netlabel_unlabeled.c 42 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554
  1. /*
  2. * NetLabel Unlabeled Support
  3. *
  4. * This file defines functions for dealing with unlabeled packets for the
  5. * NetLabel system. The NetLabel system manages static and dynamic label
  6. * mappings for network protocols such as CIPSO and RIPSO.
  7. *
  8. * Author: Paul Moore <paul@paul-moore.com>
  9. *
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
  13. *
  14. * This program is free software; you can redistribute it and/or modify
  15. * it under the terms of the GNU General Public License as published by
  16. * the Free Software Foundation; either version 2 of the License, or
  17. * (at your option) any later version.
  18. *
  19. * This program is distributed in the hope that it will be useful,
  20. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
  22. * the GNU General Public License for more details.
  23. *
  24. * You should have received a copy of the GNU General Public License
  25. * along with this program; if not, write to the Free Software
  26. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  27. *
  28. */
  29. #include <linux/types.h>
  30. #include <linux/rcupdate.h>
  31. #include <linux/list.h>
  32. #include <linux/spinlock.h>
  33. #include <linux/socket.h>
  34. #include <linux/string.h>
  35. #include <linux/skbuff.h>
  36. #include <linux/audit.h>
  37. #include <linux/in.h>
  38. #include <linux/in6.h>
  39. #include <linux/ip.h>
  40. #include <linux/ipv6.h>
  41. #include <linux/notifier.h>
  42. #include <linux/netdevice.h>
  43. #include <linux/security.h>
  44. #include <linux/slab.h>
  45. #include <net/sock.h>
  46. #include <net/netlink.h>
  47. #include <net/genetlink.h>
  48. #include <net/ip.h>
  49. #include <net/ipv6.h>
  50. #include <net/net_namespace.h>
  51. #include <net/netlabel.h>
  52. #include <asm/bug.h>
  53. #include <linux/atomic.h>
  54. #include "netlabel_user.h"
  55. #include "netlabel_addrlist.h"
  56. #include "netlabel_domainhash.h"
  57. #include "netlabel_unlabeled.h"
  58. #include "netlabel_mgmt.h"
  59. /* NOTE: at present we always use init's network namespace since we don't
  60. * presently support different namespaces even though the majority of
  61. * the functions in this file are "namespace safe" */
  62. /* The unlabeled connection hash table which we use to map network interfaces
  63. * and addresses of unlabeled packets to a user specified secid value for the
  64. * LSM. The hash table is used to lookup the network interface entry
  65. * (struct netlbl_unlhsh_iface) and then the interface entry is used to
  66. * lookup an IP address match from an ordered list. If a network interface
  67. * match can not be found in the hash table then the default entry
  68. * (netlbl_unlhsh_def) is used. The IP address entry list
  69. * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
  70. * larger netmask come first.
  71. */
  72. struct netlbl_unlhsh_tbl {
  73. struct list_head *tbl;
  74. u32 size;
  75. };
  76. #define netlbl_unlhsh_addr4_entry(iter) \
  77. container_of(iter, struct netlbl_unlhsh_addr4, list)
  78. struct netlbl_unlhsh_addr4 {
  79. u32 secid;
  80. struct netlbl_af4list list;
  81. struct rcu_head rcu;
  82. };
  83. #define netlbl_unlhsh_addr6_entry(iter) \
  84. container_of(iter, struct netlbl_unlhsh_addr6, list)
  85. struct netlbl_unlhsh_addr6 {
  86. u32 secid;
  87. struct netlbl_af6list list;
  88. struct rcu_head rcu;
  89. };
  90. struct netlbl_unlhsh_iface {
  91. int ifindex;
  92. struct list_head addr4_list;
  93. struct list_head addr6_list;
  94. u32 valid;
  95. struct list_head list;
  96. struct rcu_head rcu;
  97. };
  98. /* Argument struct for netlbl_unlhsh_walk() */
  99. struct netlbl_unlhsh_walk_arg {
  100. struct netlink_callback *nl_cb;
  101. struct sk_buff *skb;
  102. u32 seq;
  103. };
  104. /* Unlabeled connection hash table */
  105. /* updates should be so rare that having one spinlock for the entire
  106. * hash table should be okay */
  107. static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
  108. #define netlbl_unlhsh_rcu_deref(p) \
  109. rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
  110. static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL;
  111. static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL;
  112. /* Accept unlabeled packets flag */
  113. static u8 netlabel_unlabel_acceptflg = 0;
  114. /* NetLabel Generic NETLINK unlabeled family */
  115. static struct genl_family netlbl_unlabel_gnl_family = {
  116. .id = GENL_ID_GENERATE,
  117. .hdrsize = 0,
  118. .name = NETLBL_NLTYPE_UNLABELED_NAME,
  119. .version = NETLBL_PROTO_VERSION,
  120. .maxattr = NLBL_UNLABEL_A_MAX,
  121. };
  122. /* NetLabel Netlink attribute policy */
  123. static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
  124. [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
  125. [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
  126. .len = sizeof(struct in6_addr) },
  127. [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
  128. .len = sizeof(struct in6_addr) },
  129. [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
  130. .len = sizeof(struct in_addr) },
  131. [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
  132. .len = sizeof(struct in_addr) },
  133. [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
  134. .len = IFNAMSIZ - 1 },
  135. [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
  136. };
  137. /*
  138. * Unlabeled Connection Hash Table Functions
  139. */
  140. /**
  141. * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
  142. * @entry: the entry's RCU field
  143. *
  144. * Description:
  145. * This function is designed to be used as a callback to the call_rcu()
  146. * function so that memory allocated to a hash table interface entry can be
  147. * released safely. It is important to note that this function does not free
  148. * the IPv4 and IPv6 address lists contained as part of an interface entry. It
  149. * is up to the rest of the code to make sure an interface entry is only freed
  150. * once it's address lists are empty.
