Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * NetLabel Unlabeled Support
0004  *
0005  * This file defines functions for dealing with unlabeled packets for the
0006  * NetLabel system.  The NetLabel system manages static and dynamic label
0007  * mappings for network protocols such as CIPSO and RIPSO.
0008  *
0009  * Author: Paul Moore <paul@paul-moore.com>
0010  */
0011 
0012 /*
0013  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
0014  */
0015 
0016 #include <linux/types.h>
0017 #include <linux/rcupdate.h>
0018 #include <linux/list.h>
0019 #include <linux/spinlock.h>
0020 #include <linux/socket.h>
0021 #include <linux/string.h>
0022 #include <linux/skbuff.h>
0023 #include <linux/audit.h>
0024 #include <linux/in.h>
0025 #include <linux/in6.h>
0026 #include <linux/ip.h>
0027 #include <linux/ipv6.h>
0028 #include <linux/notifier.h>
0029 #include <linux/netdevice.h>
0030 #include <linux/security.h>
0031 #include <linux/slab.h>
0032 #include <net/sock.h>
0033 #include <net/netlink.h>
0034 #include <net/genetlink.h>
0035 #include <net/ip.h>
0036 #include <net/ipv6.h>
0037 #include <net/net_namespace.h>
0038 #include <net/netlabel.h>
0039 #include <asm/bug.h>
0040 #include <linux/atomic.h>
0041 
0042 #include "netlabel_user.h"
0043 #include "netlabel_addrlist.h"
0044 #include "netlabel_domainhash.h"
0045 #include "netlabel_unlabeled.h"
0046 #include "netlabel_mgmt.h"
0047 
0048 /* NOTE: at present we always use init's network namespace since we don't
0049  *       presently support different namespaces even though the majority of
0050  *       the functions in this file are "namespace safe" */
0051 
0052 /* The unlabeled connection hash table which we use to map network interfaces
0053  * and addresses of unlabeled packets to a user specified secid value for the
0054  * LSM.  The hash table is used to lookup the network interface entry
0055  * (struct netlbl_unlhsh_iface) and then the interface entry is used to
0056  * lookup an IP address match from an ordered list.  If a network interface
0057  * match can not be found in the hash table then the default entry
0058  * (netlbl_unlhsh_def) is used.  The IP address entry list
0059  * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
0060  * larger netmask come first.
0061  */
0062 struct netlbl_unlhsh_tbl {
0063     struct list_head *tbl;
0064     u32 size;
0065 };
0066 #define netlbl_unlhsh_addr4_entry(iter) \
0067     container_of(iter, struct netlbl_unlhsh_addr4, list)
0068 struct netlbl_unlhsh_addr4 {
0069     u32 secid;
0070 
0071     struct netlbl_af4list list;
0072     struct rcu_head rcu;
0073 };
0074 #define netlbl_unlhsh_addr6_entry(iter) \
0075     container_of(iter, struct netlbl_unlhsh_addr6, list)
0076 struct netlbl_unlhsh_addr6 {
0077     u32 secid;
0078 
0079     struct netlbl_af6list list;
0080     struct rcu_head rcu;
0081 };
0082 struct netlbl_unlhsh_iface {
0083     int ifindex;
0084     struct list_head addr4_list;
0085     struct list_head addr6_list;
0086 
0087     u32 valid;
0088     struct list_head list;
0089     struct rcu_head rcu;
0090 };
0091 
0092 /* Argument struct for netlbl_unlhsh_walk() */
0093 struct netlbl_unlhsh_walk_arg {
0094     struct netlink_callback *nl_cb;
0095     struct sk_buff *skb;
0096     u32 seq;
0097 };
0098 
0099 /* Unlabeled connection hash table */
0100 /* updates should be so rare that having one spinlock for the entire
0101  * hash table should be okay */
0102 static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
0103 #define netlbl_unlhsh_rcu_deref(p) \
0104     rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
0105 static struct netlbl_unlhsh_tbl __rcu *netlbl_unlhsh;
0106 static struct netlbl_unlhsh_iface __rcu *netlbl_unlhsh_def;
0107 
0108 /* Accept unlabeled packets flag */
0109 static u8 netlabel_unlabel_acceptflg;
0110 
0111 /* NetLabel Generic NETLINK unlabeled family */
0112 static struct genl_family netlbl_unlabel_gnl_family;
0113 
0114 /* NetLabel Netlink attribute policy */
0115 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
0116     [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
0117     [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
0118                       .len = sizeof(struct in6_addr) },
0119     [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
0120                       .len = sizeof(struct in6_addr) },
0121     [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
0122                       .len = sizeof(struct in_addr) },
0123     [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
0124                       .len = sizeof(struct in_addr) },
0125     [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
0126                    .len = IFNAMSIZ - 1 },
0127     [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
0128 };
0129 
0130 /*
0131  * Unlabeled Connection Hash Table Functions
0132  */
0133 
0134 /**
0135  * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
0136  * @entry: the entry's RCU field
0137  *
0138  * Description:
0139  * This function is designed to be used as a callback to the call_rcu()
0140  * function so that memory allocated to a hash table interface entry can be
0141  * released safely.  It is important to note that this function does not free
0142  * the IPv4 and IPv6 address lists contained as part of an interface entry.  It
0143  * is up to the rest of the code to make sure an interface entry is only freed
0144  * once it's address lists are empty.
0145  *
0146  */
0147 static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
0148 {
0149     struct netlbl_unlhsh_iface *iface;
0150     struct netlbl_af4list *iter4;
0151     struct netlbl_af4list *tmp4;
0152 #if IS_ENABLED(CONFIG_IPV6)
0153     struct netlbl_af6list *iter6;
0154     struct netlbl_af6list *tmp6;
0155 #endif /* IPv6 */
0156 
0157     iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
0158 
0159     /* no need for locks here since we are the only one with access to this
0160      * structure */
0161 
0162     netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
0163         netlbl_af4list_remove_entry(iter4);
0164         kfree(netlbl_unlhsh_addr4_entry(iter4));
0165     }
0166 #if IS_ENABLED(CONFIG_IPV6)
0167     netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
0168         netlbl_af6list_remove_entry(iter6);
0169         kfree(netlbl_unlhsh_addr6_entry(iter6));
0170     }
0171 #endif /* IPv6 */
0172     kfree(iface);
0173 }
0174 
0175 /**
0176  * netlbl_unlhsh_hash - Hashing function for the hash table
0177  * @ifindex: the network interface/device to hash
0178  *
0179  * Description:
0180  * This is the hashing function for the unlabeled hash table, it returns the
0181  * bucket number for the given device/interface.  The caller is responsible for
0182  * ensuring that the hash table is protected with either a RCU read lock or
0183  * the hash table lock.
