blob: ab56a052ce31cb53e873df670a4afdc8dc68972a [file] [log] [blame]
Paul Moore446fda42006-08-03 16:48:06 -07001/*
2 * CIPSO - Commercial IP Security Option
3 *
4 * This is an implementation of the CIPSO 2.2 protocol as specified in
5 * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
6 * FIPS-188, copies of both documents can be found in the Documentation
7 * directory. While CIPSO never became a full IETF RFC standard many vendors
8 * have chosen to adopt the protocol and over the years it has become a
9 * de-facto standard for labeled networking.
10 *
11 * Author: Paul Moore <paul.moore@hp.com>
12 *
13 */
14
15/*
16 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
17 *
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License as published by
20 * the Free Software Foundation; either version 2 of the License, or
21 * (at your option) any later version.
22 *
23 * This program is distributed in the hope that it will be useful,
24 * but WITHOUT ANY WARRANTY; without even the implied warranty of
25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
26 * the GNU General Public License for more details.
27 *
28 * You should have received a copy of the GNU General Public License
29 * along with this program; if not, write to the Free Software
30 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 *
32 */
33
34#include <linux/init.h>
35#include <linux/types.h>
36#include <linux/rcupdate.h>
37#include <linux/list.h>
38#include <linux/spinlock.h>
39#include <linux/string.h>
40#include <linux/jhash.h>
41#include <net/ip.h>
42#include <net/icmp.h>
43#include <net/tcp.h>
44#include <net/netlabel.h>
45#include <net/cipso_ipv4.h>
paul.moore@hp.comffb733c2006-10-04 11:46:31 -040046#include <asm/atomic.h>
Paul Moore446fda42006-08-03 16:48:06 -070047#include <asm/bug.h>
Paul Moore50e5d352007-06-07 18:38:14 -070048#include <asm/unaligned.h>
Paul Moore446fda42006-08-03 16:48:06 -070049
50struct cipso_v4_domhsh_entry {
51 char *domain;
52 u32 valid;
53 struct list_head list;
54 struct rcu_head rcu;
55};
56
57/* List of available DOI definitions */
58/* XXX - Updates should be minimal so having a single lock for the
59 * cipso_v4_doi_list and the cipso_v4_doi_list->dom_list should be
60 * okay. */
61/* XXX - This currently assumes a minimal number of different DOIs in use,
62 * if in practice there are a lot of different DOIs this list should
63 * probably be turned into a hash table or something similar so we
64 * can do quick lookups. */
Adrian Bunk8ce11e62006-08-07 21:50:48 -070065static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
Paul Moore446fda42006-08-03 16:48:06 -070066static struct list_head cipso_v4_doi_list = LIST_HEAD_INIT(cipso_v4_doi_list);
67
68/* Label mapping cache */
69int cipso_v4_cache_enabled = 1;
70int cipso_v4_cache_bucketsize = 10;
71#define CIPSO_V4_CACHE_BUCKETBITS 7
72#define CIPSO_V4_CACHE_BUCKETS (1 << CIPSO_V4_CACHE_BUCKETBITS)
73#define CIPSO_V4_CACHE_REORDERLIMIT 10
74struct cipso_v4_map_cache_bkt {
75 spinlock_t lock;
76 u32 size;
77 struct list_head list;
78};
79struct cipso_v4_map_cache_entry {
80 u32 hash;
81 unsigned char *key;
82 size_t key_len;
83
paul.moore@hp.comffb733c2006-10-04 11:46:31 -040084 struct netlbl_lsm_cache *lsm_data;
Paul Moore446fda42006-08-03 16:48:06 -070085
86 u32 activity;
87 struct list_head list;
88};
89static struct cipso_v4_map_cache_bkt *cipso_v4_cache = NULL;
90
91/* Restricted bitmap (tag #1) flags */
92int cipso_v4_rbm_optfmt = 0;
93int cipso_v4_rbm_strictvalid = 1;
94
95/*
Paul Mooref998e8c2007-02-28 15:14:20 -050096 * Protocol Constants
97 */
98
99/* Maximum size of the CIPSO IP option, derived from the fact that the maximum
100 * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
101#define CIPSO_V4_OPT_LEN_MAX 40
102
103/* Length of the base CIPSO option, this includes the option type (1 byte), the
104 * option length (1 byte), and the DOI (4 bytes). */
105#define CIPSO_V4_HDR_LEN 6
106
107/* Base length of the restrictive category bitmap tag (tag #1). */
108#define CIPSO_V4_TAG_RBM_BLEN 4
109
110/* Base length of the enumerated category tag (tag #2). */
111#define CIPSO_V4_TAG_ENUM_BLEN 4
112
113/* Base length of the ranged categories bitmap tag (tag #5). */
114#define CIPSO_V4_TAG_RNG_BLEN 4
115/* The maximum number of category ranges permitted in the ranged category tag
116 * (tag #5). You may note that the IETF draft states that the maximum number
117 * of category ranges is 7, but if the low end of the last category range is
118 * zero then it is possibile to fit 8 category ranges because the zero should
119 * be omitted. */
120#define CIPSO_V4_TAG_RNG_CAT_MAX 8
121
122/*
Paul Moore446fda42006-08-03 16:48:06 -0700123 * Helper Functions
124 */
125
126/**
127 * cipso_v4_bitmap_walk - Walk a bitmap looking for a bit
128 * @bitmap: the bitmap
129 * @bitmap_len: length in bits
130 * @offset: starting offset
131 * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
132 *
133 * Description:
134 * Starting at @offset, walk the bitmap from left to right until either the
135 * desired bit is found or we reach the end. Return the bit offset, -1 if
136 * not found, or -2 if error.
137 */
138static int cipso_v4_bitmap_walk(const unsigned char *bitmap,
139 u32 bitmap_len,
140 u32 offset,
141 u8 state)
142{
143 u32 bit_spot;
144 u32 byte_offset;
145 unsigned char bitmask;
146 unsigned char byte;
147
148 /* gcc always rounds to zero when doing integer division */
149 byte_offset = offset / 8;
150 byte = bitmap[byte_offset];
151 bit_spot = offset;
152 bitmask = 0x80 >> (offset % 8);
153
154 while (bit_spot < bitmap_len) {
155 if ((state && (byte & bitmask) == bitmask) ||
156 (state == 0 && (byte & bitmask) == 0))
157 return bit_spot;
158
159 bit_spot++;
160 bitmask >>= 1;
161 if (bitmask == 0) {
162 byte = bitmap[++byte_offset];
163 bitmask = 0x80;
164 }
165 }
166
167 return -1;
168}
169
170/**
171 * cipso_v4_bitmap_setbit - Sets a single bit in a bitmap
172 * @bitmap: the bitmap
173 * @bit: the bit
174 * @state: if non-zero, set the bit (1) else clear the bit (0)
175 *
176 * Description:
177 * Set a single bit in the bitmask. Returns zero on success, negative values
178 * on error.
179 */
180static void cipso_v4_bitmap_setbit(unsigned char *bitmap,
181 u32 bit,
182 u8 state)
183{
184 u32 byte_spot;
185 u8 bitmask;
186
187 /* gcc always rounds to zero when doing integer division */
188 byte_spot = bit / 8;
189 bitmask = 0x80 >> (bit % 8);
190 if (state)
191 bitmap[byte_spot] |= bitmask;
192 else
193 bitmap[byte_spot] &= ~bitmask;
194}
195
196/**
197 * cipso_v4_doi_domhsh_free - Frees a domain list entry
198 * @entry: the entry's RCU field
199 *
200 * Description:
201 * This function is designed to be used as a callback to the call_rcu()
202 * function so that the memory allocated to a domain list entry can be released
203 * safely.
204 *
205 */
206static void cipso_v4_doi_domhsh_free(struct rcu_head *entry)
207{
208 struct cipso_v4_domhsh_entry *ptr;
209
210 ptr = container_of(entry, struct cipso_v4_domhsh_entry, rcu);
211 kfree(ptr->domain);
212 kfree(ptr);
213}
214
215/**
216 * cipso_v4_cache_entry_free - Frees a cache entry
217 * @entry: the entry to free
218 *
219 * Description:
paul.moore@hp.comffb733c2006-10-04 11:46:31 -0400220 * This function frees the memory associated with a cache entry including the
221 * LSM cache data if there are no longer any users, i.e. reference count == 0.
Paul Moore446fda42006-08-03 16:48:06 -0700222 *
223 */
224static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
225{
paul.moore@hp.comffb733c2006-10-04 11:46:31 -0400226 if (entry->lsm_data)
227 netlbl_secattr_cache_free(entry->lsm_data);
Paul Moore446fda42006-08-03 16:48:06 -0700228 kfree(entry->key);
229 kfree(entry);
230}
231
232/**
233 * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
234 * @key: the hash key
235 * @key_len: the length of the key in bytes
236 *
237 * Description:
238 * The CIPSO tag hashing function. Returns a 32-bit hash value.
239 *
240 */
241static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
242{
243 return jhash(key, key_len, 0);
244}
245
246/*
247 * Label Mapping Cache Functions
248 */
249
250/**
251 * cipso_v4_cache_init - Initialize the CIPSO cache
252 *
253 * Description:
254 * Initializes the CIPSO label mapping cache, this function should be called
255 * before any of the other functions defined in this file. Returns zero on
256 * success, negative values on error.
257 *
258 */
259static int cipso_v4_cache_init(void)
260{
261 u32 iter;
262
263 cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
264 sizeof(struct cipso_v4_map_cache_bkt),
265 GFP_KERNEL);
266 if (cipso_v4_cache == NULL)
267 return -ENOMEM;
268
269 for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
270 spin_lock_init(&cipso_v4_cache[iter].lock);
271 cipso_v4_cache[iter].size = 0;
272 INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
273 }
274
275 return 0;
276}
277
278/**
279 * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
280 *
281 * Description:
282 * Invalidates and frees any entries in the CIPSO cache. Returns zero on
283 * success and negative values on failure.
