Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1 | /* |
| 2 | * NetLabel Unlabeled Support |
| 3 | * |
| 4 | * This file defines functions for dealing with unlabeled packets for the |
| 5 | * NetLabel system. The NetLabel system manages static and dynamic label |
| 6 | * mappings for network protocols such as CIPSO and RIPSO. |
| 7 | * |
| 8 | * Author: Paul Moore <paul.moore@hp.com> |
| 9 | * |
| 10 | */ |
| 11 | |
| 12 | /* |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008 |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 14 | * |
| 15 | * This program is free software; you can redistribute it and/or modify |
| 16 | * it under the terms of the GNU General Public License as published by |
| 17 | * the Free Software Foundation; either version 2 of the License, or |
| 18 | * (at your option) any later version. |
| 19 | * |
| 20 | * This program is distributed in the hope that it will be useful, |
| 21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
| 23 | * the GNU General Public License for more details. |
| 24 | * |
| 25 | * You should have received a copy of the GNU General Public License |
| 26 | * along with this program; if not, write to the Free Software |
| 27 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 28 | * |
| 29 | */ |
| 30 | |
| 31 | #include <linux/types.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 32 | #include <linux/rcupdate.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 33 | #include <linux/list.h> |
| 34 | #include <linux/spinlock.h> |
| 35 | #include <linux/socket.h> |
| 36 | #include <linux/string.h> |
| 37 | #include <linux/skbuff.h> |
Paul Moore | de64688 | 2006-11-17 17:38:55 -0500 | [diff] [blame] | 38 | #include <linux/audit.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 39 | #include <linux/in.h> |
| 40 | #include <linux/in6.h> |
| 41 | #include <linux/ip.h> |
| 42 | #include <linux/ipv6.h> |
| 43 | #include <linux/notifier.h> |
| 44 | #include <linux/netdevice.h> |
| 45 | #include <linux/security.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame^] | 46 | #include <linux/slab.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 47 | #include <net/sock.h> |
| 48 | #include <net/netlink.h> |
| 49 | #include <net/genetlink.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 50 | #include <net/ip.h> |
| 51 | #include <net/ipv6.h> |
| 52 | #include <net/net_namespace.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 53 | #include <net/netlabel.h> |
| 54 | #include <asm/bug.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 55 | #include <asm/atomic.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 56 | |
| 57 | #include "netlabel_user.h" |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 58 | #include "netlabel_addrlist.h" |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 59 | #include "netlabel_domainhash.h" |
| 60 | #include "netlabel_unlabeled.h" |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 61 | #include "netlabel_mgmt.h" |
| 62 | |
| 63 | /* NOTE: at present we always use init's network namespace since we don't |
| 64 | * presently support different namespaces even though the majority of |
| 65 | * the functions in this file are "namespace safe" */ |
| 66 | |
| 67 | /* The unlabeled connection hash table which we use to map network interfaces |
| 68 | * and addresses of unlabeled packets to a user specified secid value for the |
| 69 | * LSM. The hash table is used to lookup the network interface entry |
| 70 | * (struct netlbl_unlhsh_iface) and then the interface entry is used to |
| 71 | * lookup an IP address match from an ordered list. If a network interface |
| 72 | * match can not be found in the hash table then the default entry |
| 73 | * (netlbl_unlhsh_def) is used. The IP address entry list |
| 74 | * (struct netlbl_unlhsh_addr) is ordered such that the entries with a |
| 75 | * larger netmask come first. |
| 76 | */ |
| 77 | struct netlbl_unlhsh_tbl { |
| 78 | struct list_head *tbl; |
| 79 | u32 size; |
| 80 | }; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 81 | #define netlbl_unlhsh_addr4_entry(iter) \ |
| 82 | container_of(iter, struct netlbl_unlhsh_addr4, list) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 83 | struct netlbl_unlhsh_addr4 { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 84 | u32 secid; |
| 85 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 86 | struct netlbl_af4list list; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 87 | struct rcu_head rcu; |
| 88 | }; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 89 | #define netlbl_unlhsh_addr6_entry(iter) \ |
| 90 | container_of(iter, struct netlbl_unlhsh_addr6, list) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 91 | struct netlbl_unlhsh_addr6 { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 92 | u32 secid; |
| 93 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 94 | struct netlbl_af6list list; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 95 | struct rcu_head rcu; |
| 96 | }; |
| 97 | struct netlbl_unlhsh_iface { |
| 98 | int ifindex; |
| 99 | struct list_head addr4_list; |
| 100 | struct list_head addr6_list; |
| 101 | |
| 102 | u32 valid; |
| 103 | struct list_head list; |
| 104 | struct rcu_head rcu; |
| 105 | }; |
| 106 | |
| 107 | /* Argument struct for netlbl_unlhsh_walk() */ |
| 108 | struct netlbl_unlhsh_walk_arg { |
| 109 | struct netlink_callback *nl_cb; |
| 110 | struct sk_buff *skb; |
| 111 | u32 seq; |
| 112 | }; |
| 113 | |
| 114 | /* Unlabeled connection hash table */ |
| 115 | /* updates should be so rare that having one spinlock for the entire |
| 116 | * hash table should be okay */ |
| 117 | static DEFINE_SPINLOCK(netlbl_unlhsh_lock); |
| 118 | static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL; |
| 119 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 120 | |
| 121 | /* Accept unlabeled packets flag */ |
Paul Moore | cd28786 | 2006-11-17 17:38:44 -0500 | [diff] [blame] | 122 | static u8 netlabel_unlabel_acceptflg = 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 123 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 124 | /* NetLabel Generic NETLINK unlabeled family */ |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 125 | static struct genl_family netlbl_unlabel_gnl_family = { |
| 126 | .id = GENL_ID_GENERATE, |
| 127 | .hdrsize = 0, |
| 128 | .name = NETLBL_NLTYPE_UNLABELED_NAME, |
| 129 | .version = NETLBL_PROTO_VERSION, |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 130 | .maxattr = NLBL_UNLABEL_A_MAX, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 131 | }; |
| 132 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 133 | /* NetLabel Netlink attribute policy */ |
Patrick McHardy | ef7c79e | 2007-06-05 12:38:30 -0700 | [diff] [blame] | 134 | static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 135 | [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 136 | [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY, |
| 137 | .len = sizeof(struct in6_addr) }, |
| 138 | [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY, |
| 139 | .len = sizeof(struct in6_addr) }, |
| 140 | [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY, |
| 141 | .len = sizeof(struct in_addr) }, |
| 142 | [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY, |
| 143 | .len = sizeof(struct in_addr) }, |
| 144 | [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING, |
| 145 | .len = IFNAMSIZ - 1 }, |
| 146 | [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY } |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 147 | }; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 148 | |
| 149 | /* |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 150 | * Unlabeled Connection Hash Table Functions |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 151 | */ |
| 152 | |
| 153 | /** |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 154 | * netlbl_unlhsh_free_addr4 - Frees an IPv4 address entry from the hash table |
| 155 | * @entry: the entry's RCU field |
| 156 | * |
| 157 | * Description: |
| 158 | * This function is designed to be used as a callback to the call_rcu() |
| 159 | * function so that memory allocated to a hash table address entry can be |
| 160 | * released safely. |
| 161 | * |
| 162 | */ |
| 163 | static void netlbl_unlhsh_free_addr4(struct rcu_head *entry) |
| 164 | { |
| 165 | struct netlbl_unlhsh_addr4 *ptr; |
| 166 | |
| 167 | ptr = container_of(entry, struct netlbl_unlhsh_addr4, rcu); |
| 168 | kfree(ptr); |
| 169 | } |
| 170 | |
| 171 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 172 | /** |
| 173 | * netlbl_unlhsh_free_addr6 - Frees an IPv6 address entry from the hash table |
| 174 | * @entry: the entry's RCU field |
| 175 | * |
| 176 | * Description: |
| 177 | * This function is designed to be used as a callback to the call_rcu() |
| 178 | * function so that memory allocated to a hash table address entry can be |
| 179 | * released safely. |
| 180 | * |
| 181 | */ |
| 182 | static void netlbl_unlhsh_free_addr6(struct rcu_head *entry) |
| 183 | { |
| 184 | struct netlbl_unlhsh_addr6 *ptr; |
| 185 | |
| 186 | ptr = container_of(entry, struct netlbl_unlhsh_addr6, rcu); |
| 187 | kfree(ptr); |
| 188 | } |
| 189 | #endif /* IPv6 */ |
| 190 | |
| 191 | /** |