  151. *
  152. */
  153. static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
  154. {
  155. struct netlbl_unlhsh_iface *iface;
  156. struct netlbl_af4list *iter4;
  157. struct netlbl_af4list *tmp4;
  158. #if IS_ENABLED(CONFIG_IPV6)
  159. struct netlbl_af6list *iter6;
  160. struct netlbl_af6list *tmp6;
  161. #endif /* IPv6 */
  162. iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
  163. /* no need for locks here since we are the only one with access to this
  164. * structure */
  165. netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
  166. netlbl_af4list_remove_entry(iter4);
  167. kfree(netlbl_unlhsh_addr4_entry(iter4));
  168. }
  169. #if IS_ENABLED(CONFIG_IPV6)
  170. netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
  171. netlbl_af6list_remove_entry(iter6);
  172. kfree(netlbl_unlhsh_addr6_entry(iter6));
  173. }
  174. #endif /* IPv6 */
  175. kfree(iface);
  176. }
  177. /**
  178. * netlbl_unlhsh_hash - Hashing function for the hash table
  179. * @ifindex: the network interface/device to hash
  180. *
  181. * Description:
  182. * This is the hashing function for the unlabeled hash table, it returns the
  183. * bucket number for the given device/interface. The caller is responsible for
  184. * ensuring that the hash table is protected with either a RCU read lock or
  185. * the hash table lock.
  186. *
  187. */
  188. static u32 netlbl_unlhsh_hash(int ifindex)
  189. {
  190. return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
  191. }
  192. /**
  193. * netlbl_unlhsh_search_iface - Search for a matching interface entry
  194. * @ifindex: the network interface
  195. *
  196. * Description:
  197. * Searches the unlabeled connection hash table and returns a pointer to the
  198. * interface entry which matches @ifindex, otherwise NULL is returned. The
  199. * caller is responsible for ensuring that the hash table is protected with
  200. * either a RCU read lock or the hash table lock.
  201. *
  202. */
  203. static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
  204. {
  205. u32 bkt;
  206. struct list_head *bkt_list;
  207. struct netlbl_unlhsh_iface *iter;
  208. bkt = netlbl_unlhsh_hash(ifindex);
  209. bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
  210. list_for_each_entry_rcu(iter, bkt_list, list)
  211. if (iter->valid && iter->ifindex == ifindex)
  212. return iter;
  213. return NULL;
  214. }
  215. /**
  216. * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
  217. * @iface: the associated interface entry
  218. * @addr: IPv4 address in network byte order
  219. * @mask: IPv4 address mask in network byte order
  220. * @secid: LSM secid value for entry
  221. *
  222. * Description:
  223. * Add a new address entry into the unlabeled connection hash table using the
  224. * interface entry specified by @iface. On success zero is returned, otherwise
  225. * a negative value is returned.
  226. *
  227. */
  228. static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
  229. const struct in_addr *addr,
  230. const struct in_addr *mask,
  231. u32 secid)
  232. {
  233. int ret_val;
  234. struct netlbl_unlhsh_addr4 *entry;
  235. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  236. if (entry == NULL)
  237. return -ENOMEM;
  238. entry->list.addr = addr->s_addr & mask->s_addr;
  239. entry->list.mask = mask->s_addr;
  240. entry->list.valid = 1;
  241. entry->secid = secid;
  242. spin_lock(&netlbl_unlhsh_lock);
  243. ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
  244. spin_unlock(&netlbl_unlhsh_lock);
  245. if (ret_val != 0)
  246. kfree(entry);
  247. return ret_val;
  248. }
  249. #if IS_ENABLED(CONFIG_IPV6)
  250. /**
  251. * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
  252. * @iface: the associated interface entry
  253. * @addr: IPv6 address in network byte order
  254. * @mask: IPv6 address mask in network byte order
  255. * @secid: LSM secid value for entry
  256. *
  257. * Description:
  258. * Add a new address entry into the unlabeled connection hash table using the
  259. * interface entry specified by @iface. On success zero is returned, otherwise
  260. * a negative value is returned.
  261. *
  262. */
  263. static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
  264. const struct in6_addr *addr,
  265. const struct in6_addr *mask,
  266. u32 secid)
  267. {
  268. int ret_val;
  269. struct netlbl_unlhsh_addr6 *entry;
  270. entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  271. if (entry == NULL)
  272. return -ENOMEM;
  273. entry->list.addr = *addr;
  274. entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
  275. entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
  276. entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
  277. entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
  278. entry->list.mask = *mask;
  279. entry->list.valid = 1;
  280. entry->secid = secid;
  281. spin_lock(&netlbl_unlhsh_lock);
  282. ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
  283. spin_unlock(&netlbl_unlhsh_lock);
  284. if (ret_val != 0)
  285. kfree(entry);
  286. return 0;
  287. }
  288. #endif /* IPv6 */
  289. /**
  290. * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
  291. * @ifindex: network interface
  292. *
  293. * Description:
  294. * Add a new, empty, interface entry into the unlabeled connection hash table.
  295. * On success a pointer to the new interface entry is returned, on failure NULL
  296. * is returned.
  297. *
  298. */
  299. static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
  300. {
  301. u32 bkt;
  302. struct netlbl_unlhsh_iface *iface;
  303. iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
  304. if (iface == NULL)
  305. return NULL;
  306. iface->ifindex = ifindex;
  307. INIT_LIST_HEAD(&iface->addr4_list);
  308. INIT_LIST_HEAD(&iface->addr6_list);
  309. iface->valid = 1;
  310. spin_lock(&netlbl_unlhsh_lock);
  311. if (ifindex > 0) {
  312. bkt = netlbl_unlhsh_hash(ifindex);
  313. if (netlbl_unlhsh_search_iface(ifindex) != NULL)
  314. goto add_iface_failure;
  315. list_add_tail_rcu(&iface->list,
  316. &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
  317. } else {
  318. INIT_LIST_HEAD(&iface->list);
  319. if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
  320. goto add_iface_failure;
  321. rcu_assign_pointer(netlbl_unlhsh_def, iface);
  322. }
  323. spin_unlock(&netlbl_unlhsh_lock);
  324. return iface;
  325. add_iface_failure:
  326. spin_unlock(&netlbl_unlhsh_lock);
  327. kfree(iface);
  328. return NULL;
  329. }
  330. /**
  331. * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
  332. * @net: network namespace
  333. * @dev_name: interface name
  334. * @addr: IP address in network byte order
  335. * @mask: address mask in network byte order
  336. * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
  337. * @secid: LSM secid value for the entry
  338. * @audit_info: NetLabel audit information
  339. *
  340. * Description:
  341. * Adds a new entry to the unlabeled connection hash table. Returns zero on
  342. * success, negative values on failure.