284 *
285 */
286void cipso_v4_cache_invalidate(void)
287{
288 struct cipso_v4_map_cache_entry *entry, *tmp_entry;
289 u32 iter;
290
291 for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
Paul Moore609c92f2006-09-25 15:52:37 -0700292 spin_lock_bh(&cipso_v4_cache[iter].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700293 list_for_each_entry_safe(entry,
294 tmp_entry,
295 &cipso_v4_cache[iter].list, list) {
296 list_del(&entry->list);
297 cipso_v4_cache_entry_free(entry);
298 }
299 cipso_v4_cache[iter].size = 0;
Paul Moore609c92f2006-09-25 15:52:37 -0700300 spin_unlock_bh(&cipso_v4_cache[iter].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700301 }
302
303 return;
304}
305
306/**
307 * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
308 * @key: the buffer to check
309 * @key_len: buffer length in bytes
310 * @secattr: the security attribute struct to use
311 *
312 * Description:
313 * This function checks the cache to see if a label mapping already exists for
314 * the given key. If there is a match then the cache is adjusted and the
315 * @secattr struct is populated with the correct LSM security attributes. The
316 * cache is adjusted in the following manner if the entry is not already the
317 * first in the cache bucket:
318 *
319 * 1. The cache entry's activity counter is incremented
320 * 2. The previous (higher ranking) entry's activity counter is decremented
321 * 3. If the difference between the two activity counters is geater than
322 * CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
323 *
324 * Returns zero on success, -ENOENT for a cache miss, and other negative values
325 * on error.
326 *
327 */
328static int cipso_v4_cache_check(const unsigned char *key,
329 u32 key_len,
330 struct netlbl_lsm_secattr *secattr)
331{
332 u32 bkt;
333 struct cipso_v4_map_cache_entry *entry;
334 struct cipso_v4_map_cache_entry *prev_entry = NULL;
335 u32 hash;
336
337 if (!cipso_v4_cache_enabled)
338 return -ENOENT;
339
340 hash = cipso_v4_map_cache_hash(key, key_len);
341 bkt = hash & (CIPSO_V4_CACHE_BUCKETBITS - 1);
Paul Moore609c92f2006-09-25 15:52:37 -0700342 spin_lock_bh(&cipso_v4_cache[bkt].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700343 list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
344 if (entry->hash == hash &&
345 entry->key_len == key_len &&
346 memcmp(entry->key, key, key_len) == 0) {
347 entry->activity += 1;
paul.moore@hp.comffb733c2006-10-04 11:46:31 -0400348 atomic_inc(&entry->lsm_data->refcount);
349 secattr->cache = entry->lsm_data;
Paul Moore701a90b2006-11-17 17:38:46 -0500350 secattr->flags |= NETLBL_SECATTR_CACHE;
Paul Moore446fda42006-08-03 16:48:06 -0700351 if (prev_entry == NULL) {
Paul Moore609c92f2006-09-25 15:52:37 -0700352 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700353 return 0;
354 }
355
356 if (prev_entry->activity > 0)
357 prev_entry->activity -= 1;
358 if (entry->activity > prev_entry->activity &&
359 entry->activity - prev_entry->activity >
360 CIPSO_V4_CACHE_REORDERLIMIT) {
361 __list_del(entry->list.prev, entry->list.next);
362 __list_add(&entry->list,
363 prev_entry->list.prev,
364 &prev_entry->list);
365 }
366
Paul Moore609c92f2006-09-25 15:52:37 -0700367 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700368 return 0;
369 }
370 prev_entry = entry;
371 }
Paul Moore609c92f2006-09-25 15:52:37 -0700372 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700373
374 return -ENOENT;
375}
376
377/**
378 * cipso_v4_cache_add - Add an entry to the CIPSO cache
379 * @skb: the packet
380 * @secattr: the packet's security attributes
381 *
382 * Description:
383 * Add a new entry into the CIPSO label mapping cache. Add the new entry to
384 * head of the cache bucket's list, if the cache bucket is out of room remove
385 * the last entry in the list first. It is important to note that there is
386 * currently no checking for duplicate keys. Returns zero on success,
387 * negative values on failure.
388 *
389 */
390int cipso_v4_cache_add(const struct sk_buff *skb,
391 const struct netlbl_lsm_secattr *secattr)
392{
393 int ret_val = -EPERM;
394 u32 bkt;
395 struct cipso_v4_map_cache_entry *entry = NULL;
396 struct cipso_v4_map_cache_entry *old_entry = NULL;
397 unsigned char *cipso_ptr;
398 u32 cipso_ptr_len;
399
400 if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
401 return 0;
402
403 cipso_ptr = CIPSO_V4_OPTPTR(skb);
404 cipso_ptr_len = cipso_ptr[1];
405
406 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
407 if (entry == NULL)
408 return -ENOMEM;
Arnaldo Carvalho de Melofac5d732006-11-17 11:14:16 -0200409 entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
Paul Moore446fda42006-08-03 16:48:06 -0700410 if (entry->key == NULL) {
411 ret_val = -ENOMEM;
412 goto cache_add_failure;
413 }
Paul Moore446fda42006-08-03 16:48:06 -0700414 entry->key_len = cipso_ptr_len;
415 entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
paul.moore@hp.comffb733c2006-10-04 11:46:31 -0400416 atomic_inc(&secattr->cache->refcount);
417 entry->lsm_data = secattr->cache;
Paul Moore446fda42006-08-03 16:48:06 -0700418
419 bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETBITS - 1);
Paul Moore609c92f2006-09-25 15:52:37 -0700420 spin_lock_bh(&cipso_v4_cache[bkt].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700421 if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
422 list_add(&entry->list, &cipso_v4_cache[bkt].list);
423 cipso_v4_cache[bkt].size += 1;
424 } else {
425 old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
426 struct cipso_v4_map_cache_entry, list);
427 list_del(&old_entry->list);
428 list_add(&entry->list, &cipso_v4_cache[bkt].list);
429 cipso_v4_cache_entry_free(old_entry);
430 }
Paul Moore609c92f2006-09-25 15:52:37 -0700431 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
Paul Moore446fda42006-08-03 16:48:06 -0700432
433 return 0;
434
435cache_add_failure:
436 if (entry)
437 cipso_v4_cache_entry_free(entry);
438 return ret_val;
439}
440
441/*
442 * DOI List Functions
443 */
444
445/**
446 * cipso_v4_doi_search - Searches for a DOI definition
447 * @doi: the DOI to search for
448 *
449 * Description:
450 * Search the DOI definition list for a DOI definition with a DOI value that
451 * matches @doi. The caller is responsibile for calling rcu_read_[un]lock().
452 * Returns a pointer to the DOI definition on success and NULL on failure.
453 */
454static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
455{
456 struct cipso_v4_doi *iter;
457
458 list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
459 if (iter->doi == doi && iter->valid)
460 return iter;
461 return NULL;
462}
463
464/**
465 * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
466 * @doi_def: the DOI structure
467 *
468 * Description:
469 * The caller defines a new DOI for use by the CIPSO engine and calls this
470 * function to add it to the list of acceptable domains. The caller must
471 * ensure that the mapping table specified in @doi_def->map meets all of the
472 * requirements of the mapping type (see cipso_ipv4.h for details). Returns
473 * zero on success and non-zero on failure.
474 *
475 */
476int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
477{
Paul Moore6ce61a72006-11-17 17:38:48 -0500478 u32 iter;
479
Paul Moore446fda42006-08-03 16:48:06 -0700480 if (doi_def == NULL || doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
481 return -EINVAL;
Paul Moore6ce61a72006-11-17 17:38:48 -0500482 for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
483 switch (doi_def->tags[iter]) {
484 case CIPSO_V4_TAG_RBITMAP:
485 break;
Paul Moore484b3662006-11-29 13:18:20 -0500486 case CIPSO_V4_TAG_RANGE:
487 if (doi_def->type != CIPSO_V4_MAP_PASS)
488 return -EINVAL;
489 break;
Paul Moore6ce61a72006-11-17 17:38:48 -0500490 case CIPSO_V4_TAG_INVALID:
491 if (iter == 0)
492 return -EINVAL;
493 break;
Paul Moore654bbc22006-11-29 13:18:19 -0500494 case CIPSO_V4_TAG_ENUM:
495 if (doi_def->type != CIPSO_V4_MAP_PASS)
496 return -EINVAL;
497 break;
Paul Moore6ce61a72006-11-17 17:38:48 -0500498 default:
499 return -EINVAL;
500 }
501 }
Paul Moore446fda42006-08-03 16:48:06 -0700502
503 doi_def->valid = 1;
504 INIT_RCU_HEAD(&doi_def->rcu);
505 INIT_LIST_HEAD(&doi_def->dom_list);
506
507 rcu_read_lock();
508 if (cipso_v4_doi_search(doi_def->doi) != NULL)
509 goto doi_add_failure_rlock;
510 spin_lock(&cipso_v4_doi_list_lock);
511 if (cipso_v4_doi_search(doi_def->doi) != NULL)
512 goto doi_add_failure_slock;
513 list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
514 spin_unlock(&cipso_v4_doi_list_lock);
515 rcu_read_unlock();
516
517 return 0;
518
519doi_add_failure_slock:
520 spin_unlock(&cipso_v4_doi_list_lock);
521doi_add_failure_rlock:
522 rcu_read_unlock();
523 return -EEXIST;
524}
525
526/**
527 * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
528 * @doi: the DOI value
Paul Moore32f50cd2006-09-28 14:51:47 -0700529 * @audit_secid: the LSM secid to use in the audit message
Paul Moore446fda42006-08-03 16:48:06 -0700530 * @callback: the DOI cleanup/free callback
531 *
532 * Description:
533 * Removes a DOI definition from the CIPSO engine, @callback is called to
534 * free any memory. The NetLabel routines will be called to release their own
535 * LSM domain mappings as well as our own domain list. Returns zero on
536 * success and negative values on failure.
