diff options
-rw-r--r-- | include/net/netlabel.h | 6 | ||||
-rw-r--r-- | net/netlabel/netlabel_kapi.c | 16 | ||||
-rw-r--r-- | net/netlabel/netlabel_unlabeled.c | 1375 | ||||
-rw-r--r-- | net/netlabel/netlabel_unlabeled.h | 145 |
4 files changed, 1524 insertions, 18 deletions
diff --git a/include/net/netlabel.h b/include/net/netlabel.h index a3bffb4bb749..b3213c7c5309 100644 --- a/include/net/netlabel.h +++ b/include/net/netlabel.h | |||
@@ -67,7 +67,11 @@ | |||
67 | * NetLabel NETLINK protocol | 67 | * NetLabel NETLINK protocol |
68 | */ | 68 | */ |
69 | 69 | ||
70 | #define NETLBL_PROTO_VERSION 1 | 70 | /* NetLabel NETLINK protocol version |
71 | * 1: initial version | ||
72 | * 2: added static labels for unlabeled connections | ||
73 | */ | ||
74 | #define NETLBL_PROTO_VERSION 2 | ||
71 | 75 | ||
72 | /* NetLabel NETLINK types/families */ | 76 | /* NetLabel NETLINK types/families */ |
73 | #define NETLBL_NLTYPE_NONE 0 | 77 | #define NETLBL_NLTYPE_NONE 0 |
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index 49146153f235..c69e3e1f05c3 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c | |||
@@ -312,7 +312,7 @@ socket_setattr_return: | |||
312 | * @secattr: the security attributes | 312 | * @secattr: the security attributes |
313 | * | 313 | * |
314 | * Description: | 314 | * Description: |
315 | * Examines the given sock to see any NetLabel style labeling has been | 315 | * Examines the given sock to see if any NetLabel style labeling has been |
316 | * applied to the sock, if so it parses the socket label and returns the | 316 | * applied to the sock, if so it parses the socket label and returns the |
317 | * security attributes in @secattr. Returns zero on success, negative values | 317 | * security attributes in @secattr. Returns zero on success, negative values |
318 | * on failure. | 318 | * on failure. |
@@ -320,13 +320,7 @@ socket_setattr_return: | |||
320 | */ | 320 | */ |
321 | int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) | 321 | int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) |
322 | { | 322 | { |
323 | int ret_val; | 323 | return cipso_v4_sock_getattr(sk, secattr); |
324 | |||
325 | ret_val = cipso_v4_sock_getattr(sk, secattr); | ||
326 | if (ret_val == 0) | ||
327 | return 0; | ||
328 | |||
329 | return netlbl_unlabel_getattr(secattr); | ||
330 | } | 324 | } |
331 | 325 | ||
332 | /** | 326 | /** |
@@ -350,7 +344,7 @@ int netlbl_skbuff_getattr(const struct sk_buff *skb, | |||
350 | cipso_v4_skbuff_getattr(skb, secattr) == 0) | 344 | cipso_v4_skbuff_getattr(skb, secattr) == 0) |
351 | return 0; | 345 | return 0; |
352 | 346 | ||
353 | return netlbl_unlabel_getattr(secattr); | 347 | return netlbl_unlabel_getattr(skb, family, secattr); |
354 | } | 348 | } |
355 | 349 | ||
356 | /** | 350 | /** |
@@ -434,6 +428,10 @@ static int __init netlbl_init(void) | |||
434 | if (ret_val != 0) | 428 | if (ret_val != 0) |
435 | goto init_failure; | 429 | goto init_failure; |
436 | 430 | ||
431 | ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE); | ||
432 | if (ret_val != 0) | ||
433 | goto init_failure; | ||
434 | |||
437 | ret_val = netlbl_netlink_init(); | 435 | ret_val = netlbl_netlink_init(); |
438 | if (ret_val != 0) | 436 | if (ret_val != 0) |
439 | goto init_failure; | 437 | goto init_failure; |
diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index 7f5df0cbc63f..d0c628c875ae 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c | |||
@@ -10,7 +10,7 @@ | |||
10 | */ | 10 | */ |
11 | 11 | ||
12 | /* | 12 | /* |
13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 | 13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2007 |
14 | * | 14 | * |
15 | * This program is free software; you can redistribute it and/or modify | 15 | * This program is free software; you can redistribute it and/or modify |
16 | * it under the terms of the GNU General Public License as published by | 16 | * it under the terms of the GNU General Public License as published by |
@@ -29,27 +29,99 @@ | |||
29 | */ | 29 | */ |
30 | 30 | ||
31 | #include <linux/types.h> | 31 | #include <linux/types.h> |
32 | #include <linux/rcupdate.h> | ||
32 | #include <linux/list.h> | 33 | #include <linux/list.h> |
33 | #include <linux/spinlock.h> | 34 | #include <linux/spinlock.h> |
34 | #include <linux/socket.h> | 35 | #include <linux/socket.h> |
35 | #include <linux/string.h> | 36 | #include <linux/string.h> |
36 | #include <linux/skbuff.h> | 37 | #include <linux/skbuff.h> |
37 | #include <linux/audit.h> | 38 | #include <linux/audit.h> |
39 | #include <linux/in.h> | ||
40 | #include <linux/in6.h> | ||
41 | #include <linux/ip.h> | ||
42 | #include <linux/ipv6.h> | ||
43 | #include <linux/notifier.h> | ||
44 | #include <linux/netdevice.h> | ||
45 | #include <linux/security.h> | ||
38 | #include <net/sock.h> | 46 | #include <net/sock.h> |
39 | #include <net/netlink.h> | 47 | #include <net/netlink.h> |
40 | #include <net/genetlink.h> | 48 | #include <net/genetlink.h> |
41 | 49 | #include <net/ip.h> | |
50 | #include <net/ipv6.h> | ||
51 | #include <net/net_namespace.h> | ||
42 | #include <net/netlabel.h> | 52 | #include <net/netlabel.h> |
43 | #include <asm/bug.h> | 53 | #include <asm/bug.h> |
54 | #include <asm/atomic.h> | ||
44 | 55 | ||
45 | #include "netlabel_user.h" | 56 | #include "netlabel_user.h" |
46 | #include "netlabel_domainhash.h" | 57 | #include "netlabel_domainhash.h" |
47 | #include "netlabel_unlabeled.h" | 58 | #include "netlabel_unlabeled.h" |
59 | #include "netlabel_mgmt.h" | ||
60 | |||
61 | /* NOTE: at present we always use init's network namespace since we don't | ||
62 | * presently support different namespaces even though the majority of | ||
63 | * the functions in this file are "namespace safe" */ | ||
64 | |||
65 | /* The unlabeled connection hash table which we use to map network interfaces | ||
66 | * and addresses of unlabeled packets to a user specified secid value for the | ||
67 | * LSM. The hash table is used to lookup the network interface entry | ||
68 | * (struct netlbl_unlhsh_iface) and then the interface entry is used to | ||
69 | * lookup an IP address match from an ordered list. If a network interface | ||
70 | * match can not be found in the hash table then the default entry | ||
71 | * (netlbl_unlhsh_def) is used. The IP address entry list | ||
72 | * (struct netlbl_unlhsh_addr) is ordered such that the entries with a | ||
73 | * larger netmask come first. | ||
74 | */ | ||
75 | struct netlbl_unlhsh_tbl { | ||
76 | struct list_head *tbl; | ||
77 | u32 size; | ||
78 | }; | ||
79 | struct netlbl_unlhsh_addr4 { | ||
80 | __be32 addr; | ||
81 | __be32 mask; | ||
82 | u32 secid; | ||
83 | |||
84 | u32 valid; | ||
85 | struct list_head list; | ||
86 | struct rcu_head rcu; | ||
87 | }; | ||
88 | struct netlbl_unlhsh_addr6 { | ||
89 | struct in6_addr addr; | ||
90 | struct in6_addr mask; | ||
91 | u32 secid; | ||
92 | |||
93 | u32 valid; | ||
94 | struct list_head list; | ||
95 | struct rcu_head rcu; | ||
96 | }; | ||
97 | struct netlbl_unlhsh_iface { | ||
98 | int ifindex; | ||
99 | struct list_head addr4_list; | ||
100 | struct list_head addr6_list; | ||
101 | |||
102 | u32 valid; | ||
103 | struct list_head list; | ||
104 | struct rcu_head rcu; | ||
105 | }; | ||
106 | |||
107 | /* Argument struct for netlbl_unlhsh_walk() */ | ||
108 | struct netlbl_unlhsh_walk_arg { | ||
109 | struct netlink_callback *nl_cb; | ||
110 | struct sk_buff *skb; | ||
111 | u32 seq; | ||
112 | }; | ||
113 | |||
114 | /* Unlabeled connection hash table */ | ||
115 | /* updates should be so rare that having one spinlock for the entire | ||
116 | * hash table should be okay */ | ||
117 | static DEFINE_SPINLOCK(netlbl_unlhsh_lock); | ||
118 | static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL; | ||
119 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL; | ||
48 | 120 | ||
49 | /* Accept unlabeled packets flag */ | 121 | /* Accept unlabeled packets flag */ |
50 | static u8 netlabel_unlabel_acceptflg = 0; | 122 | static u8 netlabel_unlabel_acceptflg = 0; |
51 | 123 | ||
52 | /* NetLabel Generic NETLINK CIPSOv4 family */ | 124 | /* NetLabel Generic NETLINK unlabeled family */ |
53 | static struct genl_family netlbl_unlabel_gnl_family = { | 125 | static struct genl_family netlbl_unlabel_gnl_family = { |
54 | .id = GENL_ID_GENERATE, | 126 | .id = GENL_ID_GENERATE, |
55 | .hdrsize = 0, | 127 | .hdrsize = 0, |
@@ -61,11 +133,681 @@ static struct genl_family netlbl_unlabel_gnl_family = { | |||
61 | /* NetLabel Netlink attribute policy */ | 133 | /* NetLabel Netlink attribute policy */ |