0184  *
0185  */
0186 static u32 netlbl_unlhsh_hash(int ifindex)
0187 {
0188     return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
0189 }
0190 
0191 /**
0192  * netlbl_unlhsh_search_iface - Search for a matching interface entry
0193  * @ifindex: the network interface
0194  *
0195  * Description:
0196  * Searches the unlabeled connection hash table and returns a pointer to the
0197  * interface entry which matches @ifindex, otherwise NULL is returned.  The
0198  * caller is responsible for ensuring that the hash table is protected with
0199  * either a RCU read lock or the hash table lock.
0200  *
0201  */
0202 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
0203 {
0204     u32 bkt;
0205     struct list_head *bkt_list;
0206     struct netlbl_unlhsh_iface *iter;
0207 
0208     bkt = netlbl_unlhsh_hash(ifindex);
0209     bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
0210     list_for_each_entry_rcu(iter, bkt_list, list,
0211                 lockdep_is_held(&netlbl_unlhsh_lock))
0212         if (iter->valid && iter->ifindex == ifindex)
0213             return iter;
0214 
0215     return NULL;
0216 }
0217 
0218 /**
0219  * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
0220  * @iface: the associated interface entry
0221  * @addr: IPv4 address in network byte order
0222  * @mask: IPv4 address mask in network byte order
0223  * @secid: LSM secid value for entry
0224  *
0225  * Description:
0226  * Add a new address entry into the unlabeled connection hash table using the
0227  * interface entry specified by @iface.  On success zero is returned, otherwise
0228  * a negative value is returned.
0229  *
0230  */
0231 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
0232                    const struct in_addr *addr,
0233                    const struct in_addr *mask,
0234                    u32 secid)
0235 {
0236     int ret_val;
0237     struct netlbl_unlhsh_addr4 *entry;
0238 
0239     entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
0240     if (entry == NULL)
0241         return -ENOMEM;
0242 
0243     entry->list.addr = addr->s_addr & mask->s_addr;
0244     entry->list.mask = mask->s_addr;
0245     entry->list.valid = 1;
0246     entry->secid = secid;
0247 
0248     spin_lock(&netlbl_unlhsh_lock);
0249     ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
0250     spin_unlock(&netlbl_unlhsh_lock);
0251 
0252     if (ret_val != 0)
0253         kfree(entry);
0254     return ret_val;
0255 }
0256 
0257 #if IS_ENABLED(CONFIG_IPV6)
0258 /**
0259  * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
0260  * @iface: the associated interface entry
0261  * @addr: IPv6 address in network byte order
0262  * @mask: IPv6 address mask in network byte order
0263  * @secid: LSM secid value for entry
0264  *
0265  * Description:
0266  * Add a new address entry into the unlabeled connection hash table using the
0267  * interface entry specified by @iface.  On success zero is returned, otherwise
0268  * a negative value is returned.
0269  *
0270  */
0271 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
0272                    const struct in6_addr *addr,
0273                    const struct in6_addr *mask,
0274                    u32 secid)
0275 {
0276     int ret_val;
0277     struct netlbl_unlhsh_addr6 *entry;
0278 
0279     entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
0280     if (entry == NULL)
0281         return -ENOMEM;
0282 
0283     entry->list.addr = *addr;
0284     entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
0285     entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
0286     entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
0287     entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
0288     entry->list.mask = *mask;
0289     entry->list.valid = 1;
0290     entry->secid = secid;
0291 
0292     spin_lock(&netlbl_unlhsh_lock);
0293     ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
0294     spin_unlock(&netlbl_unlhsh_lock);
0295 
0296     if (ret_val != 0)
0297         kfree(entry);
0298     return 0;
0299 }
0300 #endif /* IPv6 */
0301 
0302 /**
0303  * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
0304  * @ifindex: network interface
0305  *
0306  * Description:
0307  * Add a new, empty, interface entry into the unlabeled connection hash table.
0308  * On success a pointer to the new interface entry is returned, on failure NULL
0309  * is returned.
0310  *
0311  */
0312 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
0313 {
0314     u32 bkt;
0315     struct netlbl_unlhsh_iface *iface;
0316 
0317     iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
0318     if (iface == NULL)
0319         return NULL;
0320 
0321     iface->ifindex = ifindex;
0322     INIT_LIST_HEAD(&iface->addr4_list);
0323     INIT_LIST_HEAD(&iface->addr6_list);
0324     iface->valid = 1;
0325 
0326     spin_lock(&netlbl_unlhsh_lock);
0327     if (ifindex > 0) {
0328         bkt = netlbl_unlhsh_hash(ifindex);
0329         if (netlbl_unlhsh_search_iface(ifindex) != NULL)
0330             goto add_iface_failure;
0331         list_add_tail_rcu(&iface->list,
0332                  &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
0333     } else {
0334         INIT_LIST_HEAD(&iface->list);
0335         if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
0336             goto add_iface_failure;
0337         rcu_assign_pointer(netlbl_unlhsh_def, iface);
0338     }
0339     spin_unlock(&netlbl_unlhsh_lock);
0340 
0341     return iface;
0342 
0343 add_iface_failure:
0344     spin_unlock(&netlbl_unlhsh_lock);
0345     kfree(iface);
0346     return NULL;
0347 }
0348 
0349 /**
0350  * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
0351  * @net: network namespace
0352  * @dev_name: interface name
0353  * @addr: IP address in network byte order
0354  * @mask: address mask in network byte order
0355  * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
0356  * @secid: LSM secid value for the entry
0357  * @audit_info: NetLabel audit information
0358  *
0359  * Description:
0360  * Adds a new entry to the unlabeled connection hash table.  Returns zero on
0361  * success, negative values on failure.