537 *
538 */
Paul Moore32f50cd2006-09-28 14:51:47 -0700539int cipso_v4_doi_remove(u32 doi,
Paul Moore95d4e6b2006-09-29 17:05:05 -0700540 struct netlbl_audit *audit_info,
Paul Moore32f50cd2006-09-28 14:51:47 -0700541 void (*callback) (struct rcu_head * head))
Paul Moore446fda42006-08-03 16:48:06 -0700542{
543 struct cipso_v4_doi *doi_def;
544 struct cipso_v4_domhsh_entry *dom_iter;
545
546 rcu_read_lock();
547 if (cipso_v4_doi_search(doi) != NULL) {
548 spin_lock(&cipso_v4_doi_list_lock);
549 doi_def = cipso_v4_doi_search(doi);
550 if (doi_def == NULL) {
551 spin_unlock(&cipso_v4_doi_list_lock);
552 rcu_read_unlock();
553 return -ENOENT;
554 }
555 doi_def->valid = 0;
556 list_del_rcu(&doi_def->list);
557 spin_unlock(&cipso_v4_doi_list_lock);
558 list_for_each_entry_rcu(dom_iter, &doi_def->dom_list, list)
559 if (dom_iter->valid)
Paul Moore32f50cd2006-09-28 14:51:47 -0700560 netlbl_domhsh_remove(dom_iter->domain,
Paul Moore95d4e6b2006-09-29 17:05:05 -0700561 audit_info);
Paul Moore446fda42006-08-03 16:48:06 -0700562 cipso_v4_cache_invalidate();
563 rcu_read_unlock();
564
565 call_rcu(&doi_def->rcu, callback);
566 return 0;
567 }
568 rcu_read_unlock();
569
570 return -ENOENT;
571}
572
573/**
574 * cipso_v4_doi_getdef - Returns a pointer to a valid DOI definition
575 * @doi: the DOI value
576 *
577 * Description:
578 * Searches for a valid DOI definition and if one is found it is returned to
579 * the caller. Otherwise NULL is returned. The caller must ensure that
580 * rcu_read_lock() is held while accessing the returned definition.
581 *
582 */
583struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
584{
585 return cipso_v4_doi_search(doi);
586}
587
588/**
Paul Moorefcd48282006-09-25 15:56:09 -0700589 * cipso_v4_doi_walk - Iterate through the DOI definitions
590 * @skip_cnt: skip past this number of DOI definitions, updated
591 * @callback: callback for each DOI definition
592 * @cb_arg: argument for the callback function
Paul Moore446fda42006-08-03 16:48:06 -0700593 *
594 * Description:
Paul Moorefcd48282006-09-25 15:56:09 -0700595 * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
596 * For each entry call @callback, if @callback returns a negative value stop
597 * 'walking' through the list and return. Updates the value in @skip_cnt upon
598 * return. Returns zero on success, negative values on failure.
Paul Moore446fda42006-08-03 16:48:06 -0700599 *
600 */
Paul Moorefcd48282006-09-25 15:56:09 -0700601int cipso_v4_doi_walk(u32 *skip_cnt,
602 int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
603 void *cb_arg)
Paul Moore446fda42006-08-03 16:48:06 -0700604{
Paul Moorefcd48282006-09-25 15:56:09 -0700605 int ret_val = -ENOENT;
Paul Moore446fda42006-08-03 16:48:06 -0700606 u32 doi_cnt = 0;
Paul Moorefcd48282006-09-25 15:56:09 -0700607 struct cipso_v4_doi *iter_doi;
Paul Moore446fda42006-08-03 16:48:06 -0700608
609 rcu_read_lock();
Paul Moorefcd48282006-09-25 15:56:09 -0700610 list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
611 if (iter_doi->valid) {
612 if (doi_cnt++ < *skip_cnt)
613 continue;
614 ret_val = callback(iter_doi, cb_arg);
615 if (ret_val < 0) {
616 doi_cnt--;
617 goto doi_walk_return;
Paul Moore446fda42006-08-03 16:48:06 -0700618 }
Paul Moorefcd48282006-09-25 15:56:09 -0700619 }
Paul Moore446fda42006-08-03 16:48:06 -0700620
Paul Moorefcd48282006-09-25 15:56:09 -0700621doi_walk_return:
Paul Moore446fda42006-08-03 16:48:06 -0700622 rcu_read_unlock();
Paul Moorefcd48282006-09-25 15:56:09 -0700623 *skip_cnt = doi_cnt;
624 return ret_val;
Paul Moore446fda42006-08-03 16:48:06 -0700625}
626
627/**
628 * cipso_v4_doi_domhsh_add - Adds a domain entry to a DOI definition
629 * @doi_def: the DOI definition
630 * @domain: the domain to add
631 *
632 * Description:
Michael Opdenacker59c51592007-05-09 08:57:56 +0200633 * Adds the @domain to the DOI specified by @doi_def, this function
Paul Moore446fda42006-08-03 16:48:06 -0700634 * should only be called by external functions (i.e. NetLabel). This function
635 * does allocate memory. Returns zero on success, negative values on failure.
636 *
637 */
638int cipso_v4_doi_domhsh_add(struct cipso_v4_doi *doi_def, const char *domain)
639{
640 struct cipso_v4_domhsh_entry *iter;
641 struct cipso_v4_domhsh_entry *new_dom;
642
643 new_dom = kzalloc(sizeof(*new_dom), GFP_KERNEL);
644 if (new_dom == NULL)
645 return -ENOMEM;
646 if (domain) {
647 new_dom->domain = kstrdup(domain, GFP_KERNEL);
648 if (new_dom->domain == NULL) {
649 kfree(new_dom);
650 return -ENOMEM;
651 }
652 }
653 new_dom->valid = 1;
654 INIT_RCU_HEAD(&new_dom->rcu);
655
656 rcu_read_lock();
657 spin_lock(&cipso_v4_doi_list_lock);
658 list_for_each_entry_rcu(iter, &doi_def->dom_list, list)
659 if (iter->valid &&
660 ((domain != NULL && iter->domain != NULL &&
661 strcmp(iter->domain, domain) == 0) ||
662 (domain == NULL && iter->domain == NULL))) {
663 spin_unlock(&cipso_v4_doi_list_lock);
664 rcu_read_unlock();
665 kfree(new_dom->domain);
666 kfree(new_dom);
667 return -EEXIST;
668 }
669 list_add_tail_rcu(&new_dom->list, &doi_def->dom_list);
670 spin_unlock(&cipso_v4_doi_list_lock);
671 rcu_read_unlock();
672
673 return 0;
674}
675
676/**
677 * cipso_v4_doi_domhsh_remove - Removes a domain entry from a DOI definition
678 * @doi_def: the DOI definition
679 * @domain: the domain to remove
680 *
681 * Description:
682 * Removes the @domain from the DOI specified by @doi_def, this function
683 * should only be called by external functions (i.e. NetLabel). Returns zero
684 * on success and negative values on error.
685 *
686 */
687int cipso_v4_doi_domhsh_remove(struct cipso_v4_doi *doi_def,
688 const char *domain)
689{
690 struct cipso_v4_domhsh_entry *iter;
691
692 rcu_read_lock();
693 spin_lock(&cipso_v4_doi_list_lock);
694 list_for_each_entry_rcu(iter, &doi_def->dom_list, list)
695 if (iter->valid &&
696 ((domain != NULL && iter->domain != NULL &&
697 strcmp(iter->domain, domain) == 0) ||
698 (domain == NULL && iter->domain == NULL))) {
699 iter->valid = 0;
700 list_del_rcu(&iter->list);
701 spin_unlock(&cipso_v4_doi_list_lock);
702 rcu_read_unlock();
703 call_rcu(&iter->rcu, cipso_v4_doi_domhsh_free);
704
705 return 0;
706 }
707 spin_unlock(&cipso_v4_doi_list_lock);
708 rcu_read_unlock();
709
710 return -ENOENT;
711}
712
713/*
714 * Label Mapping Functions
715 */
716
717/**
718 * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
719 * @doi_def: the DOI definition
720 * @level: the level to check
721 *
722 * Description:
723 * Checks the given level against the given DOI definition and returns a
724 * negative value if the level does not have a valid mapping and a zero value
725 * if the level is defined by the DOI.
726 *
727 */
728static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
729{
730 switch (doi_def->type) {
731 case CIPSO_V4_MAP_PASS:
732 return 0;
733 case CIPSO_V4_MAP_STD:
734 if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
735 return 0;
736 break;
737 }
738
739 return -EFAULT;
740}
741
742/**
743 * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
744 * @doi_def: the DOI definition
745 * @host_lvl: the host MLS level
746 * @net_lvl: the network/CIPSO MLS level
747 *
748 * Description:
749 * Perform a label mapping to translate a local MLS level to the correct
750 * CIPSO level using the given DOI definition. Returns zero on success,
751 * negative values otherwise.
752 *
753 */
754static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
755 u32 host_lvl,
756 u32 *net_lvl)
757{
758 switch (doi_def->type) {
759 case CIPSO_V4_MAP_PASS:
760 *net_lvl = host_lvl;
761 return 0;
762 case CIPSO_V4_MAP_STD:
Paul Moorec6387a82007-03-02 13:19:02 -0800763 if (host_lvl < doi_def->map.std->lvl.local_size &&
764 doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
Paul Moore446fda42006-08-03 16:48:06 -0700765 *net_lvl = doi_def->map.std->lvl.local[host_lvl];
766 return 0;
767 }
Paul Moorec6387a82007-03-02 13:19:02 -0800768 return -EPERM;
Paul Moore446fda42006-08-03 16:48:06 -0700769 }
770
771 return -EINVAL;
772}
773
774/**
775 * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
776 * @doi_def: the DOI definition
777 * @net_lvl: the network/CIPSO MLS level
778 * @host_lvl: the host MLS level
779 *
780 * Description:
781 * Perform a label mapping to translate a CIPSO level to the correct local MLS
782 * level using the given DOI definition. Returns zero on success, negative
783 * values otherwise.
