Pileus Git - ~andy/linux/blob - net/netlabel/netlabel_unlabeled.c

   1 /*
   2  * NetLabel Unlabeled Support
   3  *
   4  * This file defines functions for dealing with unlabeled packets for the
   5  * NetLabel system.  The NetLabel system manages static and dynamic label
   6  * mappings for network protocols such as CIPSO and RIPSO.
   7  *
   8  * Author: Paul Moore <paul.moore@hp.com>
   9  *
  10  */
  11
  12 /*
  13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2007
  14  *
  15  * This program is free software;  you can redistribute it and/or modify
  16  * it under the terms of the GNU General Public License as published by
  17  * the Free Software Foundation; either version 2 of the License, or
  18  * (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  23  * the GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program;  if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28  *
  29  */
  30
  31 #include <linux/types.h>
  32 #include <linux/rcupdate.h>
  33 #include <linux/list.h>
  34 #include <linux/spinlock.h>
  35 #include <linux/socket.h>
  36 #include <linux/string.h>
  37 #include <linux/skbuff.h>
  38 #include <linux/audit.h>
  39 #include <linux/in.h>
  40 #include <linux/in6.h>
  41 #include <linux/ip.h>
  42 #include <linux/ipv6.h>
  43 #include <linux/notifier.h>
  44 #include <linux/netdevice.h>
  45 #include <linux/security.h>
  46 #include <net/sock.h>
  47 #include <net/netlink.h>
  48 #include <net/genetlink.h>
  49 #include <net/ip.h>
  50 #include <net/ipv6.h>
  51 #include <net/net_namespace.h>
  52 #include <net/netlabel.h>
  53 #include <asm/bug.h>
  54 #include <asm/atomic.h>
  55
  56 #include "netlabel_user.h"
  57 #include "netlabel_domainhash.h"
  58 #include "netlabel_unlabeled.h"
  59 #include "netlabel_mgmt.h"
  60
  61 /* NOTE: at present we always use init's network namespace since we don't
  62  *       presently support different namespaces even though the majority of
  63  *       the functions in this file are "namespace safe" */
  64
  65 /* The unlabeled connection hash table which we use to map network interfaces
  66  * and addresses of unlabeled packets to a user specified secid value for the
  67  * LSM.  The hash table is used to lookup the network interface entry
  68  * (struct netlbl_unlhsh_iface) and then the interface entry is used to
  69  * lookup an IP address match from an ordered list.  If a network interface
  70  * match can not be found in the hash table then the default entry
  71  * (netlbl_unlhsh_def) is used.  The IP address entry list
  72  * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
  73  * larger netmask come first.
  74  */
  75 struct netlbl_unlhsh_tbl {
  76         struct list_head *tbl;
  77         u32 size;
  78 };
  79 struct netlbl_unlhsh_addr4 {
  80         __be32 addr;
  81         __be32 mask;
  82         u32 secid;
  83
  84         u32 valid;
  85         struct list_head list;
  86         struct rcu_head rcu;
  87 };
  88 struct netlbl_unlhsh_addr6 {
  89         struct in6_addr addr;
  90         struct in6_addr mask;
  91         u32 secid;
  92
  93         u32 valid;
  94         struct list_head list;
  95         struct rcu_head rcu;
  96 };
  97 struct netlbl_unlhsh_iface {
  98         int ifindex;
  99         struct list_head addr4_list;
 100         struct list_head addr6_list;
 101
 102         u32 valid;
 103         struct list_head list;
 104         struct rcu_head rcu;
 105 };
 106
 107 /* Argument struct for netlbl_unlhsh_walk() */
 108 struct netlbl_unlhsh_walk_arg {
 109         struct netlink_callback *nl_cb;
 110         struct sk_buff *skb;
 111         u32 seq;
 112 };
 113
 114 /* Unlabeled connection hash table */
 115 /* updates should be so rare that having one spinlock for the entire
 116  * hash table should be okay */
 117 static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
 118 static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL;
 119 static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL;
 120
 121 /* Accept unlabeled packets flag */
 122 static u8 netlabel_unlabel_acceptflg = 0;
 123
 124 /* NetLabel Generic NETLINK unlabeled family */
 125 static struct genl_family netlbl_unlabel_gnl_family = {
 126         .id = GENL_ID_GENERATE,
 127         .hdrsize = 0,
 128         .name = NETLBL_NLTYPE_UNLABELED_NAME,
 129         .version = NETLBL_PROTO_VERSION,
 130         .maxattr = NLBL_UNLABEL_A_MAX,
 131 };
 132
 133 /* NetLabel Netlink attribute policy */
 134 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
 135         [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
 136         [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
 137                                       .len = sizeof(struct in6_addr) },
 138         [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
 139                                       .len = sizeof(struct in6_addr) },
 140         [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
 141                                       .len = sizeof(struct in_addr) },
 142         [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
 143                                       .len = sizeof(struct in_addr) },
 144         [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
 145                                    .len = IFNAMSIZ - 1 },
 146         [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
 147 };
 148
 149 /*
 150  * Unlabeled Connection Hash Table Functions
 151  */
 152
 153 /**
 154  * netlbl_unlhsh_free_addr4 - Frees an IPv4 address entry from the hash table
 155  * @entry: the entry's RCU field
 156  *
 157  * Description:
 158  * This function is designed to be used as a callback to the call_rcu()
 159  * function so that memory allocated to a hash table address entry can be
 160  * released safely.
 161  *
 162  */
 163 static void netlbl_unlhsh_free_addr4(struct rcu_head *entry)
 164 {
 165         struct netlbl_unlhsh_addr4 *ptr;
 166
 167         ptr = container_of(entry, struct netlbl_unlhsh_addr4, rcu);
 168         kfree(ptr);
 169 }
 170
 171 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 172 /**
 173  * netlbl_unlhsh_free_addr6 - Frees an IPv6 address entry from the hash table
 174  * @entry: the entry's RCU field
 175  *
 176  * Description:
 177  * This function is designed to be used as a callback to the call_rcu()
 178  * function so that memory allocated to a hash table address entry can be
 179  * released safely.
 180  *
 181  */
 182 static void netlbl_unlhsh_free_addr6(struct rcu_head *entry)
 183 {
 184         struct netlbl_unlhsh_addr6 *ptr;
 185
 186         ptr = container_of(entry, struct netlbl_unlhsh_addr6, rcu);
 187         kfree(ptr);
 188 }
 189 #endif /* IPv6 */
 190
 191 /**
 192  * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
 193  * @entry: the entry's RCU field
 194  *
 195  * Description:
 196  * This function is designed to be used as a callback to the call_rcu()
 197  * function so that memory allocated to a hash table interface entry can be
 198  * released safely.  It is important to note that this function does not free
 199  * the IPv4 and IPv6 address lists contained as part of an interface entry.  It
 200  * is up to the rest of the code to make sure an interface entry is only freed
 201  * once it's address lists are empty.