0362  *
0363  */
0364 int netlbl_unlhsh_add(struct net *net,
0365               const char *dev_name,
0366               const void *addr,
0367               const void *mask,
0368               u32 addr_len,
0369               u32 secid,
0370               struct netlbl_audit *audit_info)
0371 {
0372     int ret_val;
0373     int ifindex;
0374     struct net_device *dev;
0375     struct netlbl_unlhsh_iface *iface;
0376     struct audit_buffer *audit_buf = NULL;
0377     char *secctx = NULL;
0378     u32 secctx_len;
0379 
0380     if (addr_len != sizeof(struct in_addr) &&
0381         addr_len != sizeof(struct in6_addr))
0382         return -EINVAL;
0383 
0384     rcu_read_lock();
0385     if (dev_name != NULL) {
0386         dev = dev_get_by_name_rcu(net, dev_name);
0387         if (dev == NULL) {
0388             ret_val = -ENODEV;
0389             goto unlhsh_add_return;
0390         }
0391         ifindex = dev->ifindex;
0392         iface = netlbl_unlhsh_search_iface(ifindex);
0393     } else {
0394         ifindex = 0;
0395         iface = rcu_dereference(netlbl_unlhsh_def);
0396     }
0397     if (iface == NULL) {
0398         iface = netlbl_unlhsh_add_iface(ifindex);
0399         if (iface == NULL) {
0400             ret_val = -ENOMEM;
0401             goto unlhsh_add_return;
0402         }
0403     }
0404     audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
0405                           audit_info);
0406     switch (addr_len) {
0407     case sizeof(struct in_addr): {
0408         const struct in_addr *addr4 = addr;
0409         const struct in_addr *mask4 = mask;
0410 
0411         ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
0412         if (audit_buf != NULL)
0413             netlbl_af4list_audit_addr(audit_buf, 1,
0414                           dev_name,
0415                           addr4->s_addr,
0416                           mask4->s_addr);
0417         break;
0418     }
0419 #if IS_ENABLED(CONFIG_IPV6)
0420     case sizeof(struct in6_addr): {
0421         const struct in6_addr *addr6 = addr;
0422         const struct in6_addr *mask6 = mask;
0423 
0424         ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
0425         if (audit_buf != NULL)
0426             netlbl_af6list_audit_addr(audit_buf, 1,
0427                           dev_name,
0428                           addr6, mask6);
0429         break;
0430     }
0431 #endif /* IPv6 */
0432     default:
0433         ret_val = -EINVAL;
0434     }
0435     if (ret_val == 0)
0436         atomic_inc(&netlabel_mgmt_protocount);
0437 
0438 unlhsh_add_return:
0439     rcu_read_unlock();
0440     if (audit_buf != NULL) {
0441         if (security_secid_to_secctx(secid,
0442                          &secctx,
0443                          &secctx_len) == 0) {
0444             audit_log_format(audit_buf, " sec_obj=%s", secctx);
0445             security_release_secctx(secctx, secctx_len);
0446         }
0447         audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
0448         audit_log_end(audit_buf);
0449     }
0450     return ret_val;
0451 }
0452 
0453 /**
0454  * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
0455  * @net: network namespace
0456  * @iface: interface entry
0457  * @addr: IP address
0458  * @mask: IP address mask
0459  * @audit_info: NetLabel audit information
0460  *
0461  * Description:
0462  * Remove an IP address entry from the unlabeled connection hash table.
0463  * Returns zero on success, negative values on failure.
0464  *
0465  */
0466 static int netlbl_unlhsh_remove_addr4(struct net *net,
0467                       struct netlbl_unlhsh_iface *iface,
0468                       const struct in_addr *addr,
0469                       const struct in_addr *mask,
0470                       struct netlbl_audit *audit_info)
0471 {
0472     struct netlbl_af4list *list_entry;
0473     struct netlbl_unlhsh_addr4 *entry;
0474     struct audit_buffer *audit_buf;
0475     struct net_device *dev;
0476     char *secctx;
0477     u32 secctx_len;
0478 
0479     spin_lock(&netlbl_unlhsh_lock);
0480     list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
0481                        &iface->addr4_list);
0482     spin_unlock(&netlbl_unlhsh_lock);
0483     if (list_entry != NULL)
0484         entry = netlbl_unlhsh_addr4_entry(list_entry);
0485     else
0486         entry = NULL;
0487 
0488     audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
0489                           audit_info);
0490     if (audit_buf != NULL) {
0491         dev = dev_get_by_index(net, iface->ifindex);
0492         netlbl_af4list_audit_addr(audit_buf, 1,
0493                       (dev != NULL ? dev->name : NULL),
0494                       addr->s_addr, mask->s_addr);
0495         dev_put(dev);
0496         if (entry != NULL &&
0497             security_secid_to_secctx(entry->secid,
0498                          &secctx, &secctx_len) == 0) {
0499             audit_log_format(audit_buf, " sec_obj=%s", secctx);
0500             security_release_secctx(secctx, secctx_len);
0501         }
0502         audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
0503         audit_log_end(audit_buf);
0504     }
0505 
0506     if (entry == NULL)
0507         return -ENOENT;
0508 
0509     kfree_rcu(entry, rcu);
0510     return 0;
0511 }
0512 
0513 #if IS_ENABLED(CONFIG_IPV6)
0514 /**
0515  * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
0516  * @net: network namespace
0517  * @iface: interface entry
0518  * @addr: IP address
0519  * @mask: IP address mask
0520  * @audit_info: NetLabel audit information
0521  *
0522  * Description:
0523  * Remove an IP address entry from the unlabeled connection hash table.
0524  * Returns zero on success, negative values on failure.
0525  *
0526  */
0527 static int netlbl_unlhsh_remove_addr6(struct net *net,
0528                       struct netlbl_unlhsh_iface *iface,
0529                       const struct in6_addr *addr,
0530                       const struct in6_addr *mask,
0531                       struct netlbl_audit *audit_info)
0532 {
0533     struct netlbl_af6list *list_entry;
0534     struct netlbl_unlhsh_addr6 *entry;
0535     struct audit_buffer *audit_buf;
0536     struct net_device *dev;
0537     char *secctx;
0538     u32 secctx_len;
0539 
0540     spin_lock(&netlbl_unlhsh_lock);
0541     list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
0542     spin_unlock(&netlbl_unlhsh_lock);
0543     if (list_entry != NULL)
0544         entry = netlbl_unlhsh_addr6_entry(list_entry);
0545     else
0546         entry = NULL;
0547 
0548     audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
0549                           audit_info);
0550     if (audit_buf != NULL) {
0551         dev = dev_get_by_index(net, iface->ifindex);
0552         netlbl_af6list_audit_addr(audit_buf, 1,
0553                       (dev != NULL ? dev->name : NULL),
0554                       addr, mask);
0555         dev_put(dev);
0556         if (entry != NULL &&
0557             security_secid_to_secctx(entry->secid,
0558                          &secctx, &secctx_len) == 0) {
0559             audit_log_format(audit_buf, " sec_obj=%s", secctx);
0560             security_release_secctx(secctx, secctx_len);
0561         }
0562         audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
0563         audit_log_end(audit_buf);
0564     }
0565 
0566     if (entry == NULL)
0567         return -ENOENT;
0568 
0569     kfree_rcu(entry, rcu);
0570     return 0;
0571 }
0572 #endif /* IPv6 */
0573 
0574 /**
0575  * netlbl_unlhsh_condremove_iface - Remove an interface entry
0576  * @iface: the interface entry
0577  *
0578  * Description:
0579  * Remove an interface entry from the unlabeled connection hash table if it is
0580  * empty.  An interface entry is considered to be empty if there are no
0581  * address entries assigned to it.