784 *
785 */
786static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
787 u32 net_lvl,
788 u32 *host_lvl)
789{
790 struct cipso_v4_std_map_tbl *map_tbl;
791
792 switch (doi_def->type) {
793 case CIPSO_V4_MAP_PASS:
794 *host_lvl = net_lvl;
795 return 0;
796 case CIPSO_V4_MAP_STD:
797 map_tbl = doi_def->map.std;
798 if (net_lvl < map_tbl->lvl.cipso_size &&
799 map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
800 *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
801 return 0;
802 }
Paul Moorec6387a82007-03-02 13:19:02 -0800803 return -EPERM;
Paul Moore446fda42006-08-03 16:48:06 -0700804 }
805
806 return -EINVAL;
807}
808
809/**
810 * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
811 * @doi_def: the DOI definition
812 * @bitmap: category bitmap
813 * @bitmap_len: bitmap length in bytes
814 *
815 * Description:
816 * Checks the given category bitmap against the given DOI definition and
817 * returns a negative value if any of the categories in the bitmap do not have
818 * a valid mapping and a zero value if all of the categories are valid.
819 *
820 */
821static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
822 const unsigned char *bitmap,
823 u32 bitmap_len)
824{
825 int cat = -1;
826 u32 bitmap_len_bits = bitmap_len * 8;
Paul Moore044a68e2006-10-11 19:10:47 -0400827 u32 cipso_cat_size;
828 u32 *cipso_array;
Paul Moore446fda42006-08-03 16:48:06 -0700829
830 switch (doi_def->type) {
831 case CIPSO_V4_MAP_PASS:
832 return 0;
833 case CIPSO_V4_MAP_STD:
Paul Moore044a68e2006-10-11 19:10:47 -0400834 cipso_cat_size = doi_def->map.std->cat.cipso_size;
835 cipso_array = doi_def->map.std->cat.cipso;
Paul Moore446fda42006-08-03 16:48:06 -0700836 for (;;) {
837 cat = cipso_v4_bitmap_walk(bitmap,
838 bitmap_len_bits,
839 cat + 1,
840 1);
841 if (cat < 0)
842 break;
843 if (cat >= cipso_cat_size ||
844 cipso_array[cat] >= CIPSO_V4_INV_CAT)
845 return -EFAULT;
846 }
847
848 if (cat == -1)
849 return 0;
850 break;
851 }
852
853 return -EFAULT;
854}
855
856/**
857 * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
858 * @doi_def: the DOI definition
Paul Moore02752762006-11-29 13:18:18 -0500859 * @secattr: the security attributes
Paul Moore446fda42006-08-03 16:48:06 -0700860 * @net_cat: the zero'd out category bitmap in network/CIPSO format
861 * @net_cat_len: the length of the CIPSO bitmap in bytes
862 *
863 * Description:
864 * Perform a label mapping to translate a local MLS category bitmap to the
865 * correct CIPSO bitmap using the given DOI definition. Returns the minimum
866 * size in bytes of the network bitmap on success, negative values otherwise.
867 *
868 */
869static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
Paul Moore02752762006-11-29 13:18:18 -0500870 const struct netlbl_lsm_secattr *secattr,
Paul Moore446fda42006-08-03 16:48:06 -0700871 unsigned char *net_cat,
872 u32 net_cat_len)
873{
874 int host_spot = -1;
Paul Moore02752762006-11-29 13:18:18 -0500875 u32 net_spot = CIPSO_V4_INV_CAT;
Paul Moore446fda42006-08-03 16:48:06 -0700876 u32 net_spot_max = 0;
Paul Moore446fda42006-08-03 16:48:06 -0700877 u32 net_clen_bits = net_cat_len * 8;
Paul Moore02752762006-11-29 13:18:18 -0500878 u32 host_cat_size = 0;
879 u32 *host_cat_array = NULL;
Paul Moore446fda42006-08-03 16:48:06 -0700880
Paul Moore02752762006-11-29 13:18:18 -0500881 if (doi_def->type == CIPSO_V4_MAP_STD) {
Paul Moore044a68e2006-10-11 19:10:47 -0400882 host_cat_size = doi_def->map.std->cat.local_size;
883 host_cat_array = doi_def->map.std->cat.local;
Paul Moore02752762006-11-29 13:18:18 -0500884 }
885
886 for (;;) {
887 host_spot = netlbl_secattr_catmap_walk(secattr->mls_cat,
888 host_spot + 1);
889 if (host_spot < 0)
890 break;
891
892 switch (doi_def->type) {
893 case CIPSO_V4_MAP_PASS:
894 net_spot = host_spot;
895 break;
896 case CIPSO_V4_MAP_STD:
Paul Moore446fda42006-08-03 16:48:06 -0700897 if (host_spot >= host_cat_size)
898 return -EPERM;
Paul Moore446fda42006-08-03 16:48:06 -0700899 net_spot = host_cat_array[host_spot];
Paul Moore9fade4b2006-11-17 17:38:50 -0500900 if (net_spot >= CIPSO_V4_INV_CAT)
901 return -EPERM;
Paul Moore02752762006-11-29 13:18:18 -0500902 break;
Paul Moore446fda42006-08-03 16:48:06 -0700903 }
Paul Moore02752762006-11-29 13:18:18 -0500904 if (net_spot >= net_clen_bits)
905 return -ENOSPC;
906 cipso_v4_bitmap_setbit(net_cat, net_spot, 1);
Paul Moore446fda42006-08-03 16:48:06 -0700907
Paul Moore02752762006-11-29 13:18:18 -0500908 if (net_spot > net_spot_max)
909 net_spot_max = net_spot;
Paul Moore446fda42006-08-03 16:48:06 -0700910 }
911
Paul Moore02752762006-11-29 13:18:18 -0500912 if (++net_spot_max % 8)
913 return net_spot_max / 8 + 1;
914 return net_spot_max / 8;
Paul Moore446fda42006-08-03 16:48:06 -0700915}
916
917/**
918 * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
919 * @doi_def: the DOI definition
920 * @net_cat: the category bitmap in network/CIPSO format
921 * @net_cat_len: the length of the CIPSO bitmap in bytes
Paul Moore02752762006-11-29 13:18:18 -0500922 * @secattr: the security attributes
Paul Moore446fda42006-08-03 16:48:06 -0700923 *
924 * Description:
925 * Perform a label mapping to translate a CIPSO bitmap to the correct local
Paul Moore02752762006-11-29 13:18:18 -0500926 * MLS category bitmap using the given DOI definition. Returns zero on
927 * success, negative values on failure.
Paul Moore446fda42006-08-03 16:48:06 -0700928 *
929 */
930static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
931 const unsigned char *net_cat,
932 u32 net_cat_len,
Paul Moore02752762006-11-29 13:18:18 -0500933 struct netlbl_lsm_secattr *secattr)
Paul Moore446fda42006-08-03 16:48:06 -0700934{
Paul Moore02752762006-11-29 13:18:18 -0500935 int ret_val;
Paul Moore446fda42006-08-03 16:48:06 -0700936 int net_spot = -1;
Paul Moore02752762006-11-29 13:18:18 -0500937 u32 host_spot = CIPSO_V4_INV_CAT;
Paul Moore446fda42006-08-03 16:48:06 -0700938 u32 net_clen_bits = net_cat_len * 8;
Paul Moore02752762006-11-29 13:18:18 -0500939 u32 net_cat_size = 0;
940 u32 *net_cat_array = NULL;
Paul Moore446fda42006-08-03 16:48:06 -0700941
Paul Moore02752762006-11-29 13:18:18 -0500942 if (doi_def->type == CIPSO_V4_MAP_STD) {
Paul Moore044a68e2006-10-11 19:10:47 -0400943 net_cat_size = doi_def->map.std->cat.cipso_size;
944 net_cat_array = doi_def->map.std->cat.cipso;
Paul Moore02752762006-11-29 13:18:18 -0500945 }
Paul Moore446fda42006-08-03 16:48:06 -0700946
Paul Moore02752762006-11-29 13:18:18 -0500947 for (;;) {
948 net_spot = cipso_v4_bitmap_walk(net_cat,
949 net_clen_bits,
950 net_spot + 1,
951 1);
952 if (net_spot < 0) {
953 if (net_spot == -2)
954 return -EFAULT;
955 return 0;
956 }
957
958 switch (doi_def->type) {
959 case CIPSO_V4_MAP_PASS:
960 host_spot = net_spot;
961 break;
962 case CIPSO_V4_MAP_STD:
963 if (net_spot >= net_cat_size)
964 return -EPERM;
Paul Moore446fda42006-08-03 16:48:06 -0700965 host_spot = net_cat_array[net_spot];
Paul Moore9fade4b2006-11-17 17:38:50 -0500966 if (host_spot >= CIPSO_V4_INV_CAT)
967 return -EPERM;
Paul Moore02752762006-11-29 13:18:18 -0500968 break;
Paul Moore446fda42006-08-03 16:48:06 -0700969 }
Paul Moore02752762006-11-29 13:18:18 -0500970 ret_val = netlbl_secattr_catmap_setbit(secattr->mls_cat,
971 host_spot,
972 GFP_ATOMIC);
973 if (ret_val != 0)
974 return ret_val;
Paul Moore446fda42006-08-03 16:48:06 -0700975 }
976
977 return -EINVAL;
978}
979
Paul Moore654bbc22006-11-29 13:18:19 -0500980/**
981 * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
982 * @doi_def: the DOI definition
983 * @enumcat: category list
984 * @enumcat_len: length of the category list in bytes
985 *
986 * Description:
987 * Checks the given categories against the given DOI definition and returns a
988 * negative value if any of the categories do not have a valid mapping and a
989 * zero value if all of the categories are valid.