| 192 | * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table |
| 193 | * @entry: the entry's RCU field |
| 194 | * |
| 195 | * Description: |
| 196 | * This function is designed to be used as a callback to the call_rcu() |
| 197 | * function so that memory allocated to a hash table interface entry can be |
| 198 | * released safely. It is important to note that this function does not free |
| 199 | * the IPv4 and IPv6 address lists contained as part of an interface entry. It |
| 200 | * is up to the rest of the code to make sure an interface entry is only freed |
| 201 | * once it's address lists are empty. |
| 202 | * |
| 203 | */ |
| 204 | static void netlbl_unlhsh_free_iface(struct rcu_head *entry) |
| 205 | { |
| 206 | struct netlbl_unlhsh_iface *iface; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 207 | struct netlbl_af4list *iter4; |
| 208 | struct netlbl_af4list *tmp4; |
| 209 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 210 | struct netlbl_af6list *iter6; |
| 211 | struct netlbl_af6list *tmp6; |
| 212 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 213 | |
| 214 | iface = container_of(entry, struct netlbl_unlhsh_iface, rcu); |
| 215 | |
| 216 | /* no need for locks here since we are the only one with access to this |
| 217 | * structure */ |
| 218 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 219 | netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) { |
| 220 | netlbl_af4list_remove_entry(iter4); |
| 221 | kfree(netlbl_unlhsh_addr4_entry(iter4)); |
| 222 | } |
| 223 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 224 | netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) { |
| 225 | netlbl_af6list_remove_entry(iter6); |
| 226 | kfree(netlbl_unlhsh_addr6_entry(iter6)); |
| 227 | } |
| 228 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 229 | kfree(iface); |
| 230 | } |
| 231 | |
| 232 | /** |
| 233 | * netlbl_unlhsh_hash - Hashing function for the hash table |
| 234 | * @ifindex: the network interface/device to hash |
| 235 | * |
| 236 | * Description: |
| 237 | * This is the hashing function for the unlabeled hash table, it returns the |
| 238 | * bucket number for the given device/interface. The caller is responsible for |
| 239 | * calling the rcu_read_[un]lock() functions. |
| 240 | * |
| 241 | */ |
| 242 | static u32 netlbl_unlhsh_hash(int ifindex) |
| 243 | { |
| 244 | /* this is taken _almost_ directly from |
| 245 | * security/selinux/netif.c:sel_netif_hasfn() as they do pretty much |
| 246 | * the same thing */ |
| 247 | return ifindex & (rcu_dereference(netlbl_unlhsh)->size - 1); |
| 248 | } |
| 249 | |
| 250 | /** |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 251 | * netlbl_unlhsh_search_iface - Search for a matching interface entry |
| 252 | * @ifindex: the network interface |
| 253 | * |
| 254 | * Description: |
| 255 | * Searches the unlabeled connection hash table and returns a pointer to the |
| 256 | * interface entry which matches @ifindex, otherwise NULL is returned. The |
| 257 | * caller is responsible for calling the rcu_read_[un]lock() functions. |
| 258 | * |
| 259 | */ |
| 260 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex) |
| 261 | { |
| 262 | u32 bkt; |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 263 | struct list_head *bkt_list; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 264 | struct netlbl_unlhsh_iface *iter; |
| 265 | |
| 266 | bkt = netlbl_unlhsh_hash(ifindex); |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 267 | bkt_list = &rcu_dereference(netlbl_unlhsh)->tbl[bkt]; |
| 268 | list_for_each_entry_rcu(iter, bkt_list, list) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 269 | if (iter->valid && iter->ifindex == ifindex) |
| 270 | return iter; |
| 271 | |
| 272 | return NULL; |
| 273 | } |
| 274 | |
| 275 | /** |
| 276 | * netlbl_unlhsh_search_iface_def - Search for a matching interface entry |
| 277 | * @ifindex: the network interface |
| 278 | * |
| 279 | * Description: |
| 280 | * Searches the unlabeled connection hash table and returns a pointer to the |
| 281 | * interface entry which matches @ifindex. If an exact match can not be found |
| 282 | * and there is a valid default entry, the default entry is returned, otherwise |
| 283 | * NULL is returned. The caller is responsible for calling the |
| 284 | * rcu_read_[un]lock() functions. |
| 285 | * |
| 286 | */ |
| 287 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface_def(int ifindex) |
| 288 | { |
| 289 | struct netlbl_unlhsh_iface *entry; |
| 290 | |
| 291 | entry = netlbl_unlhsh_search_iface(ifindex); |
| 292 | if (entry != NULL) |
| 293 | return entry; |
| 294 | |
| 295 | entry = rcu_dereference(netlbl_unlhsh_def); |
| 296 | if (entry != NULL && entry->valid) |
| 297 | return entry; |
| 298 | |
| 299 | return NULL; |
| 300 | } |
| 301 | |
| 302 | /** |
| 303 | * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table |
| 304 | * @iface: the associated interface entry |
| 305 | * @addr: IPv4 address in network byte order |
| 306 | * @mask: IPv4 address mask in network byte order |
| 307 | * @secid: LSM secid value for entry |
| 308 | * |
| 309 | * Description: |
| 310 | * Add a new address entry into the unlabeled connection hash table using the |
| 311 | * interface entry specified by @iface. On success zero is returned, otherwise |
| 312 | * a negative value is returned. The caller is responsible for calling the |
| 313 | * rcu_read_[un]lock() functions. |
| 314 | * |
| 315 | */ |
| 316 | static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface, |
| 317 | const struct in_addr *addr, |
| 318 | const struct in_addr *mask, |
| 319 | u32 secid) |
| 320 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 321 | int ret_val; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 322 | struct netlbl_unlhsh_addr4 *entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 323 | |
| 324 | entry = kzalloc(sizeof(*entry), GFP_ATOMIC); |
| 325 | if (entry == NULL) |
| 326 | return -ENOMEM; |
| 327 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 328 | entry->list.addr = addr->s_addr & mask->s_addr; |
| 329 | entry->list.mask = mask->s_addr; |
| 330 | entry->list.valid = 1; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 331 | entry->secid = secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 332 | |
| 333 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 334 | ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 335 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 336 | |
| 337 | if (ret_val != 0) |
| 338 | kfree(entry); |
| 339 | return ret_val; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 340 | } |
| 341 | |
| 342 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 343 | /** |
| 344 | * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table |
| 345 | * @iface: the associated interface entry |
| 346 | * @addr: IPv6 address in network byte order |
| 347 | * @mask: IPv6 address mask in network byte order |
| 348 | * @secid: LSM secid value for entry |
| 349 | * |
| 350 | * Description: |
| 351 | * Add a new address entry into the unlabeled connection hash table using the |
| 352 | * interface entry specified by @iface. On success zero is returned, otherwise |
| 353 | * a negative value is returned. The caller is responsible for calling the |
| 354 | * rcu_read_[un]lock() functions. |
| 355 | * |
| 356 | */ |
| 357 | static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface, |
| 358 | const struct in6_addr *addr, |
| 359 | const struct in6_addr *mask, |
| 360 | u32 secid) |
| 361 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 362 | int ret_val; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 363 | struct netlbl_unlhsh_addr6 *entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 364 | |
| 365 | entry = kzalloc(sizeof(*entry), GFP_ATOMIC); |
| 366 | if (entry == NULL) |
| 367 | return -ENOMEM; |
| 368 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 369 | ipv6_addr_copy(&entry->list.addr, addr); |
| 370 | entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; |
| 371 | entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; |
| 372 | entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2]; |
| 373 | entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3]; |
| 374 | ipv6_addr_copy(&entry->list.mask, mask); |
| 375 | entry->list.valid = 1; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 376 | entry->secid = secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 377 | |
| 378 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 379 | ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 380 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 381 | |
| 382 | if (ret_val != 0) |
| 383 | kfree(entry); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 384 | return 0; |
| 385 | } |
| 386 | #endif /* IPv6 */ |
| 387 | |
| 388 | /** |
| 389 | * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table |
| 390 | * @ifindex: network interface |
| 391 | * |
| 392 | * Description: |
| 393 | * Add a new, empty, interface entry into the unlabeled connection hash table. |
| 394 | * On success a pointer to the new interface entry is returned, on failure NULL |
| 395 | * is returned. The caller is responsible for calling the rcu_read_[un]lock() |
