Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1 | /* |
| 2 | * NetLabel Unlabeled Support |
| 3 | * |
| 4 | * This file defines functions for dealing with unlabeled packets for the |
| 5 | * NetLabel system. The NetLabel system manages static and dynamic label |
| 6 | * mappings for network protocols such as CIPSO and RIPSO. |
| 7 | * |
| 8 | * Author: Paul Moore <paul.moore@hp.com> |
| 9 | * |
| 10 | */ |
| 11 | |
| 12 | /* |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008 |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 14 | * |
| 15 | * This program is free software; you can redistribute it and/or modify |
| 16 | * it under the terms of the GNU General Public License as published by |
| 17 | * the Free Software Foundation; either version 2 of the License, or |
| 18 | * (at your option) any later version. |
| 19 | * |
| 20 | * This program is distributed in the hope that it will be useful, |
| 21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See |
| 23 | * the GNU General Public License for more details. |
| 24 | * |
| 25 | * You should have received a copy of the GNU General Public License |
| 26 | * along with this program; if not, write to the Free Software |
| 27 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA |
| 28 | * |
| 29 | */ |
| 30 | |
| 31 | #include <linux/types.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 32 | #include <linux/rcupdate.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 33 | #include <linux/list.h> |
| 34 | #include <linux/spinlock.h> |
| 35 | #include <linux/socket.h> |
| 36 | #include <linux/string.h> |
| 37 | #include <linux/skbuff.h> |
Paul Moore | de64688 | 2006-11-17 17:38:55 -0500 | [diff] [blame] | 38 | #include <linux/audit.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 39 | #include <linux/in.h> |
| 40 | #include <linux/in6.h> |
| 41 | #include <linux/ip.h> |
| 42 | #include <linux/ipv6.h> |
| 43 | #include <linux/notifier.h> |
| 44 | #include <linux/netdevice.h> |
| 45 | #include <linux/security.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 46 | #include <linux/slab.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 47 | #include <net/sock.h> |
| 48 | #include <net/netlink.h> |
| 49 | #include <net/genetlink.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 50 | #include <net/ip.h> |
| 51 | #include <net/ipv6.h> |
| 52 | #include <net/net_namespace.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 53 | #include <net/netlabel.h> |
| 54 | #include <asm/bug.h> |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 55 | #include <asm/atomic.h> |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 56 | |
| 57 | #include "netlabel_user.h" |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 58 | #include "netlabel_addrlist.h" |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 59 | #include "netlabel_domainhash.h" |
| 60 | #include "netlabel_unlabeled.h" |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 61 | #include "netlabel_mgmt.h" |
| 62 | |
| 63 | /* NOTE: at present we always use init's network namespace since we don't |
| 64 | * presently support different namespaces even though the majority of |
| 65 | * the functions in this file are "namespace safe" */ |
| 66 | |
| 67 | /* The unlabeled connection hash table which we use to map network interfaces |
| 68 | * and addresses of unlabeled packets to a user specified secid value for the |
| 69 | * LSM. The hash table is used to lookup the network interface entry |
| 70 | * (struct netlbl_unlhsh_iface) and then the interface entry is used to |
| 71 | * lookup an IP address match from an ordered list. If a network interface |
| 72 | * match can not be found in the hash table then the default entry |
| 73 | * (netlbl_unlhsh_def) is used. The IP address entry list |
| 74 | * (struct netlbl_unlhsh_addr) is ordered such that the entries with a |
| 75 | * larger netmask come first. |
| 76 | */ |
| 77 | struct netlbl_unlhsh_tbl { |
| 78 | struct list_head *tbl; |
| 79 | u32 size; |
| 80 | }; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 81 | #define netlbl_unlhsh_addr4_entry(iter) \ |
| 82 | container_of(iter, struct netlbl_unlhsh_addr4, list) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 83 | struct netlbl_unlhsh_addr4 { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 84 | u32 secid; |
| 85 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 86 | struct netlbl_af4list list; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 87 | struct rcu_head rcu; |
| 88 | }; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 89 | #define netlbl_unlhsh_addr6_entry(iter) \ |
| 90 | container_of(iter, struct netlbl_unlhsh_addr6, list) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 91 | struct netlbl_unlhsh_addr6 { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 92 | u32 secid; |
| 93 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 94 | struct netlbl_af6list list; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 95 | struct rcu_head rcu; |
| 96 | }; |
| 97 | struct netlbl_unlhsh_iface { |
| 98 | int ifindex; |
| 99 | struct list_head addr4_list; |
| 100 | struct list_head addr6_list; |
| 101 | |
| 102 | u32 valid; |
| 103 | struct list_head list; |
| 104 | struct rcu_head rcu; |
| 105 | }; |
| 106 | |
| 107 | /* Argument struct for netlbl_unlhsh_walk() */ |
| 108 | struct netlbl_unlhsh_walk_arg { |
| 109 | struct netlink_callback *nl_cb; |
| 110 | struct sk_buff *skb; |
| 111 | u32 seq; |
| 112 | }; |
| 113 | |
| 114 | /* Unlabeled connection hash table */ |
| 115 | /* updates should be so rare that having one spinlock for the entire |
| 116 | * hash table should be okay */ |
| 117 | static DEFINE_SPINLOCK(netlbl_unlhsh_lock); |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 118 | #define netlbl_unlhsh_rcu_deref(p) \ |
| 119 | rcu_dereference_check(p, rcu_read_lock_held() || \ |
| 120 | lockdep_is_held(&netlbl_unlhsh_lock)) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 121 | static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL; |
| 122 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 123 | |
| 124 | /* Accept unlabeled packets flag */ |
Paul Moore | cd28786 | 2006-11-17 17:38:44 -0500 | [diff] [blame] | 125 | static u8 netlabel_unlabel_acceptflg = 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 126 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 127 | /* NetLabel Generic NETLINK unlabeled family */ |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 128 | static struct genl_family netlbl_unlabel_gnl_family = { |
| 129 | .id = GENL_ID_GENERATE, |
| 130 | .hdrsize = 0, |
| 131 | .name = NETLBL_NLTYPE_UNLABELED_NAME, |
| 132 | .version = NETLBL_PROTO_VERSION, |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 133 | .maxattr = NLBL_UNLABEL_A_MAX, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 134 | }; |
| 135 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 136 | /* NetLabel Netlink attribute policy */ |
Patrick McHardy | ef7c79e | 2007-06-05 12:38:30 -0700 | [diff] [blame] | 137 | static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 138 | [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 139 | [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY, |
| 140 | .len = sizeof(struct in6_addr) }, |
| 141 | [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY, |
| 142 | .len = sizeof(struct in6_addr) }, |
| 143 | [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY, |
| 144 | .len = sizeof(struct in_addr) }, |
| 145 | [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY, |
| 146 | .len = sizeof(struct in_addr) }, |
| 147 | [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING, |
| 148 | .len = IFNAMSIZ - 1 }, |
| 149 | [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY } |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 150 | }; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 151 | |
| 152 | /* |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 153 | * Unlabeled Connection Hash Table Functions |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 154 | */ |
| 155 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 156 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 157 | /** |
| 158 | * netlbl_unlhsh_free_addr6 - Frees an IPv6 address entry from the hash table |
| 159 | * @entry: the entry's RCU field |
| 160 | * |
| 161 | * Description: |
| 162 | * This function is designed to be used as a callback to the call_rcu() |
| 163 | * function so that memory allocated to a hash table address entry can be |
| 164 | * released safely. |
| 165 | * |
| 166 | */ |
| 167 | static void netlbl_unlhsh_free_addr6(struct rcu_head *entry) |
| 168 | { |
| 169 | struct netlbl_unlhsh_addr6 *ptr; |
| 170 | |
| 171 | ptr = container_of(entry, struct netlbl_unlhsh_addr6, rcu); |
| 172 | kfree(ptr); |
| 173 | } |
| 174 | #endif /* IPv6 */ |
| 175 | |
| 176 | /** |
| 177 | * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table |
| 178 | * @entry: the entry's RCU field |
| 179 | * |
| 180 | * Description: |
| 181 | * This function is designed to be used as a callback to the call_rcu() |
| 182 | * function so that memory allocated to a hash table interface entry can be |
| 183 | * released safely. It is important to note that this function does not free |