 202  *
 203  */
 204 static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
 205 {
 206         struct netlbl_unlhsh_iface *iface;
 207         struct netlbl_unlhsh_addr4 *iter4;
 208         struct netlbl_unlhsh_addr4 *tmp4;
 209         struct netlbl_unlhsh_addr6 *iter6;
 210         struct netlbl_unlhsh_addr6 *tmp6;
 211
 212         iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
 213
 214         /* no need for locks here since we are the only one with access to this
 215          * structure */
 216
 217         list_for_each_entry_safe(iter4, tmp4, &iface->addr4_list, list)
 218                 if (iter4->valid) {
 219                         list_del_rcu(&iter4->list);
 220                         kfree(iter4);
 221                 }
 222         list_for_each_entry_safe(iter6, tmp6, &iface->addr6_list, list)
 223                 if (iter6->valid) {
 224                         list_del_rcu(&iter6->list);
 225                         kfree(iter6);
 226                 }
 227         kfree(iface);
 228 }
 229
 230 /**
 231  * netlbl_unlhsh_hash - Hashing function for the hash table
 232  * @ifindex: the network interface/device to hash
 233  *
 234  * Description:
 235  * This is the hashing function for the unlabeled hash table, it returns the
 236  * bucket number for the given device/interface.  The caller is responsible for
 237  * calling the rcu_read_[un]lock() functions.
 238  *
 239  */
 240 static u32 netlbl_unlhsh_hash(int ifindex)
 241 {
 242         /* this is taken _almost_ directly from
 243          * security/selinux/netif.c:sel_netif_hasfn() as they do pretty much
 244          * the same thing */
 245         return ifindex & (rcu_dereference(netlbl_unlhsh)->size - 1);
 246 }
 247
 248 /**
 249  * netlbl_unlhsh_search_addr4 - Search for a matching IPv4 address entry
 250  * @addr: IPv4 address
 251  * @iface: the network interface entry
 252  *
 253  * Description:
 254  * Searches the IPv4 address list of the network interface specified by @iface.
 255  * If a matching address entry is found it is returned, otherwise NULL is
 256  * returned.  The caller is responsible for calling the rcu_read_[un]lock()
 257  * functions.
 258  *
 259  */
 260 static struct netlbl_unlhsh_addr4 *netlbl_unlhsh_search_addr4(
 261                                        __be32 addr,
 262                                        const struct netlbl_unlhsh_iface *iface)
 263 {
 264         struct netlbl_unlhsh_addr4 *iter;
 265
 266         list_for_each_entry_rcu(iter, &iface->addr4_list, list)
 267                 if (iter->valid && (addr & iter->mask) == iter->addr)
 268                         return iter;
 269
 270         return NULL;
 271 }
 272
 273 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 274 /**
 275  * netlbl_unlhsh_search_addr6 - Search for a matching IPv6 address entry
 276  * @addr: IPv6 address
 277  * @iface: the network interface entry
 278  *
 279  * Description:
 280  * Searches the IPv6 address list of the network interface specified by @iface.
 281  * If a matching address entry is found it is returned, otherwise NULL is
 282  * returned.  The caller is responsible for calling the rcu_read_[un]lock()
 283  * functions.
 284  *
 285  */
 286 static struct netlbl_unlhsh_addr6 *netlbl_unlhsh_search_addr6(
 287                                        const struct in6_addr *addr,
 288                                        const struct netlbl_unlhsh_iface *iface)
 289 {
 290         struct netlbl_unlhsh_addr6 *iter;
 291
 292         list_for_each_entry_rcu(iter, &iface->addr6_list, list)
 293                 if (iter->valid &&
 294                     ipv6_masked_addr_cmp(&iter->addr, &iter->mask, addr) == 0)
 295                 return iter;
 296
 297         return NULL;
 298 }
 299 #endif /* IPv6 */
 300
 301 /**
 302  * netlbl_unlhsh_search_iface - Search for a matching interface entry
 303  * @ifindex: the network interface
 304  *
 305  * Description:
 306  * Searches the unlabeled connection hash table and returns a pointer to the
 307  * interface entry which matches @ifindex, otherwise NULL is returned.  The
 308  * caller is responsible for calling the rcu_read_[un]lock() functions.
 309  *
 310  */
 311 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
 312 {
 313         u32 bkt;
 314         struct netlbl_unlhsh_iface *iter;
 315
 316         bkt = netlbl_unlhsh_hash(ifindex);
 317         list_for_each_entry_rcu(iter,
 318                                 &rcu_dereference(netlbl_unlhsh)->tbl[bkt],
 319                                 list)
 320                 if (iter->valid && iter->ifindex == ifindex)
 321                         return iter;
 322
 323         return NULL;
 324 }
 325
 326 /**
 327  * netlbl_unlhsh_search_iface_def - Search for a matching interface entry
 328  * @ifindex: the network interface
 329  *
 330  * Description:
 331  * Searches the unlabeled connection hash table and returns a pointer to the
 332  * interface entry which matches @ifindex.  If an exact match can not be found
 333  * and there is a valid default entry, the default entry is returned, otherwise
 334  * NULL is returned.  The caller is responsible for calling the
 335  * rcu_read_[un]lock() functions.
 336  *
 337  */
 338 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface_def(int ifindex)
 339 {
 340         struct netlbl_unlhsh_iface *entry;
 341
 342         entry = netlbl_unlhsh_search_iface(ifindex);
 343         if (entry != NULL)
 344                 return entry;
 345
 346         entry = rcu_dereference(netlbl_unlhsh_def);
 347         if (entry != NULL && entry->valid)
 348                 return entry;
 349
 350         return NULL;
 351 }
 352
 353 /**
 354  * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
 355  * @iface: the associated interface entry
 356  * @addr: IPv4 address in network byte order
 357  * @mask: IPv4 address mask in network byte order
 358  * @secid: LSM secid value for entry
 359  *
 360  * Description:
 361  * Add a new address entry into the unlabeled connection hash table using the
 362  * interface entry specified by @iface.  On success zero is returned, otherwise
 363  * a negative value is returned.  The caller is responsible for calling the
 364  * rcu_read_[un]lock() functions.
 365  *
 366  */
 367 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
 368                                    const struct in_addr *addr,
 369                                    const struct in_addr *mask,
 370                                    u32 secid)
 371 {
 372         struct netlbl_unlhsh_addr4 *entry;
 373         struct netlbl_unlhsh_addr4 *iter;
 374
 375         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 376         if (entry == NULL)
 377                 return -ENOMEM;
 378
 379         entry->addr = addr->s_addr & mask->s_addr;
 380         entry->mask = mask->s_addr;
 381         entry->secid = secid;
 382         entry->valid = 1;
 383         INIT_RCU_HEAD(&entry->rcu);
 384
 385         spin_lock(&netlbl_unlhsh_lock);
 386         iter = netlbl_unlhsh_search_addr4(entry->addr, iface);
 387         if (iter != NULL &&
 388             iter->addr == addr->s_addr && iter->mask == mask->s_addr) {
 389                 spin_unlock(&netlbl_unlhsh_lock);
 390                 kfree(entry);
 391                 return -EEXIST;
 392         }
 393         /* in order to speed up address searches through the list (the common
 394          * case) we need to keep the list in order based on the size of the
 395          * address mask such that the entry with the widest mask (smallest
 396          * numerical value) appears first in the list */
 397         list_for_each_entry_rcu(iter, &iface->addr4_list, list)
 398                 if (iter->valid &&
 399                     ntohl(entry->mask) > ntohl(iter->mask)) {
 400                         __list_add_rcu(&entry->list,
 401                                        iter->list.prev,
 402                                        &iter->list);
 403                         spin_unlock(&netlbl_unlhsh_lock);
 404                         return 0;
 405                 }
 406         list_add_tail_rcu(&entry->list, &iface->addr4_list);
 407         spin_unlock(&netlbl_unlhsh_lock);
 408         return 0;
 409 }
 410
 411 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 412 /**
 413  * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
 414  * @iface: the associated interface entry
 415  * @addr: IPv6 address in network byte order
 416  * @mask: IPv6 address mask in network byte order
 417  * @secid: LSM secid value for entry
 418  *
 419  * Description:
 420  * Add a new address entry into the unlabeled connection hash table using the
 421  * interface entry specified by @iface.  On success zero is returned, otherwise
 422  * a negative value is returned.  The caller is responsible for calling the
 423  * rcu_read_[un]lock() functions.