990 *
991 */
992static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
993 const unsigned char *enumcat,
994 u32 enumcat_len)
995{
996 u16 cat;
997 int cat_prev = -1;
998 u32 iter;
999
1000 if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
1001 return -EFAULT;
1002
1003 for (iter = 0; iter < enumcat_len; iter += 2) {
Paul Moore50e5d352007-06-07 18:38:14 -07001004 cat = ntohs(get_unaligned((__be16 *)&enumcat[iter]));
Paul Moore654bbc22006-11-29 13:18:19 -05001005 if (cat <= cat_prev)
1006 return -EFAULT;
1007 cat_prev = cat;
1008 }
1009
1010 return 0;
1011}
1012
1013/**
1014 * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
1015 * @doi_def: the DOI definition
1016 * @secattr: the security attributes
1017 * @net_cat: the zero'd out category list in network/CIPSO format
1018 * @net_cat_len: the length of the CIPSO category list in bytes
1019 *
1020 * Description:
1021 * Perform a label mapping to translate a local MLS category bitmap to the
1022 * correct CIPSO category list using the given DOI definition. Returns the
1023 * size in bytes of the network category bitmap on success, negative values
1024 * otherwise.
1025 *
1026 */
1027static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
1028 const struct netlbl_lsm_secattr *secattr,
1029 unsigned char *net_cat,
1030 u32 net_cat_len)
1031{
1032 int cat = -1;
1033 u32 cat_iter = 0;
1034
1035 for (;;) {
1036 cat = netlbl_secattr_catmap_walk(secattr->mls_cat, cat + 1);
1037 if (cat < 0)
1038 break;
1039 if ((cat_iter + 2) > net_cat_len)
1040 return -ENOSPC;
1041
1042 *((__be16 *)&net_cat[cat_iter]) = htons(cat);
1043 cat_iter += 2;
1044 }
1045
1046 return cat_iter;
1047}
1048
1049/**
1050 * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
1051 * @doi_def: the DOI definition
1052 * @net_cat: the category list in network/CIPSO format
1053 * @net_cat_len: the length of the CIPSO bitmap in bytes
1054 * @secattr: the security attributes
1055 *
1056 * Description:
1057 * Perform a label mapping to translate a CIPSO category list to the correct
1058 * local MLS category bitmap using the given DOI definition. Returns zero on
1059 * success, negative values on failure.
1060 *
1061 */
1062static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
1063 const unsigned char *net_cat,
1064 u32 net_cat_len,
1065 struct netlbl_lsm_secattr *secattr)
1066{
1067 int ret_val;
1068 u32 iter;
1069
1070 for (iter = 0; iter < net_cat_len; iter += 2) {
1071 ret_val = netlbl_secattr_catmap_setbit(secattr->mls_cat,
Paul Moore50e5d352007-06-07 18:38:14 -07001072 ntohs(get_unaligned((__be16 *)&net_cat[iter])),
1073 GFP_ATOMIC);
Paul Moore654bbc22006-11-29 13:18:19 -05001074 if (ret_val != 0)
1075 return ret_val;
1076 }
1077
1078 return 0;
1079}
1080
Paul Moore484b3662006-11-29 13:18:20 -05001081/**
1082 * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
1083 * @doi_def: the DOI definition
1084 * @rngcat: category list
1085 * @rngcat_len: length of the category list in bytes
1086 *
1087 * Description:
1088 * Checks the given categories against the given DOI definition and returns a
1089 * negative value if any of the categories do not have a valid mapping and a
1090 * zero value if all of the categories are valid.
1091 *
1092 */
1093static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1094 const unsigned char *rngcat,
1095 u32 rngcat_len)
1096{
1097 u16 cat_high;
1098 u16 cat_low;
1099 u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1100 u32 iter;
1101
1102 if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1103 return -EFAULT;
1104
1105 for (iter = 0; iter < rngcat_len; iter += 4) {
Paul Moore50e5d352007-06-07 18:38:14 -07001106 cat_high = ntohs(get_unaligned((__be16 *)&rngcat[iter]));
Paul Moore484b3662006-11-29 13:18:20 -05001107 if ((iter + 4) <= rngcat_len)
Paul Moore50e5d352007-06-07 18:38:14 -07001108 cat_low = ntohs(
1109 get_unaligned((__be16 *)&rngcat[iter + 2]));
Paul Moore484b3662006-11-29 13:18:20 -05001110 else
1111 cat_low = 0;
1112
1113 if (cat_high > cat_prev)
1114 return -EFAULT;
1115
1116 cat_prev = cat_low;
1117 }
1118
1119 return 0;
1120}
1121
1122/**
1123 * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
1124 * @doi_def: the DOI definition
1125 * @secattr: the security attributes
1126 * @net_cat: the zero'd out category list in network/CIPSO format
1127 * @net_cat_len: the length of the CIPSO category list in bytes
1128 *
1129 * Description:
1130 * Perform a label mapping to translate a local MLS category bitmap to the
1131 * correct CIPSO category list using the given DOI definition. Returns the
1132 * size in bytes of the network category bitmap on success, negative values
1133 * otherwise.
1134 *
1135 */
1136static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1137 const struct netlbl_lsm_secattr *secattr,
1138 unsigned char *net_cat,
1139 u32 net_cat_len)
1140{
Paul Moore484b3662006-11-29 13:18:20 -05001141 int iter = -1;
Paul Mooref998e8c2007-02-28 15:14:20 -05001142 u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
Paul Moore484b3662006-11-29 13:18:20 -05001143 u32 array_cnt = 0;
1144 u32 cat_size = 0;
1145
Paul Mooref998e8c2007-02-28 15:14:20 -05001146 /* make sure we don't overflow the 'array[]' variable */
Paul Moore128c6b62007-02-28 15:14:21 -05001147 if (net_cat_len >
1148 (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1149 return -ENOSPC;
Paul Moore484b3662006-11-29 13:18:20 -05001150
1151 for (;;) {
1152 iter = netlbl_secattr_catmap_walk(secattr->mls_cat, iter + 1);
1153 if (iter < 0)
1154 break;
1155 cat_size += (iter == 0 ? 0 : sizeof(u16));
1156 if (cat_size > net_cat_len)
1157 return -ENOSPC;
1158 array[array_cnt++] = iter;
1159
1160 iter = netlbl_secattr_catmap_walk_rng(secattr->mls_cat, iter);
1161 if (iter < 0)
1162 return -EFAULT;
1163 cat_size += sizeof(u16);
1164 if (cat_size > net_cat_len)
1165 return -ENOSPC;
1166 array[array_cnt++] = iter;
1167 }
1168
1169 for (iter = 0; array_cnt > 0;) {
1170 *((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1171 iter += 2;
1172 array_cnt--;
1173 if (array[array_cnt] != 0) {
1174 *((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1175 iter += 2;
1176 }
1177 }
1178
1179 return cat_size;
1180}
1181
1182/**
1183 * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
1184 * @doi_def: the DOI definition
1185 * @net_cat: the category list in network/CIPSO format
1186 * @net_cat_len: the length of the CIPSO bitmap in bytes
1187 * @secattr: the security attributes
1188 *
1189 * Description:
1190 * Perform a label mapping to translate a CIPSO category list to the correct
1191 * local MLS category bitmap using the given DOI definition. Returns zero on
1192 * success, negative values on failure.
1193 *
1194 */
1195static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1196 const unsigned char *net_cat,
1197 u32 net_cat_len,
1198 struct netlbl_lsm_secattr *secattr)
1199{
1200 int ret_val;
1201 u32 net_iter;
1202 u16 cat_low;
1203 u16 cat_high;
1204
Stephen Hemminger132adf52007-03-08 20:44:43 -08001205 for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
Paul Moore50e5d352007-06-07 18:38:14 -07001206 cat_high = ntohs(get_unaligned((__be16 *)&net_cat[net_iter]));
Paul Moore484b3662006-11-29 13:18:20 -05001207 if ((net_iter + 4) <= net_cat_len)
Paul Moore50e5d352007-06-07 18:38:14 -07001208 cat_low = ntohs(
1209 get_unaligned((__be16 *)&net_cat[net_iter + 2]));
Paul Moore484b3662006-11-29 13:18:20 -05001210 else
1211 cat_low = 0;
1212
1213 ret_val = netlbl_secattr_catmap_setrng(secattr->mls_cat,
1214 cat_low,
1215 cat_high,
1216 GFP_ATOMIC);
1217 if (ret_val != 0)
1218 return ret_val;
1219 }
1220
1221 return 0;
1222}
1223
Paul Moore446fda42006-08-03 16:48:06 -07001224/*
1225 * Protocol Handling Functions
1226 */
1227
Paul Moore446fda42006-08-03 16:48:06 -07001228/**
1229 * cipso_v4_gentag_hdr - Generate a CIPSO option header
1230 * @doi_def: the DOI definition
Paul Moore91b1ed02006-11-17 17:38:49 -05001231 * @len: the total tag length in bytes, not including this header
Paul Moore446fda42006-08-03 16:48:06 -07001232 * @buf: the CIPSO option buffer
1233 *
1234 * Description:
Paul Moore91b1ed02006-11-17 17:38:49 -05001235 * Write a CIPSO header into the beginning of @buffer.
