blob: 4f50949722a95a6e082404601b98c98f39190821 [file] [log] [blame]
Paul Moored15c3452006-08-03 16:48:37 -07001/*
2 * NetLabel Kernel API
3 *
4 * This file defines the kernel API for the NetLabel system. The NetLabel
5 * system manages static and dynamic label mappings for network protocols such
6 * as CIPSO and RIPSO.
7 *
8 * Author: Paul Moore <paul.moore@hp.com>
9 *
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28 *
29 */
30
31#include <linux/init.h>
32#include <linux/types.h>
33#include <net/ip.h>
34#include <net/netlabel.h>
35#include <net/cipso_ipv4.h>
36#include <asm/bug.h>
37
38#include "netlabel_domainhash.h"
39#include "netlabel_unlabeled.h"
40#include "netlabel_user.h"
Paul Moore23bcdc12007-07-18 12:28:45 -040041#include "netlabel_mgmt.h"
Paul Moored15c3452006-08-03 16:48:37 -070042
43/*
Paul Moore02752762006-11-29 13:18:18 -050044 * Security Attribute Functions
45 */
46
47/**
48 * netlbl_secattr_catmap_walk - Walk a LSM secattr catmap looking for a bit
49 * @catmap: the category bitmap
50 * @offset: the offset to start searching at, in bits
51 *
52 * Description:
53 * This function walks a LSM secattr category bitmap starting at @offset and
54 * returns the spot of the first set bit or -ENOENT if no bits are set.
55 *
56 */
57int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
58 u32 offset)
59{
60 struct netlbl_lsm_secattr_catmap *iter = catmap;
61 u32 node_idx;
62 u32 node_bit;
63 NETLBL_CATMAP_MAPTYPE bitmap;
64
65 if (offset > iter->startbit) {
66 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
67 iter = iter->next;
68 if (iter == NULL)
69 return -ENOENT;
70 }
71 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
72 node_bit = offset - iter->startbit -
73 (NETLBL_CATMAP_MAPSIZE * node_idx);
74 } else {
75 node_idx = 0;
76 node_bit = 0;
77 }
78 bitmap = iter->bitmap[node_idx] >> node_bit;
79
80 for (;;) {
81 if (bitmap != 0) {
82 while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
83 bitmap >>= 1;
84 node_bit++;
85 }
86 return iter->startbit +
87 (NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit;
88 }
89 if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
90 if (iter->next != NULL) {
91 iter = iter->next;
92 node_idx = 0;
93 } else
94 return -ENOENT;
95 }
96 bitmap = iter->bitmap[node_idx];
97 node_bit = 0;
98 }
99
100 return -ENOENT;
101}
102
103/**
104 * netlbl_secattr_catmap_walk_rng - Find the end of a string of set bits
105 * @catmap: the category bitmap
106 * @offset: the offset to start searching at, in bits
107 *
108 * Description:
109 * This function walks a LSM secattr category bitmap starting at @offset and
110 * returns the spot of the first cleared bit or -ENOENT if the offset is past
111 * the end of the bitmap.
112 *
113 */
114int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
115 u32 offset)
116{
117 struct netlbl_lsm_secattr_catmap *iter = catmap;
118 u32 node_idx;
119 u32 node_bit;
120 NETLBL_CATMAP_MAPTYPE bitmask;
121 NETLBL_CATMAP_MAPTYPE bitmap;
122
123 if (offset > iter->startbit) {
124 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
125 iter = iter->next;
126 if (iter == NULL)
127 return -ENOENT;
128 }
129 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
130 node_bit = offset - iter->startbit -
131 (NETLBL_CATMAP_MAPSIZE * node_idx);
132 } else {
133 node_idx = 0;
134 node_bit = 0;
135 }
136 bitmask = NETLBL_CATMAP_BIT << node_bit;
137
138 for (;;) {
139 bitmap = iter->bitmap[node_idx];
140 while (bitmask != 0 && (bitmap & bitmask) != 0) {
141 bitmask <<= 1;
142 node_bit++;
143 }
144
145 if (bitmask != 0)
146 return iter->startbit +
147 (NETLBL_CATMAP_MAPSIZE * node_idx) +
148 node_bit - 1;
149 else if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
150 if (iter->next == NULL)
151 return iter->startbit + NETLBL_CATMAP_SIZE - 1;
152 iter = iter->next;
153 node_idx = 0;
154 }
155 bitmask = NETLBL_CATMAP_BIT;
156 node_bit = 0;
157 }
158
159 return -ENOENT;
160}
161
162/**
163 * netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap
164 * @catmap: the category bitmap
165 * @bit: the bit to set
166 * @flags: memory allocation flags
167 *
168 * Description:
169 * Set the bit specified by @bit in @catmap. Returns zero on success,
170 * negative values on failure.