| 184 | * the IPv4 and IPv6 address lists contained as part of an interface entry. It |
| 185 | * is up to the rest of the code to make sure an interface entry is only freed |
| 186 | * once it's address lists are empty. |
| 187 | * |
| 188 | */ |
| 189 | static void netlbl_unlhsh_free_iface(struct rcu_head *entry) |
| 190 | { |
| 191 | struct netlbl_unlhsh_iface *iface; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 192 | struct netlbl_af4list *iter4; |
| 193 | struct netlbl_af4list *tmp4; |
| 194 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 195 | struct netlbl_af6list *iter6; |
| 196 | struct netlbl_af6list *tmp6; |
| 197 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 198 | |
| 199 | iface = container_of(entry, struct netlbl_unlhsh_iface, rcu); |
| 200 | |
| 201 | /* no need for locks here since we are the only one with access to this |
| 202 | * structure */ |
| 203 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 204 | netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) { |
| 205 | netlbl_af4list_remove_entry(iter4); |
| 206 | kfree(netlbl_unlhsh_addr4_entry(iter4)); |
| 207 | } |
| 208 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 209 | netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) { |
| 210 | netlbl_af6list_remove_entry(iter6); |
| 211 | kfree(netlbl_unlhsh_addr6_entry(iter6)); |
| 212 | } |
| 213 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 214 | kfree(iface); |
| 215 | } |
| 216 | |
| 217 | /** |
| 218 | * netlbl_unlhsh_hash - Hashing function for the hash table |
| 219 | * @ifindex: the network interface/device to hash |
| 220 | * |
| 221 | * Description: |
| 222 | * This is the hashing function for the unlabeled hash table, it returns the |
| 223 | * bucket number for the given device/interface. The caller is responsible for |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 224 | * ensuring that the hash table is protected with either a RCU read lock or |
| 225 | * the hash table lock. |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 226 | * |
| 227 | */ |
| 228 | static u32 netlbl_unlhsh_hash(int ifindex) |
| 229 | { |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 230 | return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 231 | } |
| 232 | |
| 233 | /** |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 234 | * netlbl_unlhsh_search_iface - Search for a matching interface entry |
| 235 | * @ifindex: the network interface |
| 236 | * |
| 237 | * Description: |
| 238 | * Searches the unlabeled connection hash table and returns a pointer to the |
| 239 | * interface entry which matches @ifindex, otherwise NULL is returned. The |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 240 | * caller is responsible for ensuring that the hash table is protected with |
| 241 | * either a RCU read lock or the hash table lock. |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 242 | * |
| 243 | */ |
| 244 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex) |
| 245 | { |
| 246 | u32 bkt; |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 247 | struct list_head *bkt_list; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 248 | struct netlbl_unlhsh_iface *iter; |
| 249 | |
| 250 | bkt = netlbl_unlhsh_hash(ifindex); |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 251 | bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]; |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 252 | list_for_each_entry_rcu(iter, bkt_list, list) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 253 | if (iter->valid && iter->ifindex == ifindex) |
| 254 | return iter; |
| 255 | |
| 256 | return NULL; |
| 257 | } |
| 258 | |
| 259 | /** |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 260 | * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table |
| 261 | * @iface: the associated interface entry |
| 262 | * @addr: IPv4 address in network byte order |
| 263 | * @mask: IPv4 address mask in network byte order |
| 264 | * @secid: LSM secid value for entry |
| 265 | * |
| 266 | * Description: |
| 267 | * Add a new address entry into the unlabeled connection hash table using the |
| 268 | * interface entry specified by @iface. On success zero is returned, otherwise |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 269 | * a negative value is returned. |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 270 | * |
| 271 | */ |
| 272 | static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface, |
| 273 | const struct in_addr *addr, |
| 274 | const struct in_addr *mask, |
| 275 | u32 secid) |
| 276 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 277 | int ret_val; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 278 | struct netlbl_unlhsh_addr4 *entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 279 | |
| 280 | entry = kzalloc(sizeof(*entry), GFP_ATOMIC); |
| 281 | if (entry == NULL) |
| 282 | return -ENOMEM; |
| 283 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 284 | entry->list.addr = addr->s_addr & mask->s_addr; |
| 285 | entry->list.mask = mask->s_addr; |
| 286 | entry->list.valid = 1; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 287 | entry->secid = secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 288 | |
| 289 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 290 | ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 291 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 292 | |
| 293 | if (ret_val != 0) |
| 294 | kfree(entry); |
| 295 | return ret_val; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 296 | } |
| 297 | |
| 298 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 299 | /** |
| 300 | * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table |
| 301 | * @iface: the associated interface entry |
| 302 | * @addr: IPv6 address in network byte order |
| 303 | * @mask: IPv6 address mask in network byte order |
| 304 | * @secid: LSM secid value for entry |
| 305 | * |
| 306 | * Description: |
| 307 | * Add a new address entry into the unlabeled connection hash table using the |
| 308 | * interface entry specified by @iface. On success zero is returned, otherwise |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 309 | * a negative value is returned. |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 310 | * |
| 311 | */ |
| 312 | static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface, |
| 313 | const struct in6_addr *addr, |
| 314 | const struct in6_addr *mask, |
| 315 | u32 secid) |
| 316 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 317 | int ret_val; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 318 | struct netlbl_unlhsh_addr6 *entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 319 | |
| 320 | entry = kzalloc(sizeof(*entry), GFP_ATOMIC); |
| 321 | if (entry == NULL) |
| 322 | return -ENOMEM; |
| 323 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 324 | ipv6_addr_copy(&entry->list.addr, addr); |
| 325 | entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; |
| 326 | entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; |
| 327 | entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2]; |
| 328 | entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3]; |
| 329 | ipv6_addr_copy(&entry->list.mask, mask); |
| 330 | entry->list.valid = 1; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 331 | entry->secid = secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 332 | |
| 333 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 334 | ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 335 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 336 | |
| 337 | if (ret_val != 0) |
| 338 | kfree(entry); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 339 | return 0; |
| 340 | } |
| 341 | #endif /* IPv6 */ |
| 342 | |
| 343 | /** |
| 344 | * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table |
| 345 | * @ifindex: network interface |
| 346 | * |
| 347 | * Description: |
| 348 | * Add a new, empty, interface entry into the unlabeled connection hash table. |
| 349 | * On success a pointer to the new interface entry is returned, on failure NULL |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 350 | * is returned. |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 351 | * |
| 352 | */ |
| 353 | static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex) |
| 354 | { |
| 355 | u32 bkt; |
| 356 | struct netlbl_unlhsh_iface *iface; |
| 357 | |
| 358 | iface = kzalloc(sizeof(*iface), GFP_ATOMIC); |
| 359 | if (iface == NULL) |
| 360 | return NULL; |
| 361 | |
| 362 | iface->ifindex = ifindex; |
| 363 | INIT_LIST_HEAD(&iface->addr4_list); |
| 364 | INIT_LIST_HEAD(&iface->addr6_list); |
| 365 | iface->valid = 1; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 366 | |
| 367 | spin_lock(&netlbl_unlhsh_lock); |
| 368 | if (ifindex > 0) { |
| 369 | bkt = netlbl_unlhsh_hash(ifindex); |
| 370 | if (netlbl_unlhsh_search_iface(ifindex) != NULL) |
| 371 | goto add_iface_failure; |
| 372 | list_add_tail_rcu(&iface->list, |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 373 | &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 374 | } else { |