62 | static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { | 134 | static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { |
63 | [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, | 135 | [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, |
136 | [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY, | ||
137 | .len = sizeof(struct in6_addr) }, | ||
138 | [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY, | ||
139 | .len = sizeof(struct in6_addr) }, | ||
140 | [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY, | ||
141 | .len = sizeof(struct in_addr) }, | ||
142 | [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY, | ||
143 | .len = sizeof(struct in_addr) }, | ||
144 | [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING, | ||
145 | .len = IFNAMSIZ - 1 }, | ||
146 | [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY } | ||
64 | }; | 147 | }; |
65 | 148 | ||
66 | /* | 149 | /* |
67 | * Helper Functions | 150 | * Unlabeled Connection Hash Table Functions |
151 | */ | ||
152 | |||
153 | /** | ||
154 | * netlbl_unlhsh_free_addr4 - Frees an IPv4 address entry from the hash table | ||
155 | * @entry: the entry's RCU field | ||
156 | * | ||
157 | * Description: | ||
158 | * This function is designed to be used as a callback to the call_rcu() | ||
159 | * function so that memory allocated to a hash table address entry can be | ||
160 | * released safely. | ||
161 | * | ||
162 | */ | ||
163 | static void netlbl_unlhsh_free_addr4(struct rcu_head *entry) | ||
164 | { | ||
165 | struct netlbl_unlhsh_addr4 *ptr; | ||
166 | |||
167 | ptr = container_of(entry, struct netlbl_unlhsh_addr4, rcu); | ||
168 | kfree(ptr); | ||
169 | } | ||
170 | |||
171 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
172 | /** | ||
173 | * netlbl_unlhsh_free_addr6 - Frees an IPv6 address entry from the hash table | ||
174 | * @entry: the entry's RCU field | ||
175 | * | ||
176 | * Description: | ||
177 | * This function is designed to be used as a callback to the call_rcu() | ||
178 | * function so that memory allocated to a hash table address entry can be | ||
179 | * released safely. | ||
180 | * | ||
181 | */ | ||
182 | static void netlbl_unlhsh_free_addr6(struct rcu_head *entry) | ||
183 | { | ||
184 | struct netlbl_unlhsh_addr6 *ptr; | ||
185 | |||
186 | ptr = container_of(entry, struct netlbl_unlhsh_addr6, rcu); | ||
187 | kfree(ptr); | ||
188 | } | ||
189 | #endif /* IPv6 */ | ||
190 | |||
191 | /** | ||
192 | * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table | ||
193 | * @entry: the entry's RCU field | ||
194 | * | ||
195 | * Description: | ||
196 | * This function is designed to be used as a callback to the call_rcu() | ||
197 | * function so that memory allocated to a hash table interface entry can be | ||
198 | * released safely. It is important to note that this function does not free | ||
199 | * the IPv4 and IPv6 address lists contained as part of an interface entry. It | ||
200 | * is up to the rest of the code to make sure an interface entry is only freed | ||
201 | * once it's address lists are empty. | ||
202 | * | ||
203 | */ | ||
204 | static void netlbl_unlhsh_free_iface(struct rcu_head *entry) | ||
205 | { | ||
206 | struct netlbl_unlhsh_iface *iface; | ||
207 | struct netlbl_unlhsh_addr4 *iter4; | ||
208 | struct netlbl_unlhsh_addr4 *tmp4; | ||
209 | struct netlbl_unlhsh_addr6 *iter6; | ||
210 | struct netlbl_unlhsh_addr6 *tmp6; | ||
211 | |||
212 | iface = container_of(entry, struct netlbl_unlhsh_iface, rcu); | ||
213 | |||
214 | /* no need for locks here since we are the only one with access to this | ||
215 | * structure */ | ||
216 | |||
217 | list_for_each_entry_safe(iter4, tmp4, &iface->addr4_list, list) | ||
218 | if (iter4->valid) { | ||
219 | list_del_rcu(&iter4->list); | ||
220 | kfree(iter4); | ||
221 | } | ||
222 | list_for_each_entry_safe(iter6, tmp6, &iface->addr6_list, list) | ||
223 | if (iter6->valid) { | ||
224 | list_del_rcu(&iter6->list); | ||
225 | kfree(iter6); | ||
226 | } | ||
227 | kfree(iface); | ||
228 | } | ||
229 | |||
230 | /** | ||
231 | * netlbl_unlhsh_hash - Hashing function for the hash table | ||
232 | * @ifindex: the network interface/device to hash | ||
233 | * | ||
234 | * Description: | ||
235 | * This is the hashing function for the unlabeled hash table, it returns the | ||
236 | * bucket number for the given device/interface. The caller is responsible for | ||
237 | * calling the rcu_read_[un]lock() functions. | ||
238 | * | ||
239 | */ | ||
240 | static u32 netlbl_unlhsh_hash(int ifindex) | ||
241 | { | ||
242 | /* this is taken _almost_ directly from | ||
243 | * security/selinux/netif.c:sel_netif_hasfn() as they do pretty much | ||
244 | * the same thing */ | ||
245 | return ifindex & (rcu_dereference(netlbl_unlhsh)->size - 1); | ||
246 | } | ||
247 | |||
248 | /** | ||
249 | * netlbl_unlhsh_search_addr4 - Search for a matching IPv4 address entry | ||
250 | * @addr: IPv4 address | ||
251 | * @iface: the network interface entry | ||
252 | * | ||
253 | * Description: | ||
254 | * Searches the IPv4 address list of the network interface specified by @iface. | ||
255 | * If a matching address entry is found it is returned, otherwise NULL is | ||
256 | * returned. The caller is responsible for calling the rcu_read_[un]lock() | ||
257 | * functions. | ||
258 | * | ||
259 | */ | ||
260 | static struct netlbl_unlhsh_addr4 *netlbl_unlhsh_search_addr4( | ||
261 | __be32 addr, | ||
262 | const struct netlbl_unlhsh_iface *iface) | ||
263 | { | ||
264 | struct netlbl_unlhsh_addr4 *iter; | ||
265 | |||
266 | list_for_each_entry_rcu(iter, &iface->addr4_list, list) | ||
267 | if (iter->valid && (addr & iter->mask) == iter->addr) | ||
268 | return iter; | ||
269 | |||
270 | return NULL; | ||
271 | } | ||
272 | |||
273 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
274 | /** | ||
275 | * netlbl_unlhsh_search_addr6 - Search for a matching IPv6 address entry | ||
276 | * @addr: IPv6 address | ||
277 | * @iface: the network interface entry | ||
278 | * | ||
279 | * Description: | ||
280 | * Searches the IPv6 address list of the network interface specified by @iface. | ||
281 | * If a matching address entry is found it is returned, otherwise NULL is | ||
282 | * returned. The caller is responsible for calling the rcu_read_[un]lock() | ||
283 | * functions. | ||
284 | * | ||
285 | */ | ||
286 | static struct netlbl_unlhsh_addr6 *netlbl_unlhsh_search_addr6( | ||
287 | const struct in6_addr *addr, | ||
288 | const struct netlbl_unlhsh_iface *iface) | ||
289 | { | ||
290 | struct netlbl_unlhsh_addr6 *iter; | ||
291 | |||
292 | list_for_each_entry_rcu(iter, &iface->addr6_list, list) | ||
293 | if (iter->valid && | ||
294 | ipv6_masked_addr_cmp(&iter->addr, &iter->mask, addr) == 0) | ||
295 | return iter; | ||
296 | |||
297 | return NULL; | ||
298 | } | ||
299 | #endif /* IPv6 */ | ||
300 | |||
301 | /** | ||
302 | * netlbl_unlhsh_search_iface - Search for a matching interface entry | ||
303 | * @ifindex: the network interface | ||
304 | * | ||
305 | * Description: | ||
306 | * Searches the unlabeled connection hash table and returns a pointer to the | ||
307 | * interface entry which matches @ifindex, otherwise NULL is returned. The | ||
308 | * caller is responsible for calling the rcu_read_[un]lock() functions. | ||
309 | * | ||
310 | */ | ||
311 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex) | ||
312 | { | ||
313 | u32 bkt; | ||
314 | struct netlbl_unlhsh_iface *iter; | ||
315 | |||
316 | bkt = netlbl_unlhsh_hash(ifindex); | ||
317 | list_for_each_entry_rcu(iter, | ||
318 | &rcu_dereference(netlbl_unlhsh)->tbl[bkt], | ||
319 | list) | ||
320 | if (iter->valid && iter->ifindex == ifindex) | ||
321 | return iter; | ||
322 | |||
323 | return NULL; | ||
324 | } | ||
325 | |||
326 | /** | ||
327 | * netlbl_unlhsh_search_iface_def - Search for a matching interface entry | ||
328 | * @ifindex: the network interface | ||
329 | * | ||
330 | * Description: | ||
331 | * Searches the unlabeled connection hash table and returns a pointer to the | ||
332 | * interface entry which matches @ifindex. If an exact match can not be found | ||
333 | * and there is a valid default entry, the default entry is returned, otherwise | ||
334 | * NULL is returned. The caller is responsible for calling the | ||
335 | * rcu_read_[un]lock() functions. | ||
336 | * | ||
337 | */ | ||
338 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface_def(int ifindex) | ||
339 | { | ||
340 | struct netlbl_unlhsh_iface *entry; | ||