0582  *
0583  */
0584 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
0585 {
0586     struct netlbl_af4list *iter4;
0587 #if IS_ENABLED(CONFIG_IPV6)
0588     struct netlbl_af6list *iter6;
0589 #endif /* IPv6 */
0590 
0591     spin_lock(&netlbl_unlhsh_lock);
0592     netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
0593         goto unlhsh_condremove_failure;
0594 #if IS_ENABLED(CONFIG_IPV6)
0595     netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
0596         goto unlhsh_condremove_failure;
0597 #endif /* IPv6 */
0598     iface->valid = 0;
0599     if (iface->ifindex > 0)
0600         list_del_rcu(&iface->list);
0601     else
0602         RCU_INIT_POINTER(netlbl_unlhsh_def, NULL);
0603     spin_unlock(&netlbl_unlhsh_lock);
0604 
0605     call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
0606     return;
0607 
0608 unlhsh_condremove_failure:
0609     spin_unlock(&netlbl_unlhsh_lock);
0610 }
0611 
0612 /**
0613  * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
0614  * @net: network namespace
0615  * @dev_name: interface name
0616  * @addr: IP address in network byte order
0617  * @mask: address mask in network byte order
0618  * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
0619  * @audit_info: NetLabel audit information
0620  *
0621  * Description:
0622  * Removes and existing entry from the unlabeled connection hash table.
0623  * Returns zero on success, negative values on failure.
0624  *
0625  */
0626 int netlbl_unlhsh_remove(struct net *net,
0627              const char *dev_name,
0628              const void *addr,
0629              const void *mask,
0630              u32 addr_len,
0631              struct netlbl_audit *audit_info)
0632 {
0633     int ret_val;
0634     struct net_device *dev;
0635     struct netlbl_unlhsh_iface *iface;
0636 
0637     if (addr_len != sizeof(struct in_addr) &&
0638         addr_len != sizeof(struct in6_addr))
0639         return -EINVAL;
0640 
0641     rcu_read_lock();
0642     if (dev_name != NULL) {
0643         dev = dev_get_by_name_rcu(net, dev_name);
0644         if (dev == NULL) {
0645             ret_val = -ENODEV;
0646             goto unlhsh_remove_return;
0647         }
0648         iface = netlbl_unlhsh_search_iface(dev->ifindex);
0649     } else
0650         iface = rcu_dereference(netlbl_unlhsh_def);
0651     if (iface == NULL) {
0652         ret_val = -ENOENT;
0653         goto unlhsh_remove_return;
0654     }
0655     switch (addr_len) {
0656     case sizeof(struct in_addr):
0657         ret_val = netlbl_unlhsh_remove_addr4(net,
0658                              iface, addr, mask,
0659                              audit_info);
0660         break;
0661 #if IS_ENABLED(CONFIG_IPV6)
0662     case sizeof(struct in6_addr):
0663         ret_val = netlbl_unlhsh_remove_addr6(net,
0664                              iface, addr, mask,
0665                              audit_info);
0666         break;
0667 #endif /* IPv6 */
0668     default:
0669         ret_val = -EINVAL;
0670     }
0671     if (ret_val == 0) {
0672         netlbl_unlhsh_condremove_iface(iface);
0673         atomic_dec(&netlabel_mgmt_protocount);
0674     }
0675 
0676 unlhsh_remove_return:
0677     rcu_read_unlock();
0678     return ret_val;
0679 }
0680 
0681 /*
0682  * General Helper Functions
0683  */
0684 
0685 /**
0686  * netlbl_unlhsh_netdev_handler - Network device notification handler
0687  * @this: notifier block
0688  * @event: the event
0689  * @ptr: the netdevice notifier info (cast to void)
0690  *
0691  * Description:
0692  * Handle network device events, although at present all we care about is a
0693  * network device going away.  In the case of a device going away we clear any
0694  * related entries from the unlabeled connection hash table.
0695  *
0696  */
0697 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
0698                     unsigned long event, void *ptr)
0699 {
0700     struct net_device *dev = netdev_notifier_info_to_dev(ptr);
0701     struct netlbl_unlhsh_iface *iface = NULL;
0702 
0703     if (!net_eq(dev_net(dev), &init_net))
0704         return NOTIFY_DONE;
0705 
0706     /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
0707     if (event == NETDEV_DOWN) {
0708         spin_lock(&netlbl_unlhsh_lock);
0709         iface = netlbl_unlhsh_search_iface(dev->ifindex);
0710         if (iface != NULL && iface->valid) {
0711             iface->valid = 0;
0712             list_del_rcu(&iface->list);
0713         } else
0714             iface = NULL;
0715         spin_unlock(&netlbl_unlhsh_lock);
0716     }
0717 
0718     if (iface != NULL)
0719         call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
0720 
0721     return NOTIFY_DONE;
0722 }
0723 
0724 /**
0725  * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
0726  * @value: desired value
0727  * @audit_info: NetLabel audit information
0728  *
0729  * Description:
0730  * Set the value of the unlabeled accept flag to @value.
0731  *
0732  */
0733 static void netlbl_unlabel_acceptflg_set(u8 value,
0734                      struct netlbl_audit *audit_info)
0735 {
0736     struct audit_buffer *audit_buf;
0737     u8 old_val;
0738 
0739     old_val = netlabel_unlabel_acceptflg;
0740     netlabel_unlabel_acceptflg = value;
0741     audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
0742                           audit_info);
0743     if (audit_buf != NULL) {
0744         audit_log_format(audit_buf,
0745                  " unlbl_accept=%u old=%u", value, old_val);
0746         audit_log_end(audit_buf);
0747     }
0748 }
0749 
0750 /**
0751  * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
0752  * @info: the Generic NETLINK info block
0753  * @addr: the IP address
0754  * @mask: the IP address mask
0755  * @len: the address length
0756  *
0757  * Description:
0758  * Examine the Generic NETLINK message and extract the IP address information.
0759  * Returns zero on success, negative values on failure.