| 375 | INIT_LIST_HEAD(&iface->list); |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 376 | if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 377 | goto add_iface_failure; |
| 378 | rcu_assign_pointer(netlbl_unlhsh_def, iface); |
| 379 | } |
| 380 | spin_unlock(&netlbl_unlhsh_lock); |
| 381 | |
| 382 | return iface; |
| 383 | |
| 384 | add_iface_failure: |
| 385 | spin_unlock(&netlbl_unlhsh_lock); |
| 386 | kfree(iface); |
| 387 | return NULL; |
| 388 | } |
| 389 | |
| 390 | /** |
| 391 | * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table |
| 392 | * @net: network namespace |
| 393 | * @dev_name: interface name |
| 394 | * @addr: IP address in network byte order |
| 395 | * @mask: address mask in network byte order |
| 396 | * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) |
| 397 | * @secid: LSM secid value for the entry |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 398 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 399 | * |
| 400 | * Description: |
| 401 | * Adds a new entry to the unlabeled connection hash table. Returns zero on |
| 402 | * success, negative values on failure. |
| 403 | * |
| 404 | */ |
Paul Moore | 6c2e8ac | 2008-12-31 12:54:11 -0500 | [diff] [blame] | 405 | int netlbl_unlhsh_add(struct net *net, |
| 406 | const char *dev_name, |
| 407 | const void *addr, |
| 408 | const void *mask, |
| 409 | u32 addr_len, |
| 410 | u32 secid, |
| 411 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 412 | { |
| 413 | int ret_val; |
| 414 | int ifindex; |
| 415 | struct net_device *dev; |
| 416 | struct netlbl_unlhsh_iface *iface; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 417 | struct audit_buffer *audit_buf = NULL; |
| 418 | char *secctx = NULL; |
| 419 | u32 secctx_len; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 420 | |
| 421 | if (addr_len != sizeof(struct in_addr) && |
| 422 | addr_len != sizeof(struct in6_addr)) |
| 423 | return -EINVAL; |
| 424 | |
| 425 | rcu_read_lock(); |
| 426 | if (dev_name != NULL) { |
Eric Dumazet | 122ec6f | 2009-11-05 20:53:47 -0800 | [diff] [blame] | 427 | dev = dev_get_by_name_rcu(net, dev_name); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 428 | if (dev == NULL) { |
| 429 | ret_val = -ENODEV; |
| 430 | goto unlhsh_add_return; |
| 431 | } |
| 432 | ifindex = dev->ifindex; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 433 | iface = netlbl_unlhsh_search_iface(ifindex); |
| 434 | } else { |
| 435 | ifindex = 0; |
| 436 | iface = rcu_dereference(netlbl_unlhsh_def); |
| 437 | } |
| 438 | if (iface == NULL) { |
| 439 | iface = netlbl_unlhsh_add_iface(ifindex); |
| 440 | if (iface == NULL) { |
| 441 | ret_val = -ENOMEM; |
| 442 | goto unlhsh_add_return; |
| 443 | } |
| 444 | } |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 445 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD, |
| 446 | audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 447 | switch (addr_len) { |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 448 | case sizeof(struct in_addr): { |
| 449 | struct in_addr *addr4, *mask4; |
| 450 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 451 | addr4 = (struct in_addr *)addr; |
| 452 | mask4 = (struct in_addr *)mask; |
| 453 | ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid); |
| 454 | if (audit_buf != NULL) |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 455 | netlbl_af4list_audit_addr(audit_buf, 1, |
| 456 | dev_name, |
| 457 | addr4->s_addr, |
| 458 | mask4->s_addr); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 459 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 460 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 461 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 462 | case sizeof(struct in6_addr): { |
| 463 | struct in6_addr *addr6, *mask6; |
| 464 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 465 | addr6 = (struct in6_addr *)addr; |
| 466 | mask6 = (struct in6_addr *)mask; |
| 467 | ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid); |
| 468 | if (audit_buf != NULL) |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 469 | netlbl_af6list_audit_addr(audit_buf, 1, |
| 470 | dev_name, |
| 471 | addr6, mask6); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 472 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 473 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 474 | #endif /* IPv6 */ |
| 475 | default: |
| 476 | ret_val = -EINVAL; |
| 477 | } |
| 478 | if (ret_val == 0) |
| 479 | atomic_inc(&netlabel_mgmt_protocount); |
| 480 | |
| 481 | unlhsh_add_return: |
| 482 | rcu_read_unlock(); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 483 | if (audit_buf != NULL) { |
| 484 | if (security_secid_to_secctx(secid, |
| 485 | &secctx, |
| 486 | &secctx_len) == 0) { |
| 487 | audit_log_format(audit_buf, " sec_obj=%s", secctx); |
| 488 | security_release_secctx(secctx, secctx_len); |
| 489 | } |
| 490 | audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0); |
| 491 | audit_log_end(audit_buf); |
| 492 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 493 | return ret_val; |
| 494 | } |
| 495 | |
| 496 | /** |
| 497 | * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 498 | * @net: network namespace |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 499 | * @iface: interface entry |
| 500 | * @addr: IP address |
| 501 | * @mask: IP address mask |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 502 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 503 | * |
| 504 | * Description: |
| 505 | * Remove an IP address entry from the unlabeled connection hash table. |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 506 | * Returns zero on success, negative values on failure. |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 507 | * |
| 508 | */ |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 509 | static int netlbl_unlhsh_remove_addr4(struct net *net, |
| 510 | struct netlbl_unlhsh_iface *iface, |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 511 | const struct in_addr *addr, |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 512 | const struct in_addr *mask, |
| 513 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 514 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 515 | struct netlbl_af4list *list_entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 516 | struct netlbl_unlhsh_addr4 *entry; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 517 | struct audit_buffer *audit_buf; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 518 | struct net_device *dev; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 519 | char *secctx; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 520 | u32 secctx_len; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 521 | |
| 522 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 523 | list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr, |
| 524 | &iface->addr4_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 525 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | d25830e | 2008-12-03 00:37:04 -0800 | [diff] [blame] | 526 | if (list_entry != NULL) |
| 527 | entry = netlbl_unlhsh_addr4_entry(list_entry); |
| 528 | else |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 529 | entry = NULL; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 530 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 531 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, |
| 532 | audit_info); |
| 533 | if (audit_buf != NULL) { |
| 534 | dev = dev_get_by_index(net, iface->ifindex); |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 535 | netlbl_af4list_audit_addr(audit_buf, 1, |
| 536 | (dev != NULL ? dev->name : NULL), |
| 537 | addr->s_addr, mask->s_addr); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 538 | if (dev != NULL) |
| 539 | dev_put(dev); |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 540 | if (entry != NULL && |
| 541 | security_secid_to_secctx(entry->secid, |
| 542 | &secctx, &secctx_len) == 0) { |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 543 | audit_log_format(audit_buf, " sec_obj=%s", secctx); |
| 544 | security_release_secctx(secctx, secctx_len); |
| 545 | } |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 546 | audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 547 | audit_log_end(audit_buf); |
| 548 | } |
| 549 | |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 550 | if (entry == NULL) |
| 551 | return -ENOENT; |
| 552 | |
Lai Jiangshan | c3b4942 | 2011-03-18 12:03:56 +0800 | [diff] [blame^] | 553 | kfree_rcu(entry, rcu); |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 554 | return 0; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 555 | } |
| 556 | |
| 557 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 558 | /** |
| 559 | * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 560 | * @net: network namespace |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 561 | * @iface: interface entry |
| 562 | * @addr: IP address |
| 563 | * @mask: IP address mask |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 564 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 565 | * |
| 566 | * Description: |
| 567 | * Remove an IP address entry from the unlabeled connection hash table. |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 568 | * Returns zero on success, negative values on failure. |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 569 | * |