341 | |||
342 | entry = netlbl_unlhsh_search_iface(ifindex); | ||
343 | if (entry != NULL) | ||
344 | return entry; | ||
345 | |||
346 | entry = rcu_dereference(netlbl_unlhsh_def); | ||
347 | if (entry != NULL && entry->valid) | ||
348 | return entry; | ||
349 | |||
350 | return NULL; | ||
351 | } | ||
352 | |||
353 | /** | ||
354 | * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table | ||
355 | * @iface: the associated interface entry | ||
356 | * @addr: IPv4 address in network byte order | ||
357 | * @mask: IPv4 address mask in network byte order | ||
358 | * @secid: LSM secid value for entry | ||
359 | * | ||
360 | * Description: | ||
361 | * Add a new address entry into the unlabeled connection hash table using the | ||
362 | * interface entry specified by @iface. On success zero is returned, otherwise | ||
363 | * a negative value is returned. The caller is responsible for calling the | ||
364 | * rcu_read_[un]lock() functions. | ||
365 | * | ||
68 | */ | 366 | */ |
367 | static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface, | ||
368 | const struct in_addr *addr, | ||
369 | const struct in_addr *mask, | ||
370 | u32 secid) | ||
371 | { | ||
372 | struct netlbl_unlhsh_addr4 *entry; | ||
373 | struct netlbl_unlhsh_addr4 *iter; | ||
374 | |||
375 | entry = kzalloc(sizeof(*entry), GFP_ATOMIC); | ||
376 | if (entry == NULL) | ||
377 | return -ENOMEM; | ||
378 | |||
379 | entry->addr = addr->s_addr & mask->s_addr; | ||
380 | entry->mask = mask->s_addr; | ||
381 | entry->secid = secid; | ||
382 | entry->valid = 1; | ||
383 | INIT_RCU_HEAD(&entry->rcu); | ||
384 | |||
385 | spin_lock(&netlbl_unlhsh_lock); | ||
386 | iter = netlbl_unlhsh_search_addr4(entry->addr, iface); | ||
387 | if (iter != NULL && | ||
388 | iter->addr == addr->s_addr && iter->mask == mask->s_addr) { | ||
389 | spin_unlock(&netlbl_unlhsh_lock); | ||
390 | kfree(entry); | ||
391 | return -EEXIST; | ||
392 | } | ||
393 | /* in order to speed up address searches through the list (the common | ||
394 | * case) we need to keep the list in order based on the size of the | ||
395 | * address mask such that the entry with the widest mask (smallest | ||
396 | * numerical value) appears first in the list */ | ||
397 | list_for_each_entry_rcu(iter, &iface->addr4_list, list) | ||
398 | if (iter->valid && | ||
399 | ntohl(entry->mask) > ntohl(iter->mask)) { | ||
400 | __list_add_rcu(&entry->list, | ||
401 | iter->list.prev, | ||
402 | &iter->list); | ||
403 | spin_unlock(&netlbl_unlhsh_lock); | ||
404 | return 0; | ||
405 | } | ||
406 | list_add_tail_rcu(&entry->list, &iface->addr4_list); | ||
407 | spin_unlock(&netlbl_unlhsh_lock); | ||
408 | return 0; | ||
409 | } | ||
410 | |||
411 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
412 | /** | ||
413 | * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table | ||
414 | * @iface: the associated interface entry | ||
415 | * @addr: IPv6 address in network byte order | ||
416 | * @mask: IPv6 address mask in network byte order | ||
417 | * @secid: LSM secid value for entry | ||
418 | * | ||
419 | * Description: | ||
420 | * Add a new address entry into the unlabeled connection hash table using the | ||
421 | * interface entry specified by @iface. On success zero is returned, otherwise | ||
422 | * a negative value is returned. The caller is responsible for calling the | ||
423 | * rcu_read_[un]lock() functions. | ||
424 | * | ||
425 | */ | ||
426 | static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface, | ||
427 | const struct in6_addr *addr, | ||
428 | const struct in6_addr *mask, | ||
429 | u32 secid) | ||
430 | { | ||
431 | struct netlbl_unlhsh_addr6 *entry; | ||
432 | struct netlbl_unlhsh_addr6 *iter; | ||
433 | |||
434 | entry = kzalloc(sizeof(*entry), GFP_ATOMIC); | ||
435 | if (entry == NULL) | ||
436 | return -ENOMEM; | ||
437 | |||
438 | ipv6_addr_copy(&entry->addr, addr); | ||
439 | entry->addr.s6_addr32[0] &= mask->s6_addr32[0]; | ||
440 | entry->addr.s6_addr32[1] &= mask->s6_addr32[1]; | ||
441 | entry->addr.s6_addr32[2] &= mask->s6_addr32[2]; | ||
442 | entry->addr.s6_addr32[3] &= mask->s6_addr32[3]; | ||
443 | ipv6_addr_copy(&entry->mask, mask); | ||
444 | entry->secid = secid; | ||
445 | entry->valid = 1; | ||
446 | INIT_RCU_HEAD(&entry->rcu); | ||
447 | |||
448 | spin_lock(&netlbl_unlhsh_lock); | ||
449 | iter = netlbl_unlhsh_search_addr6(&entry->addr, iface); | ||
450 | if (iter != NULL && | ||
451 | (ipv6_addr_equal(&iter->addr, addr) && | ||
452 | ipv6_addr_equal(&iter->mask, mask))) { | ||
453 | spin_unlock(&netlbl_unlhsh_lock); | ||
454 | kfree(entry); | ||
455 | return -EEXIST; | ||
456 | } | ||
457 | /* in order to speed up address searches through the list (the common | ||
458 | * case) we need to keep the list in order based on the size of the | ||
459 | * address mask such that the entry with the widest mask (smallest | ||
460 | * numerical value) appears first in the list */ | ||
461 | list_for_each_entry_rcu(iter, &iface->addr6_list, list) | ||
462 | if (iter->valid && | ||
463 | ipv6_addr_cmp(&entry->mask, &iter->mask) > 0) { | ||
464 | __list_add_rcu(&entry->list, | ||
465 | iter->list.prev, | ||
466 | &iter->list); | ||
467 | spin_unlock(&netlbl_unlhsh_lock); | ||
468 | return 0; | ||
469 | } | ||
470 | list_add_tail_rcu(&entry->list, &iface->addr6_list); | ||
471 | spin_unlock(&netlbl_unlhsh_lock); | ||
472 | return 0; | ||
473 | } | ||
474 | #endif /* IPv6 */ | ||
475 | |||
476 | /** | ||
477 | * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table | ||
478 | * @ifindex: network interface | ||
479 | * | ||
480 | * Description: | ||
481 | * Add a new, empty, interface entry into the unlabeled connection hash table. | ||
482 | * On success a pointer to the new interface entry is returned, on failure NULL | ||
483 | * is returned. The caller is responsible for calling the rcu_read_[un]lock() | ||
484 | * functions. | ||
485 | * | ||
486 | */ | ||
487 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex) | ||
488 | { | ||
489 | u32 bkt; | ||
490 | struct netlbl_unlhsh_iface *iface; | ||
491 | |||
492 | iface = kzalloc(sizeof(*iface), GFP_ATOMIC); | ||
493 | if (iface == NULL) | ||
494 | return NULL; | ||
495 | |||
496 | iface->ifindex = ifindex; | ||
497 | INIT_LIST_HEAD(&iface->addr4_list); | ||
498 | INIT_LIST_HEAD(&iface->addr6_list); | ||
499 | iface->valid = 1; | ||
500 | INIT_RCU_HEAD(&iface->rcu); | ||
501 | |||
502 | spin_lock(&netlbl_unlhsh_lock); | ||
503 | if (ifindex > 0) { | ||
504 | bkt = netlbl_unlhsh_hash(ifindex); | ||
505 | if (netlbl_unlhsh_search_iface(ifindex) != NULL) | ||
506 | goto add_iface_failure; | ||
507 | list_add_tail_rcu(&iface->list, | ||
508 | &rcu_dereference(netlbl_unlhsh)->tbl[bkt]); | ||
509 | } else { | ||
510 | INIT_LIST_HEAD(&iface->list); | ||
511 | if (rcu_dereference(netlbl_unlhsh_def) != NULL) | ||
512 | goto add_iface_failure; | ||
513 | rcu_assign_pointer(netlbl_unlhsh_def, iface); | ||
514 | } | ||
515 | spin_unlock(&netlbl_unlhsh_lock); | ||
516 | |||
517 | return iface; | ||
518 | |||
519 | add_iface_failure: | ||
520 | spin_unlock(&netlbl_unlhsh_lock); | ||
521 | kfree(iface); | ||
522 | return NULL; | ||
523 | } | ||
524 | |||
525 | /** | ||
526 | * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table | ||
527 | * @net: network namespace | ||
528 | * @dev_name: interface name | ||
529 | * @addr: IP address in network byte order | ||
530 | * @mask: address mask in network byte order | ||
531 | * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) | ||
532 | * @secid: LSM secid value for the entry | ||
533 | * | ||
534 | * Description: | ||
535 | * Adds a new entry to the unlabeled connection hash table. Returns zero on | ||
536 | * success, negative values on failure. | ||
537 | * | ||
538 | */ | ||
539 | static int netlbl_unlhsh_add(struct net *net, | ||
540 | const char *dev_name, | ||
541 | const void *addr, | ||
542 | const void *mask, | ||
543 | u32 addr_len, | ||
544 | u32 secid) | ||
545 | { | ||
546 | int ret_val; | ||
547 | int ifindex; | ||
548 | struct net_device *dev; | ||
549 | struct netlbl_unlhsh_iface *iface; | ||
550 | |||
551 | if (addr_len != sizeof(struct in_addr) && | ||
552 | addr_len != sizeof(struct in6_addr)) | ||
553 | return -EINVAL; | ||
554 | |||
555 | rcu_read_lock(); | ||
556 | if (dev_name != NULL) { | ||
557 | dev = dev_get_by_name(net, dev_name); | ||
558 | if (dev == NULL) { | ||
559 | ret_val = -ENODEV; | ||
560 | goto unlhsh_add_return; | ||
561 | } | ||
562 | ifindex = dev->ifindex; | ||
563 | dev_put(dev); | ||