  343. *
  344. */
  345. int netlbl_unlhsh_add(struct net *net,
  346. const char *dev_name,
  347. const void *addr,
  348. const void *mask,
  349. u32 addr_len,
  350. u32 secid,
  351. struct netlbl_audit *audit_info)
  352. {
  353. int ret_val;
  354. int ifindex;
  355. struct net_device *dev;
  356. struct netlbl_unlhsh_iface *iface;
  357. struct audit_buffer *audit_buf = NULL;
  358. char *secctx = NULL;
  359. u32 secctx_len;
  360. if (addr_len != sizeof(struct in_addr) &&
  361. addr_len != sizeof(struct in6_addr))
  362. return -EINVAL;
  363. rcu_read_lock();
  364. if (dev_name != NULL) {
  365. dev = dev_get_by_name_rcu(net, dev_name);
  366. if (dev == NULL) {
  367. ret_val = -ENODEV;
  368. goto unlhsh_add_return;
  369. }
  370. ifindex = dev->ifindex;
  371. iface = netlbl_unlhsh_search_iface(ifindex);
  372. } else {
  373. ifindex = 0;
  374. iface = rcu_dereference(netlbl_unlhsh_def);
  375. }
  376. if (iface == NULL) {
  377. iface = netlbl_unlhsh_add_iface(ifindex);
  378. if (iface == NULL) {
  379. ret_val = -ENOMEM;
  380. goto unlhsh_add_return;
  381. }
  382. }
  383. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
  384. audit_info);
  385. switch (addr_len) {
  386. case sizeof(struct in_addr): {
  387. const struct in_addr *addr4 = addr;
  388. const struct in_addr *mask4 = mask;
  389. ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
  390. if (audit_buf != NULL)
  391. netlbl_af4list_audit_addr(audit_buf, 1,
  392. dev_name,
  393. addr4->s_addr,
  394. mask4->s_addr);
  395. break;
  396. }
  397. #if IS_ENABLED(CONFIG_IPV6)
  398. case sizeof(struct in6_addr): {
  399. const struct in6_addr *addr6 = addr;
  400. const struct in6_addr *mask6 = mask;
  401. ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
  402. if (audit_buf != NULL)
  403. netlbl_af6list_audit_addr(audit_buf, 1,
  404. dev_name,
  405. addr6, mask6);
  406. break;
  407. }
  408. #endif /* IPv6 */
  409. default:
  410. ret_val = -EINVAL;
  411. }
  412. if (ret_val == 0)
  413. atomic_inc(&netlabel_mgmt_protocount);
  414. unlhsh_add_return:
  415. rcu_read_unlock();
  416. if (audit_buf != NULL) {
  417. if (security_secid_to_secctx(secid,
  418. &secctx,
  419. &secctx_len) == 0) {
  420. audit_log_format(audit_buf, " sec_obj=%s", secctx);
  421. security_release_secctx(secctx, secctx_len);
  422. }
  423. audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
  424. audit_log_end(audit_buf);
  425. }
  426. return ret_val;
  427. }
  428. /**
  429. * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
  430. * @net: network namespace
  431. * @iface: interface entry
  432. * @addr: IP address
  433. * @mask: IP address mask
  434. * @audit_info: NetLabel audit information
  435. *
  436. * Description:
  437. * Remove an IP address entry from the unlabeled connection hash table.
  438. * Returns zero on success, negative values on failure.
  439. *
  440. */
  441. static int netlbl_unlhsh_remove_addr4(struct net *net,
  442. struct netlbl_unlhsh_iface *iface,
  443. const struct in_addr *addr,
  444. const struct in_addr *mask,
  445. struct netlbl_audit *audit_info)
  446. {
  447. struct netlbl_af4list *list_entry;
  448. struct netlbl_unlhsh_addr4 *entry;
  449. struct audit_buffer *audit_buf;
  450. struct net_device *dev;
  451. char *secctx;
  452. u32 secctx_len;
  453. spin_lock(&netlbl_unlhsh_lock);
  454. list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
  455. &iface->addr4_list);
  456. spin_unlock(&netlbl_unlhsh_lock);
  457. if (list_entry != NULL)
  458. entry = netlbl_unlhsh_addr4_entry(list_entry);
  459. else
  460. entry = NULL;
  461. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
  462. audit_info);
  463. if (audit_buf != NULL) {
  464. dev = dev_get_by_index(net, iface->ifindex);
  465. netlbl_af4list_audit_addr(audit_buf, 1,
  466. (dev != NULL ? dev->name : NULL),
  467. addr->s_addr, mask->s_addr);
  468. if (dev != NULL)
  469. dev_put(dev);
  470. if (entry != NULL &&
  471. security_secid_to_secctx(entry->secid,
  472. &secctx, &secctx_len) == 0) {
  473. audit_log_format(audit_buf, " sec_obj=%s", secctx);
  474. security_release_secctx(secctx, secctx_len);
  475. }
  476. audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
  477. audit_log_end(audit_buf);
  478. }
  479. if (entry == NULL)
  480. return -ENOENT;
  481. kfree_rcu(entry, rcu);
  482. return 0;
  483. }
  484. #if IS_ENABLED(CONFIG_IPV6)
  485. /**
  486. * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
  487. * @net: network namespace
  488. * @iface: interface entry
  489. * @addr: IP address
  490. * @mask: IP address mask
  491. * @audit_info: NetLabel audit information
  492. *
  493. * Description:
  494. * Remove an IP address entry from the unlabeled connection hash table.
  495. * Returns zero on success, negative values on failure.
  496. *
  497. */
  498. static int netlbl_unlhsh_remove_addr6(struct net *net,
  499. struct netlbl_unlhsh_iface *iface,
  500. const struct in6_addr *addr,
  501. const struct in6_addr *mask,
  502. struct netlbl_audit *audit_info)
  503. {
  504. struct netlbl_af6list *list_entry;
  505. struct netlbl_unlhsh_addr6 *entry;
  506. struct audit_buffer *audit_buf;
  507. struct net_device *dev;
  508. char *secctx;
  509. u32 secctx_len;
  510. spin_lock(&netlbl_unlhsh_lock);
  511. list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
  512. spin_unlock(&netlbl_unlhsh_lock);
  513. if (list_entry != NULL)
  514. entry = netlbl_unlhsh_addr6_entry(list_entry);
  515. else
  516. entry = NULL;
  517. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
  518. audit_info);
  519. if (audit_buf != NULL) {
  520. dev = dev_get_by_index(net, iface->ifindex);
  521. netlbl_af6list_audit_addr(audit_buf, 1,
  522. (dev != NULL ? dev->name : NULL),
  523. addr, mask);
  524. if (dev != NULL)
  525. dev_put(dev);
  526. if (entry != NULL &&
  527. security_secid_to_secctx(entry->secid,
  528. &secctx, &secctx_len) == 0) {
  529. audit_log_format(audit_buf, " sec_obj=%s", secctx);
  530. security_release_secctx(secctx, secctx_len);
  531. }
  532. audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
  533. audit_log_end(audit_buf);
  534. }
  535. if (entry == NULL)
  536. return -ENOENT;
  537. kfree_rcu(entry, rcu);
  538. return 0;
  539. }
  540. #endif /* IPv6 */
  541. /**
  542. * netlbl_unlhsh_condremove_iface - Remove an interface entry
  543. * @iface: the interface entry
  544. *
  545. * Description:
  546. * Remove an interface entry from the unlabeled connection hash table if it is
  547. * empty. An interface entry is considered to be empty if there are no
  548. * address entries assigned to it.
