1 /* 2 * NetLabel Kernel API 3 * 4 * This file defines the kernel API for the NetLabel system. The NetLabel 5 * system manages static and dynamic label mappings for network protocols such 6 * as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul.moore@hp.com> 9 * 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, write to the Free Software 27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28 * 29 */ 30 31 #include <linux/init.h> 32 #include <linux/types.h> 33 #include <net/ip.h> 34 #include <net/netlabel.h> 35 #include <net/cipso_ipv4.h> 36 #include <asm/bug.h> 37 38 #include "netlabel_domainhash.h" 39 #include "netlabel_unlabeled.h" 40 #include "netlabel_user.h" 41 42 /* 43 * Security Attribute Functions 44 */ 45 46 /** 47 * netlbl_secattr_catmap_walk - Walk a LSM secattr catmap looking for a bit 48 * @catmap: the category bitmap 49 * @offset: the offset to start searching at, in bits 50 * 51 * Description: 52 * This function walks a LSM secattr category bitmap starting at @offset and 53 * returns the spot of the first set bit or -ENOENT if no bits are set. 54 * 55 */ 56 int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap, 57 u32 offset) 58 { 59 struct netlbl_lsm_secattr_catmap *iter = catmap; 60 u32 node_idx; 61 u32 node_bit; 62 NETLBL_CATMAP_MAPTYPE bitmap; 63 64 if (offset > iter->startbit) { 65 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 66 iter = iter->next; 67 if (iter == NULL) 68 return -ENOENT; 69 } 70 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 71 node_bit = offset - iter->startbit - 72 (NETLBL_CATMAP_MAPSIZE * node_idx); 73 } else { 74 node_idx = 0; 75 node_bit = 0; 76 } 77 bitmap = iter->bitmap[node_idx] >> node_bit; 78 79 for (;;) { 80 if (bitmap != 0) { 81 while ((bitmap & NETLBL_CATMAP_BIT) == 0) { 82 bitmap >>= 1; 83 node_bit++; 84 } 85 return iter->startbit + 86 (NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit; 87 } 88 if (++node_idx >= NETLBL_CATMAP_MAPCNT) { 89 if (iter->next != NULL) { 90 iter = iter->next; 91 node_idx = 0; 92 } else 93 return -ENOENT; 94 } 95 bitmap = iter->bitmap[node_idx]; 96 node_bit = 0; 97 } 98 99 return -ENOENT; 100 } 101 102 /** 103 * netlbl_secattr_catmap_walk_rng - Find the end of a string of set bits 104 * @catmap: the category bitmap 105 * @offset: the offset to start searching at, in bits 106 * 107 * Description: 108 * This function walks a LSM secattr category bitmap starting at @offset and 109 * returns the spot of the first cleared bit or -ENOENT if the offset is past 110 * the end of the bitmap. 111 * 112 */ 113 int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap, 114 u32 offset) 115 { 116 struct netlbl_lsm_secattr_catmap *iter = catmap; 117 u32 node_idx; 118 u32 node_bit; 119 NETLBL_CATMAP_MAPTYPE bitmask; 120 NETLBL_CATMAP_MAPTYPE bitmap; 121 122 if (offset > iter->startbit) { 123 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 124 iter = iter->next; 125 if (iter == NULL) 126 return -ENOENT; 127 } 128 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 129 node_bit = offset - iter->startbit - 130 (NETLBL_CATMAP_MAPSIZE * node_idx); 131 } else { 132 node_idx = 0; 133 node_bit = 0; 134 } 135 bitmask = NETLBL_CATMAP_BIT << node_bit; 136 137 for (;;) { 138 bitmap = iter->bitmap[node_idx]; 139 while (bitmask != 0 && (bitmap & bitmask) != 0) { 140 bitmask <<= 1; 141 node_bit++; 142 } 143 144 if (bitmask != 0) 145 return iter->startbit + 146 (NETLBL_CATMAP_MAPSIZE * node_idx) + 147 node_bit - 1; 148 else if (++node_idx >= NETLBL_CATMAP_MAPCNT) { 149 if (iter->next == NULL) 150 return iter->startbit + NETLBL_CATMAP_SIZE - 1; 151 iter = iter->next; 152 node_idx = 0; 153 } 154 bitmask = NETLBL_CATMAP_BIT; 155 node_bit = 0; 156 } 157 158 return -ENOENT; 159 } 160 161 /** 162 * netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap 163 * @catmap: the category bitmap 164 * @bit: the bit to set 165 * @flags: memory allocation flags 166 * 167 * Description: 168 * Set the bit specified by @bit in @catmap. Returns zero on success, 169 * negative values on failure. 