564 | iface = netlbl_unlhsh_search_iface(ifindex); | ||
565 | } else { | ||
566 | ifindex = 0; | ||
567 | iface = rcu_dereference(netlbl_unlhsh_def); | ||
568 | } | ||
569 | if (iface == NULL) { | ||
570 | iface = netlbl_unlhsh_add_iface(ifindex); | ||
571 | if (iface == NULL) { | ||
572 | ret_val = -ENOMEM; | ||
573 | goto unlhsh_add_return; | ||
574 | } | ||
575 | } | ||
576 | switch (addr_len) { | ||
577 | case sizeof(struct in_addr): | ||
578 | ret_val = netlbl_unlhsh_add_addr4(iface, addr, mask, secid); | ||
579 | break; | ||
580 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
581 | case sizeof(struct in6_addr): | ||
582 | ret_val = netlbl_unlhsh_add_addr6(iface, addr, mask, secid); | ||
583 | break; | ||
584 | #endif /* IPv6 */ | ||
585 | default: | ||
586 | ret_val = -EINVAL; | ||
587 | } | ||
588 | if (ret_val == 0) | ||
589 | atomic_inc(&netlabel_mgmt_protocount); | ||
590 | |||
591 | unlhsh_add_return: | ||
592 | rcu_read_unlock(); | ||
593 | return ret_val; | ||
594 | } | ||
595 | |||
596 | /** | ||
597 | * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry | ||
598 | * @iface: interface entry | ||
599 | * @addr: IP address | ||
600 | * @mask: IP address mask | ||
601 | * | ||
602 | * Description: | ||
603 | * Remove an IP address entry from the unlabeled connection hash table. | ||
604 | * Returns zero on success, negative values on failure. The caller is | ||
605 | * responsible for calling the rcu_read_[un]lock() functions. | ||
606 | * | ||
607 | */ | ||
608 | static int netlbl_unlhsh_remove_addr4(struct netlbl_unlhsh_iface *iface, | ||
609 | const struct in_addr *addr, | ||
610 | const struct in_addr *mask) | ||
611 | { | ||
612 | int ret_val = -ENOENT; | ||
613 | struct netlbl_unlhsh_addr4 *entry; | ||
614 | |||
615 | spin_lock(&netlbl_unlhsh_lock); | ||
616 | entry = netlbl_unlhsh_search_addr4(addr->s_addr, iface); | ||
617 | if (entry != NULL && | ||
618 | entry->addr == addr->s_addr && entry->mask == mask->s_addr) { | ||
619 | entry->valid = 0; | ||
620 | list_del_rcu(&entry->list); | ||
621 | ret_val = 0; | ||
622 | } | ||
623 | spin_unlock(&netlbl_unlhsh_lock); | ||
624 | |||
625 | if (ret_val == 0) | ||
626 | call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4); | ||
627 | return ret_val; | ||
628 | } | ||
629 | |||
630 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
631 | /** | ||
632 | * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry | ||
633 | * @iface: interface entry | ||
634 | * @addr: IP address | ||
635 | * @mask: IP address mask | ||
636 | * | ||
637 | * Description: | ||
638 | * Remove an IP address entry from the unlabeled connection hash table. | ||
639 | * Returns zero on success, negative values on failure. The caller is | ||
640 | * responsible for calling the rcu_read_[un]lock() functions. | ||
641 | * | ||
642 | */ | ||
643 | static int netlbl_unlhsh_remove_addr6(struct netlbl_unlhsh_iface *iface, | ||
644 | const struct in6_addr *addr, | ||
645 | const struct in6_addr *mask) | ||
646 | { | ||
647 | int ret_val = -ENOENT; | ||
648 | struct netlbl_unlhsh_addr6 *entry; | ||
649 | |||
650 | spin_lock(&netlbl_unlhsh_lock); | ||
651 | entry = netlbl_unlhsh_search_addr6(addr, iface); | ||
652 | if (entry != NULL && | ||
653 | (ipv6_addr_equal(&entry->addr, addr) && | ||
654 | ipv6_addr_equal(&entry->mask, mask))) { | ||
655 | entry->valid = 0; | ||
656 | list_del_rcu(&entry->list); | ||
657 | ret_val = 0; | ||
658 | } | ||
659 | spin_unlock(&netlbl_unlhsh_lock); | ||
660 | |||
661 | if (ret_val == 0) | ||
662 | call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6); | ||
663 | return ret_val; | ||
664 | } | ||
665 | #endif /* IPv6 */ | ||
666 | |||
667 | /** | ||
668 | * netlbl_unlhsh_condremove_iface - Remove an interface entry | ||
669 | * @iface: the interface entry | ||
670 | * | ||
671 | * Description: | ||
672 | * Remove an interface entry from the unlabeled connection hash table if it is | ||
673 | * empty. An interface entry is considered to be empty if there are no | ||
674 | * address entries assigned to it. | ||
675 | * | ||
676 | */ | ||
677 | static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface) | ||
678 | { | ||
679 | struct netlbl_unlhsh_addr4 *iter4; | ||
680 | struct netlbl_unlhsh_addr6 *iter6; | ||
681 | |||
682 | spin_lock(&netlbl_unlhsh_lock); | ||
683 | list_for_each_entry_rcu(iter4, &iface->addr4_list, list) | ||
684 | if (iter4->valid) | ||
685 | goto unlhsh_condremove_failure; | ||
686 | list_for_each_entry_rcu(iter6, &iface->addr6_list, list) | ||
687 | if (iter6->valid) | ||
688 | goto unlhsh_condremove_failure; | ||
689 | iface->valid = 0; | ||
690 | if (iface->ifindex > 0) | ||
691 | list_del_rcu(&iface->list); | ||
692 | else | ||
693 | rcu_assign_pointer(netlbl_unlhsh_def, NULL); | ||
694 | spin_unlock(&netlbl_unlhsh_lock); | ||
695 | |||
696 | call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); | ||
697 | return; | ||
698 | |||
699 | unlhsh_condremove_failure: | ||
700 | spin_unlock(&netlbl_unlhsh_lock); | ||
701 | return; | ||
702 | } | ||
703 | |||
704 | /** | ||
705 | * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table | ||
706 | * @net: network namespace | ||
707 | * @dev_name: interface name | ||
708 | * @addr: IP address in network byte order | ||
709 | * @mask: address mask in network byte order | ||
710 | * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) | ||
711 | * | ||
712 | * Description: | ||
713 | * Removes and existing entry from the unlabeled connection hash table. | ||
714 | * Returns zero on success, negative values on failure. | ||
715 | * | ||
716 | */ | ||
717 | static int netlbl_unlhsh_remove(struct net *net, | ||
718 | const char *dev_name, | ||
719 | const void *addr, | ||
720 | const void *mask, | ||
721 | u32 addr_len) | ||
722 | { | ||
723 | int ret_val; | ||
724 | struct net_device *dev; | ||
725 | struct netlbl_unlhsh_iface *iface; | ||
726 | |||
727 | if (addr_len != sizeof(struct in_addr) && | ||
728 | addr_len != sizeof(struct in6_addr)) | ||
729 | return -EINVAL; | ||
730 | |||
731 | rcu_read_lock(); | ||
732 | if (dev_name != NULL) { | ||
733 | dev = dev_get_by_name(net, dev_name); | ||
734 | if (dev == NULL) { | ||
735 | ret_val = -ENODEV; | ||
736 | goto unlhsh_remove_return; | ||
737 | } | ||
738 | iface = netlbl_unlhsh_search_iface(dev->ifindex); | ||
739 | dev_put(dev); | ||
740 | } else | ||
741 | iface = rcu_dereference(netlbl_unlhsh_def); | ||
742 | if (iface == NULL) { | ||
743 | ret_val = -ENOENT; | ||
744 | goto unlhsh_remove_return; | ||
745 | } | ||
746 | switch (addr_len) { | ||
747 | case sizeof(struct in_addr): | ||
748 | ret_val = netlbl_unlhsh_remove_addr4(iface, addr, mask); | ||
749 | break; | ||
750 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
751 | case sizeof(struct in6_addr): | ||
752 | ret_val = netlbl_unlhsh_remove_addr6(iface, addr, mask); | ||
753 | break; | ||
754 | #endif /* IPv6 */ | ||
755 | default: | ||
756 | ret_val = -EINVAL; | ||
757 | } | ||
758 | if (ret_val == 0) { | ||
759 | netlbl_unlhsh_condremove_iface(iface); | ||
760 | atomic_dec(&netlabel_mgmt_protocount); | ||
761 | } | ||
762 | |||
763 | unlhsh_remove_return: | ||
764 | rcu_read_unlock(); | ||
765 | return ret_val; | ||
766 | } | ||
767 | |||
768 | /* | ||
769 | * General Helper Functions | ||
770 | */ | ||
771 | |||
772 | /** | ||
773 | * netlbl_unlhsh_netdev_handler - Network device notification handler | ||
774 | * @this: notifier block | ||
775 | * @event: the event | ||
776 | * @ptr: the network device (cast to void) | ||
777 | * | ||
778 | * Description: | ||
779 | * Handle network device events, although at present all we care about is a | ||
780 | * network device going away. In the case of a device going away we clear any | ||
781 | * related entries from the unlabeled connection hash table. | ||
782 | * | ||
783 | */ | ||
784 | static int netlbl_unlhsh_netdev_handler(struct notifier_block *this, | ||
785 | unsigned long event, | ||
786 | void *ptr) | ||
787 | { | ||
788 | struct net_device *dev = ptr; | ||
789 | struct netlbl_unlhsh_iface *iface = NULL; | ||
790 | |||
791 | if (dev->nd_net != &init_net) | ||
792 | return NOTIFY_DONE; | ||
793 | |||
794 | /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */ | ||
795 | if (event == NETDEV_DOWN) { | ||
796 | spin_lock(&netlbl_unlhsh_lock); | ||
797 | iface = netlbl_unlhsh_search_iface(dev->ifindex); | ||
798 | if (iface != NULL && iface->valid) { | ||
799 | iface->valid = 0; | ||
800 | list_del_rcu(&iface->list); | ||
801 | } else | ||
