1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * NetLabel Network Address Lists
4  *
5  * This file contains network address list functions used to manage ordered
6  * lists of network addresses for use by the NetLabel subsystem.  The NetLabel
7  * system manages static and dynamic label mappings for network protocols such
8  * as CIPSO and RIPSO.
9  *
10  * Author: Paul Moore <paul@paul-moore.com>
11  */
12 
13 /*
14  * (c) Copyright Hewlett-Packard Development Company, L.P., 2008
15  */
16 
17 #include <linux/types.h>
18 #include <linux/rcupdate.h>
19 #include <linux/list.h>
20 #include <linux/spinlock.h>
21 #include <linux/in.h>
22 #include <linux/in6.h>
23 #include <linux/ip.h>
24 #include <linux/ipv6.h>
25 #include <net/ip.h>
26 #include <net/ipv6.h>
27 #include <linux/audit.h>
28 
29 #include "netlabel_addrlist.h"
30 
31 /*
32  * Address List Functions
33  */
34 
35 /**
36  * netlbl_af4list_search - Search for a matching IPv4 address entry
37  * @addr: IPv4 address
38  * @head: the list head
39  *
40  * Description:
41  * Searches the IPv4 address list given by @head.  If a matching address entry
42  * is found it is returned, otherwise NULL is returned.  The caller is
43  * responsible for calling the rcu_read_[un]lock() functions.
44  *
45  */
netlbl_af4list_search(__be32 addr,struct list_head * head)46 struct netlbl_af4list *netlbl_af4list_search(__be32 addr,
47 					     struct list_head *head)
48 {
49 	struct netlbl_af4list *iter;
50 
51 	list_for_each_entry_rcu(iter, head, list)
52 		if (iter->valid && (addr & iter->mask) == iter->addr)
53 			return iter;
54 
55 	return NULL;
56 }
57 
58 /**
59  * netlbl_af4list_search_exact - Search for an exact IPv4 address entry
60  * @addr: IPv4 address
61  * @mask: IPv4 address mask
62  * @head: the list head
63  *
64  * Description:
65  * Searches the IPv4 address list given by @head.  If an exact match if found
66  * it is returned, otherwise NULL is returned.  The caller is responsible for
67  * calling the rcu_read_[un]lock() functions.
68  *
69  */
netlbl_af4list_search_exact(__be32 addr,__be32 mask,struct list_head * head)70 struct netlbl_af4list *netlbl_af4list_search_exact(__be32 addr,
71 						   __be32 mask,
72 						   struct list_head *head)
73 {
74 	struct netlbl_af4list *iter;
75 
76 	list_for_each_entry_rcu(iter, head, list)
77 		if (iter->valid && iter->addr == addr && iter->mask == mask)
78 			return iter;
79 
80 	return NULL;
81 }
82 
83 
84 #if IS_ENABLED(CONFIG_IPV6)
85 /**
86  * netlbl_af6list_search - Search for a matching IPv6 address entry
87  * @addr: IPv6 address
88  * @head: the list head
89  *
90  * Description:
91  * Searches the IPv6 address list given by @head.  If a matching address entry
92  * is found it is returned, otherwise NULL is returned.  The caller is
93  * responsible for calling the rcu_read_[un]lock() functions.
94  *
95  */
netlbl_af6list_search(const struct in6_addr * addr,struct list_head * head)96 struct netlbl_af6list *netlbl_af6list_search(const struct in6_addr *addr,
97 					     struct list_head *head)
98 {
99 	struct netlbl_af6list *iter;
100 
101 	list_for_each_entry_rcu(iter, head, list)
102 		if (iter->valid &&
103 		    ipv6_masked_addr_cmp(&iter->addr, &iter->mask, addr) == 0)
104 			return iter;
105 
106 	return NULL;
107 }
108 
109 /**
110  * netlbl_af6list_search_exact - Search for an exact IPv6 address entry
111  * @addr: IPv6 address
112  * @mask: IPv6 address mask
113  * @head: the list head
114  *
115  * Description:
116  * Searches the IPv6 address list given by @head.  If an exact match if found
117  * it is returned, otherwise NULL is returned.  The caller is responsible for
118  * calling the rcu_read_[un]lock() functions.
