xref: /openbmc/linux/net/ipv4/cipso_ipv4.c (revision 9ac8d3fb)
1 /*
2  * CIPSO - Commercial IP Security Option
3  *
4  * This is an implementation of the CIPSO 2.2 protocol as specified in
5  * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
6  * FIPS-188, copies of both documents can be found in the Documentation
7  * directory.  While CIPSO never became a full IETF RFC standard many vendors
8  * have chosen to adopt the protocol and over the years it has become a
9  * de-facto standard for labeled networking.
10  *
11  * Author: Paul Moore <paul.moore@hp.com>
12  *
13  */
14 
15 /*
16  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
17  *
18  * This program is free software;  you can redistribute it and/or modify
19  * it under the terms of the GNU General Public License as published by
20  * the Free Software Foundation; either version 2 of the License, or
21  * (at your option) any later version.
22  *
23  * This program is distributed in the hope that it will be useful,
24  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
25  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
26  * the GNU General Public License for more details.
27  *
28  * You should have received a copy of the GNU General Public License
29  * along with this program;  if not, write to the Free Software
30  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31  *
32  */
33 
34 #include <linux/init.h>
35 #include <linux/types.h>
36 #include <linux/rcupdate.h>
37 #include <linux/list.h>
38 #include <linux/spinlock.h>
39 #include <linux/string.h>
40 #include <linux/jhash.h>
41 #include <net/ip.h>
42 #include <net/icmp.h>
43 #include <net/tcp.h>
44 #include <net/netlabel.h>
45 #include <net/cipso_ipv4.h>
46 #include <asm/atomic.h>
47 #include <asm/bug.h>
48 #include <asm/unaligned.h>
49 
50 /* List of available DOI definitions */
51 /* XXX - This currently assumes a minimal number of different DOIs in use,
52  * if in practice there are a lot of different DOIs this list should
53  * probably be turned into a hash table or something similar so we
54  * can do quick lookups. */
55 static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
56 static LIST_HEAD(cipso_v4_doi_list);
57 
58 /* Label mapping cache */
59 int cipso_v4_cache_enabled = 1;
60 int cipso_v4_cache_bucketsize = 10;
61 #define CIPSO_V4_CACHE_BUCKETBITS     7
62 #define CIPSO_V4_CACHE_BUCKETS        (1 << CIPSO_V4_CACHE_BUCKETBITS)
63 #define CIPSO_V4_CACHE_REORDERLIMIT   10
64 struct cipso_v4_map_cache_bkt {
65 	spinlock_t lock;
66 	u32 size;
67 	struct list_head list;
68 };
69 struct cipso_v4_map_cache_entry {
70 	u32 hash;
71 	unsigned char *key;
72 	size_t key_len;
73 
74 	struct netlbl_lsm_cache *lsm_data;
75 
76 	u32 activity;
77 	struct list_head list;
78 };
79 static struct cipso_v4_map_cache_bkt *cipso_v4_cache = NULL;
80 
81 /* Restricted bitmap (tag #1) flags */
82 int cipso_v4_rbm_optfmt = 0;
83 int cipso_v4_rbm_strictvalid = 1;
84 
85 /*
86  * Protocol Constants
87  */
88 
89 /* Maximum size of the CIPSO IP option, derived from the fact that the maximum
90  * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
91 #define CIPSO_V4_OPT_LEN_MAX          40
92 
93 /* Length of the base CIPSO option, this includes the option type (1 byte), the
94  * option length (1 byte), and the DOI (4 bytes). */
95 #define CIPSO_V4_HDR_LEN              6
96 
97 /* Base length of the restrictive category bitmap tag (tag #1). */
98 #define CIPSO_V4_TAG_RBM_BLEN         4
99 
100 /* Base length of the enumerated category tag (tag #2). */
101 #define CIPSO_V4_TAG_ENUM_BLEN        4
102 
103 /* Base length of the ranged categories bitmap tag (tag #5). */
104 #define CIPSO_V4_TAG_RNG_BLEN         4
105 /* The maximum number of category ranges permitted in the ranged category tag
106  * (tag #5).  You may note that the IETF draft states that the maximum number
107  * of category ranges is 7, but if the low end of the last category range is
108  * zero then it is possibile to fit 8 category ranges because the zero should
109  * be omitted. */
110 #define CIPSO_V4_TAG_RNG_CAT_MAX      8
111 
112 /* Base length of the local tag (non-standard tag).
113  *  Tag definition (may change between kernel versions)
114  *
115  * 0          8          16         24         32
116  * +----------+----------+----------+----------+
117  * | 10000000 | 00000110 | 32-bit secid value  |
118  * +----------+----------+----------+----------+
119  * | in (host byte order)|
120  * +----------+----------+
121  *
122  */
123 #define CIPSO_V4_TAG_LOC_BLEN         6
124 
125 /*
126  * Helper Functions
127  */
128 
129 /**
130  * cipso_v4_bitmap_walk - Walk a bitmap looking for a bit
131  * @bitmap: the bitmap
132  * @bitmap_len: length in bits
133  * @offset: starting offset
134  * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
135  *
136  * Description:
137  * Starting at @offset, walk the bitmap from left to right until either the
138  * desired bit is found or we reach the end.  Return the bit offset, -1 if
139  * not found, or -2 if error.