171 *
172 */
173int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
174 u32 bit,
175 gfp_t flags)
176{
177 struct netlbl_lsm_secattr_catmap *iter = catmap;
178 u32 node_bit;
179 u32 node_idx;
180
181 while (iter->next != NULL &&
182 bit >= (iter->startbit + NETLBL_CATMAP_SIZE))
183 iter = iter->next;
184 if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
185 iter->next = netlbl_secattr_catmap_alloc(flags);
186 if (iter->next == NULL)
187 return -ENOMEM;
188 iter = iter->next;
189 iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1);
190 }
191
192 /* gcc always rounds to zero when doing integer division */
193 node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
194 node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx);
195 iter->bitmap[node_idx] |= NETLBL_CATMAP_BIT << node_bit;
196
197 return 0;
198}
199
200/**
201 * netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap
202 * @catmap: the category bitmap
203 * @start: the starting bit
204 * @end: the last bit in the string
205 * @flags: memory allocation flags
206 *
207 * Description:
208 * Set a range of bits, starting at @start and ending with @end. Returns zero
209 * on success, negative values on failure.
210 *
211 */
212int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
213 u32 start,
214 u32 end,
215 gfp_t flags)
216{
217 int ret_val = 0;
218 struct netlbl_lsm_secattr_catmap *iter = catmap;
219 u32 iter_max_spot;
220 u32 spot;
221
222 /* XXX - This could probably be made a bit faster by combining writes
223 * to the catmap instead of setting a single bit each time, but for
224 * right now skipping to the start of the range in the catmap should
225 * be a nice improvement over calling the individual setbit function
226 * repeatedly from a loop. */
227
228 while (iter->next != NULL &&
229 start >= (iter->startbit + NETLBL_CATMAP_SIZE))
230 iter = iter->next;
231 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
232
233 for (spot = start; spot <= end && ret_val == 0; spot++) {
234 if (spot >= iter_max_spot && iter->next != NULL) {
235 iter = iter->next;
236 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
237 }
238 ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC);
239 }
240
241 return ret_val;
242}
243
244/*
Paul Moored15c3452006-08-03 16:48:37 -0700245 * LSM Functions
246 */
247
248/**
Paul Moore23bcdc12007-07-18 12:28:45 -0400249 * netlbl_enabled - Determine if the NetLabel subsystem is enabled
250 *
251 * Description:
252 * The LSM can use this function to determine if it should use NetLabel
253 * security attributes in it's enforcement mechanism. Currently, NetLabel is
254 * considered to be enabled when it's configuration contains a valid setup for
255 * at least one labeled protocol (i.e. NetLabel can understand incoming
256 * labeled packets of at least one type); otherwise NetLabel is considered to
257 * be disabled.
258 *
259 */
260int netlbl_enabled(void)
261{
262 /* At some point we probably want to expose this mechanism to the user
263 * as well so that admins can toggle NetLabel regardless of the
264 * configuration */
265 return (netlbl_mgmt_protocount_value() > 0 ? 1 : 0);
266}
267
268/**
Paul Moored15c3452006-08-03 16:48:37 -0700269 * netlbl_socket_setattr - Label a socket using the correct protocol
Paul Mooreba6ff9f2007-06-07 18:37:15 -0700270 * @sk: the socket to label
Paul Moored15c3452006-08-03 16:48:37 -0700271 * @secattr: the security attributes
272 *
273 * Description:
274 * Attach the correct label to the given socket using the security attributes
Paul Mooreba6ff9f2007-06-07 18:37:15 -0700275 * specified in @secattr. This function requires exclusive access to @sk,
276 * which means it either needs to be in the process of being created or locked.
277 * Returns zero on success, negative values on failure.
Paul Moored15c3452006-08-03 16:48:37 -0700278 *
279 */
Paul Mooreba6ff9f2007-06-07 18:37:15 -0700280int netlbl_sock_setattr(struct sock *sk,
281 const struct netlbl_lsm_secattr *secattr)
Paul Moored15c3452006-08-03 16:48:37 -0700282{
283 int ret_val = -ENOENT;
284 struct netlbl_dom_map *dom_entry;
285
286 rcu_read_lock();
287 dom_entry = netlbl_domhsh_getentry(secattr->domain);
288 if (dom_entry == NULL)
289 goto socket_setattr_return;
290 switch (dom_entry->type) {
291 case NETLBL_NLTYPE_CIPSOV4:
Paul Mooreba6ff9f2007-06-07 18:37:15 -0700292 ret_val = cipso_v4_sock_setattr(sk,
293 dom_entry->type_def.cipsov4,
294 secattr);
Paul Moored15c3452006-08-03 16:48:37 -0700295 break;
296 case NETLBL_NLTYPE_UNLABELED:
297 ret_val = 0;
298 break;
299 default:
300 ret_val = -ENOENT;
301 }
302
303socket_setattr_return:
304 rcu_read_unlock();
305 return ret_val;
306}
307
308/**
Paul Moore14a72f52006-09-25 15:52:01 -0700309 * netlbl_sock_getattr - Determine the security attributes of a sock
310 * @sk: the sock
311 * @secattr: the security attributes
312 *
313 * Description:
314 * Examines the given sock to see any NetLabel style labeling has been
315 * applied to the sock, if so it parses the socket label and returns the
316 * security attributes in @secattr. Returns zero on success, negative values
317 * on failure.