802 | iface = NULL; | ||
803 | spin_unlock(&netlbl_unlhsh_lock); | ||
804 | } | ||
805 | |||
806 | if (iface != NULL) | ||
807 | call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); | ||
808 | |||
809 | return NOTIFY_DONE; | ||
810 | } | ||
69 | 811 | ||
70 | /** | 812 | /** |
71 | * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag | 813 | * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag |
@@ -93,6 +835,48 @@ static void netlbl_unlabel_acceptflg_set(u8 value, | |||
93 | } | 835 | } |
94 | } | 836 | } |
95 | 837 | ||
838 | /** | ||
839 | * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information | ||
840 | * @info: the Generic NETLINK info block | ||
841 | * @addr: the IP address | ||
842 | * @mask: the IP address mask | ||
843 | * @len: the address length | ||
844 | * | ||
845 | * Description: | ||
846 | * Examine the Generic NETLINK message and extract the IP address information. | ||
847 | * Returns zero on success, negative values on failure. | ||
848 | * | ||
849 | */ | ||
850 | static int netlbl_unlabel_addrinfo_get(struct genl_info *info, | ||
851 | void **addr, | ||
852 | void **mask, | ||
853 | u32 *len) | ||
854 | { | ||
855 | u32 addr_len; | ||
856 | |||
857 | if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) { | ||
858 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); | ||
859 | if (addr_len != sizeof(struct in_addr) && | ||
860 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) | ||
861 | return -EINVAL; | ||
862 | *len = addr_len; | ||
863 | *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); | ||
864 | *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]); | ||
865 | return 0; | ||
866 | } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) { | ||
867 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); | ||
868 | if (addr_len != sizeof(struct in6_addr) && | ||
869 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK])) | ||
870 | return -EINVAL; | ||
871 | *len = addr_len; | ||
872 | *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); | ||
873 | *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]); | ||
874 | return 0; | ||
875 | } | ||
876 | |||
877 | return -EINVAL; | ||
878 | } | ||
879 | |||
96 | /* | 880 | /* |
97 | * NetLabel Command Handlers | 881 | * NetLabel Command Handlers |
98 | */ | 882 | */ |
@@ -168,11 +952,470 @@ list_failure: | |||
168 | return ret_val; | 952 | return ret_val; |
169 | } | 953 | } |
170 | 954 | ||
955 | /** | ||
956 | * netlbl_unlabel_staticadd - Handle a STATICADD message | ||
957 | * @skb: the NETLINK buffer | ||
958 | * @info: the Generic NETLINK info block | ||
959 | * | ||
960 | * Description: | ||
961 | * Process a user generated STATICADD message and add a new unlabeled | ||
962 | * connection entry to the hash table. Returns zero on success, negative | ||
963 | * values on failure. | ||
964 | * | ||
965 | */ | ||
966 | static int netlbl_unlabel_staticadd(struct sk_buff *skb, | ||
967 | struct genl_info *info) | ||
968 | { | ||
969 | int ret_val; | ||
970 | char *dev_name; | ||
971 | void *addr; | ||
972 | void *mask; | ||
973 | u32 addr_len; | ||
974 | u32 secid; | ||
975 | |||
976 | /* Don't allow users to add both IPv4 and IPv6 addresses for a | ||
977 | * single entry. However, allow users to create two entries, one each | ||
978 | * for IPv4 and IPv4, with the same LSM security context which should | ||
979 | * achieve the same result. */ | ||
980 | if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || | ||
981 | !info->attrs[NLBL_UNLABEL_A_IFACE] || | ||
982 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || | ||
983 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ | ||
984 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || | ||
985 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) | ||
986 | return -EINVAL; | ||
987 | |||
988 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); | ||
989 | if (ret_val != 0) | ||
990 | return ret_val; | ||
991 | dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); | ||
992 | ret_val = security_secctx_to_secid( | ||
993 | nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), | ||
994 | nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), | ||
995 | &secid); | ||
996 | if (ret_val != 0) | ||
997 | return ret_val; | ||
998 | |||
999 | return netlbl_unlhsh_add(&init_net, | ||
1000 | dev_name, addr, mask, addr_len, secid); | ||
1001 | } | ||
1002 | |||
1003 | /** | ||
1004 | * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message | ||
1005 | * @skb: the NETLINK buffer | ||
1006 | * @info: the Generic NETLINK info block | ||
1007 | * | ||
1008 | * Description: | ||
1009 | * Process a user generated STATICADDDEF message and add a new default | ||
1010 | * unlabeled connection entry. Returns zero on success, negative values on | ||
1011 | * failure. | ||
1012 | * | ||
1013 | */ | ||
1014 | static int netlbl_unlabel_staticadddef(struct sk_buff *skb, | ||
1015 | struct genl_info *info) | ||
1016 | { | ||
1017 | int ret_val; | ||
1018 | void *addr; | ||
1019 | void *mask; | ||
1020 | u32 addr_len; | ||
1021 | u32 secid; | ||
1022 | |||
1023 | /* Don't allow users to add both IPv4 and IPv6 addresses for a | ||
1024 | * single entry. However, allow users to create two entries, one each | ||
1025 | * for IPv4 and IPv6, with the same LSM security context which should | ||
1026 | * achieve the same result. */ | ||
1027 | if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || | ||
1028 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || | ||
1029 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ | ||
1030 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || | ||
1031 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) | ||
1032 | return -EINVAL; | ||
1033 | |||
1034 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); | ||
1035 | if (ret_val != 0) | ||
1036 | return ret_val; | ||
1037 | ret_val = security_secctx_to_secid( | ||
1038 | nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), | ||
1039 | nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), | ||
1040 | &secid); | ||
1041 | if (ret_val != 0) | ||
1042 | return ret_val; | ||
1043 | |||
1044 | return netlbl_unlhsh_add(&init_net, NULL, addr, mask, addr_len, secid); | ||
1045 | } | ||
1046 | |||
1047 | /** | ||
1048 | * netlbl_unlabel_staticremove - Handle a STATICREMOVE message | ||
1049 | * @skb: the NETLINK buffer | ||
1050 | * @info: the Generic NETLINK info block | ||
1051 | * | ||
1052 | * Description: | ||
1053 | * Process a user generated STATICREMOVE message and remove the specified | ||
1054 | * unlabeled connection entry. Returns zero on success, negative values on | ||
1055 | * failure. | ||
1056 | * | ||
1057 | */ | ||
1058 | static int netlbl_unlabel_staticremove(struct sk_buff *skb, | ||
1059 | struct genl_info *info) | ||
1060 | { | ||
1061 | int ret_val; | ||
1062 | char *dev_name; | ||
1063 | void *addr; | ||
1064 | void *mask; | ||
1065 | u32 addr_len; | ||
1066 | |||
1067 | /* See the note in netlbl_unlabel_staticadd() about not allowing both | ||
1068 | * IPv4 and IPv6 in the same entry. */ | ||
1069 | if (!info->attrs[NLBL_UNLABEL_A_IFACE] || | ||
1070 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || | ||
1071 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ | ||
1072 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || | ||
1073 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) | ||
1074 | return -EINVAL; | ||
1075 | |||
1076 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); | ||
1077 | if (ret_val != 0) | ||
1078 | return ret_val; | ||
1079 | dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); | ||
1080 | |||
1081 | return netlbl_unlhsh_remove(&init_net, dev_name, addr, mask, addr_len); | ||
1082 | } | ||
1083 | |||
1084 | /** | ||
1085 | * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message | ||
1086 | * @skb: the NETLINK buffer | ||
1087 | * @info: the Generic NETLINK info block | ||
1088 | * | ||
1089 | * Description: | ||
1090 | * Process a user generated STATICREMOVEDEF message and remove the default | ||
1091 | * unlabeled connection entry. Returns zero on success, negative values on | ||
1092 | * failure. | ||
1093 | * | ||
1094 | */ | ||
1095 | static int netlbl_unlabel_staticremovedef(struct sk_buff *skb, | ||
1096 | struct genl_info *info) | ||
1097 | { | ||
1098 | int ret_val; | ||
1099 | void *addr; | ||
1100 | void *mask; | ||
1101 | u32 addr_len; | ||
1102 | |||
1103 | /* See the note in netlbl_unlabel_staticadd() about not allowing both | ||