140  */
141 static int cipso_v4_bitmap_walk(const unsigned char *bitmap,
142 				u32 bitmap_len,
143 				u32 offset,
144 				u8 state)
145 {
146 	u32 bit_spot;
147 	u32 byte_offset;
148 	unsigned char bitmask;
149 	unsigned char byte;
150 
151 	/* gcc always rounds to zero when doing integer division */
152 	byte_offset = offset / 8;
153 	byte = bitmap[byte_offset];
154 	bit_spot = offset;
155 	bitmask = 0x80 >> (offset % 8);
156 
157 	while (bit_spot < bitmap_len) {
158 		if ((state && (byte & bitmask) == bitmask) ||
159 		    (state == 0 && (byte & bitmask) == 0))
160 			return bit_spot;
161 
162 		bit_spot++;
163 		bitmask >>= 1;
164 		if (bitmask == 0) {
165 			byte = bitmap[++byte_offset];
166 			bitmask = 0x80;
167 		}
168 	}
169 
170 	return -1;
171 }
172 
173 /**
174  * cipso_v4_bitmap_setbit - Sets a single bit in a bitmap
175  * @bitmap: the bitmap
176  * @bit: the bit
177  * @state: if non-zero, set the bit (1) else clear the bit (0)
178  *
179  * Description:
180  * Set a single bit in the bitmask.  Returns zero on success, negative values
181  * on error.
182  */
183 static void cipso_v4_bitmap_setbit(unsigned char *bitmap,
184 				   u32 bit,
185 				   u8 state)
186 {
187 	u32 byte_spot;
188 	u8 bitmask;
189 
190 	/* gcc always rounds to zero when doing integer division */
191 	byte_spot = bit / 8;
192 	bitmask = 0x80 >> (bit % 8);
193 	if (state)
194 		bitmap[byte_spot] |= bitmask;
195 	else
196 		bitmap[byte_spot] &= ~bitmask;
197 }
198 
199 /**
200  * cipso_v4_cache_entry_free - Frees a cache entry
201  * @entry: the entry to free
202  *
203  * Description:
204  * This function frees the memory associated with a cache entry including the
205  * LSM cache data if there are no longer any users, i.e. reference count == 0.
206  *
207  */
208 static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
209 {
210 	if (entry->lsm_data)
211 		netlbl_secattr_cache_free(entry->lsm_data);
212 	kfree(entry->key);
213 	kfree(entry);
214 }
215 
216 /**
217  * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
218  * @key: the hash key
219  * @key_len: the length of the key in bytes
220  *
221  * Description:
222  * The CIPSO tag hashing function.  Returns a 32-bit hash value.
223  *
224  */
225 static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
226 {
227 	return jhash(key, key_len, 0);
228 }
229 
230 /*
231  * Label Mapping Cache Functions
232  */
233 
234 /**
235  * cipso_v4_cache_init - Initialize the CIPSO cache
236  *
237  * Description:
238  * Initializes the CIPSO label mapping cache, this function should be called
239  * before any of the other functions defined in this file.  Returns zero on
240  * success, negative values on error.
241  *
242  */
243 static int cipso_v4_cache_init(void)
244 {
245 	u32 iter;
246 
247 	cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
248 				 sizeof(struct cipso_v4_map_cache_bkt),
249 				 GFP_KERNEL);
250 	if (cipso_v4_cache == NULL)
251 		return -ENOMEM;
252 
253 	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
254 		spin_lock_init(&cipso_v4_cache[iter].lock);
255 		cipso_v4_cache[iter].size = 0;
256 		INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
257 	}
258 
259 	return 0;
260 }
261 
262 /**
263  * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
264  *
265  * Description:
266  * Invalidates and frees any entries in the CIPSO cache.  Returns zero on
267  * success and negative values on failure.
268  *
269  */
270 void cipso_v4_cache_invalidate(void)
271 {
272 	struct cipso_v4_map_cache_entry *entry, *tmp_entry;
273 	u32 iter;
274 
275 	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
276 		spin_lock_bh(&cipso_v4_cache[iter].lock);
277 		list_for_each_entry_safe(entry,
278 					 tmp_entry,
279 					 &cipso_v4_cache[iter].list, list) {
280 			list_del(&entry->list);
281 			cipso_v4_cache_entry_free(entry);
282 		}
283 		cipso_v4_cache[iter].size = 0;
284 		spin_unlock_bh(&cipso_v4_cache[iter].lock);
285 	}
286 
287 	return;
288 }
289 
290 /**
291  * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
292  * @key: the buffer to check
293  * @key_len: buffer length in bytes
294  * @secattr: the security attribute struct to use
295  *
296  * Description:
297  * This function checks the cache to see if a label mapping already exists for
298  * the given key.  If there is a match then the cache is adjusted and the
299  * @secattr struct is populated with the correct LSM security attributes.  The
300  * cache is adjusted in the following manner if the entry is not already the
301  * first in the cache bucket:
302  *
303  *  1. The cache entry's activity counter is incremented
304  *  2. The previous (higher ranking) entry's activity counter is decremented
305  *  3. If the difference between the two activity counters is geater than
306  *     CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
307  *
308  * Returns zero on success, -ENOENT for a cache miss, and other negative values
309  * on error.