318 *
319 */
320int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
321{
322 int ret_val;
323
324 ret_val = cipso_v4_sock_getattr(sk, secattr);
325 if (ret_val == 0)
326 return 0;
327
328 return netlbl_unlabel_getattr(secattr);
329}
330
331/**
Paul Moored15c3452006-08-03 16:48:37 -0700332 * netlbl_skbuff_getattr - Determine the security attributes of a packet
333 * @skb: the packet
334 * @secattr: the security attributes
335 *
336 * Description:
337 * Examines the given packet to see if a recognized form of packet labeling
338 * is present, if so it parses the packet label and returns the security
339 * attributes in @secattr. Returns zero on success, negative values on
340 * failure.
341 *
342 */
343int netlbl_skbuff_getattr(const struct sk_buff *skb,
344 struct netlbl_lsm_secattr *secattr)
345{
Paul Moore05e00cb2006-11-17 17:38:47 -0500346 if (CIPSO_V4_OPTEXIST(skb) &&
347 cipso_v4_skbuff_getattr(skb, secattr) == 0)
Paul Moored15c3452006-08-03 16:48:37 -0700348 return 0;
349
350 return netlbl_unlabel_getattr(secattr);
351}
352
353/**
354 * netlbl_skbuff_err - Handle a LSM error on a sk_buff
355 * @skb: the packet
356 * @error: the error code
357 *
358 * Description:
359 * Deal with a LSM problem when handling the packet in @skb, typically this is
360 * a permission denied problem (-EACCES). The correct action is determined
361 * according to the packet's labeling protocol.
362 *
363 */
364void netlbl_skbuff_err(struct sk_buff *skb, int error)
365{
366 if (CIPSO_V4_OPTEXIST(skb))
367 cipso_v4_error(skb, error, 0);
368}
369
370/**
371 * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches
372 *
373 * Description:
374 * For all of the NetLabel protocols that support some form of label mapping
375 * cache, invalidate the cache. Returns zero on success, negative values on
376 * error.
377 *
378 */
379void netlbl_cache_invalidate(void)
380{
381 cipso_v4_cache_invalidate();
382}
383
384/**
385 * netlbl_cache_add - Add an entry to a NetLabel protocol cache
386 * @skb: the packet
387 * @secattr: the packet's security attributes
388 *
389 * Description:
390 * Add the LSM security attributes for the given packet to the underlying
391 * NetLabel protocol's label mapping cache. Returns zero on success, negative
392 * values on error.
393 *
394 */
395int netlbl_cache_add(const struct sk_buff *skb,
396 const struct netlbl_lsm_secattr *secattr)
397{
Paul Moore701a90b2006-11-17 17:38:46 -0500398 if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
Paul Moored15c3452006-08-03 16:48:37 -0700399 return -ENOMSG;
400
401 if (CIPSO_V4_OPTEXIST(skb))
402 return cipso_v4_cache_add(skb, secattr);
403
404 return -ENOMSG;
405}
406
407/*
408 * Setup Functions
409 */
410
411/**
412 * netlbl_init - Initialize NetLabel
413 *
414 * Description:
415 * Perform the required NetLabel initialization before first use.
416 *
417 */
418static int __init netlbl_init(void)
419{
420 int ret_val;
421
422 printk(KERN_INFO "NetLabel: Initializing\n");
423 printk(KERN_INFO "NetLabel: domain hash size = %u\n",
424 (1 << NETLBL_DOMHSH_BITSIZE));
425 printk(KERN_INFO "NetLabel: protocols ="
426 " UNLABELED"
427 " CIPSOv4"
428 "\n");
429
430 ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
431 if (ret_val != 0)
432 goto init_failure;
433
434 ret_val = netlbl_netlink_init();
435 if (ret_val != 0)
436 goto init_failure;
437
438 ret_val = netlbl_unlabel_defconf();
439 if (ret_val != 0)
440 goto init_failure;
441 printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n");
442
443 return 0;
444
445init_failure:
446 panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
447}
448
449subsys_initcall(netlbl_init);