  549. *
  550. */
  551. static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
  552. {
  553. struct netlbl_af4list *iter4;
  554. #if IS_ENABLED(CONFIG_IPV6)
  555. struct netlbl_af6list *iter6;
  556. #endif /* IPv6 */
  557. spin_lock(&netlbl_unlhsh_lock);
  558. netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
  559. goto unlhsh_condremove_failure;
  560. #if IS_ENABLED(CONFIG_IPV6)
  561. netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
  562. goto unlhsh_condremove_failure;
  563. #endif /* IPv6 */
  564. iface->valid = 0;
  565. if (iface->ifindex > 0)
  566. list_del_rcu(&iface->list);
  567. else
  568. RCU_INIT_POINTER(netlbl_unlhsh_def, NULL);
  569. spin_unlock(&netlbl_unlhsh_lock);
  570. call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
  571. return;
  572. unlhsh_condremove_failure:
  573. spin_unlock(&netlbl_unlhsh_lock);
  574. }
  575. /**
  576. * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
  577. * @net: network namespace
  578. * @dev_name: interface name
  579. * @addr: IP address in network byte order
  580. * @mask: address mask in network byte order
  581. * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
  582. * @audit_info: NetLabel audit information
  583. *
  584. * Description:
  585. * Removes and existing entry from the unlabeled connection hash table.
  586. * Returns zero on success, negative values on failure.
  587. *
  588. */
  589. int netlbl_unlhsh_remove(struct net *net,
  590. const char *dev_name,
  591. const void *addr,
  592. const void *mask,
  593. u32 addr_len,
  594. struct netlbl_audit *audit_info)
  595. {
  596. int ret_val;
  597. struct net_device *dev;
  598. struct netlbl_unlhsh_iface *iface;
  599. if (addr_len != sizeof(struct in_addr) &&
  600. addr_len != sizeof(struct in6_addr))
  601. return -EINVAL;
  602. rcu_read_lock();
  603. if (dev_name != NULL) {
  604. dev = dev_get_by_name_rcu(net, dev_name);
  605. if (dev == NULL) {
  606. ret_val = -ENODEV;
  607. goto unlhsh_remove_return;
  608. }
  609. iface = netlbl_unlhsh_search_iface(dev->ifindex);
  610. } else
  611. iface = rcu_dereference(netlbl_unlhsh_def);
  612. if (iface == NULL) {
  613. ret_val = -ENOENT;
  614. goto unlhsh_remove_return;
  615. }
  616. switch (addr_len) {
  617. case sizeof(struct in_addr):
  618. ret_val = netlbl_unlhsh_remove_addr4(net,
  619. iface, addr, mask,
  620. audit_info);
  621. break;
  622. #if IS_ENABLED(CONFIG_IPV6)
  623. case sizeof(struct in6_addr):
  624. ret_val = netlbl_unlhsh_remove_addr6(net,
  625. iface, addr, mask,
  626. audit_info);
  627. break;
  628. #endif /* IPv6 */
  629. default:
  630. ret_val = -EINVAL;
  631. }
  632. if (ret_val == 0) {
  633. netlbl_unlhsh_condremove_iface(iface);
  634. atomic_dec(&netlabel_mgmt_protocount);
  635. }
  636. unlhsh_remove_return:
  637. rcu_read_unlock();
  638. return ret_val;
  639. }
  640. /*
  641. * General Helper Functions
  642. */
  643. /**
  644. * netlbl_unlhsh_netdev_handler - Network device notification handler
  645. * @this: notifier block
  646. * @event: the event
  647. * @ptr: the network device (cast to void)
  648. *
  649. * Description:
  650. * Handle network device events, although at present all we care about is a
  651. * network device going away. In the case of a device going away we clear any
  652. * related entries from the unlabeled connection hash table.
  653. *
  654. */
  655. static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
  656. unsigned long event,
  657. void *ptr)
  658. {
  659. struct net_device *dev = ptr;
  660. struct netlbl_unlhsh_iface *iface = NULL;
  661. if (!net_eq(dev_net(dev), &init_net))
  662. return NOTIFY_DONE;
  663. /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
  664. if (event == NETDEV_DOWN) {
  665. spin_lock(&netlbl_unlhsh_lock);
  666. iface = netlbl_unlhsh_search_iface(dev->ifindex);
  667. if (iface != NULL && iface->valid) {
  668. iface->valid = 0;
  669. list_del_rcu(&iface->list);
  670. } else
  671. iface = NULL;
  672. spin_unlock(&netlbl_unlhsh_lock);
  673. }
  674. if (iface != NULL)
  675. call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
  676. return NOTIFY_DONE;
  677. }
  678. /**
  679. * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
  680. * @value: desired value
  681. * @audit_info: NetLabel audit information
  682. *
  683. * Description:
  684. * Set the value of the unlabeled accept flag to @value.
  685. *
  686. */
  687. static void netlbl_unlabel_acceptflg_set(u8 value,
  688. struct netlbl_audit *audit_info)
  689. {
  690. struct audit_buffer *audit_buf;
  691. u8 old_val;
  692. old_val = netlabel_unlabel_acceptflg;
  693. netlabel_unlabel_acceptflg = value;
  694. audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
  695. audit_info);
  696. if (audit_buf != NULL) {
  697. audit_log_format(audit_buf,
  698. " unlbl_accept=%u old=%u", value, old_val);
  699. audit_log_end(audit_buf);
  700. }
  701. }
  702. /**
  703. * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
  704. * @info: the Generic NETLINK info block
  705. * @addr: the IP address
  706. * @mask: the IP address mask
  707. * @len: the address length
  708. *
  709. * Description:
  710. * Examine the Generic NETLINK message and extract the IP address information.
  711. * Returns zero on success, negative values on failure.