 424  *
 425  */
 426 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
 427                                    const struct in6_addr *addr,
 428                                    const struct in6_addr *mask,
 429                                    u32 secid)
 430 {
 431         struct netlbl_unlhsh_addr6 *entry;
 432         struct netlbl_unlhsh_addr6 *iter;
 433
 434         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 435         if (entry == NULL)
 436                 return -ENOMEM;
 437
 438         ipv6_addr_copy(&entry->addr, addr);
 439         entry->addr.s6_addr32[0] &= mask->s6_addr32[0];
 440         entry->addr.s6_addr32[1] &= mask->s6_addr32[1];
 441         entry->addr.s6_addr32[2] &= mask->s6_addr32[2];
 442         entry->addr.s6_addr32[3] &= mask->s6_addr32[3];
 443         ipv6_addr_copy(&entry->mask, mask);
 444         entry->secid = secid;
 445         entry->valid = 1;
 446         INIT_RCU_HEAD(&entry->rcu);
 447
 448         spin_lock(&netlbl_unlhsh_lock);
 449         iter = netlbl_unlhsh_search_addr6(&entry->addr, iface);
 450         if (iter != NULL &&
 451             (ipv6_addr_equal(&iter->addr, addr) &&
 452              ipv6_addr_equal(&iter->mask, mask))) {
 453                 spin_unlock(&netlbl_unlhsh_lock);
 454                 kfree(entry);
 455                 return -EEXIST;
 456         }
 457         /* in order to speed up address searches through the list (the common
 458          * case) we need to keep the list in order based on the size of the
 459          * address mask such that the entry with the widest mask (smallest
 460          * numerical value) appears first in the list */
 461         list_for_each_entry_rcu(iter, &iface->addr6_list, list)
 462                 if (iter->valid &&
 463                     ipv6_addr_cmp(&entry->mask, &iter->mask) > 0) {
 464                         __list_add_rcu(&entry->list,
 465                                        iter->list.prev,
 466                                        &iter->list);
 467                         spin_unlock(&netlbl_unlhsh_lock);
 468                         return 0;
 469                 }
 470         list_add_tail_rcu(&entry->list, &iface->addr6_list);
 471         spin_unlock(&netlbl_unlhsh_lock);
 472         return 0;
 473 }
 474 #endif /* IPv6 */
 475
 476 /**
 477  * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
 478  * @ifindex: network interface
 479  *
 480  * Description:
 481  * Add a new, empty, interface entry into the unlabeled connection hash table.
 482  * On success a pointer to the new interface entry is returned, on failure NULL
 483  * is returned.  The caller is responsible for calling the rcu_read_[un]lock()
 484  * functions.
 485  *
 486  */
 487 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
 488 {
 489         u32 bkt;
 490         struct netlbl_unlhsh_iface *iface;
 491
 492         iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
 493         if (iface == NULL)
 494                 return NULL;
 495
 496         iface->ifindex = ifindex;
 497         INIT_LIST_HEAD(&iface->addr4_list);
 498         INIT_LIST_HEAD(&iface->addr6_list);
 499         iface->valid = 1;
 500         INIT_RCU_HEAD(&iface->rcu);
 501
 502         spin_lock(&netlbl_unlhsh_lock);
 503         if (ifindex > 0) {
 504                 bkt = netlbl_unlhsh_hash(ifindex);
 505                 if (netlbl_unlhsh_search_iface(ifindex) != NULL)
 506                         goto add_iface_failure;
 507                 list_add_tail_rcu(&iface->list,
 508                                   &rcu_dereference(netlbl_unlhsh)->tbl[bkt]);
 509         } else {
 510                 INIT_LIST_HEAD(&iface->list);
 511                 if (rcu_dereference(netlbl_unlhsh_def) != NULL)
 512                         goto add_iface_failure;
 513                 rcu_assign_pointer(netlbl_unlhsh_def, iface);
 514         }
 515         spin_unlock(&netlbl_unlhsh_lock);
 516
 517         return iface;
 518
 519 add_iface_failure:
 520         spin_unlock(&netlbl_unlhsh_lock);
 521         kfree(iface);
 522         return NULL;
 523 }
 524
 525 /**
 526  * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
 527  * @net: network namespace
 528  * @dev_name: interface name
 529  * @addr: IP address in network byte order
 530  * @mask: address mask in network byte order
 531  * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
 532  * @secid: LSM secid value for the entry
 533  *
 534  * Description:
 535  * Adds a new entry to the unlabeled connection hash table.  Returns zero on
 536  * success, negative values on failure.
 537  *
 538  */
 539 static int netlbl_unlhsh_add(struct net *net,
 540                              const char *dev_name,
 541                              const void *addr,
 542                              const void *mask,
 543                              u32 addr_len,
 544                              u32 secid)
 545 {
 546         int ret_val;
 547         int ifindex;
 548         struct net_device *dev;
 549         struct netlbl_unlhsh_iface *iface;
 550
 551         if (addr_len != sizeof(struct in_addr) &&
 552             addr_len != sizeof(struct in6_addr))
 553                 return -EINVAL;
 554
 555         rcu_read_lock();
 556         if (dev_name != NULL) {
 557                 dev = dev_get_by_name(net, dev_name);
 558                 if (dev == NULL) {
 559                         ret_val = -ENODEV;
 560                         goto unlhsh_add_return;
 561                 }
 562                 ifindex = dev->ifindex;
 563                 dev_put(dev);
 564                 iface = netlbl_unlhsh_search_iface(ifindex);
 565         } else {
 566                 ifindex = 0;
 567                 iface = rcu_dereference(netlbl_unlhsh_def);
 568         }
 569         if (iface == NULL) {
 570                 iface = netlbl_unlhsh_add_iface(ifindex);
 571                 if (iface == NULL) {
 572                         ret_val = -ENOMEM;
 573                         goto unlhsh_add_return;
 574                 }
 575         }
 576         switch (addr_len) {
 577         case sizeof(struct in_addr):
 578                 ret_val = netlbl_unlhsh_add_addr4(iface, addr, mask, secid);
 579                 break;
 580 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 581         case sizeof(struct in6_addr):
 582                 ret_val = netlbl_unlhsh_add_addr6(iface, addr, mask, secid);
 583                 break;
 584 #endif /* IPv6 */
 585         default:
 586                 ret_val = -EINVAL;
 587         }
 588         if (ret_val == 0)
 589                 atomic_inc(&netlabel_mgmt_protocount);
 590
 591 unlhsh_add_return:
 592         rcu_read_unlock();
 593         return ret_val;
 594 }
 595
 596 /**
 597  * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
 598  * @iface: interface entry
 599  * @addr: IP address
 600  * @mask: IP address mask
 601  *
 602  * Description:
 603  * Remove an IP address entry from the unlabeled connection hash table.
