
1024 if (calipso_cache_check(calipso
+ 2, calipso
[1], secattr
) == 0)
1027 doi
= get_unaligned_be32(calipso
+ 2);
1029 doi_def
= calipso_doi_search(doi
);
1031 goto getattr_return
;
1033 secattr
->attr
.mls
.lvl
= calipso
[7];
1034 secattr
->flags
|= NETLBL_SECATTR_MLS_LVL
;
1037 ret_val
= calipso_map_cat_ntoh(doi_def
,
1042 netlbl_catmap_free(secattr
->attr
.mls
.cat
);
1043 goto getattr_return
;
1046 if (secattr
->attr
.mls
.cat
)
1047 secattr
->flags
|= NETLBL_SECATTR_MLS_CAT
;
1050 secattr
->type
= NETLBL_NLTYPE_CALIPSO
;
1061 * calipso_sock_getattr - Get the security attributes from a sock
1063 * @secattr: the security attributes
1066 * Query @sk to see if there is a CALIPSO option attached to the sock and if
1067 * there is return the CALIPSO security attributes in @secattr. This function
1068 * requires that @sk be locked, or privately held, but it does not do any
1069 * locking itself. Returns zero on success and negative values on failure.
1072 static int calipso_sock_getattr(struct sock
*sk
,
1073 struct netlbl_lsm_secattr
*secattr
)
1075 struct ipv6_opt_hdr
*hop
;
1076 int opt_len
, len
, ret_val
= -ENOMSG
, offset
;
1078 struct ipv6_txoptions
*txopts
= txopt_get(inet6_sk(sk
));
1080 if (!txopts
|| !txopts
->hopopt
)
1083 hop
= txopts
->hopopt
;
1084 opt
= (unsigned char *)hop
;
1085 opt_len
= ipv6_optlen(hop
);
1086 offset
= sizeof(*hop
);
1087 while (offset
< opt_len
) {
1088 len
= calipso_tlv_len(hop
, offset
);
1093 switch (opt
[offset
]) {
1094 case IPV6_TLV_CALIPSO
:
1095 if (len
< CALIPSO_HDR_LEN
)
1098 ret_val
= calipso_opt_getattr(&opt
[offset
],
1112 * calipso_sock_setattr - Add a CALIPSO option to a socket
1114 * @doi_def: the CALIPSO DOI to use
1115 * @secattr: the specific security attributes of the socket
1118 * Set the CALIPSO option on the given socket using the DOI definition and
1119 * security attributes passed to the function. This function requires
1120 * exclusive access to @sk, which means it either needs to be in the
1121 * process of being created or locked. Returns zero on success and negative
1122 * values on failure.
1125 static int calipso_sock_setattr(struct sock
*sk
,
1126 const struct calipso_doi
*doi_def
,
1127 const struct netlbl_lsm_secattr
*secattr
)
1130 struct ipv6_opt_hdr
*old
, *new;
1131 struct ipv6_txoptions
*txopts
= txopt_get(inet6_sk(sk
));
1135 old
= txopts
->hopopt
;
1137 new = calipso_opt_insert(old
, doi_def
, secattr
);
1140 return PTR_ERR(new);
1142 ret_val
= calipso_opt_update(sk
, new);
1149 * calipso_sock_delattr - Delete the CALIPSO option from a socket
1153 * Removes the CALIPSO option from a socket, if present.
1156 static void calipso_sock_delattr(struct sock
*sk
)
1158 struct ipv6_opt_hdr
*new_hop
;
1159 struct ipv6_txoptions
*txopts
= txopt_get(inet6_sk(sk
));
1161 if (!txopts
|| !txopts
->hopopt
)
1164 if (calipso_opt_del(txopts
->hopopt
, &new_hop
))
1167 calipso_opt_update(sk
, new_hop
);
1174 /* request sock functions.
1178 * calipso_req_setattr - Add a CALIPSO option to a connection request socket
1179 * @req: the connection request socket
1180 * @doi_def: the CALIPSO DOI to use
1181 * @secattr: the specific security attributes of the socket
1184 * Set the CALIPSO option on the given socket using the DOI definition and
1185 * security attributes passed to the function. Returns zero on success and
1186 * negative values on failure.