  712. *
  713. */
  714. static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
  715. void **addr,
  716. void **mask,
  717. u32 *len)
  718. {
  719. u32 addr_len;
  720. if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) {
  721. addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
  722. if (addr_len != sizeof(struct in_addr) &&
  723. addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
  724. return -EINVAL;
  725. *len = addr_len;
  726. *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
  727. *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
  728. return 0;
  729. } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
  730. addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
  731. if (addr_len != sizeof(struct in6_addr) &&
  732. addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
  733. return -EINVAL;
  734. *len = addr_len;
  735. *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
  736. *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
  737. return 0;
  738. }
  739. return -EINVAL;
  740. }
  741. /*
  742. * NetLabel Command Handlers
  743. */
  744. /**
  745. * netlbl_unlabel_accept - Handle an ACCEPT message
  746. * @skb: the NETLINK buffer
  747. * @info: the Generic NETLINK info block
  748. *
  749. * Description:
  750. * Process a user generated ACCEPT message and set the accept flag accordingly.
  751. * Returns zero on success, negative values on failure.
  752. *
  753. */
  754. static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
  755. {
  756. u8 value;
  757. struct netlbl_audit audit_info;
  758. if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
  759. value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
  760. if (value == 1 || value == 0) {
  761. netlbl_netlink_auditinfo(skb, &audit_info);
  762. netlbl_unlabel_acceptflg_set(value, &audit_info);
  763. return 0;
  764. }
  765. }
  766. return -EINVAL;
  767. }
  768. /**
  769. * netlbl_unlabel_list - Handle a LIST message
  770. * @skb: the NETLINK buffer
  771. * @info: the Generic NETLINK info block
  772. *
  773. * Description:
  774. * Process a user generated LIST message and respond with the current status.
  775. * Returns zero on success, negative values on failure.
  776. *
  777. */
  778. static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
  779. {
  780. int ret_val = -EINVAL;
  781. struct sk_buff *ans_skb;
  782. void *data;
  783. ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  784. if (ans_skb == NULL)
  785. goto list_failure;
  786. data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
  787. 0, NLBL_UNLABEL_C_LIST);
  788. if (data == NULL) {
  789. ret_val = -ENOMEM;
  790. goto list_failure;
  791. }
  792. ret_val = nla_put_u8(ans_skb,
  793. NLBL_UNLABEL_A_ACPTFLG,
  794. netlabel_unlabel_acceptflg);
  795. if (ret_val != 0)
  796. goto list_failure;
  797. genlmsg_end(ans_skb, data);
  798. return genlmsg_reply(ans_skb, info);
  799. list_failure:
  800. kfree_skb(ans_skb);
  801. return ret_val;
  802. }
  803. /**
  804. * netlbl_unlabel_staticadd - Handle a STATICADD message
  805. * @skb: the NETLINK buffer
  806. * @info: the Generic NETLINK info block
  807. *
  808. * Description:
  809. * Process a user generated STATICADD message and add a new unlabeled
  810. * connection entry to the hash table. Returns zero on success, negative
  811. * values on failure.
  812. *
  813. */
  814. static int netlbl_unlabel_staticadd(struct sk_buff *skb,
  815. struct genl_info *info)
  816. {
  817. int ret_val;
  818. char *dev_name;
  819. void *addr;
  820. void *mask;
  821. u32 addr_len;
  822. u32 secid;
  823. struct netlbl_audit audit_info;
  824. /* Don't allow users to add both IPv4 and IPv6 addresses for a
  825. * single entry. However, allow users to create two entries, one each
  826. * for IPv4 and IPv4, with the same LSM security context which should
  827. * achieve the same result. */
  828. if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
  829. !info->attrs[NLBL_UNLABEL_A_IFACE] ||
  830. !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  831. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  832. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  833. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  834. return -EINVAL;
  835. netlbl_netlink_auditinfo(skb, &audit_info);
  836. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  837. if (ret_val != 0)
  838. return ret_val;
  839. dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
  840. ret_val = security_secctx_to_secid(
  841. nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  842. nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  843. &secid);
  844. if (ret_val != 0)
  845. return ret_val;
  846. return netlbl_unlhsh_add(&init_net,
  847. dev_name, addr, mask, addr_len, secid,
  848. &audit_info);
  849. }
  850. /**
  851. * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
  852. * @skb: the NETLINK buffer
  853. * @info: the Generic NETLINK info block
  854. *
  855. * Description:
  856. * Process a user generated STATICADDDEF message and add a new default
  857. * unlabeled connection entry. Returns zero on success, negative values on
  858. * failure.
  859. *
  860. */
  861. static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
  862. struct genl_info *info)
  863. {
  864. int ret_val;
  865. void *addr;
  866. void *mask;
  867. u32 addr_len;
  868. u32 secid;
  869. struct netlbl_audit audit_info;
  870. /* Don't allow users to add both IPv4 and IPv6 addresses for a
  871. * single entry. However, allow users to create two entries, one each
  872. * for IPv4 and IPv6, with the same LSM security context which should
  873. * achieve the same result. */
  874. if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
  875. !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  876. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  877. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  878. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  879. return -EINVAL;
  880. netlbl_netlink_auditinfo(skb, &audit_info);
  881. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  882. if (ret_val != 0)
  883. return ret_val;
  884. ret_val = security_secctx_to_secid(
  885. nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  886. nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
  887. &secid);
  888. if (ret_val != 0)
  889. return ret_val;
  890. return netlbl_unlhsh_add(&init_net,
  891. NULL, addr, mask, addr_len, secid,
  892. &audit_info);
  893. }
  894. /**
  895. * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
  896. * @skb: the NETLINK buffer
  897. * @info: the Generic NETLINK info block
  898. *
  899. * Description:
  900. * Process a user generated STATICREMOVE message and remove the specified
  901. * unlabeled connection entry. Returns zero on success, negative values on
  902. * failure.
  903. *
  904. */
  905. static int netlbl_unlabel_staticremove(struct sk_buff *skb,
  906. struct genl_info *info)
  907. {
  908. int ret_val;
  909. char *dev_name;
  910. void *addr;
  911. void *mask;
  912. u32 addr_len;
  913. struct netlbl_audit audit_info;
  914. /* See the note in netlbl_unlabel_staticadd() about not allowing both
  915. * IPv4 and IPv6 in the same entry. */
  916. if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
  917. !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  918. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  919. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  920. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  921. return -EINVAL;
  922. netlbl_netlink_auditinfo(skb, &audit_info);
  923. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  924. if (ret_val != 0)
  925. return ret_val;
  926. dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
  927. return netlbl_unlhsh_remove(&init_net,
  928. dev_name, addr, mask, addr_len,
  929. &audit_info);
  930. }
  931. /**
  932. * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
  933. * @skb: the NETLINK buffer
  934. * @info: the Generic NETLINK info block
  935. *
  936. * Description:
  937. * Process a user generated STATICREMOVEDEF message and remove the default
  938. * unlabeled connection entry. Returns zero on success, negative values on
  939. * failure.