| 396 | * functions. |
| 397 | * |
| 398 | */ |
| 399 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex) |
| 400 | { |
| 401 | u32 bkt; |
| 402 | struct netlbl_unlhsh_iface *iface; |
| 403 | |
| 404 | iface = kzalloc(sizeof(*iface), GFP_ATOMIC); |
| 405 | if (iface == NULL) |
| 406 | return NULL; |
| 407 | |
| 408 | iface->ifindex = ifindex; |
| 409 | INIT_LIST_HEAD(&iface->addr4_list); |
| 410 | INIT_LIST_HEAD(&iface->addr6_list); |
| 411 | iface->valid = 1; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 412 | |
| 413 | spin_lock(&netlbl_unlhsh_lock); |
| 414 | if (ifindex > 0) { |
| 415 | bkt = netlbl_unlhsh_hash(ifindex); |
| 416 | if (netlbl_unlhsh_search_iface(ifindex) != NULL) |
| 417 | goto add_iface_failure; |
| 418 | list_add_tail_rcu(&iface->list, |
| 419 | &rcu_dereference(netlbl_unlhsh)->tbl[bkt]); |
| 420 | } else { |
| 421 | INIT_LIST_HEAD(&iface->list); |
| 422 | if (rcu_dereference(netlbl_unlhsh_def) != NULL) |
| 423 | goto add_iface_failure; |
| 424 | rcu_assign_pointer(netlbl_unlhsh_def, iface); |
| 425 | } |
| 426 | spin_unlock(&netlbl_unlhsh_lock); |
| 427 | |
| 428 | return iface; |
| 429 | |
| 430 | add_iface_failure: |
| 431 | spin_unlock(&netlbl_unlhsh_lock); |
| 432 | kfree(iface); |
| 433 | return NULL; |
| 434 | } |
| 435 | |
| 436 | /** |
| 437 | * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table |
| 438 | * @net: network namespace |
| 439 | * @dev_name: interface name |
| 440 | * @addr: IP address in network byte order |
| 441 | * @mask: address mask in network byte order |
| 442 | * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) |
| 443 | * @secid: LSM secid value for the entry |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 444 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 445 | * |
| 446 | * Description: |
| 447 | * Adds a new entry to the unlabeled connection hash table. Returns zero on |
| 448 | * success, negative values on failure. |
| 449 | * |
| 450 | */ |
Paul Moore | 6c2e8ac | 2008-12-31 12:54:11 -0500 | [diff] [blame] | 451 | int netlbl_unlhsh_add(struct net *net, |
| 452 | const char *dev_name, |
| 453 | const void *addr, |
| 454 | const void *mask, |
| 455 | u32 addr_len, |
| 456 | u32 secid, |
| 457 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 458 | { |
| 459 | int ret_val; |
| 460 | int ifindex; |
| 461 | struct net_device *dev; |
| 462 | struct netlbl_unlhsh_iface *iface; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 463 | struct audit_buffer *audit_buf = NULL; |
| 464 | char *secctx = NULL; |
| 465 | u32 secctx_len; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 466 | |
| 467 | if (addr_len != sizeof(struct in_addr) && |
| 468 | addr_len != sizeof(struct in6_addr)) |
| 469 | return -EINVAL; |
| 470 | |
| 471 | rcu_read_lock(); |
| 472 | if (dev_name != NULL) { |
Eric Dumazet | 122ec6f | 2009-11-05 20:53:47 -0800 | [diff] [blame] | 473 | dev = dev_get_by_name_rcu(net, dev_name); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 474 | if (dev == NULL) { |
| 475 | ret_val = -ENODEV; |
| 476 | goto unlhsh_add_return; |
| 477 | } |
| 478 | ifindex = dev->ifindex; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 479 | iface = netlbl_unlhsh_search_iface(ifindex); |
| 480 | } else { |
| 481 | ifindex = 0; |
| 482 | iface = rcu_dereference(netlbl_unlhsh_def); |
| 483 | } |
| 484 | if (iface == NULL) { |
| 485 | iface = netlbl_unlhsh_add_iface(ifindex); |
| 486 | if (iface == NULL) { |
| 487 | ret_val = -ENOMEM; |
| 488 | goto unlhsh_add_return; |
| 489 | } |
| 490 | } |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 491 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD, |
| 492 | audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 493 | switch (addr_len) { |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 494 | case sizeof(struct in_addr): { |
| 495 | struct in_addr *addr4, *mask4; |
| 496 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 497 | addr4 = (struct in_addr *)addr; |
| 498 | mask4 = (struct in_addr *)mask; |
| 499 | ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid); |
| 500 | if (audit_buf != NULL) |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 501 | netlbl_af4list_audit_addr(audit_buf, 1, |
| 502 | dev_name, |
| 503 | addr4->s_addr, |
| 504 | mask4->s_addr); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 505 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 506 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 507 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 508 | case sizeof(struct in6_addr): { |
| 509 | struct in6_addr *addr6, *mask6; |
| 510 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 511 | addr6 = (struct in6_addr *)addr; |
| 512 | mask6 = (struct in6_addr *)mask; |
| 513 | ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid); |
| 514 | if (audit_buf != NULL) |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 515 | netlbl_af6list_audit_addr(audit_buf, 1, |
| 516 | dev_name, |
| 517 | addr6, mask6); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 518 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 519 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 520 | #endif /* IPv6 */ |
| 521 | default: |
| 522 | ret_val = -EINVAL; |
| 523 | } |
| 524 | if (ret_val == 0) |
| 525 | atomic_inc(&netlabel_mgmt_protocount); |
| 526 | |
| 527 | unlhsh_add_return: |
| 528 | rcu_read_unlock(); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 529 | if (audit_buf != NULL) { |
| 530 | if (security_secid_to_secctx(secid, |
| 531 | &secctx, |
| 532 | &secctx_len) == 0) { |
| 533 | audit_log_format(audit_buf, " sec_obj=%s", secctx); |
| 534 | security_release_secctx(secctx, secctx_len); |
| 535 | } |
| 536 | audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0); |
| 537 | audit_log_end(audit_buf); |
| 538 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 539 | return ret_val; |
| 540 | } |
| 541 | |
| 542 | /** |
| 543 | * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 544 | * @net: network namespace |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 545 | * @iface: interface entry |
| 546 | * @addr: IP address |
| 547 | * @mask: IP address mask |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 548 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 549 | * |
| 550 | * Description: |
| 551 | * Remove an IP address entry from the unlabeled connection hash table. |
| 552 | * Returns zero on success, negative values on failure. The caller is |
| 553 | * responsible for calling the rcu_read_[un]lock() functions. |
| 554 | * |
| 555 | */ |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 556 | static int netlbl_unlhsh_remove_addr4(struct net *net, |
| 557 | struct netlbl_unlhsh_iface *iface, |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 558 | const struct in_addr *addr, |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 559 | const struct in_addr *mask, |
| 560 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 561 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 562 | struct netlbl_af4list *list_entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 563 | struct netlbl_unlhsh_addr4 *entry; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 564 | struct audit_buffer *audit_buf; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 565 | struct net_device *dev; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 566 | char *secctx; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 567 | u32 secctx_len; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 568 | |
| 569 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 570 | list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr, |
| 571 | &iface->addr4_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 572 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | d25830e | 2008-12-03 00:37:04 -0800 | [diff] [blame] | 573 | if (list_entry != NULL) |
| 574 | entry = netlbl_unlhsh_addr4_entry(list_entry); |
| 575 | else |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 576 | entry = NULL; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 577 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 578 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, |
| 579 | audit_info); |
| 580 | if (audit_buf != NULL) { |
| 581 | dev = dev_get_by_index(net, iface->ifindex); |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 582 | netlbl_af4list_audit_addr(audit_buf, 1, |
| 583 | (dev != NULL ? dev->name : NULL), |
| 584 | addr->s_addr, mask->s_addr); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 585 | if (dev != NULL) |
| 586 | dev_put(dev); |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 587 | if (entry != NULL && |
| 588 | security_secid_to_secctx(entry->secid, |
| 589 | &secctx, &secctx_len) == 0) { |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 590 | audit_log_format(audit_buf, " sec_obj=%s", secctx); |
| 591 | security_release_secctx(secctx, secctx_len); |
| 592 | } |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 593 | audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 594 | audit_log_end(audit_buf); |
| 595 | } |
| 596 | |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 597 | if (entry == NULL) |
| 598 | return -ENOENT; |
| 599 | |