 604  * Returns zero on success, negative values on failure.  The caller is
 605  * responsible for calling the rcu_read_[un]lock() functions.
 606  *
 607  */
 608 static int netlbl_unlhsh_remove_addr4(struct netlbl_unlhsh_iface *iface,
 609                                       const struct in_addr *addr,
 610                                       const struct in_addr *mask)
 611 {
 612         int ret_val = -ENOENT;
 613         struct netlbl_unlhsh_addr4 *entry;
 614
 615         spin_lock(&netlbl_unlhsh_lock);
 616         entry = netlbl_unlhsh_search_addr4(addr->s_addr, iface);
 617         if (entry != NULL &&
 618             entry->addr == addr->s_addr && entry->mask == mask->s_addr) {
 619                 entry->valid = 0;
 620                 list_del_rcu(&entry->list);
 621                 ret_val = 0;
 622         }
 623         spin_unlock(&netlbl_unlhsh_lock);
 624
 625         if (ret_val == 0)
 626                 call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
 627         return ret_val;
 628 }
 629
 630 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 631 /**
 632  * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
 633  * @iface: interface entry
 634  * @addr: IP address
 635  * @mask: IP address mask
 636  *
 637  * Description:
 638  * Remove an IP address entry from the unlabeled connection hash table.
 639  * Returns zero on success, negative values on failure.  The caller is
 640  * responsible for calling the rcu_read_[un]lock() functions.
 641  *
 642  */
 643 static int netlbl_unlhsh_remove_addr6(struct netlbl_unlhsh_iface *iface,
 644                                       const struct in6_addr *addr,
 645                                       const struct in6_addr *mask)
 646 {
 647         int ret_val = -ENOENT;
 648         struct netlbl_unlhsh_addr6 *entry;
 649
 650         spin_lock(&netlbl_unlhsh_lock);
 651         entry = netlbl_unlhsh_search_addr6(addr, iface);
 652         if (entry != NULL &&
 653             (ipv6_addr_equal(&entry->addr, addr) &&
 654              ipv6_addr_equal(&entry->mask, mask))) {
 655                 entry->valid = 0;
 656                 list_del_rcu(&entry->list);
 657                 ret_val = 0;
 658         }
 659         spin_unlock(&netlbl_unlhsh_lock);
 660
 661         if (ret_val == 0)
 662                 call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
 663         return ret_val;
 664 }
 665 #endif /* IPv6 */
 666
 667 /**
 668  * netlbl_unlhsh_condremove_iface - Remove an interface entry
 669  * @iface: the interface entry
 670  *
 671  * Description:
 672  * Remove an interface entry from the unlabeled connection hash table if it is
 673  * empty.  An interface entry is considered to be empty if there are no
 674  * address entries assigned to it.
 675  *
 676  */
 677 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
 678 {
 679         struct netlbl_unlhsh_addr4 *iter4;
 680         struct netlbl_unlhsh_addr6 *iter6;
 681
 682         spin_lock(&netlbl_unlhsh_lock);
 683         list_for_each_entry_rcu(iter4, &iface->addr4_list, list)
 684                 if (iter4->valid)
 685                         goto unlhsh_condremove_failure;
 686         list_for_each_entry_rcu(iter6, &iface->addr6_list, list)
 687                 if (iter6->valid)
 688                         goto unlhsh_condremove_failure;
 689         iface->valid = 0;
 690         if (iface->ifindex > 0)
 691                 list_del_rcu(&iface->list);
 692         else
 693                 rcu_assign_pointer(netlbl_unlhsh_def, NULL);
 694         spin_unlock(&netlbl_unlhsh_lock);
 695
 696         call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
 697         return;
 698
 699 unlhsh_condremove_failure:
 700         spin_unlock(&netlbl_unlhsh_lock);
 701         return;
 702 }
 703
 704 /**
 705  * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
 706  * @net: network namespace
 707  * @dev_name: interface name
 708  * @addr: IP address in network byte order
 709  * @mask: address mask in network byte order
 710  * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
 711  *
 712  * Description:
 713  * Removes and existing entry from the unlabeled connection hash table.
 714  * Returns zero on success, negative values on failure.
 715  *
 716  */
 717 static int netlbl_unlhsh_remove(struct net *net,
 718                                 const char *dev_name,
 719                                 const void *addr,
 720                                 const void *mask,
 721                                 u32 addr_len)
 722 {
 723         int ret_val;
 724         struct net_device *dev;
 725         struct netlbl_unlhsh_iface *iface;
 726
 727         if (addr_len != sizeof(struct in_addr) &&
 728             addr_len != sizeof(struct in6_addr))
 729                 return -EINVAL;
 730
 731         rcu_read_lock();
 732         if (dev_name != NULL) {
 733                 dev = dev_get_by_name(net, dev_name);
 734                 if (dev == NULL) {
 735                         ret_val = -ENODEV;
 736                         goto unlhsh_remove_return;
 737                 }
 738                 iface = netlbl_unlhsh_search_iface(dev->ifindex);
 739                 dev_put(dev);
 740         } else
 741                 iface = rcu_dereference(netlbl_unlhsh_def);
 742         if (iface == NULL) {
 743                 ret_val = -ENOENT;
 744                 goto unlhsh_remove_return;
 745         }
 746         switch (addr_len) {
 747         case sizeof(struct in_addr):
 748                 ret_val = netlbl_unlhsh_remove_addr4(iface, addr, mask);
 749                 break;
 750 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 751         case sizeof(struct in6_addr):
 752                 ret_val = netlbl_unlhsh_remove_addr6(iface, addr, mask);
 753                 break;
 754 #endif /* IPv6 */
 755         default:
 756                 ret_val = -EINVAL;
 757         }
 758         if (ret_val == 0) {
 759                 netlbl_unlhsh_condremove_iface(iface);
 760                 atomic_dec(&netlabel_mgmt_protocount);
 761         }
 762
 763 unlhsh_remove_return:
 764         rcu_read_unlock();
 765         return ret_val;
 766 }
 767
 768 /*
 769  * General Helper Functions
 770  */
 771
 772 /**
 773  * netlbl_unlhsh_netdev_handler - Network device notification handler
 774  * @this: notifier block
 775  * @event: the event
 776  * @ptr: the network device (cast to void)
 777  *
 778  * Description:
 779  * Handle network device events, although at present all we care about is a
 780  * network device going away.  In the case of a device going away we clear any
 781  * related entries from the unlabeled connection hash table.