170 * 171 */ 172 int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap, 173 u32 bit, 174 gfp_t flags) 175 { 176 struct netlbl_lsm_secattr_catmap *iter = catmap; 177 u32 node_bit; 178 u32 node_idx; 179 180 while (iter->next != NULL && 181 bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) 182 iter = iter->next; 183 if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 184 iter->next = netlbl_secattr_catmap_alloc(flags); 185 if (iter->next == NULL) 186 return -ENOMEM; 187 iter = iter->next; 188 iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1); 189 } 190 191 /* gcc always rounds to zero when doing integer division */ 192 node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 193 node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx); 194 iter->bitmap[node_idx] |= NETLBL_CATMAP_BIT << node_bit; 195 196 return 0; 197 } 198 199 /** 200 * netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap 201 * @catmap: the category bitmap 202 * @start: the starting bit 203 * @end: the last bit in the string 204 * @flags: memory allocation flags 205 * 206 * Description: 207 * Set a range of bits, starting at @start and ending with @end. Returns zero 208 * on success, negative values on failure. 209 * 210 */ 211 int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap, 212 u32 start, 213 u32 end, 214 gfp_t flags) 215 { 216 int ret_val = 0; 217 struct netlbl_lsm_secattr_catmap *iter = catmap; 218 u32 iter_max_spot; 219 u32 spot; 220 221 /* XXX - This could probably be made a bit faster by combining writes 222 * to the catmap instead of setting a single bit each time, but for 223 * right now skipping to the start of the range in the catmap should 224 * be a nice improvement over calling the individual setbit function 225 * repeatedly from a loop. */ 226 227 while (iter->next != NULL && 228 start >= (iter->startbit + NETLBL_CATMAP_SIZE)) 229 iter = iter->next; 230 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE; 231 232 for (spot = start; spot <= end && ret_val == 0; spot++) { 233 if (spot >= iter_max_spot && iter->next != NULL) { 234 iter = iter->next; 235 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE; 236 } 237 ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC); 238 } 239 240 return ret_val; 241 } 242 243 /* 244 * LSM Functions 245 */ 246 247 /** 248 * netlbl_socket_setattr - Label a socket using the correct protocol 249 * @sock: the socket to label 250 * @secattr: the security attributes 251 * 252 * Description: 253 * Attach the correct label to the given socket using the security attributes 254 * specified in @secattr. This function requires exclusive access to 255 * @sock->sk, which means it either needs to be in the process of being 256 * created or locked via lock_sock(sock->sk). Returns zero on success, 257 * negative values on failure. 258 * 259 */ 260 int netlbl_socket_setattr(const struct socket *sock, 261 const struct netlbl_lsm_secattr *secattr) 262 { 263 int ret_val = -ENOENT; 264 struct netlbl_dom_map *dom_entry; 265 266 if ((secattr->flags & NETLBL_SECATTR_DOMAIN) == 0) 267 return -ENOENT; 268 269 rcu_read_lock(); 270 dom_entry = netlbl_domhsh_getentry(secattr->domain); 271 if (dom_entry == NULL) 272 goto socket_setattr_return; 273 switch (dom_entry->type) { 274 case NETLBL_NLTYPE_CIPSOV4: 275 ret_val = cipso_v4_socket_setattr(sock, 276 dom_entry->type_def.cipsov4, 277 secattr); 278 break; 279 case NETLBL_NLTYPE_UNLABELED: 280 ret_val = 0; 281 break; 282 default: 283 ret_val = -ENOENT; 284 } 285 286 socket_setattr_return: 287 rcu_read_unlock(); 288 return ret_val; 289 } 290 291 /** 292 * netlbl_sock_getattr - Determine the security attributes of a sock 293 * @sk: the sock 294 * @secattr: the security attributes 295 * 296 * Description: 297 * Examines the given sock to see any NetLabel style labeling has been 298 * applied to the sock, if so it parses the socket label and returns the 299 * security attributes in @secattr. Returns zero on success, negative values 300 * on failure. 