| 600 | call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4); |
| 601 | return 0; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 602 | } |
| 603 | |
| 604 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 605 | /** |
| 606 | * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 607 | * @net: network namespace |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 608 | * @iface: interface entry |
| 609 | * @addr: IP address |
| 610 | * @mask: IP address mask |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 611 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 612 | * |
| 613 | * Description: |
| 614 | * Remove an IP address entry from the unlabeled connection hash table. |
| 615 | * Returns zero on success, negative values on failure. The caller is |
| 616 | * responsible for calling the rcu_read_[un]lock() functions. |
| 617 | * |
| 618 | */ |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 619 | static int netlbl_unlhsh_remove_addr6(struct net *net, |
| 620 | struct netlbl_unlhsh_iface *iface, |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 621 | const struct in6_addr *addr, |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 622 | const struct in6_addr *mask, |
| 623 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 624 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 625 | struct netlbl_af6list *list_entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 626 | struct netlbl_unlhsh_addr6 *entry; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 627 | struct audit_buffer *audit_buf; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 628 | struct net_device *dev; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 629 | char *secctx; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 630 | u32 secctx_len; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 631 | |
| 632 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 633 | list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 634 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | d25830e | 2008-12-03 00:37:04 -0800 | [diff] [blame] | 635 | if (list_entry != NULL) |
| 636 | entry = netlbl_unlhsh_addr6_entry(list_entry); |
| 637 | else |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 638 | entry = NULL; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 639 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 640 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, |
| 641 | audit_info); |
| 642 | if (audit_buf != NULL) { |
| 643 | dev = dev_get_by_index(net, iface->ifindex); |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 644 | netlbl_af6list_audit_addr(audit_buf, 1, |
| 645 | (dev != NULL ? dev->name : NULL), |
| 646 | addr, mask); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 647 | if (dev != NULL) |
| 648 | dev_put(dev); |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 649 | if (entry != NULL && |
| 650 | security_secid_to_secctx(entry->secid, |
| 651 | &secctx, &secctx_len) == 0) { |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 652 | audit_log_format(audit_buf, " sec_obj=%s", secctx); |
| 653 | security_release_secctx(secctx, secctx_len); |
| 654 | } |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 655 | audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 656 | audit_log_end(audit_buf); |
| 657 | } |
| 658 | |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 659 | if (entry == NULL) |
| 660 | return -ENOENT; |
| 661 | |
| 662 | call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6); |
| 663 | return 0; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 664 | } |
| 665 | #endif /* IPv6 */ |
| 666 | |
| 667 | /** |
| 668 | * netlbl_unlhsh_condremove_iface - Remove an interface entry |
| 669 | * @iface: the interface entry |
| 670 | * |
| 671 | * Description: |
| 672 | * Remove an interface entry from the unlabeled connection hash table if it is |
| 673 | * empty. An interface entry is considered to be empty if there are no |
| 674 | * address entries assigned to it. |
| 675 | * |
| 676 | */ |
| 677 | static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface) |
| 678 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 679 | struct netlbl_af4list *iter4; |
| 680 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 681 | struct netlbl_af6list *iter6; |
| 682 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 683 | |
| 684 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 685 | netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list) |
| 686 | goto unlhsh_condremove_failure; |
| 687 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 688 | netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list) |
| 689 | goto unlhsh_condremove_failure; |
| 690 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 691 | iface->valid = 0; |
| 692 | if (iface->ifindex > 0) |
| 693 | list_del_rcu(&iface->list); |
| 694 | else |
| 695 | rcu_assign_pointer(netlbl_unlhsh_def, NULL); |
| 696 | spin_unlock(&netlbl_unlhsh_lock); |
| 697 | |
| 698 | call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); |
| 699 | return; |
| 700 | |
| 701 | unlhsh_condremove_failure: |
| 702 | spin_unlock(&netlbl_unlhsh_lock); |
| 703 | return; |
| 704 | } |
| 705 | |
| 706 | /** |
| 707 | * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table |
| 708 | * @net: network namespace |
| 709 | * @dev_name: interface name |
| 710 | * @addr: IP address in network byte order |
| 711 | * @mask: address mask in network byte order |
| 712 | * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 713 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 714 | * |
| 715 | * Description: |
| 716 | * Removes and existing entry from the unlabeled connection hash table. |
| 717 | * Returns zero on success, negative values on failure. |
| 718 | * |
| 719 | */ |
Paul Moore | 6c2e8ac | 2008-12-31 12:54:11 -0500 | [diff] [blame] | 720 | int netlbl_unlhsh_remove(struct net *net, |
| 721 | const char *dev_name, |
| 722 | const void *addr, |
| 723 | const void *mask, |
| 724 | u32 addr_len, |
| 725 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 726 | { |
| 727 | int ret_val; |
| 728 | struct net_device *dev; |
| 729 | struct netlbl_unlhsh_iface *iface; |
| 730 | |
| 731 | if (addr_len != sizeof(struct in_addr) && |
| 732 | addr_len != sizeof(struct in6_addr)) |
| 733 | return -EINVAL; |
| 734 | |
| 735 | rcu_read_lock(); |
| 736 | if (dev_name != NULL) { |
Eric Dumazet | 122ec6f | 2009-11-05 20:53:47 -0800 | [diff] [blame] | 737 | dev = dev_get_by_name_rcu(net, dev_name); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 738 | if (dev == NULL) { |
| 739 | ret_val = -ENODEV; |
| 740 | goto unlhsh_remove_return; |
| 741 | } |
| 742 | iface = netlbl_unlhsh_search_iface(dev->ifindex); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 743 | } else |
| 744 | iface = rcu_dereference(netlbl_unlhsh_def); |
| 745 | if (iface == NULL) { |
| 746 | ret_val = -ENOENT; |
| 747 | goto unlhsh_remove_return; |
| 748 | } |
| 749 | switch (addr_len) { |
| 750 | case sizeof(struct in_addr): |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 751 | ret_val = netlbl_unlhsh_remove_addr4(net, |
| 752 | iface, addr, mask, |
| 753 | audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 754 | break; |
| 755 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 756 | case sizeof(struct in6_addr): |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 757 | ret_val = netlbl_unlhsh_remove_addr6(net, |
| 758 | iface, addr, mask, |
| 759 | audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 760 | break; |
| 761 | #endif /* IPv6 */ |
| 762 | default: |
| 763 | ret_val = -EINVAL; |
| 764 | } |
| 765 | if (ret_val == 0) { |
| 766 | netlbl_unlhsh_condremove_iface(iface); |
| 767 | atomic_dec(&netlabel_mgmt_protocount); |
| 768 | } |
| 769 | |
| 770 | unlhsh_remove_return: |
| 771 | rcu_read_unlock(); |
| 772 | return ret_val; |
| 773 | } |
| 774 | |
| 775 | /* |
| 776 | * General Helper Functions |
| 777 | */ |
| 778 | |
| 779 | /** |
| 780 | * netlbl_unlhsh_netdev_handler - Network device notification handler |
| 781 | * @this: notifier block |
| 782 | * @event: the event |
| 783 | * @ptr: the network device (cast to void) |
| 784 | * |
| 785 | * Description: |
| 786 | * Handle network device events, although at present all we care about is a |
| 787 | * network device going away. In the case of a device going away we clear any |
| 788 | * related entries from the unlabeled connection hash table. |
| 789 | * |
| 790 | */ |
| 791 | static int netlbl_unlhsh_netdev_handler(struct notifier_block *this, |
| 792 | unsigned long event, |
| 793 | void *ptr) |
| 794 | { |
| 795 | struct net_device *dev = ptr; |
| 796 | struct netlbl_unlhsh_iface *iface = NULL; |
| 797 | |
YOSHIFUJI Hideaki | 721499e | 2008-07-19 22:34:43 -0700 | [diff] [blame] | 798 | if (!net_eq(dev_net(dev), &init_net)) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 799 | return NOTIFY_DONE; |
| 800 | |
| 801 | /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */ |
| 802 | if (event == NETDEV_DOWN) { |
| 803 | spin_lock(&netlbl_unlhsh_lock); |
| 804 | iface = netlbl_unlhsh_search_iface(dev->ifindex); |
| 805 | if (iface != NULL && iface->valid) { |
| 806 | iface->valid = 0; |