0760  *
0761  */
0762 static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
0763                        void **addr,
0764                        void **mask,
0765                        u32 *len)
0766 {
0767     u32 addr_len;
0768 
0769     if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] &&
0770         info->attrs[NLBL_UNLABEL_A_IPV4MASK]) {
0771         addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
0772         if (addr_len != sizeof(struct in_addr) &&
0773             addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
0774             return -EINVAL;
0775         *len = addr_len;
0776         *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
0777         *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
0778         return 0;
0779     } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
0780         addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
0781         if (addr_len != sizeof(struct in6_addr) &&
0782             addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
0783             return -EINVAL;
0784         *len = addr_len;
0785         *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
0786         *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
0787         return 0;
0788     }
0789 
0790     return -EINVAL;
0791 }
0792 
0793 /*
0794  * NetLabel Command Handlers
0795  */
0796 
0797 /**
0798  * netlbl_unlabel_accept - Handle an ACCEPT message
0799  * @skb: the NETLINK buffer
0800  * @info: the Generic NETLINK info block
0801  *
0802  * Description:
0803  * Process a user generated ACCEPT message and set the accept flag accordingly.
0804  * Returns zero on success, negative values on failure.
0805  *
0806  */
0807 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
0808 {
0809     u8 value;
0810     struct netlbl_audit audit_info;
0811 
0812     if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
0813         value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
0814         if (value == 1 || value == 0) {
0815             netlbl_netlink_auditinfo(&audit_info);
0816             netlbl_unlabel_acceptflg_set(value, &audit_info);
0817             return 0;
0818         }
0819     }
0820 
0821     return -EINVAL;
0822 }
0823 
0824 /**
0825  * netlbl_unlabel_list - Handle a LIST message
0826  * @skb: the NETLINK buffer
0827  * @info: the Generic NETLINK info block
0828  *
0829  * Description:
0830  * Process a user generated LIST message and respond with the current status.
0831  * Returns zero on success, negative values on failure.
0832  *
0833  */
0834 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
0835 {
0836     int ret_val = -EINVAL;
0837     struct sk_buff *ans_skb;
0838     void *data;
0839 
0840     ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
0841     if (ans_skb == NULL)
0842         goto list_failure;
0843     data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
0844                  0, NLBL_UNLABEL_C_LIST);
0845     if (data == NULL) {
0846         ret_val = -ENOMEM;
0847         goto list_failure;
0848     }
0849 
0850     ret_val = nla_put_u8(ans_skb,
0851                  NLBL_UNLABEL_A_ACPTFLG,
0852                  netlabel_unlabel_acceptflg);
0853     if (ret_val != 0)
0854         goto list_failure;
0855 
0856     genlmsg_end(ans_skb, data);
0857     return genlmsg_reply(ans_skb, info);
0858 
0859 list_failure:
0860     kfree_skb(ans_skb);
0861     return ret_val;
0862 }
0863 
0864 /**
0865  * netlbl_unlabel_staticadd - Handle a STATICADD message
0866  * @skb: the NETLINK buffer
0867  * @info: the Generic NETLINK info block
0868  *
0869  * Description:
0870  * Process a user generated STATICADD message and add a new unlabeled
0871  * connection entry to the hash table.  Returns zero on success, negative
0872  * values on failure.
0873  *
0874  */
0875 static int netlbl_unlabel_staticadd(struct sk_buff *skb,
0876                     struct genl_info *info)
0877 {
0878     int ret_val;
0879     char *dev_name;
0880     void *addr;
0881     void *mask;
0882     u32 addr_len;
0883     u32 secid;
0884     struct netlbl_audit audit_info;
0885 
0886     /* Don't allow users to add both IPv4 and IPv6 addresses for a
0887      * single entry.  However, allow users to create two entries, one each
0888      * for IPv4 and IPv6, with the same LSM security context which should
0889      * achieve the same result. */
0890     if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
0891         !info->attrs[NLBL_UNLABEL_A_IFACE] ||
0892         !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
0893            !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
0894           (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
0895            !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
0896         return -EINVAL;
0897 
0898     netlbl_netlink_auditinfo(&audit_info);
0899 
0900     ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
0901     if (ret_val != 0)
0902         return ret_val;
0903     dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
0904     ret_val = security_secctx_to_secid(
0905                           nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
0906                   nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
0907                   &secid);
0908     if (ret_val != 0)
0909         return ret_val;
0910 
0911     return netlbl_unlhsh_add(&init_net,
0912                  dev_name, addr, mask, addr_len, secid,
0913                  &audit_info);
0914 }
0915 
0916 /**
0917  * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
0918  * @skb: the NETLINK buffer
0919  * @info: the Generic NETLINK info block
0920  *
0921  * Description:
0922  * Process a user generated STATICADDDEF message and add a new default
0923  * unlabeled connection entry.  Returns zero on success, negative values on
0924  * failure.
0925  *
0926  */
0927 static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
0928                        struct genl_info *info)
0929 {
0930     int ret_val;
0931     void *addr;
0932     void *mask;
0933     u32 addr_len;
0934     u32 secid;
0935     struct netlbl_audit audit_info;
0936 
0937     /* Don't allow users to add both IPv4 and IPv6 addresses for a
0938      * single entry.  However, allow users to create two entries, one each
0939      * for IPv4 and IPv6, with the same LSM security context which should
0940      * achieve the same result. */
0941     if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
0942         !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
0943            !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
0944           (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
0945            !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
0946         return -EINVAL;
0947 
0948     netlbl_netlink_auditinfo(&audit_info);
0949 
0950     ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
0951     if (ret_val != 0)
0952         return ret_val;
0953     ret_val = security_secctx_to_secid(
0954                           nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
0955                   nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
0956                   &secid);
0957     if (ret_val != 0)
0958         return ret_val;
0959 
0960     return netlbl_unlhsh_add(&init_net,
0961                  NULL, addr, mask, addr_len, secid,
0962                  &audit_info);
0963 }
0964 
0965 /**
0966  * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
0967  * @skb: the NETLINK buffer
0968  * @info: the Generic NETLINK info block
0969  *
0970  * Description:
0971  * Process a user generated STATICREMOVE message and remove the specified
0972  * unlabeled connection entry.  Returns zero on success, negative values on
0973  * failure.
0974  *
0975  */
0976 static int netlbl_unlabel_staticremove(struct sk_buff *skb,
0977                        struct genl_info *info)
0978 {
0979     int ret_val;
0980     char *dev_name;
0981     void *addr;
0982     void *mask;
0983     u32 addr_len;
0984     struct netlbl_audit audit_info;
0985 
0986     /* See the note in netlbl_unlabel_staticadd() about not allowing both
0987      * IPv4 and IPv6 in the same entry. */
0988     if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
0989         !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
0990            !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
0991           (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
0992            !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
0993         return -EINVAL;
0994 
0995     netlbl_netlink_auditinfo(&audit_info);
0996 
0997     ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
0998     if (ret_val != 0)
0999         return ret_val;
1000     dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
1001 
1002     return netlbl_unlhsh_remove(&init_net,
1003                     dev_name, addr, mask, addr_len,
1004                     &audit_info);
1005 }
1006 
1007 /**
1008  * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1009  * @skb: the NETLINK buffer
1010  * @info: the Generic NETLINK info block
1011  *
1012  * Description:
1013  * Process a user generated STATICREMOVEDEF message and remove the default
1014  * unlabeled connection entry.  Returns zero on success, negative values on
1015  * failure.
