]>
git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/blob - net/netlabel/netlabel_addrlist.c
2 * NetLabel Network Address Lists
4 * This file contains network address list functions used to manage ordered
5 * lists of network addresses for use by the NetLabel subsystem. The NetLabel
6 * system manages static and dynamic label mappings for network protocols such
9 * Author: Paul Moore <paul@paul-moore.com>
14 * (c) Copyright Hewlett-Packard Development Company, L.P., 2008
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 2 of the License, or
19 * (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
24 * the GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
31 #include <linux/types.h>
32 #include <linux/rcupdate.h>
33 #include <linux/list.h>
34 #include <linux/spinlock.h>
36 #include <linux/in6.h>
38 #include <linux/ipv6.h>
41 #include <linux/audit.h>
43 #include "netlabel_addrlist.h"
46 * Address List Functions
50 * netlbl_af4list_search - Search for a matching IPv4 address entry
52 * @head: the list head
55 * Searches the IPv4 address list given by @head. If a matching address entry
56 * is found it is returned, otherwise NULL is returned. The caller is
57 * responsible for calling the rcu_read_[un]lock() functions.
60 struct netlbl_af4list
*netlbl_af4list_search(__be32 addr
,
61 struct list_head
*head
)
63 struct netlbl_af4list
*iter
;
65 list_for_each_entry_rcu(iter
, head
, list
)
66 if (iter
->valid
&& (addr
& iter
->mask
) == iter
->addr
)
73 * netlbl_af4list_search_exact - Search for an exact IPv4 address entry
75 * @mask: IPv4 address mask
76 * @head: the list head
79 * Searches the IPv4 address list given by @head. If an exact match if found
80 * it is returned, otherwise NULL is returned. The caller is responsible for
81 * calling the rcu_read_[un]lock() functions.
84 struct netlbl_af4list
*netlbl_af4list_search_exact(__be32 addr
,
86 struct list_head
*head
)
88 struct netlbl_af4list
*iter
;
90 list_for_each_entry_rcu(iter
, head
, list
)
91 if (iter
->valid
&& iter
->addr
== addr
&& iter
->mask
== mask
)
98 #if IS_ENABLED(CONFIG_IPV6)
100 * netlbl_af6list_search - Search for a matching IPv6 address entry
101 * @addr: IPv6 address
102 * @head: the list head
105 * Searches the IPv6 address list given by @head. If a matching address entry
106 * is found it is returned, otherwise NULL is returned. The caller is
107 * responsible for calling the rcu_read_[un]lock() functions.
110 struct netlbl_af6list
*netlbl_af6list_search(const struct in6_addr
*addr
,
111 struct list_head
*head
)
113 struct netlbl_af6list
*iter
;
115 list_for_each_entry_rcu(iter
, head
, list
)
117 ipv6_masked_addr_cmp(&iter
->addr
, &iter
->mask
, addr
) == 0)
124 * netlbl_af6list_search_exact - Search for an exact IPv6 address entry
125 * @addr: IPv6 address
126 * @mask: IPv6 address mask
127 * @head: the list head
130 * Searches the IPv6 address list given by @head. If an exact match if found
131 * it is returned, otherwise NULL is returned. The caller is responsible for
132 * calling the rcu_read_[un]lock() functions.
135 struct netlbl_af6list
*netlbl_af6list_search_exact(const struct in6_addr
*addr
,
136 const struct in6_addr
*mask
,
137 struct list_head
*head
)
139 struct netlbl_af6list
*iter
;
141 list_for_each_entry_rcu(iter
, head
, list
)
143 ipv6_addr_equal(&iter
->addr
, addr
) &&
144 ipv6_addr_equal(&iter
->mask
, mask
))
152 * netlbl_af4list_add - Add a new IPv4 address entry to a list
153 * @entry: address entry
154 * @head: the list head
157 * Add a new address entry to the list pointed to by @head. On success zero is
158 * returned, otherwise a negative value is returned. The caller is responsible
159 * for calling the necessary locking functions.
162 int netlbl_af4list_add(struct netlbl_af4list
*entry
, struct list_head
*head
)
164 struct netlbl_af4list
*iter
;
166 iter
= netlbl_af4list_search(entry
->addr
, head
);
168 iter
->addr
== entry
->addr
&& iter
->mask
== entry
->mask
)
171 /* in order to speed up address searches through the list (the common
172 * case) we need to keep the list in order based on the size of the
173 * address mask such that the entry with the widest mask (smallest
174 * numerical value) appears first in the list */
175 list_for_each_entry_rcu(iter
, head
, list
)
177 ntohl(entry
->mask
) > ntohl(iter
->mask
)) {
178 __list_add_rcu(&entry
->list
,
183 list_add_tail_rcu(&entry
->list
, head
);
187 #if IS_ENABLED(CONFIG_IPV6)
189 * netlbl_af6list_add - Add a new IPv6 address entry to a list
190 * @entry: address entry
191 * @head: the list head
194 * Add a new address entry to the list pointed to by @head. On success zero is
195 * returned, otherwise a negative value is returned. The caller is responsible
196 * for calling the necessary locking functions.