| 807 | list_del_rcu(&iface->list); |
| 808 | } else |
| 809 | iface = NULL; |
| 810 | spin_unlock(&netlbl_unlhsh_lock); |
| 811 | } |
| 812 | |
| 813 | if (iface != NULL) |
| 814 | call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); |
| 815 | |
| 816 | return NOTIFY_DONE; |
| 817 | } |
| 818 | |
| 819 | /** |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 820 | * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag |
| 821 | * @value: desired value |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 822 | * @audit_info: NetLabel audit information |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 823 | * |
| 824 | * Description: |
| 825 | * Set the value of the unlabeled accept flag to @value. |
| 826 | * |
| 827 | */ |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 828 | static void netlbl_unlabel_acceptflg_set(u8 value, |
| 829 | struct netlbl_audit *audit_info) |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 830 | { |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 831 | struct audit_buffer *audit_buf; |
| 832 | u8 old_val; |
| 833 | |
Paul Moore | 4be2700 | 2007-10-26 04:29:08 -0700 | [diff] [blame] | 834 | old_val = netlabel_unlabel_acceptflg; |
Paul Moore | cd28786 | 2006-11-17 17:38:44 -0500 | [diff] [blame] | 835 | netlabel_unlabel_acceptflg = value; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 836 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW, |
| 837 | audit_info); |
Paul Moore | de64688 | 2006-11-17 17:38:55 -0500 | [diff] [blame] | 838 | if (audit_buf != NULL) { |
| 839 | audit_log_format(audit_buf, |
| 840 | " unlbl_accept=%u old=%u", value, old_val); |
| 841 | audit_log_end(audit_buf); |
| 842 | } |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 843 | } |
| 844 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 845 | /** |
| 846 | * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information |
| 847 | * @info: the Generic NETLINK info block |
| 848 | * @addr: the IP address |
| 849 | * @mask: the IP address mask |
| 850 | * @len: the address length |
| 851 | * |
| 852 | * Description: |
| 853 | * Examine the Generic NETLINK message and extract the IP address information. |
| 854 | * Returns zero on success, negative values on failure. |
| 855 | * |
| 856 | */ |
| 857 | static int netlbl_unlabel_addrinfo_get(struct genl_info *info, |
| 858 | void **addr, |
| 859 | void **mask, |
| 860 | u32 *len) |
| 861 | { |
| 862 | u32 addr_len; |
| 863 | |
| 864 | if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) { |
| 865 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); |
| 866 | if (addr_len != sizeof(struct in_addr) && |
| 867 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) |
| 868 | return -EINVAL; |
| 869 | *len = addr_len; |
| 870 | *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); |
| 871 | *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]); |
| 872 | return 0; |
| 873 | } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) { |
| 874 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); |
| 875 | if (addr_len != sizeof(struct in6_addr) && |
| 876 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK])) |
| 877 | return -EINVAL; |
| 878 | *len = addr_len; |
| 879 | *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); |
| 880 | *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]); |
| 881 | return 0; |
| 882 | } |
| 883 | |
| 884 | return -EINVAL; |
| 885 | } |
| 886 | |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 887 | /* |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 888 | * NetLabel Command Handlers |
| 889 | */ |
| 890 | |
| 891 | /** |
| 892 | * netlbl_unlabel_accept - Handle an ACCEPT message |
| 893 | * @skb: the NETLINK buffer |
| 894 | * @info: the Generic NETLINK info block |
| 895 | * |
| 896 | * Description: |
| 897 | * Process a user generated ACCEPT message and set the accept flag accordingly. |
| 898 | * Returns zero on success, negative values on failure. |
| 899 | * |
| 900 | */ |
| 901 | static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info) |
| 902 | { |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 903 | u8 value; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 904 | struct netlbl_audit audit_info; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 905 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 906 | if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) { |
| 907 | value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 908 | if (value == 1 || value == 0) { |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 909 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 910 | netlbl_unlabel_acceptflg_set(value, &audit_info); |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 911 | return 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 912 | } |
| 913 | } |
| 914 | |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 915 | return -EINVAL; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 916 | } |
| 917 | |
| 918 | /** |
| 919 | * netlbl_unlabel_list - Handle a LIST message |
| 920 | * @skb: the NETLINK buffer |
| 921 | * @info: the Generic NETLINK info block |
| 922 | * |
| 923 | * Description: |
| 924 | * Process a user generated LIST message and respond with the current status. |
| 925 | * Returns zero on success, negative values on failure. |
| 926 | * |
| 927 | */ |
| 928 | static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info) |
| 929 | { |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 930 | int ret_val = -EINVAL; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 931 | struct sk_buff *ans_skb; |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 932 | void *data; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 933 | |
Thomas Graf | 339bf98 | 2006-11-10 14:10:15 -0800 | [diff] [blame] | 934 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 935 | if (ans_skb == NULL) |
| 936 | goto list_failure; |
Thomas Graf | 17c157c | 2006-11-14 19:46:02 -0800 | [diff] [blame] | 937 | data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family, |
| 938 | 0, NLBL_UNLABEL_C_LIST); |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 939 | if (data == NULL) { |
| 940 | ret_val = -ENOMEM; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 941 | goto list_failure; |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 942 | } |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 943 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 944 | ret_val = nla_put_u8(ans_skb, |
| 945 | NLBL_UNLABEL_A_ACPTFLG, |
Paul Moore | cd28786 | 2006-11-17 17:38:44 -0500 | [diff] [blame] | 946 | netlabel_unlabel_acceptflg); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 947 | if (ret_val != 0) |
| 948 | goto list_failure; |
| 949 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 950 | genlmsg_end(ans_skb, data); |
Denis V. Lunev | fe785be | 2008-07-10 16:53:39 -0700 | [diff] [blame] | 951 | return genlmsg_reply(ans_skb, info); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 952 | |
| 953 | list_failure: |
Patrick McHardy | b08d584 | 2007-02-27 09:57:37 -0800 | [diff] [blame] | 954 | kfree_skb(ans_skb); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 955 | return ret_val; |
| 956 | } |
| 957 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 958 | /** |
| 959 | * netlbl_unlabel_staticadd - Handle a STATICADD message |
| 960 | * @skb: the NETLINK buffer |
| 961 | * @info: the Generic NETLINK info block |
| 962 | * |
| 963 | * Description: |
| 964 | * Process a user generated STATICADD message and add a new unlabeled |
| 965 | * connection entry to the hash table. Returns zero on success, negative |
| 966 | * values on failure. |
| 967 | * |
| 968 | */ |
| 969 | static int netlbl_unlabel_staticadd(struct sk_buff *skb, |
| 970 | struct genl_info *info) |
| 971 | { |
| 972 | int ret_val; |
| 973 | char *dev_name; |
| 974 | void *addr; |
| 975 | void *mask; |
| 976 | u32 addr_len; |
| 977 | u32 secid; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 978 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 979 | |
| 980 | /* Don't allow users to add both IPv4 and IPv6 addresses for a |
| 981 | * single entry. However, allow users to create two entries, one each |
| 982 | * for IPv4 and IPv4, with the same LSM security context which should |
| 983 | * achieve the same result. */ |
| 984 | if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || |
| 985 | !info->attrs[NLBL_UNLABEL_A_IFACE] || |
| 986 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 987 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 988 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 989 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 990 | return -EINVAL; |
| 991 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 992 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 993 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 994 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 995 | if (ret_val != 0) |
| 996 | return ret_val; |
| 997 | dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); |
| 998 | ret_val = security_secctx_to_secid( |
| 999 | nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 1000 | nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 1001 | &secid); |