Paul Moore446fda42006-08-03 16:48:06 -07001236 *
1237 */
Paul Moore91b1ed02006-11-17 17:38:49 -05001238static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1239 unsigned char *buf,
1240 u32 len)
Paul Moore446fda42006-08-03 16:48:06 -07001241{
Paul Moore446fda42006-08-03 16:48:06 -07001242 buf[0] = IPOPT_CIPSO;
1243 buf[1] = CIPSO_V4_HDR_LEN + len;
Al Viro714e85b2006-11-14 20:51:49 -08001244 *(__be32 *)&buf[2] = htonl(doi_def->doi);
Paul Moore446fda42006-08-03 16:48:06 -07001245}
1246
Paul Moore446fda42006-08-03 16:48:06 -07001247/**
1248 * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
1249 * @doi_def: the DOI definition
1250 * @secattr: the security attributes
1251 * @buffer: the option buffer
1252 * @buffer_len: length of buffer in bytes
1253 *
1254 * Description:
1255 * Generate a CIPSO option using the restricted bitmap tag, tag type #1. The
1256 * actual buffer length may be larger than the indicated size due to
Paul Moore91b1ed02006-11-17 17:38:49 -05001257 * translation between host and network category bitmaps. Returns the size of
1258 * the tag on success, negative values on failure.
Paul Moore446fda42006-08-03 16:48:06 -07001259 *
1260 */
1261static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1262 const struct netlbl_lsm_secattr *secattr,
Paul Moore91b1ed02006-11-17 17:38:49 -05001263 unsigned char *buffer,
1264 u32 buffer_len)
Paul Moore446fda42006-08-03 16:48:06 -07001265{
Paul Moore701a90b2006-11-17 17:38:46 -05001266 int ret_val;
Paul Moore91b1ed02006-11-17 17:38:49 -05001267 u32 tag_len;
Paul Moore446fda42006-08-03 16:48:06 -07001268 u32 level;
1269
Paul Moore701a90b2006-11-17 17:38:46 -05001270 if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1271 return -EPERM;
1272
Paul Moore91b1ed02006-11-17 17:38:49 -05001273 ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
1274 if (ret_val != 0)
1275 return ret_val;
Paul Moore446fda42006-08-03 16:48:06 -07001276
Paul Moore91b1ed02006-11-17 17:38:49 -05001277 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
Paul Moore446fda42006-08-03 16:48:06 -07001278 ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
Paul Moore02752762006-11-29 13:18:18 -05001279 secattr,
Paul Moore91b1ed02006-11-17 17:38:49 -05001280 &buffer[4],
1281 buffer_len - 4);
Paul Moore446fda42006-08-03 16:48:06 -07001282 if (ret_val < 0)
Paul Moore91b1ed02006-11-17 17:38:49 -05001283 return ret_val;
Paul Moore446fda42006-08-03 16:48:06 -07001284
1285 /* This will send packets using the "optimized" format when
1286 * possibile as specified in section 3.4.2.6 of the
1287 * CIPSO draft. */
Paul Moore701a90b2006-11-17 17:38:46 -05001288 if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
Paul Moore91b1ed02006-11-17 17:38:49 -05001289 tag_len = 14;
Paul Moore701a90b2006-11-17 17:38:46 -05001290 else
Paul Moore91b1ed02006-11-17 17:38:49 -05001291 tag_len = 4 + ret_val;
1292 } else
1293 tag_len = 4;
Paul Moore446fda42006-08-03 16:48:06 -07001294
Paul Moore91b1ed02006-11-17 17:38:49 -05001295 buffer[0] = 0x01;
1296 buffer[1] = tag_len;
1297 buffer[3] = level;
Paul Moore446fda42006-08-03 16:48:06 -07001298
Paul Moore91b1ed02006-11-17 17:38:49 -05001299 return tag_len;
Paul Moore446fda42006-08-03 16:48:06 -07001300}
1301
1302/**
1303 * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
1304 * @doi_def: the DOI definition
1305 * @tag: the CIPSO tag
1306 * @secattr: the security attributes
1307 *
1308 * Description:
1309 * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
1310 * attributes in @secattr. Return zero on success, negatives values on
1311 * failure.
1312 *
1313 */
1314static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1315 const unsigned char *tag,
1316 struct netlbl_lsm_secattr *secattr)
1317{
1318 int ret_val;
1319 u8 tag_len = tag[1];
1320 u32 level;
1321
1322 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1323 if (ret_val != 0)
1324 return ret_val;
1325 secattr->mls_lvl = level;
Paul Moore701a90b2006-11-17 17:38:46 -05001326 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
Paul Moore446fda42006-08-03 16:48:06 -07001327
1328 if (tag_len > 4) {
Paul Moore02752762006-11-29 13:18:18 -05001329 secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
Paul Moore446fda42006-08-03 16:48:06 -07001330 if (secattr->mls_cat == NULL)
1331 return -ENOMEM;
1332
1333 ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1334 &tag[4],
1335 tag_len - 4,
Paul Moore02752762006-11-29 13:18:18 -05001336 secattr);
1337 if (ret_val != 0) {
1338 netlbl_secattr_catmap_free(secattr->mls_cat);
Paul Moore446fda42006-08-03 16:48:06 -07001339 return ret_val;
1340 }
Paul Moore02752762006-11-29 13:18:18 -05001341
1342 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
Paul Moore446fda42006-08-03 16:48:06 -07001343 }
1344
1345 return 0;
1346}
1347
1348/**
Paul Moore654bbc22006-11-29 13:18:19 -05001349 * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
1350 * @doi_def: the DOI definition
1351 * @secattr: the security attributes
1352 * @buffer: the option buffer
1353 * @buffer_len: length of buffer in bytes
1354 *
1355 * Description:
1356 * Generate a CIPSO option using the enumerated tag, tag type #2. Returns the
1357 * size of the tag on success, negative values on failure.
1358 *
1359 */
1360static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1361 const struct netlbl_lsm_secattr *secattr,
1362 unsigned char *buffer,
1363 u32 buffer_len)
1364{
1365 int ret_val;
1366 u32 tag_len;
1367 u32 level;
1368
1369 if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1370 return -EPERM;
1371
1372 ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
1373 if (ret_val != 0)
1374 return ret_val;
1375
1376 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1377 ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1378 secattr,
1379 &buffer[4],
1380 buffer_len - 4);
1381 if (ret_val < 0)
1382 return ret_val;
1383
1384 tag_len = 4 + ret_val;
1385 } else
1386 tag_len = 4;
1387
1388 buffer[0] = 0x02;
1389 buffer[1] = tag_len;
1390 buffer[3] = level;
1391
1392 return tag_len;
1393}
1394
1395/**
1396 * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
1397 * @doi_def: the DOI definition
1398 * @tag: the CIPSO tag
1399 * @secattr: the security attributes
1400 *
1401 * Description:
1402 * Parse a CIPSO enumerated tag (tag type #2) and return the security
1403 * attributes in @secattr. Return zero on success, negatives values on
1404 * failure.
1405 *
1406 */
1407static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1408 const unsigned char *tag,
1409 struct netlbl_lsm_secattr *secattr)
1410{
1411 int ret_val;
1412 u8 tag_len = tag[1];
1413 u32 level;
1414
1415 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1416 if (ret_val != 0)
1417 return ret_val;
1418 secattr->mls_lvl = level;
1419 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1420
1421 if (tag_len > 4) {
1422 secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1423 if (secattr->mls_cat == NULL)
1424 return -ENOMEM;
1425
1426 ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1427 &tag[4],
1428 tag_len - 4,
1429 secattr);
1430 if (ret_val != 0) {
1431 netlbl_secattr_catmap_free(secattr->mls_cat);
1432 return ret_val;
1433 }
1434
1435 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1436 }
1437
1438 return 0;
1439}
1440
1441/**
Paul Moore484b3662006-11-29 13:18:20 -05001442 * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
1443 * @doi_def: the DOI definition
1444 * @secattr: the security attributes
1445 * @buffer: the option buffer
1446 * @buffer_len: length of buffer in bytes
1447 *
1448 * Description:
1449 * Generate a CIPSO option using the ranged tag, tag type #5. Returns the
1450 * size of the tag on success, negative values on failure.
1451 *
1452 */
1453static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1454 const struct netlbl_lsm_secattr *secattr,
1455 unsigned char *buffer,
1456 u32 buffer_len)
1457{
1458 int ret_val;
1459 u32 tag_len;
1460 u32 level;
1461
1462 if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1463 return -EPERM;
1464
1465 ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
1466 if (ret_val != 0)
1467 return ret_val;
1468
1469 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1470 ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1471 secattr,
1472 &buffer[4],
1473 buffer_len - 4);
1474 if (ret_val < 0)
1475 return ret_val;
1476
1477 tag_len = 4 + ret_val;
1478 } else
1479 tag_len = 4;
1480
1481 buffer[0] = 0x05;
1482 buffer[1] = tag_len;
1483 buffer[3] = level;
1484
1485 return tag_len;
1486}
1487
1488/**
1489 * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
1490 * @doi_def: the DOI definition
1491 * @tag: the CIPSO tag
1492 * @secattr: the security attributes
1493 *
1494 * Description:
1495 * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
1496 * in @secattr. Return zero on success, negatives values on failure.
1497 *
1498 */
1499static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1500 const unsigned char *tag,
1501 struct netlbl_lsm_secattr *secattr)
1502{
1503 int ret_val;
1504 u8 tag_len = tag[1];
1505 u32 level;
1506
1507 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1508 if (ret_val != 0)
1509 return ret_val;
1510 secattr->mls_lvl = level;
1511 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1512
1513 if (tag_len > 4) {
1514 secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1515 if (secattr->mls_cat == NULL)
1516 return -ENOMEM;
1517
1518 ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1519 &tag[4],
1520 tag_len - 4,
1521 secattr);
1522 if (ret_val != 0) {
1523 netlbl_secattr_catmap_free(secattr->mls_cat);
1524 return ret_val;
1525 }
1526
1527 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1528 }
1529
1530 return 0;
1531}
1532
1533/**
Paul Moore446fda42006-08-03 16:48:06 -07001534 * cipso_v4_validate - Validate a CIPSO option
1535 * @option: the start of the option, on error it is set to point to the error
1536 *
1537 * Description:
1538 * This routine is called to validate a CIPSO option, it checks all of the
1539 * fields to ensure that they are at least valid, see the draft snippet below
1540 * for details. If the option is valid then a zero value is returned and
1541 * the value of @option is unchanged. If the option is invalid then a
1542 * non-zero value is returned and @option is adjusted to point to the
1543 * offending portion of the option. From the IETF draft ...