 782  *
 783  */
 784 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
 785                                         unsigned long event,
 786                                         void *ptr)
 787 {
 788         struct net_device *dev = ptr;
 789         struct netlbl_unlhsh_iface *iface = NULL;
 790
 791         if (dev->nd_net != &init_net)
 792                 return NOTIFY_DONE;
 793
 794         /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
 795         if (event == NETDEV_DOWN) {
 796                 spin_lock(&netlbl_unlhsh_lock);
 797                 iface = netlbl_unlhsh_search_iface(dev->ifindex);
 798                 if (iface != NULL && iface->valid) {
 799                         iface->valid = 0;
 800                         list_del_rcu(&iface->list);
 801                 } else
 802                         iface = NULL;
 803                 spin_unlock(&netlbl_unlhsh_lock);
 804         }
 805
 806         if (iface != NULL)
 807                 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
 808
 809         return NOTIFY_DONE;
 810 }
 811
 812 /**
 813  * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
 814  * @value: desired value
 815  * @audit_info: NetLabel audit information
 816  *
 817  * Description:
 818  * Set the value of the unlabeled accept flag to @value.
 819  *
 820  */
 821 static void netlbl_unlabel_acceptflg_set(u8 value,
 822                                          struct netlbl_audit *audit_info)
 823 {
 824         struct audit_buffer *audit_buf;
 825         u8 old_val;
 826
 827         old_val = netlabel_unlabel_acceptflg;
 828         netlabel_unlabel_acceptflg = value;
 829         audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
 830                                               audit_info);
 831         if (audit_buf != NULL) {
 832                 audit_log_format(audit_buf,
 833                                  " unlbl_accept=%u old=%u", value, old_val);
 834                 audit_log_end(audit_buf);
 835         }
 836 }
 837
 838 /**
 839  * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
 840  * @info: the Generic NETLINK info block
 841  * @addr: the IP address
 842  * @mask: the IP address mask
 843  * @len: the address length
 844  *
 845  * Description:
 846  * Examine the Generic NETLINK message and extract the IP address information.
 847  * Returns zero on success, negative values on failure.
 848  *
 849  */
 850 static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
 851                                        void **addr,
 852                                        void **mask,
 853                                        u32 *len)
 854 {
 855         u32 addr_len;
 856
 857         if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) {
 858                 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
 859                 if (addr_len != sizeof(struct in_addr) &&
 860                     addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
 861                         return -EINVAL;
 862                 *len = addr_len;
 863                 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
 864                 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
 865                 return 0;
 866         } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
 867                 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
 868                 if (addr_len != sizeof(struct in6_addr) &&
 869                     addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
 870                         return -EINVAL;
 871                 *len = addr_len;
 872                 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
 873                 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
 874                 return 0;
 875         }
 876
 877         return -EINVAL;
 878 }
 879
 880 /*
 881  * NetLabel Command Handlers
 882  */
 883
 884 /**
 885  * netlbl_unlabel_accept - Handle an ACCEPT message
 886  * @skb: the NETLINK buffer
 887  * @info: the Generic NETLINK info block
 888  *
 889  * Description:
 890  * Process a user generated ACCEPT message and set the accept flag accordingly.
 891  * Returns zero on success, negative values on failure.
 892  *
 893  */
 894 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
 895 {
 896         u8 value;
 897         struct netlbl_audit audit_info;
 898
 899         if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
 900                 value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
 901                 if (value == 1 || value == 0) {
 902                         netlbl_netlink_auditinfo(skb, &audit_info);
 903                         netlbl_unlabel_acceptflg_set(value, &audit_info);
 904                         return 0;
 905                 }
 906         }
 907
 908         return -EINVAL;
 909 }
 910
 911 /**
 912  * netlbl_unlabel_list - Handle a LIST message
 913  * @skb: the NETLINK buffer
 914  * @info: the Generic NETLINK info block
 915  *
 916  * Description:
 917  * Process a user generated LIST message and respond with the current status.
 918  * Returns zero on success, negative values on failure.
 919  *
 920  */
 921 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
 922 {
 923         int ret_val = -EINVAL;
 924         struct sk_buff *ans_skb;
 925         void *data;
 926
 927         ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 928         if (ans_skb == NULL)
 929                 goto list_failure;
 930         data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
 931                                  0, NLBL_UNLABEL_C_LIST);
 932         if (data == NULL) {
 933                 ret_val = -ENOMEM;
 934                 goto list_failure;
 935         }
 936
 937         ret_val = nla_put_u8(ans_skb,
 938                              NLBL_UNLABEL_A_ACPTFLG,
 939                              netlabel_unlabel_acceptflg);
 940         if (ret_val != 0)
 941                 goto list_failure;
 942
 943         genlmsg_end(ans_skb, data);
 944
 945         ret_val = genlmsg_reply(ans_skb, info);
 946         if (ret_val != 0)
 947                 goto list_failure;
 948         return 0;
 949
 950 list_failure:
 951         kfree_skb(ans_skb);
 952         return ret_val;
 953 }
 954
 955 /**
 956  * netlbl_unlabel_staticadd - Handle a STATICADD message
 957  * @skb: the NETLINK buffer
 958  * @info: the Generic NETLINK info block
 959  *
 960  * Description:
 961  * Process a user generated STATICADD message and add a new unlabeled
 962  * connection entry to the hash table.  Returns zero on success, negative
 963  * values on failure.
 964  *
 965  */
 966 static int netlbl_unlabel_staticadd(struct sk_buff *skb,
 967                                     struct genl_info *info)
 968 {
 969         int ret_val;
 970         char *dev_name;
 971         void *addr;
 972         void *mask;
 973         u32 addr_len;
 974         u32 secid;
 975
 976         /* Don't allow users to add both IPv4 and IPv6 addresses for a
 977          * single entry.  However, allow users to create two entries, one each
 978          * for IPv4 and IPv4, with the same LSM security context which should
 979          * achieve the same result. */
 980         if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
 981             !info->attrs[NLBL_UNLABEL_A_IFACE] ||
 982             !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
 983                !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
 984               (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
 985                !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 986                 return -EINVAL;
 987
 988         ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 989         if (ret_val != 0)
 990                 return ret_val;
 991         dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
 992         ret_val = security_secctx_to_secid(
 993                                   nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 994                                   nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 995                                   &secid);
 996         if (ret_val != 0)
 997                 return ret_val;
 998
 999         return netlbl_unlhsh_add(&init_net,
1000                                  dev_name, addr, mask, addr_len, secid);
1001 }
1002
1003 /**
1004  * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
1005  * @skb: the NETLINK buffer
1006  * @info: the Generic NETLINK info block
1007  *
1008  * Description:
1009  * Process a user generated STATICADDDEF message and add a new default
1010  * unlabeled connection entry.  Returns zero on success, negative values on
1011  * failure.
1012  *
1013  */
1014 static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
1015                                        struct genl_info *info)
1016 {
1017         int ret_val;
1018         void *addr;
1019         void *mask;
1020         u32 addr_len;
1021         u32 secid;
1022
1023         /* Don't allow users to add both IPv4 and IPv6 addresses for a
1024          * single entry.  However, allow users to create two entries, one each
1025          * for IPv4 and IPv6, with the same LSM security context which should
1026          * achieve the same result. */
1027         if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
1028             !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1029                !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1030               (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1031                !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1032                 return -EINVAL;
1033
1034         ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1035         if (ret_val != 0)
1036                 return ret_val;
1037         ret_val = security_secctx_to_secid(
1038                                   nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1039                                   nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1040                                   &secid);
1041         if (ret_val != 0)
1042                 return ret_val;
1043
1044         return netlbl_unlhsh_add(&init_net, NULL, addr, mask, addr_len, secid);
1045 }
1046
1047 /**
1048  * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
1049  * @skb: the NETLINK buffer
1050  * @info: the Generic NETLINK info block
1051  *
1052  * Description:
1053  * Process a user generated STATICREMOVE message and remove the specified
1054  * unlabeled connection entry.  Returns zero on success, negative values on
1055  * failure.