| 1002 | if (ret_val != 0) |
| 1003 | return ret_val; |
| 1004 | |
| 1005 | return netlbl_unlhsh_add(&init_net, |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1006 | dev_name, addr, mask, addr_len, secid, |
| 1007 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1008 | } |
| 1009 | |
| 1010 | /** |
| 1011 | * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message |
| 1012 | * @skb: the NETLINK buffer |
| 1013 | * @info: the Generic NETLINK info block |
| 1014 | * |
| 1015 | * Description: |
| 1016 | * Process a user generated STATICADDDEF message and add a new default |
| 1017 | * unlabeled connection entry. Returns zero on success, negative values on |
| 1018 | * failure. |
| 1019 | * |
| 1020 | */ |
| 1021 | static int netlbl_unlabel_staticadddef(struct sk_buff *skb, |
| 1022 | struct genl_info *info) |
| 1023 | { |
| 1024 | int ret_val; |
| 1025 | void *addr; |
| 1026 | void *mask; |
| 1027 | u32 addr_len; |
| 1028 | u32 secid; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1029 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1030 | |
| 1031 | /* Don't allow users to add both IPv4 and IPv6 addresses for a |
| 1032 | * single entry. However, allow users to create two entries, one each |
| 1033 | * for IPv4 and IPv6, with the same LSM security context which should |
| 1034 | * achieve the same result. */ |
| 1035 | if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || |
| 1036 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 1037 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 1038 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 1039 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 1040 | return -EINVAL; |
| 1041 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1042 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 1043 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1044 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 1045 | if (ret_val != 0) |
| 1046 | return ret_val; |
| 1047 | ret_val = security_secctx_to_secid( |
| 1048 | nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 1049 | nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 1050 | &secid); |
| 1051 | if (ret_val != 0) |
| 1052 | return ret_val; |
| 1053 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1054 | return netlbl_unlhsh_add(&init_net, |
| 1055 | NULL, addr, mask, addr_len, secid, |
| 1056 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1057 | } |
| 1058 | |
| 1059 | /** |
| 1060 | * netlbl_unlabel_staticremove - Handle a STATICREMOVE message |
| 1061 | * @skb: the NETLINK buffer |
| 1062 | * @info: the Generic NETLINK info block |
| 1063 | * |
| 1064 | * Description: |
| 1065 | * Process a user generated STATICREMOVE message and remove the specified |
| 1066 | * unlabeled connection entry. Returns zero on success, negative values on |
| 1067 | * failure. |
| 1068 | * |
| 1069 | */ |
| 1070 | static int netlbl_unlabel_staticremove(struct sk_buff *skb, |
| 1071 | struct genl_info *info) |
| 1072 | { |
| 1073 | int ret_val; |
| 1074 | char *dev_name; |
| 1075 | void *addr; |
| 1076 | void *mask; |
| 1077 | u32 addr_len; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1078 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1079 | |
| 1080 | /* See the note in netlbl_unlabel_staticadd() about not allowing both |
| 1081 | * IPv4 and IPv6 in the same entry. */ |
| 1082 | if (!info->attrs[NLBL_UNLABEL_A_IFACE] || |
| 1083 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 1084 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 1085 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 1086 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 1087 | return -EINVAL; |
| 1088 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1089 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 1090 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1091 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 1092 | if (ret_val != 0) |
| 1093 | return ret_val; |
| 1094 | dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); |
| 1095 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1096 | return netlbl_unlhsh_remove(&init_net, |
| 1097 | dev_name, addr, mask, addr_len, |
| 1098 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1099 | } |
| 1100 | |
| 1101 | /** |
| 1102 | * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message |
| 1103 | * @skb: the NETLINK buffer |
| 1104 | * @info: the Generic NETLINK info block |
| 1105 | * |
| 1106 | * Description: |
| 1107 | * Process a user generated STATICREMOVEDEF message and remove the default |
| 1108 | * unlabeled connection entry. Returns zero on success, negative values on |
| 1109 | * failure. |
| 1110 | * |
| 1111 | */ |
| 1112 | static int netlbl_unlabel_staticremovedef(struct sk_buff *skb, |
| 1113 | struct genl_info *info) |
| 1114 | { |
| 1115 | int ret_val; |
| 1116 | void *addr; |
| 1117 | void *mask; |
| 1118 | u32 addr_len; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1119 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1120 | |
| 1121 | /* See the note in netlbl_unlabel_staticadd() about not allowing both |
| 1122 | * IPv4 and IPv6 in the same entry. */ |
| 1123 | if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 1124 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 1125 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 1126 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 1127 | return -EINVAL; |
| 1128 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1129 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 1130 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1131 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 1132 | if (ret_val != 0) |
| 1133 | return ret_val; |
| 1134 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1135 | return netlbl_unlhsh_remove(&init_net, |
| 1136 | NULL, addr, mask, addr_len, |
| 1137 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1138 | } |
| 1139 | |
| 1140 | |
| 1141 | /** |
| 1142 | * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF] |
| 1143 | * @cmd: command/message |
| 1144 | * @iface: the interface entry |
| 1145 | * @addr4: the IPv4 address entry |
| 1146 | * @addr6: the IPv6 address entry |
| 1147 | * @arg: the netlbl_unlhsh_walk_arg structure |
| 1148 | * |
| 1149 | * Description: |
| 1150 | * This function is designed to be used to generate a response for a |
| 1151 | * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6 |
| 1152 | * can be specified, not both, the other unspecified entry should be set to |
| 1153 | * NULL by the caller. Returns the size of the message on success, negative |
| 1154 | * values on failure. |
| 1155 | * |
| 1156 | */ |
| 1157 | static int netlbl_unlabel_staticlist_gen(u32 cmd, |
| 1158 | const struct netlbl_unlhsh_iface *iface, |
| 1159 | const struct netlbl_unlhsh_addr4 *addr4, |
| 1160 | const struct netlbl_unlhsh_addr6 *addr6, |
| 1161 | void *arg) |
| 1162 | { |
| 1163 | int ret_val = -ENOMEM; |
| 1164 | struct netlbl_unlhsh_walk_arg *cb_arg = arg; |
| 1165 | struct net_device *dev; |
| 1166 | void *data; |
| 1167 | u32 secid; |
| 1168 | char *secctx; |
| 1169 | u32 secctx_len; |
| 1170 | |
| 1171 | data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid, |
| 1172 | cb_arg->seq, &netlbl_unlabel_gnl_family, |
| 1173 | NLM_F_MULTI, cmd); |
| 1174 | if (data == NULL) |
| 1175 | goto list_cb_failure; |
| 1176 | |
| 1177 | if (iface->ifindex > 0) { |
| 1178 | dev = dev_get_by_index(&init_net, iface->ifindex); |
Jesper Juhl | 794eb6b | 2008-04-17 23:22:54 -0700 | [diff] [blame] | 1179 | if (!dev) { |
| 1180 | ret_val = -ENODEV; |
| 1181 | goto list_cb_failure; |
| 1182 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1183 | ret_val = nla_put_string(cb_arg->skb, |
| 1184 | NLBL_UNLABEL_A_IFACE, dev->name); |
| 1185 | dev_put(dev); |
| 1186 | if (ret_val != 0) |
| 1187 | goto list_cb_failure; |
| 1188 | } |
| 1189 | |
| 1190 | if (addr4) { |
| 1191 | struct in_addr addr_struct; |
| 1192 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1193 | addr_struct.s_addr = addr4->list.addr; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1194 | ret_val = nla_put(cb_arg->skb, |
| 1195 | NLBL_UNLABEL_A_IPV4ADDR, |
| 1196 | sizeof(struct in_addr), |
| 1197 | &addr_struct); |
| 1198 | if (ret_val != 0) |
| 1199 | goto list_cb_failure; |
| 1200 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1201 | addr_struct.s_addr = addr4->list.mask; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1202 | ret_val = nla_put(cb_arg->skb, |
| 1203 | NLBL_UNLABEL_A_IPV4MASK, |
| 1204 | sizeof(struct in_addr), |
| 1205 | &addr_struct); |
| 1206 | if (ret_val != 0) |
| 1207 | goto list_cb_failure; |
| 1208 | |
| 1209 | secid = addr4->secid; |
| 1210 | } else { |
| 1211 | ret_val = nla_put(cb_arg->skb, |
| 1212 | NLBL_UNLABEL_A_IPV6ADDR, |
| 1213 | sizeof(struct in6_addr), |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1214 | &addr6->list.addr); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1215 | if (ret_val != 0) |
| 1216 | goto list_cb_failure; |
| 1217 | |
| 1218 | ret_val = nla_put(cb_arg->skb, |
| 1219 | NLBL_UNLABEL_A_IPV6MASK, |
| 1220 | sizeof(struct in6_addr), |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1221 | &addr6->list.mask); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1222 | if (ret_val != 0) |