  940. *
  941. */
  942. static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
  943. struct genl_info *info)
  944. {
  945. int ret_val;
  946. void *addr;
  947. void *mask;
  948. u32 addr_len;
  949. struct netlbl_audit audit_info;
  950. /* See the note in netlbl_unlabel_staticadd() about not allowing both
  951. * IPv4 and IPv6 in the same entry. */
  952. if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
  953. !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
  954. (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
  955. !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
  956. return -EINVAL;
  957. netlbl_netlink_auditinfo(skb, &audit_info);
  958. ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
  959. if (ret_val != 0)
  960. return ret_val;
  961. return netlbl_unlhsh_remove(&init_net,
  962. NULL, addr, mask, addr_len,
  963. &audit_info);
  964. }
  965. /**
  966. * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
  967. * @cmd: command/message
  968. * @iface: the interface entry
  969. * @addr4: the IPv4 address entry
  970. * @addr6: the IPv6 address entry
  971. * @arg: the netlbl_unlhsh_walk_arg structure
  972. *
  973. * Description:
  974. * This function is designed to be used to generate a response for a
  975. * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6
  976. * can be specified, not both, the other unspecified entry should be set to
  977. * NULL by the caller. Returns the size of the message on success, negative
  978. * values on failure.
  979. *
  980. */
  981. static int netlbl_unlabel_staticlist_gen(u32 cmd,
  982. const struct netlbl_unlhsh_iface *iface,
  983. const struct netlbl_unlhsh_addr4 *addr4,
  984. const struct netlbl_unlhsh_addr6 *addr6,
  985. void *arg)
  986. {
  987. int ret_val = -ENOMEM;
  988. struct netlbl_unlhsh_walk_arg *cb_arg = arg;
  989. struct net_device *dev;
  990. void *data;
  991. u32 secid;
  992. char *secctx;
  993. u32 secctx_len;
  994. data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
  995. cb_arg->seq, &netlbl_unlabel_gnl_family,
  996. NLM_F_MULTI, cmd);
  997. if (data == NULL)
  998. goto list_cb_failure;
  999. if (iface->ifindex > 0) {
  1000. dev = dev_get_by_index(&init_net, iface->ifindex);
  1001. if (!dev) {
  1002. ret_val = -ENODEV;
  1003. goto list_cb_failure;
  1004. }
  1005. ret_val = nla_put_string(cb_arg->skb,
  1006. NLBL_UNLABEL_A_IFACE, dev->name);
  1007. dev_put(dev);
  1008. if (ret_val != 0)
  1009. goto list_cb_failure;
  1010. }
  1011. if (addr4) {
  1012. struct in_addr addr_struct;
  1013. addr_struct.s_addr = addr4->list.addr;
  1014. ret_val = nla_put(cb_arg->skb,
  1015. NLBL_UNLABEL_A_IPV4ADDR,
  1016. sizeof(struct in_addr),
  1017. &addr_struct);
  1018. if (ret_val != 0)
  1019. goto list_cb_failure;
  1020. addr_struct.s_addr = addr4->list.mask;
  1021. ret_val = nla_put(cb_arg->skb,
  1022. NLBL_UNLABEL_A_IPV4MASK,
  1023. sizeof(struct in_addr),
  1024. &addr_struct);
  1025. if (ret_val != 0)
  1026. goto list_cb_failure;
  1027. secid = addr4->secid;
  1028. } else {
  1029. ret_val = nla_put(cb_arg->skb,
  1030. NLBL_UNLABEL_A_IPV6ADDR,
  1031. sizeof(struct in6_addr),
  1032. &addr6->list.addr);
  1033. if (ret_val != 0)
  1034. goto list_cb_failure;
  1035. ret_val = nla_put(cb_arg->skb,
  1036. NLBL_UNLABEL_A_IPV6MASK,
  1037. sizeof(struct in6_addr),
  1038. &addr6->list.mask);
  1039. if (ret_val != 0)
  1040. goto list_cb_failure;
  1041. secid = addr6->secid;
  1042. }
  1043. ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
  1044. if (ret_val != 0)
  1045. goto list_cb_failure;
  1046. ret_val = nla_put(cb_arg->skb,
  1047. NLBL_UNLABEL_A_SECCTX,
  1048. secctx_len,
  1049. secctx);
  1050. security_release_secctx(secctx, secctx_len);
  1051. if (ret_val != 0)
  1052. goto list_cb_failure;
  1053. cb_arg->seq++;
  1054. return genlmsg_end(cb_arg->skb, data);
  1055. list_cb_failure:
  1056. genlmsg_cancel(cb_arg->skb, data);
  1057. return ret_val;
  1058. }
  1059. /**
  1060. * netlbl_unlabel_staticlist - Handle a STATICLIST message
  1061. * @skb: the NETLINK buffer
  1062. * @cb: the NETLINK callback
  1063. *
  1064. * Description:
  1065. * Process a user generated STATICLIST message and dump the unlabeled
  1066. * connection hash table in a form suitable for use in a kernel generated
  1067. * STATICLIST message. Returns the length of @skb.