119  *
120  */
netlbl_af6list_search_exact(const struct in6_addr * addr,const struct in6_addr * mask,struct list_head * head)121 struct netlbl_af6list *netlbl_af6list_search_exact(const struct in6_addr *addr,
122 						   const struct in6_addr *mask,
123 						   struct list_head *head)
124 {
125 	struct netlbl_af6list *iter;
126 
127 	list_for_each_entry_rcu(iter, head, list)
128 		if (iter->valid &&
129 		    ipv6_addr_equal(&iter->addr, addr) &&
130 		    ipv6_addr_equal(&iter->mask, mask))
131 			return iter;
132 
133 	return NULL;
134 }
135 #endif /* IPv6 */
136 
137 /**
138  * netlbl_af4list_add - Add a new IPv4 address entry to a list
139  * @entry: address entry
140  * @head: the list head
141  *
142  * Description:
143  * Add a new address entry to the list pointed to by @head.  On success zero is
144  * returned, otherwise a negative value is returned.  The caller is responsible
145  * for calling the necessary locking functions.
146  *
147  */
netlbl_af4list_add(struct netlbl_af4list * entry,struct list_head * head)148 int netlbl_af4list_add(struct netlbl_af4list *entry, struct list_head *head)
149 {
150 	struct netlbl_af4list *iter;
151 
152 	iter = netlbl_af4list_search(entry->addr, head);
153 	if (iter != NULL &&
154 	    iter->addr == entry->addr && iter->mask == entry->mask)
155 		return -EEXIST;
156 
157 	/* in order to speed up address searches through the list (the common
158 	 * case) we need to keep the list in order based on the size of the
159 	 * address mask such that the entry with the widest mask (smallest
160 	 * numerical value) appears first in the list */
161 	list_for_each_entry_rcu(iter, head, list)
162 		if (iter->valid &&
163 		    ntohl(entry->mask) > ntohl(iter->mask)) {
164 			__list_add_rcu(&entry->list,
165 				       iter->list.prev,
166 				       &iter->list);
167 			return 0;
168 		}
169 	list_add_tail_rcu(&entry->list, head);
170 	return 0;
171 }
172 
173 #if IS_ENABLED(CONFIG_IPV6)
174 /**
175  * netlbl_af6list_add - Add a new IPv6 address entry to a list
176  * @entry: address entry
177  * @head: the list head
178  *
179  * Description:
180  * Add a new address entry to the list pointed to by @head.  On success zero is
181  * returned, otherwise a negative value is returned.  The caller is responsible
182  * for calling the necessary locking functions.
183  *
184  */
netlbl_af6list_add(struct netlbl_af6list * entry,struct list_head * head)185 int netlbl_af6list_add(struct netlbl_af6list *entry, struct list_head *head)
186 {
187 	struct netlbl_af6list *iter;
188 
189 	iter = netlbl_af6list_search(&entry->addr, head);
190 	if (iter != NULL &&
191 	    ipv6_addr_equal(&iter->addr, &entry->addr) &&
192 	    ipv6_addr_equal(&iter->mask, &entry->mask))
193 		return -EEXIST;
194 
195 	/* in order to speed up address searches through the list (the common
196 	 * case) we need to keep the list in order based on the size of the
197 	 * address mask such that the entry with the widest mask (smallest
198 	 * numerical value) appears first in the list */
199 	list_for_each_entry_rcu(iter, head, list)
200 		if (iter->valid &&
201 		    ipv6_addr_cmp(&entry->mask, &iter->mask) > 0) {
202 			__list_add_rcu(&entry->list,
203 				       iter->list.prev,
204 				       &iter->list);
205 			return 0;
206 		}
207 	list_add_tail_rcu(&entry->list, head);
208 	return 0;
209 }
210 #endif /* IPv6 */
211 
212 /**
213  * netlbl_af4list_remove_entry - Remove an IPv4 address entry
214  * @entry: address entry
215  *
216  * Description:
217  * Remove the specified IP address entry.  The caller is responsible for
218  * calling the necessary locking functions.
219  *
220  */
netlbl_af4list_remove_entry(struct netlbl_af4list * entry)221 void netlbl_af4list_remove_entry(struct netlbl_af4list *entry)
222 {
223 	entry->valid = 0;
224 	list_del_rcu(&entry->list);
225 }
226 
227 /**
228  * netlbl_af4list_remove - Remove an IPv4 address entry
229  * @addr: IP address
230  * @mask: IP address mask
231  * @head: the list head
232  *
233  * Description:
234  * Remove an IP address entry from the list pointed to by @head.  Returns the
235  * entry on success, NULL on failure.  The caller is responsible for calling
236  * the necessary locking functions.