1056  *
1057  */
1058 static int netlbl_unlabel_staticremove(struct sk_buff *skb,
1059                                        struct genl_info *info)
1060 {
1061         int ret_val;
1062         char *dev_name;
1063         void *addr;
1064         void *mask;
1065         u32 addr_len;
1066
1067         /* See the note in netlbl_unlabel_staticadd() about not allowing both
1068          * IPv4 and IPv6 in the same entry. */
1069         if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
1070             !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1071                !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1072               (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1073                !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1074                 return -EINVAL;
1075
1076         ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1077         if (ret_val != 0)
1078                 return ret_val;
1079         dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
1080
1081         return netlbl_unlhsh_remove(&init_net, dev_name, addr, mask, addr_len);
1082 }
1083
1084 /**
1085  * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1086  * @skb: the NETLINK buffer
1087  * @info: the Generic NETLINK info block
1088  *
1089  * Description:
1090  * Process a user generated STATICREMOVEDEF message and remove the default
1091  * unlabeled connection entry.  Returns zero on success, negative values on
1092  * failure.
1093  *
1094  */
1095 static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
1096                                           struct genl_info *info)
1097 {
1098         int ret_val;
1099         void *addr;
1100         void *mask;
1101         u32 addr_len;
1102
1103         /* See the note in netlbl_unlabel_staticadd() about not allowing both
1104          * IPv4 and IPv6 in the same entry. */
1105         if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1106                !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1107               (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1108                !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1109                 return -EINVAL;
1110
1111         ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1112         if (ret_val != 0)
1113                 return ret_val;
1114
1115         return netlbl_unlhsh_remove(&init_net, NULL, addr, mask, addr_len);
1116 }
1117
1118
1119 /**
1120  * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1121  * @cmd: command/message
1122  * @iface: the interface entry
1123  * @addr4: the IPv4 address entry
1124  * @addr6: the IPv6 address entry
1125  * @arg: the netlbl_unlhsh_walk_arg structure
1126  *
1127  * Description:
1128  * This function is designed to be used to generate a response for a
1129  * STATICLIST or STATICLISTDEF message.  When called either @addr4 or @addr6
1130  * can be specified, not both, the other unspecified entry should be set to
1131  * NULL by the caller.  Returns the size of the message on success, negative
1132  * values on failure.
1133  *
1134  */
1135 static int netlbl_unlabel_staticlist_gen(u32 cmd,
1136                                        const struct netlbl_unlhsh_iface *iface,
1137                                        const struct netlbl_unlhsh_addr4 *addr4,
1138                                        const struct netlbl_unlhsh_addr6 *addr6,
1139                                        void *arg)
1140 {
1141         int ret_val = -ENOMEM;
1142         struct netlbl_unlhsh_walk_arg *cb_arg = arg;
1143         struct net_device *dev;
1144         void *data;
1145         u32 secid;
1146         char *secctx;
1147         u32 secctx_len;
1148
1149         data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
1150                            cb_arg->seq, &netlbl_unlabel_gnl_family,
1151                            NLM_F_MULTI, cmd);
1152         if (data == NULL)
1153                 goto list_cb_failure;
1154
1155         if (iface->ifindex > 0) {
1156                 dev = dev_get_by_index(&init_net, iface->ifindex);
1157                 ret_val = nla_put_string(cb_arg->skb,
1158                                          NLBL_UNLABEL_A_IFACE, dev->name);
1159                 dev_put(dev);
1160                 if (ret_val != 0)
1161                         goto list_cb_failure;
1162         }
1163
1164         if (addr4) {
1165                 struct in_addr addr_struct;
1166
1167                 addr_struct.s_addr = addr4->addr;
1168                 ret_val = nla_put(cb_arg->skb,
1169                                   NLBL_UNLABEL_A_IPV4ADDR,
1170                                   sizeof(struct in_addr),
1171                                   &addr_struct);
1172                 if (ret_val != 0)
1173                         goto list_cb_failure;
1174
1175                 addr_struct.s_addr = addr4->mask;
1176                 ret_val = nla_put(cb_arg->skb,
1177                                   NLBL_UNLABEL_A_IPV4MASK,
1178                                   sizeof(struct in_addr),
1179                                   &addr_struct);
1180                 if (ret_val != 0)
1181                         goto list_cb_failure;
1182
1183                 secid = addr4->secid;
1184         } else {
1185                 ret_val = nla_put(cb_arg->skb,
1186                                   NLBL_UNLABEL_A_IPV6ADDR,
1187                                   sizeof(struct in6_addr),
1188                                   &addr6->addr);
1189                 if (ret_val != 0)
1190                         goto list_cb_failure;
1191
1192                 ret_val = nla_put(cb_arg->skb,
1193                                   NLBL_UNLABEL_A_IPV6MASK,
1194                                   sizeof(struct in6_addr),
1195                                   &addr6->mask);
1196                 if (ret_val != 0)
1197                         goto list_cb_failure;
1198
1199                 secid = addr6->secid;
1200         }
1201
1202         ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
1203         if (ret_val != 0)
1204                 goto list_cb_failure;
1205         ret_val = nla_put(cb_arg->skb,
1206                           NLBL_UNLABEL_A_SECCTX,
1207                           secctx_len,
1208                           secctx);
1209         security_release_secctx(secctx, secctx_len);
1210         if (ret_val != 0)
1211                 goto list_cb_failure;
1212
1213         cb_arg->seq++;
1214         return genlmsg_end(cb_arg->skb, data);
1215
1216 list_cb_failure:
1217         genlmsg_cancel(cb_arg->skb, data);
1218         return ret_val;
1219 }
1220
1221 /**
1222  * netlbl_unlabel_staticlist - Handle a STATICLIST message
1223  * @skb: the NETLINK buffer
1224  * @cb: the NETLINK callback
1225  *
1226  * Description:
1227  * Process a user generated STATICLIST message and dump the unlabeled
1228  * connection hash table in a form suitable for use in a kernel generated
1229  * STATICLIST message.  Returns the length of @skb.