199 int netlbl_af6list_add(struct netlbl_af6list
*entry
, struct list_head
*head
)
201 struct netlbl_af6list
*iter
;
203 iter
= netlbl_af6list_search(&entry
->addr
, head
);
205 ipv6_addr_equal(&iter
->addr
, &entry
->addr
) &&
206 ipv6_addr_equal(&iter
->mask
, &entry
->mask
))
209 /* in order to speed up address searches through the list (the common
210 * case) we need to keep the list in order based on the size of the
211 * address mask such that the entry with the widest mask (smallest
212 * numerical value) appears first in the list */
213 list_for_each_entry_rcu(iter
, head
, list
)
215 ipv6_addr_cmp(&entry
->mask
, &iter
->mask
) > 0) {
216 __list_add_rcu(&entry
->list
,
221 list_add_tail_rcu(&entry
->list
, head
);
227 * netlbl_af4list_remove_entry - Remove an IPv4 address entry
228 * @entry: address entry
231 * Remove the specified IP address entry. The caller is responsible for
232 * calling the necessary locking functions.
235 void netlbl_af4list_remove_entry(struct netlbl_af4list
*entry
)
238 list_del_rcu(&entry
->list
);
242 * netlbl_af4list_remove - Remove an IPv4 address entry
244 * @mask: IP address mask
245 * @head: the list head
248 * Remove an IP address entry from the list pointed to by @head. Returns the
249 * entry on success, NULL on failure. The caller is responsible for calling
250 * the necessary locking functions.
253 struct netlbl_af4list
*netlbl_af4list_remove(__be32 addr
, __be32 mask
,
254 struct list_head
*head
)
256 struct netlbl_af4list
*entry
;
258 entry
= netlbl_af4list_search_exact(addr
, mask
, head
);
261 netlbl_af4list_remove_entry(entry
);
265 #if IS_ENABLED(CONFIG_IPV6)
267 * netlbl_af6list_remove_entry - Remove an IPv6 address entry
268 * @entry: address entry
271 * Remove the specified IP address entry. The caller is responsible for
272 * calling the necessary locking functions.
275 void netlbl_af6list_remove_entry(struct netlbl_af6list
*entry
)
278 list_del_rcu(&entry
->list
);
282 * netlbl_af6list_remove - Remove an IPv6 address entry
284 * @mask: IP address mask
285 * @head: the list head
288 * Remove an IP address entry from the list pointed to by @head. Returns the
289 * entry on success, NULL on failure. The caller is responsible for calling
290 * the necessary locking functions.
293 struct netlbl_af6list
*netlbl_af6list_remove(const struct in6_addr
*addr
,
294 const struct in6_addr
*mask
,
295 struct list_head
*head
)
297 struct netlbl_af6list
*entry
;
299 entry
= netlbl_af6list_search_exact(addr
, mask
, head
);
302 netlbl_af6list_remove_entry(entry
);
308 * Audit Helper Functions
313 * netlbl_af4list_audit_addr - Audit an IPv4 address
314 * @audit_buf: audit buffer
315 * @src: true if source address, false if destination
316 * @dev: network interface
318 * @mask: IP address mask
321 * Write the IPv4 address and address mask, if necessary, to @audit_buf.
324 void netlbl_af4list_audit_addr(struct audit_buffer
*audit_buf
,
325 int src
, const char *dev
,
326 __be32 addr
, __be32 mask
)
328 u32 mask_val
= ntohl(mask
);
329 char *dir
= (src
? "src" : "dst");
332 audit_log_format(audit_buf
, " netif=%s", dev
);
333 audit_log_format(audit_buf
, " %s=%pI4", dir
, &addr
);
334 if (mask_val
!= 0xffffffff) {
336 while (mask_val
> 0) {
340 audit_log_format(audit_buf
, " %s_prefixlen=%d", dir
, mask_len
);
344 #if IS_ENABLED(CONFIG_IPV6)
346 * netlbl_af6list_audit_addr - Audit an IPv6 address
347 * @audit_buf: audit buffer
348 * @src: true if source address, false if destination
349 * @dev: network interface
351 * @mask: IP address mask
354 * Write the IPv6 address and address mask, if necessary, to @audit_buf.
357 void netlbl_af6list_audit_addr(struct audit_buffer
*audit_buf
,
360 const struct in6_addr
*addr
,
361 const struct in6_addr
*mask
)
363 char *dir
= (src
? "src" : "dst");
366 audit_log_format(audit_buf
, " netif=%s", dev
);
367 audit_log_format(audit_buf
, " %s=%pI6", dir
, addr
);
368 if (ntohl(mask
->s6_addr32
[3]) != 0xffffffff) {
372 while (ntohl(mask
->s6_addr32
[++iter
]) == 0xffffffff)
374 mask_val
= ntohl(mask
->s6_addr32
[iter
]);
375 while (mask_val
> 0) {
379 audit_log_format(audit_buf
, " %s_prefixlen=%d", dir
, mask_len
);
383 #endif /* CONFIG_AUDIT */