| 570 | */ |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 571 | static int netlbl_unlhsh_remove_addr6(struct net *net, |
| 572 | struct netlbl_unlhsh_iface *iface, |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 573 | const struct in6_addr *addr, |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 574 | const struct in6_addr *mask, |
| 575 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 576 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 577 | struct netlbl_af6list *list_entry; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 578 | struct netlbl_unlhsh_addr6 *entry; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 579 | struct audit_buffer *audit_buf; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 580 | struct net_device *dev; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 581 | char *secctx; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 582 | u32 secctx_len; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 583 | |
| 584 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 585 | list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 586 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | d25830e | 2008-12-03 00:37:04 -0800 | [diff] [blame] | 587 | if (list_entry != NULL) |
| 588 | entry = netlbl_unlhsh_addr6_entry(list_entry); |
| 589 | else |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 590 | entry = NULL; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 591 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 592 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, |
| 593 | audit_info); |
| 594 | if (audit_buf != NULL) { |
| 595 | dev = dev_get_by_index(net, iface->ifindex); |
Paul Moore | 63c4168 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 596 | netlbl_af6list_audit_addr(audit_buf, 1, |
| 597 | (dev != NULL ? dev->name : NULL), |
| 598 | addr, mask); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 599 | if (dev != NULL) |
| 600 | dev_put(dev); |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 601 | if (entry != NULL && |
| 602 | security_secid_to_secctx(entry->secid, |
| 603 | &secctx, &secctx_len) == 0) { |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 604 | audit_log_format(audit_buf, " sec_obj=%s", secctx); |
| 605 | security_release_secctx(secctx, secctx_len); |
| 606 | } |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 607 | audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 608 | audit_log_end(audit_buf); |
| 609 | } |
| 610 | |
Paul Moore | ec8f237 | 2008-12-11 21:31:50 -0800 | [diff] [blame] | 611 | if (entry == NULL) |
| 612 | return -ENOENT; |
| 613 | |
| 614 | call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6); |
| 615 | return 0; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 616 | } |
| 617 | #endif /* IPv6 */ |
| 618 | |
| 619 | /** |
| 620 | * netlbl_unlhsh_condremove_iface - Remove an interface entry |
| 621 | * @iface: the interface entry |
| 622 | * |
| 623 | * Description: |
| 624 | * Remove an interface entry from the unlabeled connection hash table if it is |
| 625 | * empty. An interface entry is considered to be empty if there are no |
| 626 | * address entries assigned to it. |
| 627 | * |
| 628 | */ |
| 629 | static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface) |
| 630 | { |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 631 | struct netlbl_af4list *iter4; |
| 632 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 633 | struct netlbl_af6list *iter6; |
| 634 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 635 | |
| 636 | spin_lock(&netlbl_unlhsh_lock); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 637 | netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list) |
| 638 | goto unlhsh_condremove_failure; |
| 639 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 640 | netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list) |
| 641 | goto unlhsh_condremove_failure; |
| 642 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 643 | iface->valid = 0; |
| 644 | if (iface->ifindex > 0) |
| 645 | list_del_rcu(&iface->list); |
| 646 | else |
| 647 | rcu_assign_pointer(netlbl_unlhsh_def, NULL); |
| 648 | spin_unlock(&netlbl_unlhsh_lock); |
| 649 | |
| 650 | call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); |
| 651 | return; |
| 652 | |
| 653 | unlhsh_condremove_failure: |
| 654 | spin_unlock(&netlbl_unlhsh_lock); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 655 | } |
| 656 | |
| 657 | /** |
| 658 | * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table |
| 659 | * @net: network namespace |
| 660 | * @dev_name: interface name |
| 661 | * @addr: IP address in network byte order |
| 662 | * @mask: address mask in network byte order |
| 663 | * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 664 | * @audit_info: NetLabel audit information |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 665 | * |
| 666 | * Description: |
| 667 | * Removes and existing entry from the unlabeled connection hash table. |
| 668 | * Returns zero on success, negative values on failure. |
| 669 | * |
| 670 | */ |
Paul Moore | 6c2e8ac | 2008-12-31 12:54:11 -0500 | [diff] [blame] | 671 | int netlbl_unlhsh_remove(struct net *net, |
| 672 | const char *dev_name, |
| 673 | const void *addr, |
| 674 | const void *mask, |
| 675 | u32 addr_len, |
| 676 | struct netlbl_audit *audit_info) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 677 | { |
| 678 | int ret_val; |
| 679 | struct net_device *dev; |
| 680 | struct netlbl_unlhsh_iface *iface; |
| 681 | |
| 682 | if (addr_len != sizeof(struct in_addr) && |
| 683 | addr_len != sizeof(struct in6_addr)) |
| 684 | return -EINVAL; |
| 685 | |
| 686 | rcu_read_lock(); |
| 687 | if (dev_name != NULL) { |
Eric Dumazet | 122ec6f | 2009-11-05 20:53:47 -0800 | [diff] [blame] | 688 | dev = dev_get_by_name_rcu(net, dev_name); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 689 | if (dev == NULL) { |
| 690 | ret_val = -ENODEV; |
| 691 | goto unlhsh_remove_return; |
| 692 | } |
| 693 | iface = netlbl_unlhsh_search_iface(dev->ifindex); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 694 | } else |
| 695 | iface = rcu_dereference(netlbl_unlhsh_def); |
| 696 | if (iface == NULL) { |
| 697 | ret_val = -ENOENT; |
| 698 | goto unlhsh_remove_return; |
| 699 | } |
| 700 | switch (addr_len) { |
| 701 | case sizeof(struct in_addr): |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 702 | ret_val = netlbl_unlhsh_remove_addr4(net, |
| 703 | iface, addr, mask, |
| 704 | audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 705 | break; |
| 706 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 707 | case sizeof(struct in6_addr): |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 708 | ret_val = netlbl_unlhsh_remove_addr6(net, |
| 709 | iface, addr, mask, |
| 710 | audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 711 | break; |
| 712 | #endif /* IPv6 */ |
| 713 | default: |
| 714 | ret_val = -EINVAL; |
| 715 | } |
| 716 | if (ret_val == 0) { |
| 717 | netlbl_unlhsh_condremove_iface(iface); |
| 718 | atomic_dec(&netlabel_mgmt_protocount); |
| 719 | } |
| 720 | |
| 721 | unlhsh_remove_return: |
| 722 | rcu_read_unlock(); |
| 723 | return ret_val; |
| 724 | } |
| 725 | |
| 726 | /* |
| 727 | * General Helper Functions |
| 728 | */ |
| 729 | |
| 730 | /** |
| 731 | * netlbl_unlhsh_netdev_handler - Network device notification handler |
| 732 | * @this: notifier block |
| 733 | * @event: the event |
| 734 | * @ptr: the network device (cast to void) |
| 735 | * |
| 736 | * Description: |
| 737 | * Handle network device events, although at present all we care about is a |
| 738 | * network device going away. In the case of a device going away we clear any |
| 739 | * related entries from the unlabeled connection hash table. |
| 740 | * |
| 741 | */ |
| 742 | static int netlbl_unlhsh_netdev_handler(struct notifier_block *this, |
| 743 | unsigned long event, |
| 744 | void *ptr) |
| 745 | { |
| 746 | struct net_device *dev = ptr; |
| 747 | struct netlbl_unlhsh_iface *iface = NULL; |
| 748 | |
YOSHIFUJI Hideaki | 721499e | 2008-07-19 22:34:43 -0700 | [diff] [blame] | 749 | if (!net_eq(dev_net(dev), &init_net)) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 750 | return NOTIFY_DONE; |
| 751 | |
| 752 | /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */ |
| 753 | if (event == NETDEV_DOWN) { |
| 754 | spin_lock(&netlbl_unlhsh_lock); |
| 755 | iface = netlbl_unlhsh_search_iface(dev->ifindex); |
| 756 | if (iface != NULL && iface->valid) { |
| 757 | iface->valid = 0; |
| 758 | list_del_rcu(&iface->list); |
| 759 | } else |
| 760 | iface = NULL; |
| 761 | spin_unlock(&netlbl_unlhsh_lock); |
| 762 | } |
| 763 | |
| 764 | if (iface != NULL) |
| 765 | call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); |
| 766 | |
| 767 | return NOTIFY_DONE; |
| 768 | } |
| 769 | |
| 770 | /** |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 771 | * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag |
| 772 | * @value: desired value |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 773 | * @audit_info: NetLabel audit information |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 774 | * |