237  *
238  */
netlbl_af4list_remove(__be32 addr,__be32 mask,struct list_head * head)239 struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,
240 					     struct list_head *head)
241 {
242 	struct netlbl_af4list *entry;
243 
244 	entry = netlbl_af4list_search_exact(addr, mask, head);
245 	if (entry == NULL)
246 		return NULL;
247 	netlbl_af4list_remove_entry(entry);
248 	return entry;
249 }
250 
251 #if IS_ENABLED(CONFIG_IPV6)
252 /**
253  * netlbl_af6list_remove_entry - Remove an IPv6 address entry
254  * @entry: address entry
255  *
256  * Description:
257  * Remove the specified IP address entry.  The caller is responsible for
258  * calling the necessary locking functions.
259  *
260  */
netlbl_af6list_remove_entry(struct netlbl_af6list * entry)261 void netlbl_af6list_remove_entry(struct netlbl_af6list *entry)
262 {
263 	entry->valid = 0;
264 	list_del_rcu(&entry->list);
265 }
266 
267 /**
268  * netlbl_af6list_remove - Remove an IPv6 address entry
269  * @addr: IP address
270  * @mask: IP address mask
271  * @head: the list head
272  *
273  * Description:
274  * Remove an IP address entry from the list pointed to by @head.  Returns the
275  * entry on success, NULL on failure.  The caller is responsible for calling
276  * the necessary locking functions.
277  *
278  */
netlbl_af6list_remove(const struct in6_addr * addr,const struct in6_addr * mask,struct list_head * head)279 struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,
280 					     const struct in6_addr *mask,
281 					     struct list_head *head)
282 {
283 	struct netlbl_af6list *entry;
284 
285 	entry = netlbl_af6list_search_exact(addr, mask, head);
286 	if (entry == NULL)
287 		return NULL;
288 	netlbl_af6list_remove_entry(entry);
289 	return entry;
290 }
291 #endif /* IPv6 */
292 
293 /*
294  * Audit Helper Functions
295  */
296 
297 #ifdef CONFIG_AUDIT
298 /**
299  * netlbl_af4list_audit_addr - Audit an IPv4 address
300  * @audit_buf: audit buffer
301  * @src: true if source address, false if destination
302  * @dev: network interface
303  * @addr: IP address
304  * @mask: IP address mask
305  *
306  * Description:
307  * Write the IPv4 address and address mask, if necessary, to @audit_buf.
308  *
309  */
netlbl_af4list_audit_addr(struct audit_buffer * audit_buf,int src,const char * dev,__be32 addr,__be32 mask)310 void netlbl_af4list_audit_addr(struct audit_buffer *audit_buf,
311 					int src, const char *dev,
312 					__be32 addr, __be32 mask)
313 {
314 	u32 mask_val = ntohl(mask);
315 	char *dir = (src ? "src" : "dst");
316 
317 	if (dev != NULL)
318 		audit_log_format(audit_buf, " netif=%s", dev);
319 	audit_log_format(audit_buf, " %s=%pI4", dir, &addr);
320 	if (mask_val != 0xffffffff) {
321 		u32 mask_len = 0;
322 		while (mask_val > 0) {
323 			mask_val <<= 1;
324 			mask_len++;
325 		}
326 		audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
327 	}
328 }
329 
330 #if IS_ENABLED(CONFIG_IPV6)
331 /**
332  * netlbl_af6list_audit_addr - Audit an IPv6 address
333  * @audit_buf: audit buffer
334  * @src: true if source address, false if destination
335  * @dev: network interface
336  * @addr: IP address
337  * @mask: IP address mask
338  *
339  * Description:
340  * Write the IPv6 address and address mask, if necessary, to @audit_buf.
341  *
342  */
netlbl_af6list_audit_addr(struct audit_buffer * audit_buf,int src,const char * dev,const struct in6_addr * addr,const struct in6_addr * mask)343 void netlbl_af6list_audit_addr(struct audit_buffer *audit_buf,
344 				 int src,
345 				 const char *dev,
346 				 const struct in6_addr *addr,
347 				 const struct in6_addr *mask)
348 {
349 	char *dir = (src ? "src" : "dst");
350 
351 	if (dev != NULL)
352 		audit_log_format(audit_buf, " netif=%s", dev);
353 	audit_log_format(audit_buf, " %s=%pI6", dir, addr);
354 	if (ntohl(mask->s6_addr32[3]) != 0xffffffff) {
355 		u32 mask_len = 0;
356 		u32 mask_val;
357 		int iter = -1;
358 		while (ntohl(mask->s6_addr32[++iter]) == 0xffffffff)
359 			mask_len += 32;
360 		mask_val = ntohl(mask->s6_addr32[iter]);
361 		while (mask_val > 0) {
362 			mask_val <<= 1;
363 			mask_len++;
364 		}
365 		audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
366 	}
367 }
368 #endif /* IPv6 */
369 #endif /* CONFIG_AUDIT */
370