1104 | * IPv4 and IPv6 in the same entry. */ | ||
1105 | if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || | ||
1106 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ | ||
1107 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || | ||
1108 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) | ||
1109 | return -EINVAL; | ||
1110 | |||
1111 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); | ||
1112 | if (ret_val != 0) | ||
1113 | return ret_val; | ||
1114 | |||
1115 | return netlbl_unlhsh_remove(&init_net, NULL, addr, mask, addr_len); | ||
1116 | } | ||
1117 | |||
1118 | |||
1119 | /** | ||
1120 | * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF] | ||
1121 | * @cmd: command/message | ||
1122 | * @iface: the interface entry | ||
1123 | * @addr4: the IPv4 address entry | ||
1124 | * @addr6: the IPv6 address entry | ||
1125 | * @arg: the netlbl_unlhsh_walk_arg structure | ||
1126 | * | ||
1127 | * Description: | ||
1128 | * This function is designed to be used to generate a response for a | ||
1129 | * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6 | ||
1130 | * can be specified, not both, the other unspecified entry should be set to | ||
1131 | * NULL by the caller. Returns the size of the message on success, negative | ||
1132 | * values on failure. | ||
1133 | * | ||
1134 | */ | ||
1135 | static int netlbl_unlabel_staticlist_gen(u32 cmd, | ||
1136 | const struct netlbl_unlhsh_iface *iface, | ||
1137 | const struct netlbl_unlhsh_addr4 *addr4, | ||
1138 | const struct netlbl_unlhsh_addr6 *addr6, | ||
1139 | void *arg) | ||
1140 | { | ||
1141 | int ret_val = -ENOMEM; | ||
1142 | struct netlbl_unlhsh_walk_arg *cb_arg = arg; | ||
1143 | struct net_device *dev; | ||
1144 | void *data; | ||
1145 | u32 secid; | ||
1146 | char *secctx; | ||
1147 | u32 secctx_len; | ||
1148 | |||
1149 | data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid, | ||
1150 | cb_arg->seq, &netlbl_unlabel_gnl_family, | ||
1151 | NLM_F_MULTI, cmd); | ||
1152 | if (data == NULL) | ||
1153 | goto list_cb_failure; | ||
1154 | |||
1155 | if (iface->ifindex > 0) { | ||
1156 | dev = dev_get_by_index(&init_net, iface->ifindex); | ||
1157 | ret_val = nla_put_string(cb_arg->skb, | ||
1158 | NLBL_UNLABEL_A_IFACE, dev->name); | ||
1159 | dev_put(dev); | ||
1160 | if (ret_val != 0) | ||
1161 | goto list_cb_failure; | ||
1162 | } | ||
1163 | |||
1164 | if (addr4) { | ||
1165 | struct in_addr addr_struct; | ||
1166 | |||
1167 | addr_struct.s_addr = addr4->addr; | ||
1168 | ret_val = nla_put(cb_arg->skb, | ||
1169 | NLBL_UNLABEL_A_IPV4ADDR, | ||
1170 | sizeof(struct in_addr), | ||
1171 | &addr_struct); | ||
1172 | if (ret_val != 0) | ||
1173 | goto list_cb_failure; | ||
1174 | |||
1175 | addr_struct.s_addr = addr4->mask; | ||
1176 | ret_val = nla_put(cb_arg->skb, | ||
1177 | NLBL_UNLABEL_A_IPV4MASK, | ||
1178 | sizeof(struct in_addr), | ||
1179 | &addr_struct); | ||
1180 | if (ret_val != 0) | ||
1181 | goto list_cb_failure; | ||
1182 | |||
1183 | secid = addr4->secid; | ||
1184 | } else { | ||
1185 | ret_val = nla_put(cb_arg->skb, | ||
1186 | NLBL_UNLABEL_A_IPV6ADDR, | ||
1187 | sizeof(struct in6_addr), | ||
1188 | &addr6->addr); | ||
1189 | if (ret_val != 0) | ||
1190 | goto list_cb_failure; | ||
1191 | |||
1192 | ret_val = nla_put(cb_arg->skb, | ||
1193 | NLBL_UNLABEL_A_IPV6MASK, | ||
1194 | sizeof(struct in6_addr), | ||
1195 | &addr6->mask); | ||
1196 | if (ret_val != 0) | ||
1197 | goto list_cb_failure; | ||
1198 | |||
1199 | secid = addr6->secid; | ||
1200 | } | ||
1201 | |||
1202 | ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len); | ||
1203 | if (ret_val != 0) | ||
1204 | goto list_cb_failure; | ||
1205 | ret_val = nla_put(cb_arg->skb, | ||
1206 | NLBL_UNLABEL_A_SECCTX, | ||
1207 | secctx_len, | ||
1208 | secctx); | ||
1209 | security_release_secctx(secctx, secctx_len); | ||
1210 | if (ret_val != 0) | ||
1211 | goto list_cb_failure; | ||
1212 | |||
1213 | cb_arg->seq++; | ||
1214 | return genlmsg_end(cb_arg->skb, data); | ||
1215 | |||
1216 | list_cb_failure: | ||
1217 | genlmsg_cancel(cb_arg->skb, data); | ||
1218 | return ret_val; | ||
1219 | } | ||
1220 | |||
1221 | /** | ||
1222 | * netlbl_unlabel_staticlist - Handle a STATICLIST message | ||
1223 | * @skb: the NETLINK buffer | ||
1224 | * @cb: the NETLINK callback | ||
1225 | * | ||
1226 | * Description: | ||
1227 | * Process a user generated STATICLIST message and dump the unlabeled | ||
1228 | * connection hash table in a form suitable for use in a kernel generated | ||
1229 | * STATICLIST message. Returns the length of @skb. | ||
1230 | * | ||
1231 | */ | ||
1232 | static int netlbl_unlabel_staticlist(struct sk_buff *skb, | ||
1233 | struct netlink_callback *cb) | ||
1234 | { | ||
1235 | struct netlbl_unlhsh_walk_arg cb_arg; | ||
1236 | u32 skip_bkt = cb->args[0]; | ||
1237 | u32 skip_chain = cb->args[1]; | ||
1238 | u32 skip_addr4 = cb->args[2]; | ||
1239 | u32 skip_addr6 = cb->args[3]; | ||
1240 | u32 iter_bkt; | ||
1241 | u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; | ||
1242 | struct netlbl_unlhsh_iface *iface; | ||
1243 | struct netlbl_unlhsh_addr4 *addr4; | ||
1244 | struct netlbl_unlhsh_addr6 *addr6; | ||
1245 | |||
1246 | cb_arg.nl_cb = cb; | ||
1247 | cb_arg.skb = skb; | ||
1248 | cb_arg.seq = cb->nlh->nlmsg_seq; | ||
1249 | |||
1250 | rcu_read_lock(); | ||
1251 | for (iter_bkt = skip_bkt; | ||
1252 | iter_bkt < rcu_dereference(netlbl_unlhsh)->size; | ||
1253 | iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) { | ||
1254 | list_for_each_entry_rcu(iface, | ||
1255 | &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt], | ||
1256 | list) { | ||
1257 | if (!iface->valid || | ||
1258 | iter_chain++ < skip_chain) | ||
1259 | continue; | ||
1260 | list_for_each_entry_rcu(addr4, | ||
1261 | &iface->addr4_list, | ||
1262 | list) { | ||
1263 | if (!addr4->valid || iter_addr4++ < skip_addr4) | ||
1264 | continue; | ||
1265 | if (netlbl_unlabel_staticlist_gen( | ||
1266 | NLBL_UNLABEL_C_STATICLIST, | ||
1267 | iface, | ||
1268 | addr4, | ||
1269 | NULL, | ||
1270 | &cb_arg) < 0) { | ||
1271 | iter_addr4--; | ||
1272 | iter_chain--; | ||
1273 | goto unlabel_staticlist_return; | ||
1274 | } | ||
1275 | } | ||
1276 | list_for_each_entry_rcu(addr6, | ||
1277 | &iface->addr6_list, | ||
1278 | list) { | ||
1279 | if (!addr6->valid || iter_addr6++ < skip_addr6) | ||
1280 | continue; | ||
1281 | if (netlbl_unlabel_staticlist_gen( | ||
1282 | NLBL_UNLABEL_C_STATICLIST, | ||
1283 | iface, | ||
1284 | NULL, | ||
1285 | addr6, | ||
1286 | &cb_arg) < 0) { | ||
1287 | iter_addr6--; | ||
1288 | iter_chain--; | ||
1289 | goto unlabel_staticlist_return; | ||
1290 | } | ||
1291 | } | ||
1292 | } | ||
1293 | } | ||
1294 | |||
1295 | unlabel_staticlist_return: | ||
1296 | rcu_read_unlock(); | ||
1297 | cb->args[0] = skip_bkt; | ||
1298 | cb->args[1] = skip_chain; | ||
1299 | cb->args[2] = skip_addr4; | ||
1300 | cb->args[3] = skip_addr6; | ||
1301 | return skb->len; | ||
1302 | } | ||
1303 | |||
1304 | /** | ||
1305 | * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message | ||
1306 | * @skb: the NETLINK buffer | ||
1307 | * @cb: the NETLINK callback | ||
1308 | * | ||
1309 | * Description: | ||
1310 | * Process a user generated STATICLISTDEF message and dump the default | ||
1311 | * unlabeled connection entry in a form suitable for use in a kernel generated | ||
1312 | * STATICLISTDEF message. Returns the length of @skb. | ||
1313 | * | ||
1314 | */ | ||
1315 | static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, | ||
1316 | struct netlink_callback *cb) | ||
1317 | { | ||
1318 | struct netlbl_unlhsh_walk_arg cb_arg; | ||
1319 | struct netlbl_unlhsh_iface *iface; | ||
1320 | u32 skip_addr4 = cb->args[0]; | ||
1321 | u32 skip_addr6 = cb->args[1]; | ||
1322 | u32 iter_addr4 = 0, iter_addr6 = 0; | ||
1323 | struct netlbl_unlhsh_addr4 *addr4; | ||
1324 | struct netlbl_unlhsh_addr6 *addr6; | ||
1325 | |||
1326 | cb_arg.nl_cb = cb; | ||
1327 | cb_arg.skb = skb; | ||
1328 | cb_arg.seq = cb->nlh->nlmsg_seq; | ||
1329 | |||
1330 | rcu_read_lock(); | ||
1331 | iface = rcu_dereference(netlbl_unlhsh_def); | ||
1332 | if (iface == NULL || !iface->valid) | ||
1333 | goto unlabel_staticlistdef_return; | ||
1334 | |||
1335 | list_for_each_entry_rcu(addr4, &iface->addr4_list, list) { | ||
1336 | if (!addr4->valid || iter_addr4++ < skip_addr4) | ||
1337 | continue; | ||
1338 | if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, | ||
1339 | iface, | ||
1340 | addr4, | ||
1341 | NULL, | ||
1342 | &cb_arg) < 0) { | ||