| 1223 | goto list_cb_failure; |
| 1224 | |
| 1225 | secid = addr6->secid; |
| 1226 | } |
| 1227 | |
| 1228 | ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len); |
| 1229 | if (ret_val != 0) |
| 1230 | goto list_cb_failure; |
| 1231 | ret_val = nla_put(cb_arg->skb, |
| 1232 | NLBL_UNLABEL_A_SECCTX, |
| 1233 | secctx_len, |
| 1234 | secctx); |
| 1235 | security_release_secctx(secctx, secctx_len); |
| 1236 | if (ret_val != 0) |
| 1237 | goto list_cb_failure; |
| 1238 | |
| 1239 | cb_arg->seq++; |
| 1240 | return genlmsg_end(cb_arg->skb, data); |
| 1241 | |
| 1242 | list_cb_failure: |
| 1243 | genlmsg_cancel(cb_arg->skb, data); |
| 1244 | return ret_val; |
| 1245 | } |
| 1246 | |
| 1247 | /** |
| 1248 | * netlbl_unlabel_staticlist - Handle a STATICLIST message |
| 1249 | * @skb: the NETLINK buffer |
| 1250 | * @cb: the NETLINK callback |
| 1251 | * |
| 1252 | * Description: |
| 1253 | * Process a user generated STATICLIST message and dump the unlabeled |
| 1254 | * connection hash table in a form suitable for use in a kernel generated |
| 1255 | * STATICLIST message. Returns the length of @skb. |
| 1256 | * |
| 1257 | */ |
| 1258 | static int netlbl_unlabel_staticlist(struct sk_buff *skb, |
| 1259 | struct netlink_callback *cb) |
| 1260 | { |
| 1261 | struct netlbl_unlhsh_walk_arg cb_arg; |
| 1262 | u32 skip_bkt = cb->args[0]; |
| 1263 | u32 skip_chain = cb->args[1]; |
| 1264 | u32 skip_addr4 = cb->args[2]; |
| 1265 | u32 skip_addr6 = cb->args[3]; |
| 1266 | u32 iter_bkt; |
| 1267 | u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; |
| 1268 | struct netlbl_unlhsh_iface *iface; |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 1269 | struct list_head *iter_list; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1270 | struct netlbl_af4list *addr4; |
| 1271 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1272 | struct netlbl_af6list *addr6; |
| 1273 | #endif |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1274 | |
| 1275 | cb_arg.nl_cb = cb; |
| 1276 | cb_arg.skb = skb; |
| 1277 | cb_arg.seq = cb->nlh->nlmsg_seq; |
| 1278 | |
| 1279 | rcu_read_lock(); |
| 1280 | for (iter_bkt = skip_bkt; |
| 1281 | iter_bkt < rcu_dereference(netlbl_unlhsh)->size; |
| 1282 | iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) { |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 1283 | iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt]; |
| 1284 | list_for_each_entry_rcu(iface, iter_list, list) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1285 | if (!iface->valid || |
| 1286 | iter_chain++ < skip_chain) |
| 1287 | continue; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1288 | netlbl_af4list_foreach_rcu(addr4, |
| 1289 | &iface->addr4_list) { |
| 1290 | if (iter_addr4++ < skip_addr4) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1291 | continue; |
| 1292 | if (netlbl_unlabel_staticlist_gen( |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1293 | NLBL_UNLABEL_C_STATICLIST, |
| 1294 | iface, |
| 1295 | netlbl_unlhsh_addr4_entry(addr4), |
| 1296 | NULL, |
| 1297 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1298 | iter_addr4--; |
| 1299 | iter_chain--; |
| 1300 | goto unlabel_staticlist_return; |
| 1301 | } |
| 1302 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1303 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1304 | netlbl_af6list_foreach_rcu(addr6, |
| 1305 | &iface->addr6_list) { |
| 1306 | if (iter_addr6++ < skip_addr6) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1307 | continue; |
| 1308 | if (netlbl_unlabel_staticlist_gen( |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1309 | NLBL_UNLABEL_C_STATICLIST, |
| 1310 | iface, |
| 1311 | NULL, |
| 1312 | netlbl_unlhsh_addr6_entry(addr6), |
| 1313 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1314 | iter_addr6--; |
| 1315 | iter_chain--; |
| 1316 | goto unlabel_staticlist_return; |
| 1317 | } |
| 1318 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1319 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1320 | } |
| 1321 | } |
| 1322 | |
| 1323 | unlabel_staticlist_return: |
| 1324 | rcu_read_unlock(); |
| 1325 | cb->args[0] = skip_bkt; |
| 1326 | cb->args[1] = skip_chain; |
| 1327 | cb->args[2] = skip_addr4; |
| 1328 | cb->args[3] = skip_addr6; |
| 1329 | return skb->len; |
| 1330 | } |
| 1331 | |
| 1332 | /** |
| 1333 | * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message |
| 1334 | * @skb: the NETLINK buffer |
| 1335 | * @cb: the NETLINK callback |
| 1336 | * |
| 1337 | * Description: |
| 1338 | * Process a user generated STATICLISTDEF message and dump the default |
| 1339 | * unlabeled connection entry in a form suitable for use in a kernel generated |
| 1340 | * STATICLISTDEF message. Returns the length of @skb. |
| 1341 | * |
| 1342 | */ |
| 1343 | static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, |
| 1344 | struct netlink_callback *cb) |
| 1345 | { |
| 1346 | struct netlbl_unlhsh_walk_arg cb_arg; |
| 1347 | struct netlbl_unlhsh_iface *iface; |
| 1348 | u32 skip_addr4 = cb->args[0]; |
| 1349 | u32 skip_addr6 = cb->args[1]; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1350 | u32 iter_addr4 = 0; |
| 1351 | struct netlbl_af4list *addr4; |
| 1352 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1353 | u32 iter_addr6 = 0; |
| 1354 | struct netlbl_af6list *addr6; |
| 1355 | #endif |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1356 | |
| 1357 | cb_arg.nl_cb = cb; |
| 1358 | cb_arg.skb = skb; |
| 1359 | cb_arg.seq = cb->nlh->nlmsg_seq; |
| 1360 | |
| 1361 | rcu_read_lock(); |
| 1362 | iface = rcu_dereference(netlbl_unlhsh_def); |
| 1363 | if (iface == NULL || !iface->valid) |
| 1364 | goto unlabel_staticlistdef_return; |
| 1365 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1366 | netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) { |
| 1367 | if (iter_addr4++ < skip_addr4) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1368 | continue; |
| 1369 | if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1370 | iface, |
| 1371 | netlbl_unlhsh_addr4_entry(addr4), |
| 1372 | NULL, |
| 1373 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1374 | iter_addr4--; |
| 1375 | goto unlabel_staticlistdef_return; |
| 1376 | } |
| 1377 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1378 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1379 | netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) { |
| 1380 | if (iter_addr6++ < skip_addr6) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1381 | continue; |
| 1382 | if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1383 | iface, |
| 1384 | NULL, |
| 1385 | netlbl_unlhsh_addr6_entry(addr6), |
| 1386 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1387 | iter_addr6--; |
| 1388 | goto unlabel_staticlistdef_return; |
| 1389 | } |
| 1390 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1391 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1392 | |
| 1393 | unlabel_staticlistdef_return: |
| 1394 | rcu_read_unlock(); |
| 1395 | cb->args[0] = skip_addr4; |
| 1396 | cb->args[1] = skip_addr6; |
| 1397 | return skb->len; |
| 1398 | } |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1399 | |
| 1400 | /* |
| 1401 | * NetLabel Generic NETLINK Command Definitions |
| 1402 | */ |
| 1403 | |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1404 | static struct genl_ops netlbl_unlabel_genl_ops[] = { |
| 1405 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1406 | .cmd = NLBL_UNLABEL_C_STATICADD, |
| 1407 | .flags = GENL_ADMIN_PERM, |
| 1408 | .policy = netlbl_unlabel_genl_policy, |
| 1409 | .doit = netlbl_unlabel_staticadd, |
| 1410 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1411 | }, |
| 1412 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1413 | .cmd = NLBL_UNLABEL_C_STATICREMOVE, |
| 1414 | .flags = GENL_ADMIN_PERM, |
| 1415 | .policy = netlbl_unlabel_genl_policy, |
| 1416 | .doit = netlbl_unlabel_staticremove, |
| 1417 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1418 | }, |
| 1419 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1420 | .cmd = NLBL_UNLABEL_C_STATICLIST, |
| 1421 | .flags = 0, |
| 1422 | .policy = netlbl_unlabel_genl_policy, |
| 1423 | .doit = NULL, |
| 1424 | .dumpit = netlbl_unlabel_staticlist, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1425 | }, |
| 1426 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1427 | .cmd = NLBL_UNLABEL_C_STATICADDDEF, |
| 1428 | .flags = GENL_ADMIN_PERM, |
| 1429 | .policy = netlbl_unlabel_genl_policy, |
| 1430 | .doit = netlbl_unlabel_staticadddef, |
| 1431 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1432 | }, |
| 1433 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1434 | .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF, |
| 1435 | .flags = GENL_ADMIN_PERM, |
| 1436 | .policy = netlbl_unlabel_genl_policy, |
| 1437 | .doit = netlbl_unlabel_staticremovedef, |
| 1438 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1439 | }, |
| 1440 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1441 | .cmd = NLBL_UNLABEL_C_STATICLISTDEF, |
| 1442 | .flags = 0, |
| 1443 | .policy = netlbl_unlabel_genl_policy, |
| 1444 | .doit = NULL, |