1016  *
1017  */
1018 static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
1019                       struct genl_info *info)
1020 {
1021     int ret_val;
1022     void *addr;
1023     void *mask;
1024     u32 addr_len;
1025     struct netlbl_audit audit_info;
1026 
1027     /* See the note in netlbl_unlabel_staticadd() about not allowing both
1028      * IPv4 and IPv6 in the same entry. */
1029     if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1030            !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1031           (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1032            !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1033         return -EINVAL;
1034 
1035     netlbl_netlink_auditinfo(&audit_info);
1036 
1037     ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1038     if (ret_val != 0)
1039         return ret_val;
1040 
1041     return netlbl_unlhsh_remove(&init_net,
1042                     NULL, addr, mask, addr_len,
1043                     &audit_info);
1044 }
1045 
1046 
1047 /**
1048  * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1049  * @cmd: command/message
1050  * @iface: the interface entry
1051  * @addr4: the IPv4 address entry
1052  * @addr6: the IPv6 address entry
1053  * @arg: the netlbl_unlhsh_walk_arg structure
1054  *
1055  * Description:
1056  * This function is designed to be used to generate a response for a
1057  * STATICLIST or STATICLISTDEF message.  When called either @addr4 or @addr6
1058  * can be specified, not both, the other unspecified entry should be set to
1059  * NULL by the caller.  Returns the size of the message on success, negative
1060  * values on failure.
1061  *
1062  */
1063 static int netlbl_unlabel_staticlist_gen(u32 cmd,
1064                        const struct netlbl_unlhsh_iface *iface,
1065                        const struct netlbl_unlhsh_addr4 *addr4,
1066                        const struct netlbl_unlhsh_addr6 *addr6,
1067                        void *arg)
1068 {
1069     int ret_val = -ENOMEM;
1070     struct netlbl_unlhsh_walk_arg *cb_arg = arg;
1071     struct net_device *dev;
1072     void *data;
1073     u32 secid;
1074     char *secctx;
1075     u32 secctx_len;
1076 
1077     data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
1078                cb_arg->seq, &netlbl_unlabel_gnl_family,
1079                NLM_F_MULTI, cmd);
1080     if (data == NULL)
1081         goto list_cb_failure;
1082 
1083     if (iface->ifindex > 0) {
1084         dev = dev_get_by_index(&init_net, iface->ifindex);
1085         if (!dev) {
1086             ret_val = -ENODEV;
1087             goto list_cb_failure;
1088         }
1089         ret_val = nla_put_string(cb_arg->skb,
1090                      NLBL_UNLABEL_A_IFACE, dev->name);
1091         dev_put(dev);
1092         if (ret_val != 0)
1093             goto list_cb_failure;
1094     }
1095 
1096     if (addr4) {
1097         struct in_addr addr_struct;
1098 
1099         addr_struct.s_addr = addr4->list.addr;
1100         ret_val = nla_put_in_addr(cb_arg->skb,
1101                       NLBL_UNLABEL_A_IPV4ADDR,
1102                       addr_struct.s_addr);
1103         if (ret_val != 0)
1104             goto list_cb_failure;
1105 
1106         addr_struct.s_addr = addr4->list.mask;
1107         ret_val = nla_put_in_addr(cb_arg->skb,
1108                       NLBL_UNLABEL_A_IPV4MASK,
1109                       addr_struct.s_addr);
1110         if (ret_val != 0)
1111             goto list_cb_failure;
1112 
1113         secid = addr4->secid;
1114     } else {
1115         ret_val = nla_put_in6_addr(cb_arg->skb,
1116                        NLBL_UNLABEL_A_IPV6ADDR,
1117                        &addr6->list.addr);
1118         if (ret_val != 0)
1119             goto list_cb_failure;
1120 
1121         ret_val = nla_put_in6_addr(cb_arg->skb,
1122                        NLBL_UNLABEL_A_IPV6MASK,
1123                        &addr6->list.mask);
1124         if (ret_val != 0)
1125             goto list_cb_failure;
1126 
1127         secid = addr6->secid;
1128     }
1129 
1130     ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
1131     if (ret_val != 0)
1132         goto list_cb_failure;
1133     ret_val = nla_put(cb_arg->skb,
1134               NLBL_UNLABEL_A_SECCTX,
1135               secctx_len,
1136               secctx);
1137     security_release_secctx(secctx, secctx_len);
1138     if (ret_val != 0)
1139         goto list_cb_failure;
1140 
1141     cb_arg->seq++;
1142     genlmsg_end(cb_arg->skb, data);
1143     return 0;
1144 
1145 list_cb_failure:
1146     genlmsg_cancel(cb_arg->skb, data);
1147     return ret_val;
1148 }
1149 
1150 /**
1151  * netlbl_unlabel_staticlist - Handle a STATICLIST message
1152  * @skb: the NETLINK buffer
1153  * @cb: the NETLINK callback
1154  *
1155  * Description:
1156  * Process a user generated STATICLIST message and dump the unlabeled
1157  * connection hash table in a form suitable for use in a kernel generated
1158  * STATICLIST message.  Returns the length of @skb.