| 775 | * Description: |
| 776 | * Set the value of the unlabeled accept flag to @value. |
| 777 | * |
| 778 | */ |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 779 | static void netlbl_unlabel_acceptflg_set(u8 value, |
| 780 | struct netlbl_audit *audit_info) |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 781 | { |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 782 | struct audit_buffer *audit_buf; |
| 783 | u8 old_val; |
| 784 | |
Paul Moore | 4be2700 | 2007-10-26 04:29:08 -0700 | [diff] [blame] | 785 | old_val = netlabel_unlabel_acceptflg; |
Paul Moore | cd28786 | 2006-11-17 17:38:44 -0500 | [diff] [blame] | 786 | netlabel_unlabel_acceptflg = value; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 787 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW, |
| 788 | audit_info); |
Paul Moore | de64688 | 2006-11-17 17:38:55 -0500 | [diff] [blame] | 789 | if (audit_buf != NULL) { |
| 790 | audit_log_format(audit_buf, |
| 791 | " unlbl_accept=%u old=%u", value, old_val); |
| 792 | audit_log_end(audit_buf); |
| 793 | } |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 794 | } |
| 795 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 796 | /** |
| 797 | * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information |
| 798 | * @info: the Generic NETLINK info block |
| 799 | * @addr: the IP address |
| 800 | * @mask: the IP address mask |
| 801 | * @len: the address length |
| 802 | * |
| 803 | * Description: |
| 804 | * Examine the Generic NETLINK message and extract the IP address information. |
| 805 | * Returns zero on success, negative values on failure. |
| 806 | * |
| 807 | */ |
| 808 | static int netlbl_unlabel_addrinfo_get(struct genl_info *info, |
| 809 | void **addr, |
| 810 | void **mask, |
| 811 | u32 *len) |
| 812 | { |
| 813 | u32 addr_len; |
| 814 | |
| 815 | if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) { |
| 816 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); |
| 817 | if (addr_len != sizeof(struct in_addr) && |
| 818 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) |
| 819 | return -EINVAL; |
| 820 | *len = addr_len; |
| 821 | *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); |
| 822 | *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]); |
| 823 | return 0; |
| 824 | } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) { |
| 825 | addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); |
| 826 | if (addr_len != sizeof(struct in6_addr) && |
| 827 | addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK])) |
| 828 | return -EINVAL; |
| 829 | *len = addr_len; |
| 830 | *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); |
| 831 | *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]); |
| 832 | return 0; |
| 833 | } |
| 834 | |
| 835 | return -EINVAL; |
| 836 | } |
| 837 | |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 838 | /* |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 839 | * NetLabel Command Handlers |
| 840 | */ |
| 841 | |
| 842 | /** |
| 843 | * netlbl_unlabel_accept - Handle an ACCEPT message |
| 844 | * @skb: the NETLINK buffer |
| 845 | * @info: the Generic NETLINK info block |
| 846 | * |
| 847 | * Description: |
| 848 | * Process a user generated ACCEPT message and set the accept flag accordingly. |
| 849 | * Returns zero on success, negative values on failure. |
| 850 | * |
| 851 | */ |
| 852 | static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info) |
| 853 | { |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 854 | u8 value; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 855 | struct netlbl_audit audit_info; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 856 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 857 | if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) { |
| 858 | value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 859 | if (value == 1 || value == 0) { |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 860 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 861 | netlbl_unlabel_acceptflg_set(value, &audit_info); |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 862 | return 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 863 | } |
| 864 | } |
| 865 | |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 866 | return -EINVAL; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 867 | } |
| 868 | |
| 869 | /** |
| 870 | * netlbl_unlabel_list - Handle a LIST message |
| 871 | * @skb: the NETLINK buffer |
| 872 | * @info: the Generic NETLINK info block |
| 873 | * |
| 874 | * Description: |
| 875 | * Process a user generated LIST message and respond with the current status. |
| 876 | * Returns zero on success, negative values on failure. |
| 877 | * |
| 878 | */ |
| 879 | static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info) |
| 880 | { |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 881 | int ret_val = -EINVAL; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 882 | struct sk_buff *ans_skb; |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 883 | void *data; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 884 | |
Thomas Graf | 339bf98 | 2006-11-10 14:10:15 -0800 | [diff] [blame] | 885 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 886 | if (ans_skb == NULL) |
| 887 | goto list_failure; |
Thomas Graf | 17c157c | 2006-11-14 19:46:02 -0800 | [diff] [blame] | 888 | data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family, |
| 889 | 0, NLBL_UNLABEL_C_LIST); |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 890 | if (data == NULL) { |
| 891 | ret_val = -ENOMEM; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 892 | goto list_failure; |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 893 | } |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 894 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 895 | ret_val = nla_put_u8(ans_skb, |
| 896 | NLBL_UNLABEL_A_ACPTFLG, |
Paul Moore | cd28786 | 2006-11-17 17:38:44 -0500 | [diff] [blame] | 897 | netlabel_unlabel_acceptflg); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 898 | if (ret_val != 0) |
| 899 | goto list_failure; |
| 900 | |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 901 | genlmsg_end(ans_skb, data); |
Denis V. Lunev | fe785be | 2008-07-10 16:53:39 -0700 | [diff] [blame] | 902 | return genlmsg_reply(ans_skb, info); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 903 | |
| 904 | list_failure: |
Patrick McHardy | b08d584 | 2007-02-27 09:57:37 -0800 | [diff] [blame] | 905 | kfree_skb(ans_skb); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 906 | return ret_val; |
| 907 | } |
| 908 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 909 | /** |
| 910 | * netlbl_unlabel_staticadd - Handle a STATICADD message |
| 911 | * @skb: the NETLINK buffer |
| 912 | * @info: the Generic NETLINK info block |
| 913 | * |
| 914 | * Description: |
| 915 | * Process a user generated STATICADD message and add a new unlabeled |
| 916 | * connection entry to the hash table. Returns zero on success, negative |
| 917 | * values on failure. |
| 918 | * |
| 919 | */ |
| 920 | static int netlbl_unlabel_staticadd(struct sk_buff *skb, |
| 921 | struct genl_info *info) |
| 922 | { |
| 923 | int ret_val; |
| 924 | char *dev_name; |
| 925 | void *addr; |
| 926 | void *mask; |
| 927 | u32 addr_len; |
| 928 | u32 secid; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 929 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 930 | |
| 931 | /* Don't allow users to add both IPv4 and IPv6 addresses for a |
| 932 | * single entry. However, allow users to create two entries, one each |
| 933 | * for IPv4 and IPv4, with the same LSM security context which should |
| 934 | * achieve the same result. */ |
| 935 | if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || |
| 936 | !info->attrs[NLBL_UNLABEL_A_IFACE] || |
| 937 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 938 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 939 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 940 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 941 | return -EINVAL; |
| 942 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 943 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 944 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 945 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 946 | if (ret_val != 0) |
| 947 | return ret_val; |
| 948 | dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); |
| 949 | ret_val = security_secctx_to_secid( |
| 950 | nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 951 | nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 952 | &secid); |
| 953 | if (ret_val != 0) |
| 954 | return ret_val; |
| 955 | |
| 956 | return netlbl_unlhsh_add(&init_net, |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 957 | dev_name, addr, mask, addr_len, secid, |
| 958 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 959 | } |
| 960 | |
| 961 | /** |
| 962 | * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message |
| 963 | * @skb: the NETLINK buffer |
| 964 | * @info: the Generic NETLINK info block |
| 965 | * |
| 966 | * Description: |
| 967 | * Process a user generated STATICADDDEF message and add a new default |