1343 | iter_addr4--; | ||
1344 | goto unlabel_staticlistdef_return; | ||
1345 | } | ||
1346 | } | ||
1347 | list_for_each_entry_rcu(addr6, &iface->addr6_list, list) { | ||
1348 | if (addr6->valid || iter_addr6++ < skip_addr6) | ||
1349 | continue; | ||
1350 | if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, | ||
1351 | iface, | ||
1352 | NULL, | ||
1353 | addr6, | ||
1354 | &cb_arg) < 0) { | ||
1355 | iter_addr6--; | ||
1356 | goto unlabel_staticlistdef_return; | ||
1357 | } | ||
1358 | } | ||
1359 | |||
1360 | unlabel_staticlistdef_return: | ||
1361 | rcu_read_unlock(); | ||
1362 | cb->args[0] = skip_addr4; | ||
1363 | cb->args[1] = skip_addr6; | ||
1364 | return skb->len; | ||
1365 | } | ||
171 | 1366 | ||
172 | /* | 1367 | /* |
173 | * NetLabel Generic NETLINK Command Definitions | 1368 | * NetLabel Generic NETLINK Command Definitions |
174 | */ | 1369 | */ |
175 | 1370 | ||
1371 | static struct genl_ops netlbl_unlabel_genl_c_staticadd = { | ||
1372 | .cmd = NLBL_UNLABEL_C_STATICADD, | ||
1373 | .flags = GENL_ADMIN_PERM, | ||
1374 | .policy = netlbl_unlabel_genl_policy, | ||
1375 | .doit = netlbl_unlabel_staticadd, | ||
1376 | .dumpit = NULL, | ||
1377 | }; | ||
1378 | |||
1379 | static struct genl_ops netlbl_unlabel_genl_c_staticremove = { | ||
1380 | .cmd = NLBL_UNLABEL_C_STATICREMOVE, | ||
1381 | .flags = GENL_ADMIN_PERM, | ||
1382 | .policy = netlbl_unlabel_genl_policy, | ||
1383 | .doit = netlbl_unlabel_staticremove, | ||
1384 | .dumpit = NULL, | ||
1385 | }; | ||
1386 | |||
1387 | static struct genl_ops netlbl_unlabel_genl_c_staticlist = { | ||
1388 | .cmd = NLBL_UNLABEL_C_STATICLIST, | ||
1389 | .flags = 0, | ||
1390 | .policy = netlbl_unlabel_genl_policy, | ||
1391 | .doit = NULL, | ||
1392 | .dumpit = netlbl_unlabel_staticlist, | ||
1393 | }; | ||
1394 | |||
1395 | static struct genl_ops netlbl_unlabel_genl_c_staticadddef = { | ||
1396 | .cmd = NLBL_UNLABEL_C_STATICADDDEF, | ||
1397 | .flags = GENL_ADMIN_PERM, | ||
1398 | .policy = netlbl_unlabel_genl_policy, | ||
1399 | .doit = netlbl_unlabel_staticadddef, | ||
1400 | .dumpit = NULL, | ||
1401 | }; | ||
1402 | |||
1403 | static struct genl_ops netlbl_unlabel_genl_c_staticremovedef = { | ||
1404 | .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF, | ||
1405 | .flags = GENL_ADMIN_PERM, | ||
1406 | .policy = netlbl_unlabel_genl_policy, | ||
1407 | .doit = netlbl_unlabel_staticremovedef, | ||
1408 | .dumpit = NULL, | ||
1409 | }; | ||
1410 | |||
1411 | static struct genl_ops netlbl_unlabel_genl_c_staticlistdef = { | ||
1412 | .cmd = NLBL_UNLABEL_C_STATICLISTDEF, | ||
1413 | .flags = 0, | ||
1414 | .policy = netlbl_unlabel_genl_policy, | ||
1415 | .doit = NULL, | ||
1416 | .dumpit = netlbl_unlabel_staticlistdef, | ||
1417 | }; | ||
1418 | |||
176 | static struct genl_ops netlbl_unlabel_genl_c_accept = { | 1419 | static struct genl_ops netlbl_unlabel_genl_c_accept = { |
177 | .cmd = NLBL_UNLABEL_C_ACCEPT, | 1420 | .cmd = NLBL_UNLABEL_C_ACCEPT, |
178 | .flags = GENL_ADMIN_PERM, | 1421 | .flags = GENL_ADMIN_PERM, |
@@ -189,7 +1432,6 @@ static struct genl_ops netlbl_unlabel_genl_c_list = { | |||
189 | .dumpit = NULL, | 1432 | .dumpit = NULL, |
190 | }; | 1433 | }; |
191 | 1434 | ||
192 | |||
193 | /* | 1435 | /* |
194 | * NetLabel Generic NETLINK Protocol Functions | 1436 | * NetLabel Generic NETLINK Protocol Functions |
195 | */ | 1437 | */ |
@@ -211,6 +1453,36 @@ int netlbl_unlabel_genl_init(void) | |||
211 | return ret_val; | 1453 | return ret_val; |
212 | 1454 | ||
213 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | 1455 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, |
1456 | &netlbl_unlabel_genl_c_staticadd); | ||
1457 | if (ret_val != 0) | ||
1458 | return ret_val; | ||
1459 | |||
1460 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | ||
1461 | &netlbl_unlabel_genl_c_staticremove); | ||
1462 | if (ret_val != 0) | ||
1463 | return ret_val; | ||
1464 | |||
1465 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | ||
1466 | &netlbl_unlabel_genl_c_staticlist); | ||
1467 | if (ret_val != 0) | ||
1468 | return ret_val; | ||
1469 | |||
1470 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | ||
1471 | &netlbl_unlabel_genl_c_staticadddef); | ||
1472 | if (ret_val != 0) | ||
1473 | return ret_val; | ||
1474 | |||
1475 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | ||
1476 | &netlbl_unlabel_genl_c_staticremovedef); | ||
1477 | if (ret_val != 0) | ||
1478 | return ret_val; | ||
1479 | |||
1480 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | ||
1481 | &netlbl_unlabel_genl_c_staticlistdef); | ||
1482 | if (ret_val != 0) | ||
1483 | return ret_val; | ||
1484 | |||
1485 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | ||
214 | &netlbl_unlabel_genl_c_accept); | 1486 | &netlbl_unlabel_genl_c_accept); |
215 | if (ret_val != 0) | 1487 | if (ret_val != 0) |
216 | return ret_val; | 1488 | return ret_val; |
@@ -227,8 +1499,58 @@ int netlbl_unlabel_genl_init(void) | |||
227 | * NetLabel KAPI Hooks | 1499 | * NetLabel KAPI Hooks |
228 | */ | 1500 | */ |
229 | 1501 | ||
1502 | static struct notifier_block netlbl_unlhsh_netdev_notifier = { | ||
1503 | .notifier_call = netlbl_unlhsh_netdev_handler, | ||
1504 | }; | ||
1505 | |||
1506 | /** | ||
1507 | * netlbl_unlabel_init - Initialize the unlabeled connection hash table | ||
1508 | * @size: the number of bits to use for the hash buckets | ||
1509 | * | ||
1510 | * Description: | ||
1511 | * Initializes the unlabeled connection hash table and registers a network | ||
1512 | * device notification handler. This function should only be called by the | ||
1513 | * NetLabel subsystem itself during initialization. Returns zero on success, | ||
1514 | * non-zero values on error. | ||
1515 | * | ||
1516 | */ | ||
1517 | int netlbl_unlabel_init(u32 size) | ||
1518 | { | ||
1519 | u32 iter; | ||
1520 | struct netlbl_unlhsh_tbl *hsh_tbl; | ||
1521 | |||
1522 | if (size == 0) | ||
1523 | return -EINVAL; | ||
1524 | |||
1525 | hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL); | ||
1526 | if (hsh_tbl == NULL) | ||
1527 | return -ENOMEM; | ||
1528 | hsh_tbl->size = 1 << size; | ||
1529 | hsh_tbl->tbl = kcalloc(hsh_tbl->size, | ||
1530 | sizeof(struct list_head), | ||
1531 | GFP_KERNEL); | ||
1532 | if (hsh_tbl->tbl == NULL) { | ||
1533 | kfree(hsh_tbl); | ||
1534 | return -ENOMEM; | ||
1535 | } | ||
1536 | for (iter = 0; iter < hsh_tbl->size; iter++) | ||
1537 | INIT_LIST_HEAD(&hsh_tbl->tbl[iter]); | ||
1538 | |||
1539 | rcu_read_lock(); | ||
1540 | spin_lock(&netlbl_unlhsh_lock); | ||
1541 | rcu_assign_pointer(netlbl_unlhsh, hsh_tbl); | ||
1542 | spin_unlock(&netlbl_unlhsh_lock); | ||
1543 | rcu_read_unlock(); | ||
1544 | |||
1545 | register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier); | ||
1546 | |||
1547 | return 0; | ||
1548 | } | ||
1549 | |||
230 | /** | 1550 | /** |
231 | * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet | 1551 | * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet |
1552 | * @skb: the packet | ||
1553 | * @family: protocol family | ||
232 | * @secattr: the security attributes | 1554 | * @secattr: the security attributes |
233 | * | 1555 | * |
234 | * Description: | 1556 | * Description: |
@@ -236,11 +1558,50 @@ int netlbl_unlabel_genl_init(void) | |||
236 | * them in @secattr. Returns zero on success and negative values on failure. | 1558 | * them in @secattr. Returns zero on success and negative values on failure. |
237 | * | 1559 | * |
238 | */ | 1560 | */ |
239 | int netlbl_unlabel_getattr(struct netlbl_lsm_secattr *secattr) | 1561 | int netlbl_unlabel_getattr(const struct sk_buff *skb, |
1562 | u16 family, | ||
1563 | struct netlbl_lsm_secattr *secattr) | ||
240 | { | 1564 | { |
1565 | struct iphdr *hdr4; | ||
1566 | struct ipv6hdr *hdr6; | ||
1567 | struct netlbl_unlhsh_addr4 *addr4; | ||
1568 | struct netlbl_unlhsh_addr6 *addr6; | ||
1569 | struct netlbl_unlhsh_iface *iface; | ||
1570 | |||
1571 | rcu_read_lock(); | ||
1572 | iface = netlbl_unlhsh_search_iface_def(skb->iif); | ||
1573 | if (iface == NULL) | ||
1574 | goto unlabel_getattr_nolabel; | ||
1575 | switch (family) { | ||
1576 | case PF_INET: | ||
1577 | hdr4 = ip_hdr(skb); | ||
1578 | addr4 = netlbl_unlhsh_search_addr4(hdr4->saddr, iface); | ||
1579 | if (addr4 == NULL) | ||
1580 | goto unlabel_getattr_nolabel; | ||
1581 | secattr->attr.secid = addr4->secid; | ||
1582 | break; | ||
1583 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) | ||
1584 | case PF_INET6: | ||
1585 | hdr6 = ipv6_hdr(skb); | ||
1586 | addr6 = netlbl_unlhsh_search_addr6(&hdr6->saddr, iface); | ||