1159  *
1160  */
1161 static int netlbl_unlabel_staticlist(struct sk_buff *skb,
1162                      struct netlink_callback *cb)
1163 {
1164     struct netlbl_unlhsh_walk_arg cb_arg;
1165     u32 skip_bkt = cb->args[0];
1166     u32 skip_chain = cb->args[1];
1167     u32 skip_addr4 = cb->args[2];
1168     u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
1169     struct netlbl_unlhsh_iface *iface;
1170     struct list_head *iter_list;
1171     struct netlbl_af4list *addr4;
1172 #if IS_ENABLED(CONFIG_IPV6)
1173     u32 skip_addr6 = cb->args[3];
1174     struct netlbl_af6list *addr6;
1175 #endif
1176 
1177     cb_arg.nl_cb = cb;
1178     cb_arg.skb = skb;
1179     cb_arg.seq = cb->nlh->nlmsg_seq;
1180 
1181     rcu_read_lock();
1182     for (iter_bkt = skip_bkt;
1183          iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
1184          iter_bkt++) {
1185         iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
1186         list_for_each_entry_rcu(iface, iter_list, list) {
1187             if (!iface->valid ||
1188                 iter_chain++ < skip_chain)
1189                 continue;
1190             netlbl_af4list_foreach_rcu(addr4,
1191                            &iface->addr4_list) {
1192                 if (iter_addr4++ < skip_addr4)
1193                     continue;
1194                 if (netlbl_unlabel_staticlist_gen(
1195                           NLBL_UNLABEL_C_STATICLIST,
1196                           iface,
1197                           netlbl_unlhsh_addr4_entry(addr4),
1198                           NULL,
1199                           &cb_arg) < 0) {
1200                     iter_addr4--;
1201                     iter_chain--;
1202                     goto unlabel_staticlist_return;
1203                 }
1204             }
1205             iter_addr4 = 0;
1206             skip_addr4 = 0;
1207 #if IS_ENABLED(CONFIG_IPV6)
1208             netlbl_af6list_foreach_rcu(addr6,
1209                            &iface->addr6_list) {
1210                 if (iter_addr6++ < skip_addr6)
1211                     continue;
1212                 if (netlbl_unlabel_staticlist_gen(
1213                           NLBL_UNLABEL_C_STATICLIST,
1214                           iface,
1215                           NULL,
1216                           netlbl_unlhsh_addr6_entry(addr6),
1217                           &cb_arg) < 0) {
1218                     iter_addr6--;
1219                     iter_chain--;
1220                     goto unlabel_staticlist_return;
1221                 }
1222             }
1223             iter_addr6 = 0;
1224             skip_addr6 = 0;
1225 #endif /* IPv6 */
1226         }
1227         iter_chain = 0;
1228         skip_chain = 0;
1229     }
1230 
1231 unlabel_staticlist_return:
1232     rcu_read_unlock();
1233     cb->args[0] = iter_bkt;
1234     cb->args[1] = iter_chain;
1235     cb->args[2] = iter_addr4;
1236     cb->args[3] = iter_addr6;
1237     return skb->len;
1238 }
1239 
1240 /**
1241  * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1242  * @skb: the NETLINK buffer
1243  * @cb: the NETLINK callback
1244  *
1245  * Description:
1246  * Process a user generated STATICLISTDEF message and dump the default
1247  * unlabeled connection entry in a form suitable for use in a kernel generated
1248  * STATICLISTDEF message.  Returns the length of @skb.
1249  *
1250  */
1251 static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
1252                     struct netlink_callback *cb)
1253 {
1254     struct netlbl_unlhsh_walk_arg cb_arg;
1255     struct netlbl_unlhsh_iface *iface;
1256     u32 iter_addr4 = 0, iter_addr6 = 0;
1257     struct netlbl_af4list *addr4;
1258 #if IS_ENABLED(CONFIG_IPV6)
1259     struct netlbl_af6list *addr6;
1260 #endif
1261 
1262     cb_arg.nl_cb = cb;
1263     cb_arg.skb = skb;
1264     cb_arg.seq = cb->nlh->nlmsg_seq;
1265 
1266     rcu_read_lock();
1267     iface = rcu_dereference(netlbl_unlhsh_def);
1268     if (iface == NULL || !iface->valid)
1269         goto unlabel_staticlistdef_return;
1270 
1271     netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
1272         if (iter_addr4++ < cb->args[0])
1273             continue;
1274         if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1275                           iface,
1276                           netlbl_unlhsh_addr4_entry(addr4),
1277                           NULL,
1278                           &cb_arg) < 0) {
1279             iter_addr4--;
1280             goto unlabel_staticlistdef_return;
1281         }
1282     }
1283 #if IS_ENABLED(CONFIG_IPV6)
1284     netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
1285         if (iter_addr6++ < cb->args[1])
1286             continue;
1287         if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1288                           iface,
1289                           NULL,
1290                           netlbl_unlhsh_addr6_entry(addr6),
1291                           &cb_arg) < 0) {
1292             iter_addr6--;
1293             goto unlabel_staticlistdef_return;
1294         }
1295     }
1296 #endif /* IPv6 */
1297 
1298 unlabel_staticlistdef_return:
1299     rcu_read_unlock();
1300     cb->args[0] = iter_addr4;
1301     cb->args[1] = iter_addr6;
1302     return skb->len;
1303 }
1304 
1305 /*
1306  * NetLabel Generic NETLINK Command Definitions
1307  */
1308 
1309 static const struct genl_small_ops netlbl_unlabel_genl_ops[] = {
1310     {
1311     .cmd = NLBL_UNLABEL_C_STATICADD,
1312     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1313     .flags = GENL_ADMIN_PERM,
1314     .doit = netlbl_unlabel_staticadd,
1315     .dumpit = NULL,
1316     },
1317     {
1318     .cmd = NLBL_UNLABEL_C_STATICREMOVE,
1319     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1320     .flags = GENL_ADMIN_PERM,
1321     .doit = netlbl_unlabel_staticremove,
1322     .dumpit = NULL,
1323     },
1324     {
1325     .cmd = NLBL_UNLABEL_C_STATICLIST,
1326     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1327     .flags = 0,
1328     .doit = NULL,
1329     .dumpit = netlbl_unlabel_staticlist,
1330     },
1331     {
1332     .cmd = NLBL_UNLABEL_C_STATICADDDEF,
1333     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1334     .flags = GENL_ADMIN_PERM,
1335     .doit = netlbl_unlabel_staticadddef,
1336     .dumpit = NULL,
1337     },
1338     {
1339     .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
1340     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1341     .flags = GENL_ADMIN_PERM,
1342     .doit = netlbl_unlabel_staticremovedef,
1343     .dumpit = NULL,
1344     },
1345     {
1346     .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
1347     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1348     .flags = 0,
1349     .doit = NULL,
1350     .dumpit = netlbl_unlabel_staticlistdef,
1351     },
1352     {
1353     .cmd = NLBL_UNLABEL_C_ACCEPT,
1354     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1355     .flags = GENL_ADMIN_PERM,
1356     .doit = netlbl_unlabel_accept,
1357     .dumpit = NULL,
1358     },
1359     {
1360     .cmd = NLBL_UNLABEL_C_LIST,
1361     .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1362     .flags = 0,
1363     .doit = netlbl_unlabel_list,
1364     .dumpit = NULL,
1365     },
1366 };
1367 
1368 static struct genl_family netlbl_unlabel_gnl_family __ro_after_init = {
1369     .hdrsize = 0,
1370     .name = NETLBL_NLTYPE_UNLABELED_NAME,
1371     .version = NETLBL_PROTO_VERSION,
1372     .maxattr = NLBL_UNLABEL_A_MAX,
1373     .policy = netlbl_unlabel_genl_policy,
1374     .module = THIS_MODULE,
1375     .small_ops = netlbl_unlabel_genl_ops,
1376     .n_small_ops = ARRAY_SIZE(netlbl_unlabel_genl_ops),
1377 };
1378 
1379 /*
1380  * NetLabel Generic NETLINK Protocol Functions
1381  */
1382 
1383 /**
1384  * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1385  *
1386  * Description:
1387  * Register the unlabeled packet NetLabel component with the Generic NETLINK
1388  * mechanism.  Returns zero on success, negative values on failure.