| 968 | * unlabeled connection entry. Returns zero on success, negative values on |
| 969 | * failure. |
| 970 | * |
| 971 | */ |
| 972 | static int netlbl_unlabel_staticadddef(struct sk_buff *skb, |
| 973 | struct genl_info *info) |
| 974 | { |
| 975 | int ret_val; |
| 976 | void *addr; |
| 977 | void *mask; |
| 978 | u32 addr_len; |
| 979 | u32 secid; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 980 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 981 | |
| 982 | /* Don't allow users to add both IPv4 and IPv6 addresses for a |
| 983 | * single entry. However, allow users to create two entries, one each |
| 984 | * for IPv4 and IPv6, with the same LSM security context which should |
| 985 | * achieve the same result. */ |
| 986 | if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || |
| 987 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 988 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 989 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 990 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 991 | return -EINVAL; |
| 992 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 993 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 994 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 995 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 996 | if (ret_val != 0) |
| 997 | return ret_val; |
| 998 | ret_val = security_secctx_to_secid( |
| 999 | nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 1000 | nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), |
| 1001 | &secid); |
| 1002 | if (ret_val != 0) |
| 1003 | return ret_val; |
| 1004 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1005 | return netlbl_unlhsh_add(&init_net, |
| 1006 | NULL, addr, mask, addr_len, secid, |
| 1007 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1008 | } |
| 1009 | |
| 1010 | /** |
| 1011 | * netlbl_unlabel_staticremove - Handle a STATICREMOVE message |
| 1012 | * @skb: the NETLINK buffer |
| 1013 | * @info: the Generic NETLINK info block |
| 1014 | * |
| 1015 | * Description: |
| 1016 | * Process a user generated STATICREMOVE message and remove the specified |
| 1017 | * unlabeled connection entry. Returns zero on success, negative values on |
| 1018 | * failure. |
| 1019 | * |
| 1020 | */ |
| 1021 | static int netlbl_unlabel_staticremove(struct sk_buff *skb, |
| 1022 | struct genl_info *info) |
| 1023 | { |
| 1024 | int ret_val; |
| 1025 | char *dev_name; |
| 1026 | void *addr; |
| 1027 | void *mask; |
| 1028 | u32 addr_len; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1029 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1030 | |
| 1031 | /* See the note in netlbl_unlabel_staticadd() about not allowing both |
| 1032 | * IPv4 and IPv6 in the same entry. */ |
| 1033 | if (!info->attrs[NLBL_UNLABEL_A_IFACE] || |
| 1034 | !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 1035 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 1036 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 1037 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 1038 | return -EINVAL; |
| 1039 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1040 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 1041 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1042 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 1043 | if (ret_val != 0) |
| 1044 | return ret_val; |
| 1045 | dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); |
| 1046 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1047 | return netlbl_unlhsh_remove(&init_net, |
| 1048 | dev_name, addr, mask, addr_len, |
| 1049 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1050 | } |
| 1051 | |
| 1052 | /** |
| 1053 | * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message |
| 1054 | * @skb: the NETLINK buffer |
| 1055 | * @info: the Generic NETLINK info block |
| 1056 | * |
| 1057 | * Description: |
| 1058 | * Process a user generated STATICREMOVEDEF message and remove the default |
| 1059 | * unlabeled connection entry. Returns zero on success, negative values on |
| 1060 | * failure. |
| 1061 | * |
| 1062 | */ |
| 1063 | static int netlbl_unlabel_staticremovedef(struct sk_buff *skb, |
| 1064 | struct genl_info *info) |
| 1065 | { |
| 1066 | int ret_val; |
| 1067 | void *addr; |
| 1068 | void *mask; |
| 1069 | u32 addr_len; |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1070 | struct netlbl_audit audit_info; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1071 | |
| 1072 | /* See the note in netlbl_unlabel_staticadd() about not allowing both |
| 1073 | * IPv4 and IPv6 in the same entry. */ |
| 1074 | if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || |
| 1075 | !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ |
| 1076 | (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || |
| 1077 | !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) |
| 1078 | return -EINVAL; |
| 1079 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1080 | netlbl_netlink_auditinfo(skb, &audit_info); |
| 1081 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1082 | ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); |
| 1083 | if (ret_val != 0) |
| 1084 | return ret_val; |
| 1085 | |
Paul Moore | 13541b3 | 2008-01-29 08:44:23 -0500 | [diff] [blame] | 1086 | return netlbl_unlhsh_remove(&init_net, |
| 1087 | NULL, addr, mask, addr_len, |
| 1088 | &audit_info); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1089 | } |
| 1090 | |
| 1091 | |
| 1092 | /** |
| 1093 | * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF] |
| 1094 | * @cmd: command/message |
| 1095 | * @iface: the interface entry |
| 1096 | * @addr4: the IPv4 address entry |
| 1097 | * @addr6: the IPv6 address entry |
| 1098 | * @arg: the netlbl_unlhsh_walk_arg structure |
| 1099 | * |
| 1100 | * Description: |
| 1101 | * This function is designed to be used to generate a response for a |
| 1102 | * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6 |
| 1103 | * can be specified, not both, the other unspecified entry should be set to |
| 1104 | * NULL by the caller. Returns the size of the message on success, negative |
| 1105 | * values on failure. |
| 1106 | * |
| 1107 | */ |
| 1108 | static int netlbl_unlabel_staticlist_gen(u32 cmd, |
| 1109 | const struct netlbl_unlhsh_iface *iface, |
| 1110 | const struct netlbl_unlhsh_addr4 *addr4, |
| 1111 | const struct netlbl_unlhsh_addr6 *addr6, |
| 1112 | void *arg) |
| 1113 | { |
| 1114 | int ret_val = -ENOMEM; |
| 1115 | struct netlbl_unlhsh_walk_arg *cb_arg = arg; |
| 1116 | struct net_device *dev; |
| 1117 | void *data; |
| 1118 | u32 secid; |
| 1119 | char *secctx; |
| 1120 | u32 secctx_len; |
| 1121 | |
| 1122 | data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid, |
| 1123 | cb_arg->seq, &netlbl_unlabel_gnl_family, |
| 1124 | NLM_F_MULTI, cmd); |
| 1125 | if (data == NULL) |
| 1126 | goto list_cb_failure; |
| 1127 | |
| 1128 | if (iface->ifindex > 0) { |
| 1129 | dev = dev_get_by_index(&init_net, iface->ifindex); |
Jesper Juhl | 794eb6b | 2008-04-17 23:22:54 -0700 | [diff] [blame] | 1130 | if (!dev) { |
| 1131 | ret_val = -ENODEV; |
| 1132 | goto list_cb_failure; |
| 1133 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1134 | ret_val = nla_put_string(cb_arg->skb, |
| 1135 | NLBL_UNLABEL_A_IFACE, dev->name); |
| 1136 | dev_put(dev); |
| 1137 | if (ret_val != 0) |
| 1138 | goto list_cb_failure; |
| 1139 | } |
| 1140 | |
| 1141 | if (addr4) { |
| 1142 | struct in_addr addr_struct; |
| 1143 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1144 | addr_struct.s_addr = addr4->list.addr; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1145 | ret_val = nla_put(cb_arg->skb, |
| 1146 | NLBL_UNLABEL_A_IPV4ADDR, |
| 1147 | sizeof(struct in_addr), |
| 1148 | &addr_struct); |
| 1149 | if (ret_val != 0) |
| 1150 | goto list_cb_failure; |
| 1151 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1152 | addr_struct.s_addr = addr4->list.mask; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1153 | ret_val = nla_put(cb_arg->skb, |
| 1154 | NLBL_UNLABEL_A_IPV4MASK, |
| 1155 | sizeof(struct in_addr), |
| 1156 | &addr_struct); |
| 1157 | if (ret_val != 0) |
| 1158 | goto list_cb_failure; |
| 1159 | |
| 1160 | secid = addr4->secid; |
| 1161 | } else { |
| 1162 | ret_val = nla_put(cb_arg->skb, |
| 1163 | NLBL_UNLABEL_A_IPV6ADDR, |
| 1164 | sizeof(struct in6_addr), |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1165 | &addr6->list.addr); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1166 | if (ret_val != 0) |
| 1167 | goto list_cb_failure; |
| 1168 | |
| 1169 | ret_val = nla_put(cb_arg->skb, |
| 1170 | NLBL_UNLABEL_A_IPV6MASK, |
| 1171 | sizeof(struct in6_addr), |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1172 | &addr6->list.mask); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1173 | if (ret_val != 0) |
| 1174 | goto list_cb_failure; |
| 1175 | |
| 1176 | secid = addr6->secid; |
| 1177 | } |
| 1178 | |
| 1179 | ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len); |
| 1180 | if (ret_val != 0) |
| 1181 | goto list_cb_failure; |
| 1182 | ret_val = nla_put(cb_arg->skb, |
| 1183 | NLBL_UNLABEL_A_SECCTX, |
| 1184 | secctx_len, |
| 1185 | secctx); |
| 1186 | security_release_secctx(secctx, secctx_len); |
| 1187 | if (ret_val != 0) |