| 1445 | .dumpit = netlbl_unlabel_staticlistdef, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1446 | }, |
| 1447 | { |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1448 | .cmd = NLBL_UNLABEL_C_ACCEPT, |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 1449 | .flags = GENL_ADMIN_PERM, |
| 1450 | .policy = netlbl_unlabel_genl_policy, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1451 | .doit = netlbl_unlabel_accept, |
| 1452 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1453 | }, |
| 1454 | { |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1455 | .cmd = NLBL_UNLABEL_C_LIST, |
| 1456 | .flags = 0, |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 1457 | .policy = netlbl_unlabel_genl_policy, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1458 | .doit = netlbl_unlabel_list, |
| 1459 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1460 | }, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1461 | }; |
| 1462 | |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1463 | /* |
| 1464 | * NetLabel Generic NETLINK Protocol Functions |
| 1465 | */ |
| 1466 | |
| 1467 | /** |
| 1468 | * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component |
| 1469 | * |
| 1470 | * Description: |
| 1471 | * Register the unlabeled packet NetLabel component with the Generic NETLINK |
| 1472 | * mechanism. Returns zero on success, negative values on failure. |
| 1473 | * |
| 1474 | */ |
Pavel Emelyanov | 05705e4 | 2008-02-17 22:33:57 -0800 | [diff] [blame] | 1475 | int __init netlbl_unlabel_genl_init(void) |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1476 | { |
Michał Mirosław | 7ae740d | 2009-05-21 10:34:05 +0000 | [diff] [blame] | 1477 | return genl_register_family_with_ops(&netlbl_unlabel_gnl_family, |
| 1478 | netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops)); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1479 | } |
| 1480 | |
| 1481 | /* |
| 1482 | * NetLabel KAPI Hooks |
| 1483 | */ |
| 1484 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1485 | static struct notifier_block netlbl_unlhsh_netdev_notifier = { |
| 1486 | .notifier_call = netlbl_unlhsh_netdev_handler, |
| 1487 | }; |
| 1488 | |
| 1489 | /** |
| 1490 | * netlbl_unlabel_init - Initialize the unlabeled connection hash table |
| 1491 | * @size: the number of bits to use for the hash buckets |
| 1492 | * |
| 1493 | * Description: |
| 1494 | * Initializes the unlabeled connection hash table and registers a network |
| 1495 | * device notification handler. This function should only be called by the |
| 1496 | * NetLabel subsystem itself during initialization. Returns zero on success, |
| 1497 | * non-zero values on error. |
| 1498 | * |
| 1499 | */ |
Pavel Emelyanov | 05705e4 | 2008-02-17 22:33:57 -0800 | [diff] [blame] | 1500 | int __init netlbl_unlabel_init(u32 size) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1501 | { |
| 1502 | u32 iter; |
| 1503 | struct netlbl_unlhsh_tbl *hsh_tbl; |
| 1504 | |
| 1505 | if (size == 0) |
| 1506 | return -EINVAL; |
| 1507 | |
| 1508 | hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL); |
| 1509 | if (hsh_tbl == NULL) |
| 1510 | return -ENOMEM; |
| 1511 | hsh_tbl->size = 1 << size; |
| 1512 | hsh_tbl->tbl = kcalloc(hsh_tbl->size, |
| 1513 | sizeof(struct list_head), |
| 1514 | GFP_KERNEL); |
| 1515 | if (hsh_tbl->tbl == NULL) { |
| 1516 | kfree(hsh_tbl); |
| 1517 | return -ENOMEM; |
| 1518 | } |
| 1519 | for (iter = 0; iter < hsh_tbl->size; iter++) |
| 1520 | INIT_LIST_HEAD(&hsh_tbl->tbl[iter]); |
| 1521 | |
| 1522 | rcu_read_lock(); |
| 1523 | spin_lock(&netlbl_unlhsh_lock); |
| 1524 | rcu_assign_pointer(netlbl_unlhsh, hsh_tbl); |
| 1525 | spin_unlock(&netlbl_unlhsh_lock); |
| 1526 | rcu_read_unlock(); |
| 1527 | |
| 1528 | register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier); |
| 1529 | |
| 1530 | return 0; |
| 1531 | } |
| 1532 | |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1533 | /** |
| 1534 | * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1535 | * @skb: the packet |
| 1536 | * @family: protocol family |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1537 | * @secattr: the security attributes |
| 1538 | * |
| 1539 | * Description: |
| 1540 | * Determine the security attributes, if any, for an unlabled packet and return |
| 1541 | * them in @secattr. Returns zero on success and negative values on failure. |
| 1542 | * |
| 1543 | */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1544 | int netlbl_unlabel_getattr(const struct sk_buff *skb, |
| 1545 | u16 family, |
| 1546 | struct netlbl_lsm_secattr *secattr) |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1547 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1548 | struct netlbl_unlhsh_iface *iface; |
| 1549 | |
| 1550 | rcu_read_lock(); |
Eric Dumazet | 8964be4 | 2009-11-20 15:35:04 -0800 | [diff] [blame] | 1551 | iface = netlbl_unlhsh_search_iface_def(skb->skb_iif); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1552 | if (iface == NULL) |
| 1553 | goto unlabel_getattr_nolabel; |
| 1554 | switch (family) { |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1555 | case PF_INET: { |
| 1556 | struct iphdr *hdr4; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1557 | struct netlbl_af4list *addr4; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1558 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1559 | hdr4 = ip_hdr(skb); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1560 | addr4 = netlbl_af4list_search(hdr4->saddr, |
| 1561 | &iface->addr4_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1562 | if (addr4 == NULL) |
| 1563 | goto unlabel_getattr_nolabel; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1564 | secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1565 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1566 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1567 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1568 | case PF_INET6: { |
| 1569 | struct ipv6hdr *hdr6; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1570 | struct netlbl_af6list *addr6; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1571 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1572 | hdr6 = ipv6_hdr(skb); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1573 | addr6 = netlbl_af6list_search(&hdr6->saddr, |
| 1574 | &iface->addr6_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1575 | if (addr6 == NULL) |
| 1576 | goto unlabel_getattr_nolabel; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1577 | secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1578 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1579 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1580 | #endif /* IPv6 */ |
| 1581 | default: |
| 1582 | goto unlabel_getattr_nolabel; |
| 1583 | } |
| 1584 | rcu_read_unlock(); |
| 1585 | |
| 1586 | secattr->flags |= NETLBL_SECATTR_SECID; |
| 1587 | secattr->type = NETLBL_NLTYPE_UNLABELED; |
| 1588 | return 0; |
| 1589 | |
| 1590 | unlabel_getattr_nolabel: |
| 1591 | rcu_read_unlock(); |
Paul Moore | c783f1c | 2008-01-29 08:37:52 -0500 | [diff] [blame] | 1592 | if (netlabel_unlabel_acceptflg == 0) |
| 1593 | return -ENOMSG; |
Paul Moore | 16efd45 | 2008-01-29 08:37:59 -0500 | [diff] [blame] | 1594 | secattr->type = NETLBL_NLTYPE_UNLABELED; |
Paul Moore | c783f1c | 2008-01-29 08:37:52 -0500 | [diff] [blame] | 1595 | return 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1596 | } |
| 1597 | |
| 1598 | /** |
| 1599 | * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets |
| 1600 | * |
| 1601 | * Description: |
| 1602 | * Set the default NetLabel configuration to allow incoming unlabeled packets |
| 1603 | * and to send unlabeled network traffic by default. |
| 1604 | * |
| 1605 | */ |
Pavel Emelyanov | 05705e4 | 2008-02-17 22:33:57 -0800 | [diff] [blame] | 1606 | int __init netlbl_unlabel_defconf(void) |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1607 | { |
| 1608 | int ret_val; |
| 1609 | struct netlbl_dom_map *entry; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1610 | struct netlbl_audit audit_info; |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 1611 | |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1612 | /* Only the kernel is allowed to call this function and the only time |
| 1613 | * it is called is at bootup before the audit subsystem is reporting |
| 1614 | * messages so don't worry to much about these values. */ |
| 1615 | security_task_getsecid(current, &audit_info.secid); |
| 1616 | audit_info.loginuid = 0; |
Eric Paris | 2532386 | 2008-04-18 10:09:25 -0400 | [diff] [blame] | 1617 | audit_info.sessionid = 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1618 | |
| 1619 | entry = kzalloc(sizeof(*entry), GFP_KERNEL); |
| 1620 | if (entry == NULL) |
| 1621 | return -ENOMEM; |
| 1622 | entry->type = NETLBL_NLTYPE_UNLABELED; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1623 | ret_val = netlbl_domhsh_add_default(entry, &audit_info); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1624 | if (ret_val != 0) |
| 1625 | return ret_val; |
| 1626 | |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1627 | netlbl_unlabel_acceptflg_set(1, &audit_info); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1628 | |
| 1629 | return 0; |
| 1630 | } |