  1068. *
  1069. */
  1070. static int netlbl_unlabel_staticlist(struct sk_buff *skb,
  1071. struct netlink_callback *cb)
  1072. {
  1073. struct netlbl_unlhsh_walk_arg cb_arg;
  1074. u32 skip_bkt = cb->args[0];
  1075. u32 skip_chain = cb->args[1];
  1076. u32 iter_bkt;
  1077. u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
  1078. struct netlbl_unlhsh_iface *iface;
  1079. struct list_head *iter_list;
  1080. struct netlbl_af4list *addr4;
  1081. #if IS_ENABLED(CONFIG_IPV6)
  1082. struct netlbl_af6list *addr6;
  1083. #endif
  1084. cb_arg.nl_cb = cb;
  1085. cb_arg.skb = skb;
  1086. cb_arg.seq = cb->nlh->nlmsg_seq;
  1087. rcu_read_lock();
  1088. for (iter_bkt = skip_bkt;
  1089. iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
  1090. iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
  1091. iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
  1092. list_for_each_entry_rcu(iface, iter_list, list) {
  1093. if (!iface->valid ||
  1094. iter_chain++ < skip_chain)
  1095. continue;
  1096. netlbl_af4list_foreach_rcu(addr4,
  1097. &iface->addr4_list) {
  1098. if (iter_addr4++ < cb->args[2])
  1099. continue;
  1100. if (netlbl_unlabel_staticlist_gen(
  1101. NLBL_UNLABEL_C_STATICLIST,
  1102. iface,
  1103. netlbl_unlhsh_addr4_entry(addr4),
  1104. NULL,
  1105. &cb_arg) < 0) {
  1106. iter_addr4--;
  1107. iter_chain--;
  1108. goto unlabel_staticlist_return;
  1109. }
  1110. }
  1111. #if IS_ENABLED(CONFIG_IPV6)
  1112. netlbl_af6list_foreach_rcu(addr6,
  1113. &iface->addr6_list) {
  1114. if (iter_addr6++ < cb->args[3])
  1115. continue;
  1116. if (netlbl_unlabel_staticlist_gen(
  1117. NLBL_UNLABEL_C_STATICLIST,
  1118. iface,
  1119. NULL,
  1120. netlbl_unlhsh_addr6_entry(addr6),
  1121. &cb_arg) < 0) {
  1122. iter_addr6--;
  1123. iter_chain--;
  1124. goto unlabel_staticlist_return;
  1125. }
  1126. }
  1127. #endif /* IPv6 */
  1128. }
  1129. }
  1130. unlabel_staticlist_return:
  1131. rcu_read_unlock();
  1132. cb->args[0] = iter_bkt;
  1133. cb->args[1] = iter_chain;
  1134. cb->args[2] = iter_addr4;
  1135. cb->args[3] = iter_addr6;
  1136. return skb->len;
  1137. }
  1138. /**
  1139. * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
  1140. * @skb: the NETLINK buffer
  1141. * @cb: the NETLINK callback
  1142. *
  1143. * Description:
  1144. * Process a user generated STATICLISTDEF message and dump the default
  1145. * unlabeled connection entry in a form suitable for use in a kernel generated
  1146. * STATICLISTDEF message. Returns the length of @skb.
  1147. *
  1148. */
  1149. static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
  1150. struct netlink_callback *cb)
  1151. {
  1152. struct netlbl_unlhsh_walk_arg cb_arg;
  1153. struct netlbl_unlhsh_iface *iface;
  1154. u32 iter_addr4 = 0, iter_addr6 = 0;
  1155. struct netlbl_af4list *addr4;
  1156. #if IS_ENABLED(CONFIG_IPV6)
  1157. struct netlbl_af6list *addr6;
  1158. #endif
  1159. cb_arg.nl_cb = cb;
  1160. cb_arg.skb = skb;
  1161. cb_arg.seq = cb->nlh->nlmsg_seq;
  1162. rcu_read_lock();
  1163. iface = rcu_dereference(netlbl_unlhsh_def);
  1164. if (iface == NULL || !iface->valid)
  1165. goto unlabel_staticlistdef_return;
  1166. netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
  1167. if (iter_addr4++ < cb->args[0])
  1168. continue;
  1169. if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
  1170. iface,
  1171. netlbl_unlhsh_addr4_entry(addr4),
  1172. NULL,
  1173. &cb_arg) < 0) {
  1174. iter_addr4--;
  1175. goto unlabel_staticlistdef_return;
  1176. }
  1177. }
  1178. #if IS_ENABLED(CONFIG_IPV6)
  1179. netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
  1180. if (iter_addr6++ < cb->args[1])
  1181. continue;
  1182. if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
  1183. iface,
  1184. NULL,
  1185. netlbl_unlhsh_addr6_entry(addr6),
  1186. &cb_arg) < 0) {
  1187. iter_addr6--;
  1188. goto unlabel_staticlistdef_return;
  1189. }
  1190. }
  1191. #endif /* IPv6 */
  1192. unlabel_staticlistdef_return:
  1193. rcu_read_unlock();
  1194. cb->args[0] = iter_addr4;
  1195. cb->args[1] = iter_addr6;
  1196. return skb->len;
  1197. }
  1198. /*
  1199. * NetLabel Generic NETLINK Command Definitions
  1200. */
  1201. static struct genl_ops netlbl_unlabel_genl_ops[] = {
  1202. {
  1203. .cmd = NLBL_UNLABEL_C_STATICADD,
  1204. .flags = GENL_ADMIN_PERM,
  1205. .policy = netlbl_unlabel_genl_policy,
  1206. .doit = netlbl_unlabel_staticadd,
  1207. .dumpit = NULL,
  1208. },
  1209. {
  1210. .cmd = NLBL_UNLABEL_C_STATICREMOVE,
  1211. .flags = GENL_ADMIN_PERM,
  1212. .policy = netlbl_unlabel_genl_policy,
  1213. .doit = netlbl_unlabel_staticremove,
  1214. .dumpit = NULL,
  1215. },
  1216. {
  1217. .cmd = NLBL_UNLABEL_C_STATICLIST,
  1218. .flags = 0,
  1219. .policy = netlbl_unlabel_genl_policy,
  1220. .doit = NULL,
  1221. .dumpit = netlbl_unlabel_staticlist,
  1222. },
  1223. {
  1224. .cmd = NLBL_UNLABEL_C_STATICADDDEF,
  1225. .flags = GENL_ADMIN_PERM,
  1226. .policy = netlbl_unlabel_genl_policy,
  1227. .doit = netlbl_unlabel_staticadddef,
  1228. .dumpit = NULL,
  1229. },
  1230. {
  1231. .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
  1232. .flags = GENL_ADMIN_PERM,
  1233. .policy = netlbl_unlabel_genl_policy,
  1234. .doit = netlbl_unlabel_staticremovedef,
  1235. .dumpit = NULL,
  1236. },
  1237. {
  1238. .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
  1239. .flags = 0,
  1240. .policy = netlbl_unlabel_genl_policy,
  1241. .doit = NULL,
  1242. .dumpit = netlbl_unlabel_staticlistdef,
  1243. },
  1244. {
  1245. .cmd = NLBL_UNLABEL_C_ACCEPT,
  1246. .flags = GENL_ADMIN_PERM,
  1247. .policy = netlbl_unlabel_genl_policy,
  1248. .doit = netlbl_unlabel_accept,
  1249. .dumpit = NULL,
  1250. },
  1251. {
  1252. .cmd = NLBL_UNLABEL_C_LIST,
  1253. .flags = 0,
  1254. .policy = netlbl_unlabel_genl_policy,
  1255. .doit = netlbl_unlabel_list,
  1256. .dumpit = NULL,
  1257. },
  1258. };
  1259. /*
  1260. * NetLabel Generic NETLINK Protocol Functions
  1261. */
  1262. /**
  1263. * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
  1264. *
  1265. * Description:
  1266. * Register the unlabeled packet NetLabel component with the Generic NETLINK
  1267. * mechanism. Returns zero on success, negative values on failure.