301 * 302 */ 303 int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) 304 { 305 int ret_val; 306 307 ret_val = cipso_v4_sock_getattr(sk, secattr); 308 if (ret_val == 0) 309 return 0; 310 311 return netlbl_unlabel_getattr(secattr); 312 } 313 314 /** 315 * netlbl_socket_getattr - Determine the security attributes of a socket 316 * @sock: the socket 317 * @secattr: the security attributes 318 * 319 * Description: 320 * Examines the given socket to see any NetLabel style labeling has been 321 * applied to the socket, if so it parses the socket label and returns the 322 * security attributes in @secattr. Returns zero on success, negative values 323 * on failure. 324 * 325 */ 326 int netlbl_socket_getattr(const struct socket *sock, 327 struct netlbl_lsm_secattr *secattr) 328 { 329 int ret_val; 330 331 ret_val = cipso_v4_socket_getattr(sock, secattr); 332 if (ret_val == 0) 333 return 0; 334 335 return netlbl_unlabel_getattr(secattr); 336 } 337 338 /** 339 * netlbl_skbuff_getattr - Determine the security attributes of a packet 340 * @skb: the packet 341 * @secattr: the security attributes 342 * 343 * Description: 344 * Examines the given packet to see if a recognized form of packet labeling 345 * is present, if so it parses the packet label and returns the security 346 * attributes in @secattr. Returns zero on success, negative values on 347 * failure. 348 * 349 */ 350 int netlbl_skbuff_getattr(const struct sk_buff *skb, 351 struct netlbl_lsm_secattr *secattr) 352 { 353 if (CIPSO_V4_OPTEXIST(skb) && 354 cipso_v4_skbuff_getattr(skb, secattr) == 0) 355 return 0; 356 357 return netlbl_unlabel_getattr(secattr); 358 } 359 360 /** 361 * netlbl_skbuff_err - Handle a LSM error on a sk_buff 362 * @skb: the packet 363 * @error: the error code 364 * 365 * Description: 366 * Deal with a LSM problem when handling the packet in @skb, typically this is 367 * a permission denied problem (-EACCES). The correct action is determined 368 * according to the packet's labeling protocol. 369 * 370 */ 371 void netlbl_skbuff_err(struct sk_buff *skb, int error) 372 { 373 if (CIPSO_V4_OPTEXIST(skb)) 374 cipso_v4_error(skb, error, 0); 375 } 376 377 /** 378 * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches 379 * 380 * Description: 381 * For all of the NetLabel protocols that support some form of label mapping 382 * cache, invalidate the cache. Returns zero on success, negative values on 383 * error. 384 * 385 */ 386 void netlbl_cache_invalidate(void) 387 { 388 cipso_v4_cache_invalidate(); 389 } 390 391 /** 392 * netlbl_cache_add - Add an entry to a NetLabel protocol cache 393 * @skb: the packet 394 * @secattr: the packet's security attributes 395 * 396 * Description: 397 * Add the LSM security attributes for the given packet to the underlying 398 * NetLabel protocol's label mapping cache. Returns zero on success, negative 399 * values on error. 400 * 401 */ 402 int netlbl_cache_add(const struct sk_buff *skb, 403 const struct netlbl_lsm_secattr *secattr) 404 { 405 if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0) 406 return -ENOMSG; 407 408 if (CIPSO_V4_OPTEXIST(skb)) 409 return cipso_v4_cache_add(skb, secattr); 410 411 return -ENOMSG; 412 } 413 414 /* 415 * Setup Functions 416 */ 417 418 /** 419 * netlbl_init - Initialize NetLabel 420 * 421 * Description: 422 * Perform the required NetLabel initialization before first use. 423 * 424 */ 425 static int __init netlbl_init(void) 426 { 427 int ret_val; 428 429 printk(KERN_INFO "NetLabel: Initializing\n"); 430 printk(KERN_INFO "NetLabel: domain hash size = %u\n", 431 (1 << NETLBL_DOMHSH_BITSIZE)); 432 printk(KERN_INFO "NetLabel: protocols =" 433 " UNLABELED" 434 " CIPSOv4" 435 "\n"); 436 437 ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE); 438 if (ret_val != 0) 439 goto init_failure; 440 441 ret_val = netlbl_netlink_init(); 442 if (ret_val != 0) 443 goto init_failure; 444 445 ret_val = netlbl_unlabel_defconf(); 446 if (ret_val != 0) 447 goto init_failure; 448 printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n"); 449 450 return 0; 451 452 init_failure: 453 panic("NetLabel: failed to initialize properly (%d)\n", ret_val); 454 } 455 456 subsys_initcall(netlbl_init); 457