| 1188 | goto list_cb_failure; |
| 1189 | |
| 1190 | cb_arg->seq++; |
| 1191 | return genlmsg_end(cb_arg->skb, data); |
| 1192 | |
| 1193 | list_cb_failure: |
| 1194 | genlmsg_cancel(cb_arg->skb, data); |
| 1195 | return ret_val; |
| 1196 | } |
| 1197 | |
| 1198 | /** |
| 1199 | * netlbl_unlabel_staticlist - Handle a STATICLIST message |
| 1200 | * @skb: the NETLINK buffer |
| 1201 | * @cb: the NETLINK callback |
| 1202 | * |
| 1203 | * Description: |
| 1204 | * Process a user generated STATICLIST message and dump the unlabeled |
| 1205 | * connection hash table in a form suitable for use in a kernel generated |
| 1206 | * STATICLIST message. Returns the length of @skb. |
| 1207 | * |
| 1208 | */ |
| 1209 | static int netlbl_unlabel_staticlist(struct sk_buff *skb, |
| 1210 | struct netlink_callback *cb) |
| 1211 | { |
| 1212 | struct netlbl_unlhsh_walk_arg cb_arg; |
| 1213 | u32 skip_bkt = cb->args[0]; |
| 1214 | u32 skip_chain = cb->args[1]; |
| 1215 | u32 skip_addr4 = cb->args[2]; |
| 1216 | u32 skip_addr6 = cb->args[3]; |
| 1217 | u32 iter_bkt; |
| 1218 | u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; |
| 1219 | struct netlbl_unlhsh_iface *iface; |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 1220 | struct list_head *iter_list; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1221 | struct netlbl_af4list *addr4; |
| 1222 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1223 | struct netlbl_af6list *addr6; |
| 1224 | #endif |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1225 | |
| 1226 | cb_arg.nl_cb = cb; |
| 1227 | cb_arg.skb = skb; |
| 1228 | cb_arg.seq = cb->nlh->nlmsg_seq; |
| 1229 | |
| 1230 | rcu_read_lock(); |
| 1231 | for (iter_bkt = skip_bkt; |
| 1232 | iter_bkt < rcu_dereference(netlbl_unlhsh)->size; |
| 1233 | iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) { |
Paul Moore | 5619670 | 2008-10-10 10:16:29 -0400 | [diff] [blame] | 1234 | iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt]; |
| 1235 | list_for_each_entry_rcu(iface, iter_list, list) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1236 | if (!iface->valid || |
| 1237 | iter_chain++ < skip_chain) |
| 1238 | continue; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1239 | netlbl_af4list_foreach_rcu(addr4, |
| 1240 | &iface->addr4_list) { |
| 1241 | if (iter_addr4++ < skip_addr4) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1242 | continue; |
| 1243 | if (netlbl_unlabel_staticlist_gen( |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1244 | NLBL_UNLABEL_C_STATICLIST, |
| 1245 | iface, |
| 1246 | netlbl_unlhsh_addr4_entry(addr4), |
| 1247 | NULL, |
| 1248 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1249 | iter_addr4--; |
| 1250 | iter_chain--; |
| 1251 | goto unlabel_staticlist_return; |
| 1252 | } |
| 1253 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1254 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1255 | netlbl_af6list_foreach_rcu(addr6, |
| 1256 | &iface->addr6_list) { |
| 1257 | if (iter_addr6++ < skip_addr6) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1258 | continue; |
| 1259 | if (netlbl_unlabel_staticlist_gen( |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1260 | NLBL_UNLABEL_C_STATICLIST, |
| 1261 | iface, |
| 1262 | NULL, |
| 1263 | netlbl_unlhsh_addr6_entry(addr6), |
| 1264 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1265 | iter_addr6--; |
| 1266 | iter_chain--; |
| 1267 | goto unlabel_staticlist_return; |
| 1268 | } |
| 1269 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1270 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1271 | } |
| 1272 | } |
| 1273 | |
| 1274 | unlabel_staticlist_return: |
| 1275 | rcu_read_unlock(); |
| 1276 | cb->args[0] = skip_bkt; |
| 1277 | cb->args[1] = skip_chain; |
| 1278 | cb->args[2] = skip_addr4; |
| 1279 | cb->args[3] = skip_addr6; |
| 1280 | return skb->len; |
| 1281 | } |
| 1282 | |
| 1283 | /** |
| 1284 | * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message |
| 1285 | * @skb: the NETLINK buffer |
| 1286 | * @cb: the NETLINK callback |
| 1287 | * |
| 1288 | * Description: |
| 1289 | * Process a user generated STATICLISTDEF message and dump the default |
| 1290 | * unlabeled connection entry in a form suitable for use in a kernel generated |
| 1291 | * STATICLISTDEF message. Returns the length of @skb. |
| 1292 | * |
| 1293 | */ |
| 1294 | static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, |
| 1295 | struct netlink_callback *cb) |
| 1296 | { |
| 1297 | struct netlbl_unlhsh_walk_arg cb_arg; |
| 1298 | struct netlbl_unlhsh_iface *iface; |
| 1299 | u32 skip_addr4 = cb->args[0]; |
| 1300 | u32 skip_addr6 = cb->args[1]; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1301 | u32 iter_addr4 = 0; |
| 1302 | struct netlbl_af4list *addr4; |
| 1303 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1304 | u32 iter_addr6 = 0; |
| 1305 | struct netlbl_af6list *addr6; |
| 1306 | #endif |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1307 | |
| 1308 | cb_arg.nl_cb = cb; |
| 1309 | cb_arg.skb = skb; |
| 1310 | cb_arg.seq = cb->nlh->nlmsg_seq; |
| 1311 | |
| 1312 | rcu_read_lock(); |
| 1313 | iface = rcu_dereference(netlbl_unlhsh_def); |
| 1314 | if (iface == NULL || !iface->valid) |
| 1315 | goto unlabel_staticlistdef_return; |
| 1316 | |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1317 | netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) { |
| 1318 | if (iter_addr4++ < skip_addr4) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1319 | continue; |
| 1320 | if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1321 | iface, |
| 1322 | netlbl_unlhsh_addr4_entry(addr4), |
| 1323 | NULL, |
| 1324 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1325 | iter_addr4--; |
| 1326 | goto unlabel_staticlistdef_return; |
| 1327 | } |
| 1328 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1329 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
| 1330 | netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) { |
| 1331 | if (iter_addr6++ < skip_addr6) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1332 | continue; |
| 1333 | if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1334 | iface, |
| 1335 | NULL, |
| 1336 | netlbl_unlhsh_addr6_entry(addr6), |
| 1337 | &cb_arg) < 0) { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1338 | iter_addr6--; |
| 1339 | goto unlabel_staticlistdef_return; |
| 1340 | } |
| 1341 | } |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1342 | #endif /* IPv6 */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1343 | |
| 1344 | unlabel_staticlistdef_return: |
| 1345 | rcu_read_unlock(); |
| 1346 | cb->args[0] = skip_addr4; |
| 1347 | cb->args[1] = skip_addr6; |
| 1348 | return skb->len; |
| 1349 | } |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1350 | |
| 1351 | /* |
| 1352 | * NetLabel Generic NETLINK Command Definitions |
| 1353 | */ |
| 1354 | |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1355 | static struct genl_ops netlbl_unlabel_genl_ops[] = { |
| 1356 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1357 | .cmd = NLBL_UNLABEL_C_STATICADD, |
| 1358 | .flags = GENL_ADMIN_PERM, |
| 1359 | .policy = netlbl_unlabel_genl_policy, |
| 1360 | .doit = netlbl_unlabel_staticadd, |
| 1361 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1362 | }, |
| 1363 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1364 | .cmd = NLBL_UNLABEL_C_STATICREMOVE, |
| 1365 | .flags = GENL_ADMIN_PERM, |
| 1366 | .policy = netlbl_unlabel_genl_policy, |
| 1367 | .doit = netlbl_unlabel_staticremove, |
| 1368 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1369 | }, |
| 1370 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1371 | .cmd = NLBL_UNLABEL_C_STATICLIST, |
| 1372 | .flags = 0, |
| 1373 | .policy = netlbl_unlabel_genl_policy, |
| 1374 | .doit = NULL, |
| 1375 | .dumpit = netlbl_unlabel_staticlist, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1376 | }, |
| 1377 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1378 | .cmd = NLBL_UNLABEL_C_STATICADDDEF, |
| 1379 | .flags = GENL_ADMIN_PERM, |
| 1380 | .policy = netlbl_unlabel_genl_policy, |
| 1381 | .doit = netlbl_unlabel_staticadddef, |
| 1382 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1383 | }, |
| 1384 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1385 | .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF, |
| 1386 | .flags = GENL_ADMIN_PERM, |
| 1387 | .policy = netlbl_unlabel_genl_policy, |
| 1388 | .doit = netlbl_unlabel_staticremovedef, |
| 1389 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1390 | }, |
| 1391 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1392 | .cmd = NLBL_UNLABEL_C_STATICLISTDEF, |
| 1393 | .flags = 0, |
| 1394 | .policy = netlbl_unlabel_genl_policy, |
| 1395 | .doit = NULL, |
| 1396 | .dumpit = netlbl_unlabel_staticlistdef, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1397 | }, |
| 1398 | { |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1399 | .cmd = NLBL_UNLABEL_C_ACCEPT, |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 1400 | .flags = GENL_ADMIN_PERM, |
| 1401 | .policy = netlbl_unlabel_genl_policy, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1402 | .doit = netlbl_unlabel_accept, |
| 1403 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1404 | }, |