1544 *
1545 * "If any field within the CIPSO options, such as the DOI identifier, is not
1546 * recognized the IP datagram is discarded and an ICMP 'parameter problem'
1547 * (type 12) is generated and returned. The ICMP code field is set to 'bad
1548 * parameter' (code 0) and the pointer is set to the start of the CIPSO field
1549 * that is unrecognized."
1550 *
1551 */
1552int cipso_v4_validate(unsigned char **option)
1553{
1554 unsigned char *opt = *option;
1555 unsigned char *tag;
1556 unsigned char opt_iter;
1557 unsigned char err_offset = 0;
1558 u8 opt_len;
1559 u8 tag_len;
1560 struct cipso_v4_doi *doi_def = NULL;
1561 u32 tag_iter;
1562
1563 /* caller already checks for length values that are too large */
1564 opt_len = opt[1];
1565 if (opt_len < 8) {
1566 err_offset = 1;
1567 goto validate_return;
1568 }
1569
1570 rcu_read_lock();
Paul Moore50e5d352007-06-07 18:38:14 -07001571 doi_def = cipso_v4_doi_search(ntohl(get_unaligned((__be32 *)&opt[2])));
Paul Moore446fda42006-08-03 16:48:06 -07001572 if (doi_def == NULL) {
1573 err_offset = 2;
1574 goto validate_return_locked;
1575 }
1576
1577 opt_iter = 6;
1578 tag = opt + opt_iter;
1579 while (opt_iter < opt_len) {
1580 for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1581 if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1582 ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1583 err_offset = opt_iter;
1584 goto validate_return_locked;
1585 }
1586
1587 tag_len = tag[1];
1588 if (tag_len > (opt_len - opt_iter)) {
1589 err_offset = opt_iter + 1;
1590 goto validate_return_locked;
1591 }
1592
1593 switch (tag[0]) {
1594 case CIPSO_V4_TAG_RBITMAP:
1595 if (tag_len < 4) {
1596 err_offset = opt_iter + 1;
1597 goto validate_return_locked;
1598 }
1599
1600 /* We are already going to do all the verification
1601 * necessary at the socket layer so from our point of
1602 * view it is safe to turn these checks off (and less
1603 * work), however, the CIPSO draft says we should do
1604 * all the CIPSO validations here but it doesn't
1605 * really specify _exactly_ what we need to validate
1606 * ... so, just make it a sysctl tunable. */
1607 if (cipso_v4_rbm_strictvalid) {
1608 if (cipso_v4_map_lvl_valid(doi_def,
1609 tag[3]) < 0) {
1610 err_offset = opt_iter + 3;
1611 goto validate_return_locked;
1612 }
1613 if (tag_len > 4 &&
1614 cipso_v4_map_cat_rbm_valid(doi_def,
1615 &tag[4],
1616 tag_len - 4) < 0) {
1617 err_offset = opt_iter + 4;
1618 goto validate_return_locked;
1619 }
1620 }
1621 break;
Paul Moore654bbc22006-11-29 13:18:19 -05001622 case CIPSO_V4_TAG_ENUM:
1623 if (tag_len < 4) {
1624 err_offset = opt_iter + 1;
1625 goto validate_return_locked;
1626 }
1627
1628 if (cipso_v4_map_lvl_valid(doi_def,
1629 tag[3]) < 0) {
1630 err_offset = opt_iter + 3;
1631 goto validate_return_locked;
1632 }
1633 if (tag_len > 4 &&
1634 cipso_v4_map_cat_enum_valid(doi_def,
1635 &tag[4],
1636 tag_len - 4) < 0) {
1637 err_offset = opt_iter + 4;
1638 goto validate_return_locked;
1639 }
1640 break;
Paul Moore484b3662006-11-29 13:18:20 -05001641 case CIPSO_V4_TAG_RANGE:
1642 if (tag_len < 4) {
1643 err_offset = opt_iter + 1;
1644 goto validate_return_locked;
1645 }
1646
1647 if (cipso_v4_map_lvl_valid(doi_def,
1648 tag[3]) < 0) {
1649 err_offset = opt_iter + 3;
1650 goto validate_return_locked;
1651 }
1652 if (tag_len > 4 &&
1653 cipso_v4_map_cat_rng_valid(doi_def,
1654 &tag[4],
1655 tag_len - 4) < 0) {
1656 err_offset = opt_iter + 4;
1657 goto validate_return_locked;
1658 }
1659 break;
Paul Moore446fda42006-08-03 16:48:06 -07001660 default:
1661 err_offset = opt_iter;
1662 goto validate_return_locked;
1663 }
1664
1665 tag += tag_len;
1666 opt_iter += tag_len;
1667 }
1668
1669validate_return_locked:
1670 rcu_read_unlock();
1671validate_return:
1672 *option = opt + err_offset;
1673 return err_offset;
1674}
1675
1676/**
1677 * cipso_v4_error - Send the correct reponse for a bad packet
1678 * @skb: the packet
1679 * @error: the error code
1680 * @gateway: CIPSO gateway flag
1681 *
1682 * Description:
1683 * Based on the error code given in @error, send an ICMP error message back to
1684 * the originating host. From the IETF draft ...
1685 *
1686 * "If the contents of the CIPSO [option] are valid but the security label is
1687 * outside of the configured host or port label range, the datagram is
1688 * discarded and an ICMP 'destination unreachable' (type 3) is generated and
1689 * returned. The code field of the ICMP is set to 'communication with
1690 * destination network administratively prohibited' (code 9) or to
1691 * 'communication with destination host administratively prohibited'
1692 * (code 10). The value of the code is dependent on whether the originator
1693 * of the ICMP message is acting as a CIPSO host or a CIPSO gateway. The
1694 * recipient of the ICMP message MUST be able to handle either value. The
1695 * same procedure is performed if a CIPSO [option] can not be added to an
1696 * IP packet because it is too large to fit in the IP options area."
1697 *
1698 * "If the error is triggered by receipt of an ICMP message, the message is
1699 * discarded and no response is permitted (consistent with general ICMP
1700 * processing rules)."
1701 *
1702 */
1703void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1704{
Arnaldo Carvalho de Meloeddc9ec2007-04-20 22:47:35 -07001705 if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
Paul Moore446fda42006-08-03 16:48:06 -07001706 return;
1707
1708 if (gateway)
1709 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
1710 else
1711 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
1712}
1713
1714/**
Paul Mooreba6ff9f2007-06-07 18:37:15 -07001715 * cipso_v4_sock_setattr - Add a CIPSO option to a socket
1716 * @sk: the socket
Paul Moore446fda42006-08-03 16:48:06 -07001717 * @doi_def: the CIPSO DOI to use
1718 * @secattr: the specific security attributes of the socket
1719 *
1720 * Description:
1721 * Set the CIPSO option on the given socket using the DOI definition and
1722 * security attributes passed to the function. This function requires
Paul Mooreba6ff9f2007-06-07 18:37:15 -07001723 * exclusive access to @sk, which means it either needs to be in the
1724 * process of being created or locked. Returns zero on success and negative
1725 * values on failure.
