diff options
author | John Johansen <john.johansen@canonical.com> | 2012-02-16 09:20:26 -0500 |
---|---|---|
committer | John Johansen <john.johansen@canonical.com> | 2012-03-14 09:15:24 -0400 |
commit | 0fe1212d0539eb6c1e27d388711172d786e299cc (patch) | |
tree | b6e653222f271f52b8d4606102ef1e6bd72b7bc2 /security/apparmor | |
parent | 3372b68a3c982611dcc30b3c872f8bbdee019e5e (diff) |
AppArmor: Update dfa matching routines.
Update aa_dfa_match so that it doesn't result in an input string being
walked twice (once to get its length and another time to match)
Add a single step functions
aa_dfa_next
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <kees@ubuntu.com>
Diffstat (limited to 'security/apparmor')
-rw-r--r-- | security/apparmor/include/apparmor.h | 2 | ||||
-rw-r--r-- | security/apparmor/include/match.h | 3 | ||||
-rw-r--r-- | security/apparmor/match.c | 80 |
3 files changed, 81 insertions, 4 deletions
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h index df3649560818..248c408ddc1b 100644 --- a/security/apparmor/include/apparmor.h +++ b/security/apparmor/include/apparmor.h | |||
@@ -81,7 +81,7 @@ static inline unsigned int aa_dfa_null_transition(struct aa_dfa *dfa, | |||
81 | unsigned int start) | 81 | unsigned int start) |
82 | { | 82 | { |
83 | /* the null transition only needs the string's null terminator byte */ | 83 | /* the null transition only needs the string's null terminator byte */ |
84 | return aa_dfa_match_len(dfa, start, "", 1); | 84 | return aa_dfa_next(dfa, start, 0); |
85 | } | 85 | } |
86 | 86 | ||
87 | static inline bool mediated_filesystem(struct inode *inode) | 87 | static inline bool mediated_filesystem(struct inode *inode) |
diff --git a/security/apparmor/include/match.h b/security/apparmor/include/match.h index a4a863997bd5..775843e7f984 100644 --- a/security/apparmor/include/match.h +++ b/security/apparmor/include/match.h | |||
@@ -116,6 +116,9 @@ unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start, | |||
116 | const char *str, int len); | 116 | const char *str, int len); |
117 | unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start, | 117 | unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start, |
118 | const char *str); | 118 | const char *str); |
119 | unsigned int aa_dfa_next(struct aa_dfa *dfa, unsigned int state, | ||
120 | const char c); | ||
121 | |||
119 | void aa_dfa_free_kref(struct kref *kref); | 122 | void aa_dfa_free_kref(struct kref *kref); |
120 | 123 | ||
121 | /** | 124 | /** |
diff --git a/security/apparmor/match.c b/security/apparmor/match.c index 94de6b4907c8..90971a8c3789 100644 --- a/security/apparmor/match.c +++ b/security/apparmor/match.c | |||
@@ -335,12 +335,12 @@ unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start, | |||
335 | } | 335 | } |
336 | 336 | ||
337 | /** | 337 | /** |
338 | * aa_dfa_next_state - traverse @dfa to find state @str stops at | 338 | * aa_dfa_match - traverse @dfa to find state @str stops at |
339 | * @dfa: the dfa to match @str against (NOT NULL) | 339 | * @dfa: the dfa to match @str against (NOT NULL) |
340 | * @start: the state of the dfa to start matching in | 340 | * @start: the state of the dfa to start matching in |
341 | * @str: the null terminated string of bytes to match against the dfa (NOT NULL) | 341 | * @str: the null terminated string of bytes to match against the dfa (NOT NULL) |
342 | * | 342 | * |
343 | * aa_dfa_next_state will match @str against the dfa and return the state it | 343 | * aa_dfa_match will match @str against the dfa and return the state it |
344 | * finished matching in. The final state can be used to look up the accepting | 344 | * finished matching in. The final state can be used to look up the accepting |
345 | * label, or as the start state of a continuing match. | 345 | * label, or as the start state of a continuing match. |
346 | * | 346 | * |
@@ -349,5 +349,79 @@ unsigned int aa_dfa_match_len(struct aa_dfa *dfa, unsigned int start, | |||
349 | unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start, | 349 | unsigned int aa_dfa_match(struct aa_dfa *dfa, unsigned int start, |
350 | const char *str) | 350 | const char *str) |
351 | { | 351 | { |
352 | return aa_dfa_match_len(dfa, start, str, strlen(str)); | 352 | u16 *def = DEFAULT_TABLE(dfa); |
353 | u32 *base = BASE_TABLE(dfa); | ||
354 | u16 *next = NEXT_TABLE(dfa); | ||
355 | u16 *check = CHECK_TABLE(dfa); | ||
356 | unsigned int state = start, pos; | ||
357 | |||
358 | if (state == 0) | ||
359 | return 0; | ||
360 | |||
361 | /* current state is <state>, matching character *str */ | ||
362 | if (dfa->tables[YYTD_ID_EC]) { | ||
363 | /* Equivalence class table defined */ | ||
364 | u8 *equiv = EQUIV_TABLE(dfa); | ||
365 | /* default is direct to next state */ | ||
366 | while (*str) { | ||
367 | pos = base[state] + equiv[(u8) *str++]; | ||
368 | if (check[pos] == state) | ||
369 | state = next[pos]; | ||
370 | else | ||
371 | state = def[state]; | ||
372 | } | ||
373 | } else { | ||
374 | /* default is direct to next state */ | ||
375 | while (*str) { | ||
376 | pos = base[state] + (u8) *str++; | ||
377 | if (check[pos] == state) | ||
378 | state = next[pos]; | ||
379 | else | ||
380 | state = def[state]; | ||
381 | } | ||
382 | } | ||
383 | |||
384 | return state; | ||
385 | } | ||
386 | |||
387 | /** | ||
388 | * aa_dfa_next - step one character to the next state in the dfa | ||
389 | * @dfa: the dfa to tranverse (NOT NULL) | ||
390 | * @state: the state to start in | ||
391 | * @c: the input character to transition on | ||
392 | * | ||
393 | * aa_dfa_match will step through the dfa by one input character @c | ||
394 | * | ||
395 | * Returns: state reach after input @c | ||
396 | */ | ||
397 | unsigned int aa_dfa_next(struct aa_dfa *dfa, unsigned int state, | ||
398 | const char c) | ||
399 | { | ||
400 | u16 *def = DEFAULT_TABLE(dfa); | ||
401 | u32 *base = BASE_TABLE(dfa); | ||
402 | u16 *next = NEXT_TABLE(dfa); | ||
403 | u16 *check = CHECK_TABLE(dfa); | ||
404 | unsigned int pos; | ||
405 | |||
406 | /* current state is <state>, matching character *str */ | ||
407 | if (dfa->tables[YYTD_ID_EC]) { | ||
408 | /* Equivalence class table defined */ | ||
409 | u8 *equiv = EQUIV_TABLE(dfa); | ||
410 | /* default is direct to next state */ | ||
411 | |||
412 | pos = base[state] + equiv[(u8) c]; | ||
413 | if (check[pos] == state) | ||
414 | state = next[pos]; | ||
415 | else | ||
416 | state = def[state]; | ||
417 | } else { | ||
418 | /* default is direct to next state */ | ||
419 | pos = base[state] + (u8) c; | ||
420 | if (check[pos] == state) | ||
421 | state = next[pos]; | ||
422 | else | ||
423 | state = def[state]; | ||
424 | } | ||
425 | |||
426 | return state; | ||
353 | } | 427 | } |