| 1405 | { |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1406 | .cmd = NLBL_UNLABEL_C_LIST, |
| 1407 | .flags = 0, |
Paul Moore | fd38585 | 2006-09-25 15:56:37 -0700 | [diff] [blame] | 1408 | .policy = netlbl_unlabel_genl_policy, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1409 | .doit = netlbl_unlabel_list, |
| 1410 | .dumpit = NULL, |
Pavel Emelyanov | 227c43c | 2008-02-17 22:33:16 -0800 | [diff] [blame] | 1411 | }, |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1412 | }; |
| 1413 | |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1414 | /* |
| 1415 | * NetLabel Generic NETLINK Protocol Functions |
| 1416 | */ |
| 1417 | |
| 1418 | /** |
| 1419 | * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component |
| 1420 | * |
| 1421 | * Description: |
| 1422 | * Register the unlabeled packet NetLabel component with the Generic NETLINK |
| 1423 | * mechanism. Returns zero on success, negative values on failure. |
| 1424 | * |
| 1425 | */ |
Pavel Emelyanov | 05705e4 | 2008-02-17 22:33:57 -0800 | [diff] [blame] | 1426 | int __init netlbl_unlabel_genl_init(void) |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1427 | { |
Michał Mirosław | 7ae740d | 2009-05-21 10:34:05 +0000 | [diff] [blame] | 1428 | return genl_register_family_with_ops(&netlbl_unlabel_gnl_family, |
| 1429 | netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops)); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1430 | } |
| 1431 | |
| 1432 | /* |
| 1433 | * NetLabel KAPI Hooks |
| 1434 | */ |
| 1435 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1436 | static struct notifier_block netlbl_unlhsh_netdev_notifier = { |
| 1437 | .notifier_call = netlbl_unlhsh_netdev_handler, |
| 1438 | }; |
| 1439 | |
| 1440 | /** |
| 1441 | * netlbl_unlabel_init - Initialize the unlabeled connection hash table |
| 1442 | * @size: the number of bits to use for the hash buckets |
| 1443 | * |
| 1444 | * Description: |
| 1445 | * Initializes the unlabeled connection hash table and registers a network |
| 1446 | * device notification handler. This function should only be called by the |
| 1447 | * NetLabel subsystem itself during initialization. Returns zero on success, |
| 1448 | * non-zero values on error. |
| 1449 | * |
| 1450 | */ |
Pavel Emelyanov | 05705e4 | 2008-02-17 22:33:57 -0800 | [diff] [blame] | 1451 | int __init netlbl_unlabel_init(u32 size) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1452 | { |
| 1453 | u32 iter; |
| 1454 | struct netlbl_unlhsh_tbl *hsh_tbl; |
| 1455 | |
| 1456 | if (size == 0) |
| 1457 | return -EINVAL; |
| 1458 | |
| 1459 | hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL); |
| 1460 | if (hsh_tbl == NULL) |
| 1461 | return -ENOMEM; |
| 1462 | hsh_tbl->size = 1 << size; |
| 1463 | hsh_tbl->tbl = kcalloc(hsh_tbl->size, |
| 1464 | sizeof(struct list_head), |
| 1465 | GFP_KERNEL); |
| 1466 | if (hsh_tbl->tbl == NULL) { |
| 1467 | kfree(hsh_tbl); |
| 1468 | return -ENOMEM; |
| 1469 | } |
| 1470 | for (iter = 0; iter < hsh_tbl->size; iter++) |
| 1471 | INIT_LIST_HEAD(&hsh_tbl->tbl[iter]); |
| 1472 | |
| 1473 | rcu_read_lock(); |
| 1474 | spin_lock(&netlbl_unlhsh_lock); |
| 1475 | rcu_assign_pointer(netlbl_unlhsh, hsh_tbl); |
| 1476 | spin_unlock(&netlbl_unlhsh_lock); |
| 1477 | rcu_read_unlock(); |
| 1478 | |
| 1479 | register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier); |
| 1480 | |
| 1481 | return 0; |
| 1482 | } |
| 1483 | |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1484 | /** |
| 1485 | * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1486 | * @skb: the packet |
| 1487 | * @family: protocol family |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1488 | * @secattr: the security attributes |
| 1489 | * |
| 1490 | * Description: |
| 1491 | * Determine the security attributes, if any, for an unlabled packet and return |
| 1492 | * them in @secattr. Returns zero on success and negative values on failure. |
| 1493 | * |
| 1494 | */ |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1495 | int netlbl_unlabel_getattr(const struct sk_buff *skb, |
| 1496 | u16 family, |
| 1497 | struct netlbl_lsm_secattr *secattr) |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1498 | { |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1499 | struct netlbl_unlhsh_iface *iface; |
| 1500 | |
| 1501 | rcu_read_lock(); |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 1502 | iface = netlbl_unlhsh_search_iface(skb->skb_iif); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1503 | if (iface == NULL) |
Paul Moore | b914f3a | 2010-04-01 10:43:57 +0000 | [diff] [blame] | 1504 | iface = rcu_dereference(netlbl_unlhsh_def); |
| 1505 | if (iface == NULL || !iface->valid) |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1506 | goto unlabel_getattr_nolabel; |
| 1507 | switch (family) { |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1508 | case PF_INET: { |
| 1509 | struct iphdr *hdr4; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1510 | struct netlbl_af4list *addr4; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1511 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1512 | hdr4 = ip_hdr(skb); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1513 | addr4 = netlbl_af4list_search(hdr4->saddr, |
| 1514 | &iface->addr4_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1515 | if (addr4 == NULL) |
| 1516 | goto unlabel_getattr_nolabel; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1517 | secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1518 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1519 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1520 | #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1521 | case PF_INET6: { |
| 1522 | struct ipv6hdr *hdr6; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1523 | struct netlbl_af6list *addr6; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1524 | |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1525 | hdr6 = ipv6_hdr(skb); |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1526 | addr6 = netlbl_af6list_search(&hdr6->saddr, |
| 1527 | &iface->addr6_list); |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1528 | if (addr6 == NULL) |
| 1529 | goto unlabel_getattr_nolabel; |
Paul Moore | 61e1068 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 1530 | secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid; |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1531 | break; |
Pavel Emelyanov | 56628b1 | 2008-02-12 22:37:19 -0800 | [diff] [blame] | 1532 | } |
Paul Moore | 8cc4457 | 2008-01-29 08:44:21 -0500 | [diff] [blame] | 1533 | #endif /* IPv6 */ |
| 1534 | default: |
| 1535 | goto unlabel_getattr_nolabel; |
| 1536 | } |
| 1537 | rcu_read_unlock(); |
| 1538 | |
| 1539 | secattr->flags |= NETLBL_SECATTR_SECID; |
| 1540 | secattr->type = NETLBL_NLTYPE_UNLABELED; |
| 1541 | return 0; |
| 1542 | |
| 1543 | unlabel_getattr_nolabel: |
| 1544 | rcu_read_unlock(); |
Paul Moore | c783f1c | 2008-01-29 08:37:52 -0500 | [diff] [blame] | 1545 | if (netlabel_unlabel_acceptflg == 0) |
| 1546 | return -ENOMSG; |
Paul Moore | 16efd45 | 2008-01-29 08:37:59 -0500 | [diff] [blame] | 1547 | secattr->type = NETLBL_NLTYPE_UNLABELED; |
Paul Moore | c783f1c | 2008-01-29 08:37:52 -0500 | [diff] [blame] | 1548 | return 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1549 | } |
| 1550 | |
| 1551 | /** |
| 1552 | * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets |
| 1553 | * |
| 1554 | * Description: |
| 1555 | * Set the default NetLabel configuration to allow incoming unlabeled packets |
| 1556 | * and to send unlabeled network traffic by default. |
| 1557 | * |
| 1558 | */ |
Pavel Emelyanov | 05705e4 | 2008-02-17 22:33:57 -0800 | [diff] [blame] | 1559 | int __init netlbl_unlabel_defconf(void) |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1560 | { |
| 1561 | int ret_val; |
| 1562 | struct netlbl_dom_map *entry; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1563 | struct netlbl_audit audit_info; |
Paul Moore | 32f50cd | 2006-09-28 14:51:47 -0700 | [diff] [blame] | 1564 | |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1565 | /* Only the kernel is allowed to call this function and the only time |
| 1566 | * it is called is at bootup before the audit subsystem is reporting |
| 1567 | * messages so don't worry to much about these values. */ |
| 1568 | security_task_getsecid(current, &audit_info.secid); |
| 1569 | audit_info.loginuid = 0; |
Eric Paris | 2532386 | 2008-04-18 10:09:25 -0400 | [diff] [blame] | 1570 | audit_info.sessionid = 0; |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1571 | |
| 1572 | entry = kzalloc(sizeof(*entry), GFP_KERNEL); |
| 1573 | if (entry == NULL) |
| 1574 | return -ENOMEM; |
| 1575 | entry->type = NETLBL_NLTYPE_UNLABELED; |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1576 | ret_val = netlbl_domhsh_add_default(entry, &audit_info); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1577 | if (ret_val != 0) |
| 1578 | return ret_val; |
| 1579 | |
Paul Moore | 95d4e6b | 2006-09-29 17:05:05 -0700 | [diff] [blame] | 1580 | netlbl_unlabel_acceptflg_set(1, &audit_info); |
Paul Moore | 96cb8e3 | 2006-08-03 16:48:59 -0700 | [diff] [blame] | 1581 | |
| 1582 | return 0; |
| 1583 | } |