  1268. *
  1269. */
  1270. int __init netlbl_unlabel_genl_init(void)
  1271. {
  1272. return genl_register_family_with_ops(&netlbl_unlabel_gnl_family,
  1273. netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops));
  1274. }
  1275. /*
  1276. * NetLabel KAPI Hooks
  1277. */
  1278. static struct notifier_block netlbl_unlhsh_netdev_notifier = {
  1279. .notifier_call = netlbl_unlhsh_netdev_handler,
  1280. };
  1281. /**
  1282. * netlbl_unlabel_init - Initialize the unlabeled connection hash table
  1283. * @size: the number of bits to use for the hash buckets
  1284. *
  1285. * Description:
  1286. * Initializes the unlabeled connection hash table and registers a network
  1287. * device notification handler. This function should only be called by the
  1288. * NetLabel subsystem itself during initialization. Returns zero on success,
  1289. * non-zero values on error.
  1290. *
  1291. */
  1292. int __init netlbl_unlabel_init(u32 size)
  1293. {
  1294. u32 iter;
  1295. struct netlbl_unlhsh_tbl *hsh_tbl;
  1296. if (size == 0)
  1297. return -EINVAL;
  1298. hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
  1299. if (hsh_tbl == NULL)
  1300. return -ENOMEM;
  1301. hsh_tbl->size = 1 << size;
  1302. hsh_tbl->tbl = kcalloc(hsh_tbl->size,
  1303. sizeof(struct list_head),
  1304. GFP_KERNEL);
  1305. if (hsh_tbl->tbl == NULL) {
  1306. kfree(hsh_tbl);
  1307. return -ENOMEM;
  1308. }
  1309. for (iter = 0; iter < hsh_tbl->size; iter++)
  1310. INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
  1311. spin_lock(&netlbl_unlhsh_lock);
  1312. rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
  1313. spin_unlock(&netlbl_unlhsh_lock);
  1314. register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
  1315. return 0;
  1316. }
  1317. /**
  1318. * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
  1319. * @skb: the packet
  1320. * @family: protocol family
  1321. * @secattr: the security attributes
  1322. *
  1323. * Description:
  1324. * Determine the security attributes, if any, for an unlabled packet and return
  1325. * them in @secattr. Returns zero on success and negative values on failure.
  1326. *
  1327. */
  1328. int netlbl_unlabel_getattr(const struct sk_buff *skb,
  1329. u16 family,
  1330. struct netlbl_lsm_secattr *secattr)
  1331. {
  1332. struct netlbl_unlhsh_iface *iface;
  1333. rcu_read_lock();
  1334. iface = netlbl_unlhsh_search_iface(skb->skb_iif);
  1335. if (iface == NULL)
  1336. iface = rcu_dereference(netlbl_unlhsh_def);
  1337. if (iface == NULL || !iface->valid)
  1338. goto unlabel_getattr_nolabel;
  1339. switch (family) {
  1340. case PF_INET: {
  1341. struct iphdr *hdr4;
  1342. struct netlbl_af4list *addr4;
  1343. hdr4 = ip_hdr(skb);
  1344. addr4 = netlbl_af4list_search(hdr4->saddr,
  1345. &iface->addr4_list);
  1346. if (addr4 == NULL)
  1347. goto unlabel_getattr_nolabel;
  1348. secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
  1349. break;
  1350. }
  1351. #if IS_ENABLED(CONFIG_IPV6)
  1352. case PF_INET6: {
  1353. struct ipv6hdr *hdr6;
  1354. struct netlbl_af6list *addr6;
  1355. hdr6 = ipv6_hdr(skb);
  1356. addr6 = netlbl_af6list_search(&hdr6->saddr,
  1357. &iface->addr6_list);
  1358. if (addr6 == NULL)
  1359. goto unlabel_getattr_nolabel;
  1360. secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
  1361. break;
  1362. }
  1363. #endif /* IPv6 */
  1364. default:
  1365. goto unlabel_getattr_nolabel;
  1366. }
  1367. rcu_read_unlock();
  1368. secattr->flags |= NETLBL_SECATTR_SECID;
  1369. secattr->type = NETLBL_NLTYPE_UNLABELED;
  1370. return 0;
  1371. unlabel_getattr_nolabel:
  1372. rcu_read_unlock();
  1373. if (netlabel_unlabel_acceptflg == 0)
  1374. return -ENOMSG;
  1375. secattr->type = NETLBL_NLTYPE_UNLABELED;
  1376. return 0;
  1377. }
  1378. /**
  1379. * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
  1380. *
  1381. * Description:
  1382. * Set the default NetLabel configuration to allow incoming unlabeled packets
  1383. * and to send unlabeled network traffic by default.
  1384. *
  1385. */
  1386. int __init netlbl_unlabel_defconf(void)
  1387. {
  1388. int ret_val;
  1389. struct netlbl_dom_map *entry;
  1390. struct netlbl_audit audit_info;
  1391. /* Only the kernel is allowed to call this function and the only time
  1392. * it is called is at bootup before the audit subsystem is reporting
  1393. * messages so don't worry to much about these values. */
  1394. security_task_getsecid(current, &audit_info.secid);
  1395. audit_info.loginuid = 0;
  1396. audit_info.sessionid = 0;
  1397. entry = kzalloc(sizeof(*entry), GFP_KERNEL);
  1398. if (entry == NULL)
  1399. return -ENOMEM;
  1400. entry->type = NETLBL_NLTYPE_UNLABELED;
  1401. ret_val = netlbl_domhsh_add_default(entry, &audit_info);
  1402. if (ret_val != 0)
  1403. return ret_val;
  1404. netlbl_unlabel_acceptflg_set(1, &audit_info);
  1405. return 0;
  1406. }