Paul Moore446fda42006-08-03 16:48:06 -07001726 *
1727 */
Paul Mooreba6ff9f2007-06-07 18:37:15 -07001728int cipso_v4_sock_setattr(struct sock *sk,
1729 const struct cipso_v4_doi *doi_def,
1730 const struct netlbl_lsm_secattr *secattr)
Paul Moore446fda42006-08-03 16:48:06 -07001731{
1732 int ret_val = -EPERM;
1733 u32 iter;
Paul Moore91b1ed02006-11-17 17:38:49 -05001734 unsigned char *buf;
Paul Moore446fda42006-08-03 16:48:06 -07001735 u32 buf_len = 0;
1736 u32 opt_len;
1737 struct ip_options *opt = NULL;
Paul Moore446fda42006-08-03 16:48:06 -07001738 struct inet_sock *sk_inet;
1739 struct inet_connection_sock *sk_conn;
1740
1741 /* In the case of sock_create_lite(), the sock->sk field is not
1742 * defined yet but it is not a problem as the only users of these
1743 * "lite" PF_INET sockets are functions which do an accept() call
1744 * afterwards so we will label the socket as part of the accept(). */
Paul Moore446fda42006-08-03 16:48:06 -07001745 if (sk == NULL)
1746 return 0;
1747
Paul Moore91b1ed02006-11-17 17:38:49 -05001748 /* We allocate the maximum CIPSO option size here so we are probably
1749 * being a little wasteful, but it makes our life _much_ easier later
1750 * on and after all we are only talking about 40 bytes. */
1751 buf_len = CIPSO_V4_OPT_LEN_MAX;
1752 buf = kmalloc(buf_len, GFP_ATOMIC);
1753 if (buf == NULL) {
1754 ret_val = -ENOMEM;
1755 goto socket_setattr_failure;
1756 }
1757
Paul Moore446fda42006-08-03 16:48:06 -07001758 /* XXX - This code assumes only one tag per CIPSO option which isn't
1759 * really a good assumption to make but since we only support the MAC
1760 * tags right now it is a safe assumption. */
1761 iter = 0;
1762 do {
Paul Moore91b1ed02006-11-17 17:38:49 -05001763 memset(buf, 0, buf_len);
Paul Moore446fda42006-08-03 16:48:06 -07001764 switch (doi_def->tags[iter]) {
1765 case CIPSO_V4_TAG_RBITMAP:
1766 ret_val = cipso_v4_gentag_rbm(doi_def,
Paul Moore91b1ed02006-11-17 17:38:49 -05001767 secattr,
1768 &buf[CIPSO_V4_HDR_LEN],
1769 buf_len - CIPSO_V4_HDR_LEN);
Paul Moore446fda42006-08-03 16:48:06 -07001770 break;
Paul Moore654bbc22006-11-29 13:18:19 -05001771 case CIPSO_V4_TAG_ENUM:
1772 ret_val = cipso_v4_gentag_enum(doi_def,
1773 secattr,
1774 &buf[CIPSO_V4_HDR_LEN],
1775 buf_len - CIPSO_V4_HDR_LEN);
1776 break;
Paul Moore484b3662006-11-29 13:18:20 -05001777 case CIPSO_V4_TAG_RANGE:
1778 ret_val = cipso_v4_gentag_rng(doi_def,
1779 secattr,
1780 &buf[CIPSO_V4_HDR_LEN],
1781 buf_len - CIPSO_V4_HDR_LEN);
1782 break;
Paul Moore446fda42006-08-03 16:48:06 -07001783 default:
1784 ret_val = -EPERM;
1785 goto socket_setattr_failure;
1786 }
1787
1788 iter++;
Paul Moore91b1ed02006-11-17 17:38:49 -05001789 } while (ret_val < 0 &&
Paul Moore446fda42006-08-03 16:48:06 -07001790 iter < CIPSO_V4_TAG_MAXCNT &&
1791 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
Paul Moore91b1ed02006-11-17 17:38:49 -05001792 if (ret_val < 0)
Paul Moore446fda42006-08-03 16:48:06 -07001793 goto socket_setattr_failure;
Paul Moore91b1ed02006-11-17 17:38:49 -05001794 cipso_v4_gentag_hdr(doi_def, buf, ret_val);
1795 buf_len = CIPSO_V4_HDR_LEN + ret_val;
Paul Moore446fda42006-08-03 16:48:06 -07001796
1797 /* We can't use ip_options_get() directly because it makes a call to
1798 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
Paul Mooref8687af2006-10-30 15:22:15 -08001799 * we won't always have CAP_NET_RAW even though we _always_ want to
1800 * set the IPOPT_CIPSO option. */
Paul Moore446fda42006-08-03 16:48:06 -07001801 opt_len = (buf_len + 3) & ~3;
1802 opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1803 if (opt == NULL) {
1804 ret_val = -ENOMEM;
1805 goto socket_setattr_failure;
1806 }
1807 memcpy(opt->__data, buf, buf_len);
1808 opt->optlen = opt_len;
1809 opt->is_data = 1;
Paul Mooref8687af2006-10-30 15:22:15 -08001810 opt->cipso = sizeof(struct iphdr);
Paul Moore446fda42006-08-03 16:48:06 -07001811 kfree(buf);
1812 buf = NULL;
Paul Moore446fda42006-08-03 16:48:06 -07001813
1814 sk_inet = inet_sk(sk);
1815 if (sk_inet->is_icsk) {
1816 sk_conn = inet_csk(sk);
1817 if (sk_inet->opt)
1818 sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen;
1819 sk_conn->icsk_ext_hdr_len += opt->optlen;
1820 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1821 }
1822 opt = xchg(&sk_inet->opt, opt);
1823 kfree(opt);
1824
1825 return 0;
1826
1827socket_setattr_failure:
1828 kfree(buf);
1829 kfree(opt);
1830 return ret_val;
1831}
1832
1833/**
Paul Moore14a72f52006-09-25 15:52:01 -07001834 * cipso_v4_sock_getattr - Get the security attributes from a sock
1835 * @sk: the sock
1836 * @secattr: the security attributes
1837 *
1838 * Description:
1839 * Query @sk to see if there is a CIPSO option attached to the sock and if
1840 * there is return the CIPSO security attributes in @secattr. This function
1841 * requires that @sk be locked, or privately held, but it does not do any
1842 * locking itself. Returns zero on success and negative values on failure.
1843 *
1844 */
1845int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
1846{
1847 int ret_val = -ENOMSG;
1848 struct inet_sock *sk_inet;
1849 unsigned char *cipso_ptr;
1850 u32 doi;
1851 struct cipso_v4_doi *doi_def;
1852
1853 sk_inet = inet_sk(sk);
1854 if (sk_inet->opt == NULL || sk_inet->opt->cipso == 0)
1855 return -ENOMSG;
1856 cipso_ptr = sk_inet->opt->__data + sk_inet->opt->cipso -
1857 sizeof(struct iphdr);
1858 ret_val = cipso_v4_cache_check(cipso_ptr, cipso_ptr[1], secattr);
1859 if (ret_val == 0)
1860 return ret_val;
1861
Paul Moore50e5d352007-06-07 18:38:14 -07001862 doi = ntohl(get_unaligned((__be32 *)&cipso_ptr[2]));
Paul Moore14a72f52006-09-25 15:52:01 -07001863 rcu_read_lock();
Paul Moore9bb5fd22006-11-17 17:38:52 -05001864 doi_def = cipso_v4_doi_search(doi);
Paul Moore14a72f52006-09-25 15:52:01 -07001865 if (doi_def == NULL) {
1866 rcu_read_unlock();
1867 return -ENOMSG;
1868 }
Paul Moore91b1ed02006-11-17 17:38:49 -05001869
1870 /* XXX - This code assumes only one tag per CIPSO option which isn't
1871 * really a good assumption to make but since we only support the MAC
1872 * tags right now it is a safe assumption. */
Paul Moore14a72f52006-09-25 15:52:01 -07001873 switch (cipso_ptr[6]) {
1874 case CIPSO_V4_TAG_RBITMAP:
1875 ret_val = cipso_v4_parsetag_rbm(doi_def,
1876 &cipso_ptr[6],
1877 secattr);
1878 break;
Paul Moore654bbc22006-11-29 13:18:19 -05001879 case CIPSO_V4_TAG_ENUM:
1880 ret_val = cipso_v4_parsetag_enum(doi_def,
1881 &cipso_ptr[6],
1882 secattr);
1883 break;
Paul Moore484b3662006-11-29 13:18:20 -05001884 case CIPSO_V4_TAG_RANGE:
1885 ret_val = cipso_v4_parsetag_rng(doi_def,
1886 &cipso_ptr[6],
1887 secattr);
1888 break;
Paul Moore14a72f52006-09-25 15:52:01 -07001889 }
1890 rcu_read_unlock();
1891
1892 return ret_val;
1893}
1894
1895/**
Paul Moore446fda42006-08-03 16:48:06 -07001896 * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
1897 * @skb: the packet
1898 * @secattr: the security attributes
1899 *
1900 * Description:
1901 * Parse the given packet's CIPSO option and return the security attributes.
1902 * Returns zero on success and negative values on failure.
1903 *
1904 */
1905int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
1906 struct netlbl_lsm_secattr *secattr)
1907{
1908 int ret_val = -ENOMSG;
1909 unsigned char *cipso_ptr;
1910 u32 doi;
1911 struct cipso_v4_doi *doi_def;
1912
Paul Moore446fda42006-08-03 16:48:06 -07001913 cipso_ptr = CIPSO_V4_OPTPTR(skb);
1914 if (cipso_v4_cache_check(cipso_ptr, cipso_ptr[1], secattr) == 0)
1915 return 0;
1916
Paul Moore50e5d352007-06-07 18:38:14 -07001917 doi = ntohl(get_unaligned((__be32 *)&cipso_ptr[2]));
Paul Moore446fda42006-08-03 16:48:06 -07001918 rcu_read_lock();
Paul Moore9bb5fd22006-11-17 17:38:52 -05001919 doi_def = cipso_v4_doi_search(doi);
Paul Moore446fda42006-08-03 16:48:06 -07001920 if (doi_def == NULL)
1921 goto skbuff_getattr_return;
Paul Moore91b1ed02006-11-17 17:38:49 -05001922
1923 /* XXX - This code assumes only one tag per CIPSO option which isn't
1924 * really a good assumption to make but since we only support the MAC
1925 * tags right now it is a safe assumption. */
Paul Moore446fda42006-08-03 16:48:06 -07001926 switch (cipso_ptr[6]) {
1927 case CIPSO_V4_TAG_RBITMAP:
1928 ret_val = cipso_v4_parsetag_rbm(doi_def,
1929 &cipso_ptr[6],
1930 secattr);
1931 break;
Paul Moore654bbc22006-11-29 13:18:19 -05001932 case CIPSO_V4_TAG_ENUM:
1933 ret_val = cipso_v4_parsetag_enum(doi_def,
1934 &cipso_ptr[6],
1935 secattr);
1936 break;
Paul Moore38c89472007-03-12 14:38:02 -07001937 case CIPSO_V4_TAG_RANGE:
1938 ret_val = cipso_v4_parsetag_rng(doi_def,
1939 &cipso_ptr[6],
1940 secattr);
1941 break;
Paul Moore446fda42006-08-03 16:48:06 -07001942 }
1943
1944skbuff_getattr_return:
1945 rcu_read_unlock();
1946 return ret_val;
1947}
1948
1949/*
1950 * Setup Functions
1951 */
1952
1953/**
1954 * cipso_v4_init - Initialize the CIPSO module
1955 *
1956 * Description:
1957 * Initialize the CIPSO module and prepare it for use. Returns zero on success
1958 * and negative values on failure.
1959 *
1960 */
1961static int __init cipso_v4_init(void)
1962{
1963 int ret_val;
1964
1965 ret_val = cipso_v4_cache_init();
1966 if (ret_val != 0)
1967 panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
1968 ret_val);
1969
1970 return 0;
1971}
1972
1973subsys_initcall(cipso_v4_init);