1189 static int calipso_req_setattr(struct request_sock
*req
,
1190 const struct calipso_doi
*doi_def
,
1191 const struct netlbl_lsm_secattr
*secattr
)
1193 struct ipv6_txoptions
*txopts
;
1194 struct inet_request_sock
*req_inet
= inet_rsk(req
);
1195 struct ipv6_opt_hdr
*old
, *new;
1196 struct sock
*sk
= sk_to_full_sk(req_to_sk(req
));
1198 if (req_inet
->ipv6_opt
&& req_inet
->ipv6_opt
->hopopt
)
1199 old
= req_inet
->ipv6_opt
->hopopt
;
1203 new = calipso_opt_insert(old
, doi_def
, secattr
);
1205 return PTR_ERR(new);
1207 txopts
= ipv6_renew_options(sk
, req_inet
->ipv6_opt
, IPV6_HOPOPTS
, new);
1212 return PTR_ERR(txopts
);
1214 txopts
= xchg(&req_inet
->ipv6_opt
, txopts
);
1216 atomic_sub(txopts
->tot_len
, &sk
->sk_omem_alloc
);
1224 * calipso_req_delattr - Delete the CALIPSO option from a request socket
1225 * @req: the request socket
1228 * Removes the CALIPSO option from a request socket, if present.
1231 static void calipso_req_delattr(struct request_sock
*req
)
1233 struct inet_request_sock
*req_inet
= inet_rsk(req
);
1234 struct ipv6_opt_hdr
*new;
1235 struct ipv6_txoptions
*txopts
;
1236 struct sock
*sk
= sk_to_full_sk(req_to_sk(req
));
1238 if (!req_inet
->ipv6_opt
|| !req_inet
->ipv6_opt
->hopopt
)
1241 if (calipso_opt_del(req_inet
->ipv6_opt
->hopopt
, &new))
1242 return; /* Nothing to do */
1244 txopts
= ipv6_renew_options(sk
, req_inet
->ipv6_opt
, IPV6_HOPOPTS
, new);
1246 if (!IS_ERR(txopts
)) {
1247 txopts
= xchg(&req_inet
->ipv6_opt
, txopts
);
1249 atomic_sub(txopts
->tot_len
, &sk
->sk_omem_alloc
);
1256 /* skbuff functions.
1260 * calipso_skbuff_optptr - Find the CALIPSO option in the packet
1264 * Parse the packet's IP header looking for a CALIPSO option. Returns a pointer
1265 * to the start of the CALIPSO option on success, NULL if one if not found.
1268 static unsigned char *calipso_skbuff_optptr(const struct sk_buff
*skb
)
1270 const struct ipv6hdr
*ip6_hdr
= ipv6_hdr(skb
);
1273 if (ip6_hdr
->nexthdr
!= NEXTHDR_HOP
)
1276 offset
= ipv6_find_tlv(skb
, sizeof(*ip6_hdr
), IPV6_TLV_CALIPSO
);
1278 return (unsigned char *)ip6_hdr
+ offset
;
1284 * calipso_skbuff_setattr - Set the CALIPSO option on a packet
1286 * @doi_def: the CALIPSO DOI to use
1287 * @secattr: the security attributes
1290 * Set the CALIPSO option on the given packet based on the security attributes.
1291 * Returns a pointer to the IP header on success and NULL on failure.
1294 static int calipso_skbuff_setattr(struct sk_buff
*skb
,
1295 const struct calipso_doi
*doi_def
,
1296 const struct netlbl_lsm_secattr
*secattr
)
1299 struct ipv6hdr
*ip6_hdr
;
1300 struct ipv6_opt_hdr
*hop
;
1301 unsigned char buf
[CALIPSO_MAX_BUFFER
];
1302 int len_delta
, new_end
, pad
, payload
;
1303 unsigned int start
, end
;
1305 ip6_hdr
= ipv6_hdr(skb
);
1306 if (ip6_hdr
->nexthdr
== NEXTHDR_HOP
) {
1307 hop
= (struct ipv6_opt_hdr
*)(ip6_hdr
+ 1);
1308 ret_val
= calipso_opt_find(hop
, &start
, &end
);
1309 if (ret_val
&& ret_val
!= -ENOENT
)
1316 memset(buf
, 0, sizeof(buf
));
1317 ret_val
= calipso_genopt(buf
, start
& 3, sizeof(buf
), doi_def
, secattr
);
1321 new_end
= start
+ ret_val
;
1322 /* At this point new_end aligns to 4n, so (new_end & 4) pads to 8n */
1323 pad
= ((new_end
& 4) + (end
& 7)) & 7;
1324 len_delta
= new_end
- (int)end
+ pad
;
1325 ret_val
= skb_cow(skb
, skb_headroom(skb
) + len_delta
);
1329 ip6_hdr
= ipv6_hdr(skb
); /* Reset as skb_cow() may have moved it */
1333 skb_push(skb
, len_delta
);
1335 skb_pull(skb
, -len_delta
);
1336 memmove((char *)ip6_hdr
- len_delta
, ip6_hdr
,
1337 sizeof(*ip6_hdr
) + start
);
1338 skb_reset_network_header(skb
);
1339 ip6_hdr
= ipv6_hdr(skb
);
1340 payload
= ntohs(ip6_hdr
->payload_len
);
1341 ip6_hdr
->payload_len
= htons(payload
+ len_delta
);
1344 hop
= (struct ipv6_opt_hdr
*)(ip6_hdr
+ 1);
1346 struct ipv6_opt_hdr
*new_hop
= (struct ipv6_opt_hdr
*)buf
;
1348 new_hop
->nexthdr
= ip6_hdr
->nexthdr
;
1349 new_hop
->hdrlen
= len_delta
/ 8 - 1;
1350 ip6_hdr
->nexthdr
= NEXTHDR_HOP
;
1352 hop
->hdrlen
+= len_delta
/ 8;
1354 memcpy((char *)hop
+ start
, buf
+ (start
& 3), new_end
- start
);
1355 calipso_pad_write((unsigned char *)hop
, new_end
, pad
);
1361 * calipso_skbuff_delattr - Delete any CALIPSO options from a packet
1365 * Removes any and all CALIPSO options from the given packet. Returns zero on
1366 * success, negative values on failure.