1230  *
1231  */
1232 static int netlbl_unlabel_staticlist(struct sk_buff *skb,
1233                                      struct netlink_callback *cb)
1234 {
1235         struct netlbl_unlhsh_walk_arg cb_arg;
1236         u32 skip_bkt = cb->args[0];
1237         u32 skip_chain = cb->args[1];
1238         u32 skip_addr4 = cb->args[2];
1239         u32 skip_addr6 = cb->args[3];
1240         u32 iter_bkt;
1241         u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
1242         struct netlbl_unlhsh_iface *iface;
1243         struct netlbl_unlhsh_addr4 *addr4;
1244         struct netlbl_unlhsh_addr6 *addr6;
1245
1246         cb_arg.nl_cb = cb;
1247         cb_arg.skb = skb;
1248         cb_arg.seq = cb->nlh->nlmsg_seq;
1249
1250         rcu_read_lock();
1251         for (iter_bkt = skip_bkt;
1252              iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
1253              iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
1254                 list_for_each_entry_rcu(iface,
1255                                 &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt],
1256                                 list) {
1257                         if (!iface->valid ||
1258                             iter_chain++ < skip_chain)
1259                                 continue;
1260                         list_for_each_entry_rcu(addr4,
1261                                                 &iface->addr4_list,
1262                                                 list) {
1263                                 if (!addr4->valid || iter_addr4++ < skip_addr4)
1264                                         continue;
1265                                 if (netlbl_unlabel_staticlist_gen(
1266                                                      NLBL_UNLABEL_C_STATICLIST,
1267                                                      iface,
1268                                                      addr4,
1269                                                      NULL,
1270                                                      &cb_arg) < 0) {
1271                                         iter_addr4--;
1272                                         iter_chain--;
1273                                         goto unlabel_staticlist_return;
1274                                 }
1275                         }
1276                         list_for_each_entry_rcu(addr6,
1277                                                 &iface->addr6_list,
1278                                                 list) {
1279                                 if (!addr6->valid || iter_addr6++ < skip_addr6)
1280                                         continue;
1281                                 if (netlbl_unlabel_staticlist_gen(
1282                                                      NLBL_UNLABEL_C_STATICLIST,
1283                                                      iface,
1284                                                      NULL,
1285                                                      addr6,
1286                                                      &cb_arg) < 0) {
1287                                         iter_addr6--;
1288                                         iter_chain--;
1289                                         goto unlabel_staticlist_return;
1290                                 }
1291                         }
1292                 }
1293         }
1294
1295 unlabel_staticlist_return:
1296         rcu_read_unlock();
1297         cb->args[0] = skip_bkt;
1298         cb->args[1] = skip_chain;
1299         cb->args[2] = skip_addr4;
1300         cb->args[3] = skip_addr6;
1301         return skb->len;
1302 }
1303
1304 /**
1305  * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1306  * @skb: the NETLINK buffer
1307  * @cb: the NETLINK callback
1308  *
1309  * Description:
1310  * Process a user generated STATICLISTDEF message and dump the default
1311  * unlabeled connection entry in a form suitable for use in a kernel generated
1312  * STATICLISTDEF message.  Returns the length of @skb.
1313  *
1314  */
1315 static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
1316                                         struct netlink_callback *cb)
1317 {
1318         struct netlbl_unlhsh_walk_arg cb_arg;
1319         struct netlbl_unlhsh_iface *iface;
1320         u32 skip_addr4 = cb->args[0];
1321         u32 skip_addr6 = cb->args[1];
1322         u32 iter_addr4 = 0, iter_addr6 = 0;
1323         struct netlbl_unlhsh_addr4 *addr4;
1324         struct netlbl_unlhsh_addr6 *addr6;
1325
1326         cb_arg.nl_cb = cb;
1327         cb_arg.skb = skb;
1328         cb_arg.seq = cb->nlh->nlmsg_seq;
1329
1330         rcu_read_lock();
1331         iface = rcu_dereference(netlbl_unlhsh_def);
1332         if (iface == NULL || !iface->valid)
1333                 goto unlabel_staticlistdef_return;
1334
1335         list_for_each_entry_rcu(addr4, &iface->addr4_list, list) {
1336                 if (!addr4->valid || iter_addr4++ < skip_addr4)
1337                         continue;
1338                 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1339                                            iface,
1340                                            addr4,
1341                                            NULL,
1342                                            &cb_arg) < 0) {
1343                         iter_addr4--;
1344                         goto unlabel_staticlistdef_return;
1345                 }
1346         }
1347         list_for_each_entry_rcu(addr6, &iface->addr6_list, list) {
1348                 if (addr6->valid || iter_addr6++ < skip_addr6)
1349                         continue;
1350                 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1351                                            iface,
1352                                            NULL,
1353                                            addr6,
1354                                            &cb_arg) < 0) {
1355                         iter_addr6--;
1356                         goto unlabel_staticlistdef_return;
1357                 }
1358         }
1359
1360 unlabel_staticlistdef_return:
1361         rcu_read_unlock();
1362         cb->args[0] = skip_addr4;
1363         cb->args[1] = skip_addr6;
1364         return skb->len;
1365 }
1366
1367 /*
1368  * NetLabel Generic NETLINK Command Definitions
1369  */
1370
1371 static struct genl_ops netlbl_unlabel_genl_c_staticadd = {
1372         .cmd = NLBL_UNLABEL_C_STATICADD,
1373         .flags = GENL_ADMIN_PERM,
1374         .policy = netlbl_unlabel_genl_policy,
1375         .doit = netlbl_unlabel_staticadd,
1376         .dumpit = NULL,
1377 };
1378
1379 static struct genl_ops netlbl_unlabel_genl_c_staticremove = {
1380         .cmd = NLBL_UNLABEL_C_STATICREMOVE,
1381         .flags = GENL_ADMIN_PERM,
1382         .policy = netlbl_unlabel_genl_policy,
1383         .doit = netlbl_unlabel_staticremove,
1384         .dumpit = NULL,
1385 };
1386
1387 static struct genl_ops netlbl_unlabel_genl_c_staticlist = {
1388         .cmd = NLBL_UNLABEL_C_STATICLIST,
1389         .flags = 0,
1390         .policy = netlbl_unlabel_genl_policy,
1391         .doit = NULL,
1392         .dumpit = netlbl_unlabel_staticlist,
1393 };
1394
1395 static struct genl_ops netlbl_unlabel_genl_c_staticadddef = {
1396         .cmd = NLBL_UNLABEL_C_STATICADDDEF,
1397         .flags = GENL_ADMIN_PERM,
1398         .policy = netlbl_unlabel_genl_policy,
1399         .doit = netlbl_unlabel_staticadddef,
1400         .dumpit = NULL,
1401 };
1402
1403 static struct genl_ops netlbl_unlabel_genl_c_staticremovedef = {
1404         .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
1405         .flags = GENL_ADMIN_PERM,
1406         .policy = netlbl_unlabel_genl_policy,
1407         .doit = netlbl_unlabel_staticremovedef,
1408         .dumpit = NULL,
1409 };
1410
1411 static struct genl_ops netlbl_unlabel_genl_c_staticlistdef = {
1412         .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
1413         .flags = 0,
1414         .policy = netlbl_unlabel_genl_policy,
1415         .doit = NULL,
1416         .dumpit = netlbl_unlabel_staticlistdef,
1417 };
1418
1419 static struct genl_ops netlbl_unlabel_genl_c_accept = {
1420         .cmd = NLBL_UNLABEL_C_ACCEPT,
1421         .flags = GENL_ADMIN_PERM,
1422         .policy = netlbl_unlabel_genl_policy,
1423         .doit = netlbl_unlabel_accept,
1424         .dumpit = NULL,
1425 };
1426
1427 static struct genl_ops netlbl_unlabel_genl_c_list = {
1428         .cmd = NLBL_UNLABEL_C_LIST,
1429         .flags = 0,
1430         .policy = netlbl_unlabel_genl_policy,
1431         .doit = netlbl_unlabel_list,
1432         .dumpit = NULL,
1433 };
1434
1435 /*
1436  * NetLabel Generic NETLINK Protocol Functions
1437  */
1438
1439 /**
1440  * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1441  *
1442  * Description:
1443  * Register the unlabeled packet NetLabel component with the Generic NETLINK
1444  * mechanism.  Returns zero on success, negative values on failure.