1389  *
1390  */
1391 int __init netlbl_unlabel_genl_init(void)
1392 {
1393     return genl_register_family(&netlbl_unlabel_gnl_family);
1394 }
1395 
1396 /*
1397  * NetLabel KAPI Hooks
1398  */
1399 
1400 static struct notifier_block netlbl_unlhsh_netdev_notifier = {
1401     .notifier_call = netlbl_unlhsh_netdev_handler,
1402 };
1403 
1404 /**
1405  * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1406  * @size: the number of bits to use for the hash buckets
1407  *
1408  * Description:
1409  * Initializes the unlabeled connection hash table and registers a network
1410  * device notification handler.  This function should only be called by the
1411  * NetLabel subsystem itself during initialization.  Returns zero on success,
1412  * non-zero values on error.
1413  *
1414  */
1415 int __init netlbl_unlabel_init(u32 size)
1416 {
1417     u32 iter;
1418     struct netlbl_unlhsh_tbl *hsh_tbl;
1419 
1420     if (size == 0)
1421         return -EINVAL;
1422 
1423     hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
1424     if (hsh_tbl == NULL)
1425         return -ENOMEM;
1426     hsh_tbl->size = 1 << size;
1427     hsh_tbl->tbl = kcalloc(hsh_tbl->size,
1428                    sizeof(struct list_head),
1429                    GFP_KERNEL);
1430     if (hsh_tbl->tbl == NULL) {
1431         kfree(hsh_tbl);
1432         return -ENOMEM;
1433     }
1434     for (iter = 0; iter < hsh_tbl->size; iter++)
1435         INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
1436 
1437     spin_lock(&netlbl_unlhsh_lock);
1438     rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
1439     spin_unlock(&netlbl_unlhsh_lock);
1440 
1441     register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
1442 
1443     return 0;
1444 }
1445 
1446 /**
1447  * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1448  * @skb: the packet
1449  * @family: protocol family
1450  * @secattr: the security attributes
1451  *
1452  * Description:
1453  * Determine the security attributes, if any, for an unlabled packet and return
1454  * them in @secattr.  Returns zero on success and negative values on failure.
1455  *
1456  */
1457 int netlbl_unlabel_getattr(const struct sk_buff *skb,
1458                u16 family,
1459                struct netlbl_lsm_secattr *secattr)
1460 {
1461     struct netlbl_unlhsh_iface *iface;
1462 
1463     rcu_read_lock();
1464     iface = netlbl_unlhsh_search_iface(skb->skb_iif);
1465     if (iface == NULL)
1466         iface = rcu_dereference(netlbl_unlhsh_def);
1467     if (iface == NULL || !iface->valid)
1468         goto unlabel_getattr_nolabel;
1469 
1470 #if IS_ENABLED(CONFIG_IPV6)
1471     /* When resolving a fallback label, check the sk_buff version as
1472      * it is possible (e.g. SCTP) to have family = PF_INET6 while
1473      * receiving ip_hdr(skb)->version = 4.
1474      */
1475     if (family == PF_INET6 && ip_hdr(skb)->version == 4)
1476         family = PF_INET;
1477 #endif /* IPv6 */
1478 
1479     switch (family) {
1480     case PF_INET: {
1481         struct iphdr *hdr4;
1482         struct netlbl_af4list *addr4;
1483 
1484         hdr4 = ip_hdr(skb);
1485         addr4 = netlbl_af4list_search(hdr4->saddr,
1486                           &iface->addr4_list);
1487         if (addr4 == NULL)
1488             goto unlabel_getattr_nolabel;
1489         secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
1490         break;
1491     }
1492 #if IS_ENABLED(CONFIG_IPV6)
1493     case PF_INET6: {
1494         struct ipv6hdr *hdr6;
1495         struct netlbl_af6list *addr6;
1496 
1497         hdr6 = ipv6_hdr(skb);
1498         addr6 = netlbl_af6list_search(&hdr6->saddr,
1499                           &iface->addr6_list);
1500         if (addr6 == NULL)
1501             goto unlabel_getattr_nolabel;
1502         secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
1503         break;
1504     }
1505 #endif /* IPv6 */
1506     default:
1507         goto unlabel_getattr_nolabel;
1508     }
1509     rcu_read_unlock();
1510 
1511     secattr->flags |= NETLBL_SECATTR_SECID;
1512     secattr->type = NETLBL_NLTYPE_UNLABELED;
1513     return 0;
1514 
1515 unlabel_getattr_nolabel:
1516     rcu_read_unlock();
1517     if (netlabel_unlabel_acceptflg == 0)
1518         return -ENOMSG;
1519     secattr->type = NETLBL_NLTYPE_UNLABELED;
1520     return 0;
1521 }
1522 
1523 /**
1524  * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1525  *
1526  * Description:
1527  * Set the default NetLabel configuration to allow incoming unlabeled packets
1528  * and to send unlabeled network traffic by default.
1529  *
1530  */
1531 int __init netlbl_unlabel_defconf(void)
1532 {
1533     int ret_val;
1534     struct netlbl_dom_map *entry;
1535     struct netlbl_audit audit_info;
1536 
1537     /* Only the kernel is allowed to call this function and the only time
1538      * it is called is at bootup before the audit subsystem is reporting
1539      * messages so don't worry to much about these values. */
1540     security_current_getsecid_subj(&audit_info.secid);
1541     audit_info.loginuid = GLOBAL_ROOT_UID;
1542     audit_info.sessionid = 0;
1543 
1544     entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1545     if (entry == NULL)
1546         return -ENOMEM;
1547     entry->family = AF_UNSPEC;
1548     entry->def.type = NETLBL_NLTYPE_UNLABELED;
1549     ret_val = netlbl_domhsh_add_default(entry, &audit_info);
1550     if (ret_val != 0)
1551         return ret_val;
1552 
1553     netlbl_unlabel_acceptflg_set(1, &audit_info);
1554 
1555     return 0;
1556 }
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!