1369 static int calipso_skbuff_delattr(struct sk_buff
*skb
)
1372 struct ipv6hdr
*ip6_hdr
;
1373 struct ipv6_opt_hdr
*old_hop
;
1374 u32 old_hop_len
, start
= 0, end
= 0, delta
, size
, pad
;
1376 if (!calipso_skbuff_optptr(skb
))
1379 /* since we are changing the packet we should make a copy */
1380 ret_val
= skb_cow(skb
, skb_headroom(skb
));
1384 ip6_hdr
= ipv6_hdr(skb
);
1385 old_hop
= (struct ipv6_opt_hdr
*)(ip6_hdr
+ 1);
1386 old_hop_len
= ipv6_optlen(old_hop
);
1388 ret_val
= calipso_opt_find(old_hop
, &start
, &end
);
1392 if (start
== sizeof(*old_hop
) && end
== old_hop_len
) {
1393 /* There's no other option in the header so we delete
1394 * the whole thing. */
1395 delta
= old_hop_len
;
1396 size
= sizeof(*ip6_hdr
);
1397 ip6_hdr
->nexthdr
= old_hop
->nexthdr
;
1399 delta
= (end
- start
) & ~7;
1401 old_hop
->hdrlen
-= delta
/ 8;
1402 pad
= (end
- start
) & 7;
1403 size
= sizeof(*ip6_hdr
) + start
+ pad
;
1404 calipso_pad_write((unsigned char *)old_hop
, start
, pad
);
1408 skb_pull(skb
, delta
);
1409 memmove((char *)ip6_hdr
+ delta
, ip6_hdr
, size
);
1410 skb_reset_network_header(skb
);
1416 static const struct netlbl_calipso_ops ops
= {
1417 .doi_add
= calipso_doi_add
,
1418 .doi_free
= calipso_doi_free
,
1419 .doi_remove
= calipso_doi_remove
,
1420 .doi_getdef
= calipso_doi_getdef
,
1421 .doi_putdef
= calipso_doi_putdef
,
1422 .doi_walk
= calipso_doi_walk
,
1423 .sock_getattr
= calipso_sock_getattr
,
1424 .sock_setattr
= calipso_sock_setattr
,
1425 .sock_delattr
= calipso_sock_delattr
,
1426 .req_setattr
= calipso_req_setattr
,
1427 .req_delattr
= calipso_req_delattr
,
1428 .opt_getattr
= calipso_opt_getattr
,
1429 .skbuff_optptr
= calipso_skbuff_optptr
,
1430 .skbuff_setattr
= calipso_skbuff_setattr
,
1431 .skbuff_delattr
= calipso_skbuff_delattr
,
1432 .cache_invalidate
= calipso_cache_invalidate
,
1433 .cache_add
= calipso_cache_add
1437 * calipso_init - Initialize the CALIPSO module
1440 * Initialize the CALIPSO module and prepare it for use. Returns zero on
1441 * success and negative values on failure.
1444 int __init
calipso_init(void)
1448 ret_val
= calipso_cache_init();
1450 netlbl_calipso_ops_register(&ops
);
1454 void calipso_exit(void)
1456 netlbl_calipso_ops_register(NULL
);
1457 calipso_cache_invalidate();
1458 kfree(calipso_cache
);