1445  *
1446  */
1447 int netlbl_unlabel_genl_init(void)
1448 {
1449         int ret_val;
1450
1451         ret_val = genl_register_family(&netlbl_unlabel_gnl_family);
1452         if (ret_val != 0)
1453                 return ret_val;
1454
1455         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1456                                     &netlbl_unlabel_genl_c_staticadd);
1457         if (ret_val != 0)
1458                 return ret_val;
1459
1460         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1461                                     &netlbl_unlabel_genl_c_staticremove);
1462         if (ret_val != 0)
1463                 return ret_val;
1464
1465         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1466                                     &netlbl_unlabel_genl_c_staticlist);
1467         if (ret_val != 0)
1468                 return ret_val;
1469
1470         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1471                                     &netlbl_unlabel_genl_c_staticadddef);
1472         if (ret_val != 0)
1473                 return ret_val;
1474
1475         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1476                                     &netlbl_unlabel_genl_c_staticremovedef);
1477         if (ret_val != 0)
1478                 return ret_val;
1479
1480         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1481                                     &netlbl_unlabel_genl_c_staticlistdef);
1482         if (ret_val != 0)
1483                 return ret_val;
1484
1485         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1486                                     &netlbl_unlabel_genl_c_accept);
1487         if (ret_val != 0)
1488                 return ret_val;
1489
1490         ret_val = genl_register_ops(&netlbl_unlabel_gnl_family,
1491                                     &netlbl_unlabel_genl_c_list);
1492         if (ret_val != 0)
1493                 return ret_val;
1494
1495         return 0;
1496 }
1497
1498 /*
1499  * NetLabel KAPI Hooks
1500  */
1501
1502 static struct notifier_block netlbl_unlhsh_netdev_notifier = {
1503         .notifier_call = netlbl_unlhsh_netdev_handler,
1504 };
1505
1506 /**
1507  * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1508  * @size: the number of bits to use for the hash buckets
1509  *
1510  * Description:
1511  * Initializes the unlabeled connection hash table and registers a network
1512  * device notification handler.  This function should only be called by the
1513  * NetLabel subsystem itself during initialization.  Returns zero on success,
1514  * non-zero values on error.
1515  *
1516  */
1517 int netlbl_unlabel_init(u32 size)
1518 {
1519         u32 iter;
1520         struct netlbl_unlhsh_tbl *hsh_tbl;
1521
1522         if (size == 0)
1523                 return -EINVAL;
1524
1525         hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
1526         if (hsh_tbl == NULL)
1527                 return -ENOMEM;
1528         hsh_tbl->size = 1 << size;
1529         hsh_tbl->tbl = kcalloc(hsh_tbl->size,
1530                                sizeof(struct list_head),
1531                                GFP_KERNEL);
1532         if (hsh_tbl->tbl == NULL) {
1533                 kfree(hsh_tbl);
1534                 return -ENOMEM;
1535         }
1536         for (iter = 0; iter < hsh_tbl->size; iter++)
1537                 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
1538
1539         rcu_read_lock();
1540         spin_lock(&netlbl_unlhsh_lock);
1541         rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
1542         spin_unlock(&netlbl_unlhsh_lock);
1543         rcu_read_unlock();
1544
1545         register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
1546
1547         return 0;
1548 }
1549
1550 /**
1551  * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1552  * @skb: the packet
1553  * @family: protocol family
1554  * @secattr: the security attributes
1555  *
1556  * Description:
1557  * Determine the security attributes, if any, for an unlabled packet and return
1558  * them in @secattr.  Returns zero on success and negative values on failure.
1559  *
1560  */
1561 int netlbl_unlabel_getattr(const struct sk_buff *skb,
1562                            u16 family,
1563                            struct netlbl_lsm_secattr *secattr)
1564 {
1565         struct iphdr *hdr4;
1566         struct ipv6hdr *hdr6;
1567         struct netlbl_unlhsh_addr4 *addr4;
1568         struct netlbl_unlhsh_addr6 *addr6;
1569         struct netlbl_unlhsh_iface *iface;
1570
1571         rcu_read_lock();
1572         iface = netlbl_unlhsh_search_iface_def(skb->iif);
1573         if (iface == NULL)
1574                 goto unlabel_getattr_nolabel;
1575         switch (family) {
1576         case PF_INET:
1577                 hdr4 = ip_hdr(skb);
1578                 addr4 = netlbl_unlhsh_search_addr4(hdr4->saddr, iface);
1579                 if (addr4 == NULL)
1580                         goto unlabel_getattr_nolabel;
1581                 secattr->attr.secid = addr4->secid;
1582                 break;
1583 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1584         case PF_INET6:
1585                 hdr6 = ipv6_hdr(skb);
1586                 addr6 = netlbl_unlhsh_search_addr6(&hdr6->saddr, iface);
1587                 if (addr6 == NULL)
1588                         goto unlabel_getattr_nolabel;
1589                 secattr->attr.secid = addr6->secid;
1590                 break;
1591 #endif /* IPv6 */
1592         default:
1593                 goto unlabel_getattr_nolabel;
1594         }
1595         rcu_read_unlock();
1596
1597         secattr->flags |= NETLBL_SECATTR_SECID;
1598         secattr->type = NETLBL_NLTYPE_UNLABELED;
1599         return 0;
1600
1601 unlabel_getattr_nolabel:
1602         rcu_read_unlock();
1603         if (netlabel_unlabel_acceptflg == 0)
1604                 return -ENOMSG;
1605         secattr->type = NETLBL_NLTYPE_UNLABELED;
1606         return 0;
1607 }
1608
1609 /**
1610  * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1611  *
1612  * Description:
1613  * Set the default NetLabel configuration to allow incoming unlabeled packets
1614  * and to send unlabeled network traffic by default.
1615  *
1616  */
1617 int netlbl_unlabel_defconf(void)
1618 {
1619         int ret_val;
1620         struct netlbl_dom_map *entry;
1621         struct netlbl_audit audit_info;
1622
1623         /* Only the kernel is allowed to call this function and the only time
1624          * it is called is at bootup before the audit subsystem is reporting
1625          * messages so don't worry to much about these values. */
1626         security_task_getsecid(current, &audit_info.secid);
1627         audit_info.loginuid = 0;
1628
1629         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1630         if (entry == NULL)
1631                 return -ENOMEM;
1632         entry->type = NETLBL_NLTYPE_UNLABELED;
1633         ret_val = netlbl_domhsh_add_default(entry, &audit_info);
1634         if (ret_val != 0)
1635                 return ret_val;
1636
1637         netlbl_unlabel_acceptflg_set(1, &audit_info);
1638
1639         return 0;
1640 }