1587 | if (addr6 == NULL) | ||
1588 | goto unlabel_getattr_nolabel; | ||
1589 | secattr->attr.secid = addr6->secid; | ||
1590 | break; | ||
1591 | #endif /* IPv6 */ | ||
1592 | default: | ||
1593 | goto unlabel_getattr_nolabel; | ||
1594 | } | ||
1595 | rcu_read_unlock(); | ||
1596 | |||
1597 | secattr->flags |= NETLBL_SECATTR_SECID; | ||
1598 | secattr->type = NETLBL_NLTYPE_UNLABELED; | ||
1599 | return 0; | ||
1600 | |||
1601 | unlabel_getattr_nolabel: | ||
1602 | rcu_read_unlock(); | ||
241 | if (netlabel_unlabel_acceptflg == 0) | 1603 | if (netlabel_unlabel_acceptflg == 0) |
242 | return -ENOMSG; | 1604 | return -ENOMSG; |
243 | netlbl_secattr_init(secattr); | ||
244 | secattr->type = NETLBL_NLTYPE_UNLABELED; | 1605 | secattr->type = NETLBL_NLTYPE_UNLABELED; |
245 | return 0; | 1606 | return 0; |
246 | } | 1607 | } |
diff --git a/net/netlabel/netlabel_unlabeled.h b/net/netlabel/netlabel_unlabeled.h index c2917fbb42cf..06b1301ac072 100644 --- a/net/netlabel/netlabel_unlabeled.h +++ b/net/netlabel/netlabel_unlabeled.h | |||
@@ -36,6 +36,116 @@ | |||
36 | /* | 36 | /* |
37 | * The following NetLabel payloads are supported by the Unlabeled subsystem. | 37 | * The following NetLabel payloads are supported by the Unlabeled subsystem. |
38 | * | 38 | * |
39 | * o STATICADD | ||
40 | * This message is sent from an application to add a new static label for | ||
41 | * incoming unlabeled connections. | ||
42 | * | ||
43 | * Required attributes: | ||
44 | * | ||
45 | * NLBL_UNLABEL_A_IFACE | ||
46 | * NLBL_UNLABEL_A_SECCTX | ||
47 | * | ||
48 | * If IPv4 is specified the following attributes are required: | ||
49 | * | ||
50 | * NLBL_UNLABEL_A_IPV4ADDR | ||
51 | * NLBL_UNLABEL_A_IPV4MASK | ||
52 | * | ||
53 | * If IPv6 is specified the following attributes are required: | ||
54 | * | ||
55 | * NLBL_UNLABEL_A_IPV6ADDR | ||
56 | * NLBL_UNLABEL_A_IPV6MASK | ||
57 | * | ||
58 | * o STATICREMOVE | ||
59 | * This message is sent from an application to remove an existing static | ||
60 | * label for incoming unlabeled connections. | ||
61 | * | ||
62 | * Required attributes: | ||
63 | * | ||
64 | * NLBL_UNLABEL_A_IFACE | ||
65 | * | ||
66 | * If IPv4 is specified the following attributes are required: | ||
67 | * | ||
68 | * NLBL_UNLABEL_A_IPV4ADDR | ||
69 | * NLBL_UNLABEL_A_IPV4MASK | ||
70 | * | ||
71 | * If IPv6 is specified the following attributes are required: | ||
72 | * | ||
73 | * NLBL_UNLABEL_A_IPV6ADDR | ||
74 | * NLBL_UNLABEL_A_IPV6MASK | ||
75 | * | ||
76 | * o STATICLIST | ||
77 | * This message can be sent either from an application or by the kernel in | ||
78 | * response to an application generated STATICLIST message. When sent by an | ||
79 | * application there is no payload and the NLM_F_DUMP flag should be set. | ||
80 | * The kernel should response with a series of the following messages. | ||
81 | * | ||
82 | * Required attributes: | ||
83 | * | ||
84 | * NLBL_UNLABEL_A_IFACE | ||
85 | * NLBL_UNLABEL_A_SECCTX | ||
86 | * | ||
87 | * If IPv4 is specified the following attributes are required: | ||
88 | * | ||
89 | * NLBL_UNLABEL_A_IPV4ADDR | ||
90 | * NLBL_UNLABEL_A_IPV4MASK | ||
91 | * | ||
92 | * If IPv6 is specified the following attributes are required: | ||
93 | * | ||
94 | * NLBL_UNLABEL_A_IPV6ADDR | ||
95 | * NLBL_UNLABEL_A_IPV6MASK | ||
96 | * | ||
97 | * o STATICADDDEF | ||
98 | * This message is sent from an application to set the default static | ||
99 | * label for incoming unlabeled connections. | ||
100 | * | ||
101 | * Required attribute: | ||
102 | * | ||
103 | * NLBL_UNLABEL_A_SECCTX | ||
104 | * | ||
105 | * If IPv4 is specified the following attributes are required: | ||
106 | * | ||
107 | * NLBL_UNLABEL_A_IPV4ADDR | ||
108 | * NLBL_UNLABEL_A_IPV4MASK | ||
109 | * | ||
110 | * If IPv6 is specified the following attributes are required: | ||
111 | * | ||
112 | * NLBL_UNLABEL_A_IPV6ADDR | ||
113 | * NLBL_UNLABEL_A_IPV6MASK | ||
114 | * | ||
115 | * o STATICREMOVEDEF | ||
116 | * This message is sent from an application to remove the existing default | ||
117 | * static label for incoming unlabeled connections. | ||
118 | * | ||
119 | * If IPv4 is specified the following attributes are required: | ||
120 | * | ||
121 | * NLBL_UNLABEL_A_IPV4ADDR | ||
122 | * NLBL_UNLABEL_A_IPV4MASK | ||
123 | * | ||
124 | * If IPv6 is specified the following attributes are required: | ||
125 | * | ||
126 | * NLBL_UNLABEL_A_IPV6ADDR | ||
127 | * NLBL_UNLABEL_A_IPV6MASK | ||
128 | * | ||
129 | * o STATICLISTDEF | ||
130 | * This message can be sent either from an application or by the kernel in | ||
131 | * response to an application generated STATICLISTDEF message. When sent by | ||
132 | * an application there is no payload and the NLM_F_DUMP flag should be set. | ||
133 | * The kernel should response with the following message. | ||
134 | * | ||
135 | * Required attribute: | ||
136 | * | ||
137 | * NLBL_UNLABEL_A_SECCTX | ||
138 | * | ||
139 | * If IPv4 is specified the following attributes are required: | ||
140 | * | ||
141 | * NLBL_UNLABEL_A_IPV4ADDR | ||
142 | * NLBL_UNLABEL_A_IPV4MASK | ||
143 | * | ||
144 | * If IPv6 is specified the following attributes are required: | ||
145 | * | ||
146 | * NLBL_UNLABEL_A_IPV6ADDR | ||
147 | * NLBL_UNLABEL_A_IPV6MASK | ||
148 | * | ||
39 | * o ACCEPT | 149 | * o ACCEPT |
40 | * This message is sent from an application to specify if the kernel should | 150 | * This message is sent from an application to specify if the kernel should |
41 | * allow unlabled packets to pass if they do not match any of the static | 151 | * allow unlabled packets to pass if they do not match any of the static |
@@ -62,6 +172,12 @@ enum { | |||
62 | NLBL_UNLABEL_C_UNSPEC, | 172 | NLBL_UNLABEL_C_UNSPEC, |
63 | NLBL_UNLABEL_C_ACCEPT, | 173 | NLBL_UNLABEL_C_ACCEPT, |
64 | NLBL_UNLABEL_C_LIST, | 174 | NLBL_UNLABEL_C_LIST, |
175 | NLBL_UNLABEL_C_STATICADD, | ||
176 | NLBL_UNLABEL_C_STATICREMOVE, | ||
177 | NLBL_UNLABEL_C_STATICLIST, | ||
178 | NLBL_UNLABEL_C_STATICADDDEF, | ||
179 | NLBL_UNLABEL_C_STATICREMOVEDEF, | ||
180 | NLBL_UNLABEL_C_STATICLISTDEF, | ||
65 | __NLBL_UNLABEL_C_MAX, | 181 | __NLBL_UNLABEL_C_MAX, |
66 | }; | 182 | }; |
67 | #define NLBL_UNLABEL_C_MAX (__NLBL_UNLABEL_C_MAX - 1) | 183 | #define NLBL_UNLABEL_C_MAX (__NLBL_UNLABEL_C_MAX - 1) |
@@ -73,6 +189,24 @@ enum { | |||
73 | /* (NLA_U8) | 189 | /* (NLA_U8) |
74 | * if true then unlabeled packets are allowed to pass, else unlabeled | 190 | * if true then unlabeled packets are allowed to pass, else unlabeled |
75 | * packets are rejected */ | 191 | * packets are rejected */ |
192 | NLBL_UNLABEL_A_IPV6ADDR, | ||
193 | /* (NLA_BINARY, struct in6_addr) | ||
194 | * an IPv6 address */ | ||
195 | NLBL_UNLABEL_A_IPV6MASK, | ||
196 | /* (NLA_BINARY, struct in6_addr) | ||
197 | * an IPv6 address mask */ | ||
198 | NLBL_UNLABEL_A_IPV4ADDR, | ||
199 | /* (NLA_BINARY, struct in_addr) | ||
200 | * an IPv4 address */ | ||
201 | NLBL_UNLABEL_A_IPV4MASK, | ||
202 | /* (NLA_BINARY, struct in_addr) | ||
203 | * and IPv4 address mask */ | ||
204 | NLBL_UNLABEL_A_IFACE, | ||
205 | /* (NLA_NULL_STRING) | ||
206 | * network interface */ | ||
207 | NLBL_UNLABEL_A_SECCTX, | ||
208 | /* (NLA_BINARY) | ||
209 | * a LSM specific security context */ | ||
76 | __NLBL_UNLABEL_A_MAX, | 210 | __NLBL_UNLABEL_A_MAX, |
77 | }; | 211 | }; |
78 | #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1) | 212 | #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1) |
@@ -80,8 +214,17 @@ enum { | |||
80 | /* NetLabel protocol functions */ | 214 | /* NetLabel protocol functions */ |
81 | int netlbl_unlabel_genl_init(void); | 215 | int netlbl_unlabel_genl_init(void); |
82 | 216 | ||
217 | /* Unlabeled connection hash table size */ | ||
218 | /* XXX - currently this number is an uneducated guess */ | ||
219 | #define NETLBL_UNLHSH_BITSIZE 7 | ||
220 | |||
221 | /* General Unlabeled init function */ | ||
222 | int netlbl_unlabel_init(u32 size); | ||
223 | |||
83 | /* Process Unlabeled incoming network packets */ | 224 | /* Process Unlabeled incoming network packets */ |
84 | int netlbl_unlabel_getattr(struct netlbl_lsm_secattr *secattr); | 225 | int netlbl_unlabel_getattr(const struct sk_buff *skb, |
226 | u16 family, | ||
227 | struct netlbl_lsm_secattr *secattr); | ||
85 | 228 | ||
86 | /* Set the default configuration to allow Unlabeled packets */ | 229 | /* Set the default configuration to allow Unlabeled packets */ |
87 | int netlbl_unlabel_defconf(void); | 230 | int netlbl_unlabel_defconf(void); |