310  *
311  */
312 static int cipso_v4_cache_check(const unsigned char *key,
313 				u32 key_len,
314 				struct netlbl_lsm_secattr *secattr)
315 {
316 	u32 bkt;
317 	struct cipso_v4_map_cache_entry *entry;
318 	struct cipso_v4_map_cache_entry *prev_entry = NULL;
319 	u32 hash;
320 
321 	if (!cipso_v4_cache_enabled)
322 		return -ENOENT;
323 
324 	hash = cipso_v4_map_cache_hash(key, key_len);
325 	bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
326 	spin_lock_bh(&cipso_v4_cache[bkt].lock);
327 	list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
328 		if (entry->hash == hash &&
329 		    entry->key_len == key_len &&
330 		    memcmp(entry->key, key, key_len) == 0) {
331 			entry->activity += 1;
332 			atomic_inc(&entry->lsm_data->refcount);
333 			secattr->cache = entry->lsm_data;
334 			secattr->flags |= NETLBL_SECATTR_CACHE;
335 			secattr->type = NETLBL_NLTYPE_CIPSOV4;
336 			if (prev_entry == NULL) {
337 				spin_unlock_bh(&cipso_v4_cache[bkt].lock);
338 				return 0;
339 			}
340 
341 			if (prev_entry->activity > 0)
342 				prev_entry->activity -= 1;
343 			if (entry->activity > prev_entry->activity &&
344 			    entry->activity - prev_entry->activity >
345 			    CIPSO_V4_CACHE_REORDERLIMIT) {
346 				__list_del(entry->list.prev, entry->list.next);
347 				__list_add(&entry->list,
348 					   prev_entry->list.prev,
349 					   &prev_entry->list);
350 			}
351 
352 			spin_unlock_bh(&cipso_v4_cache[bkt].lock);
353 			return 0;
354 		}
355 		prev_entry = entry;
356 	}
357 	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
358 
359 	return -ENOENT;
360 }
361 
362 /**
363  * cipso_v4_cache_add - Add an entry to the CIPSO cache
364  * @skb: the packet
365  * @secattr: the packet's security attributes
366  *
367  * Description:
368  * Add a new entry into the CIPSO label mapping cache.  Add the new entry to
369  * head of the cache bucket's list, if the cache bucket is out of room remove
370  * the last entry in the list first.  It is important to note that there is
371  * currently no checking for duplicate keys.  Returns zero on success,
372  * negative values on failure.
373  *
374  */
375 int cipso_v4_cache_add(const struct sk_buff *skb,
376 		       const struct netlbl_lsm_secattr *secattr)
377 {
378 	int ret_val = -EPERM;
379 	u32 bkt;
380 	struct cipso_v4_map_cache_entry *entry = NULL;
381 	struct cipso_v4_map_cache_entry *old_entry = NULL;
382 	unsigned char *cipso_ptr;
383 	u32 cipso_ptr_len;
384 
385 	if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
386 		return 0;
387 
388 	cipso_ptr = CIPSO_V4_OPTPTR(skb);
389 	cipso_ptr_len = cipso_ptr[1];
390 
391 	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
392 	if (entry == NULL)
393 		return -ENOMEM;
394 	entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
395 	if (entry->key == NULL) {
396 		ret_val = -ENOMEM;
397 		goto cache_add_failure;
398 	}
399 	entry->key_len = cipso_ptr_len;
400 	entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
401 	atomic_inc(&secattr->cache->refcount);
402 	entry->lsm_data = secattr->cache;
403 
404 	bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
405 	spin_lock_bh(&cipso_v4_cache[bkt].lock);
406 	if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
407 		list_add(&entry->list, &cipso_v4_cache[bkt].list);
408 		cipso_v4_cache[bkt].size += 1;
409 	} else {
410 		old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
411 				       struct cipso_v4_map_cache_entry, list);
412 		list_del(&old_entry->list);
413 		list_add(&entry->list, &cipso_v4_cache[bkt].list);
414 		cipso_v4_cache_entry_free(old_entry);
415 	}
416 	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
417 
418 	return 0;
419 
420 cache_add_failure:
421 	if (entry)
422 		cipso_v4_cache_entry_free(entry);
423 	return ret_val;
424 }
425 
426 /*
427  * DOI List Functions
428  */
429 
430 /**
431  * cipso_v4_doi_search - Searches for a DOI definition
432  * @doi: the DOI to search for
433  *
434  * Description:
435  * Search the DOI definition list for a DOI definition with a DOI value that
436  * matches @doi.  The caller is responsibile for calling rcu_read_[un]lock().
437  * Returns a pointer to the DOI definition on success and NULL on failure.
438  */
439 static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
440 {
441 	struct cipso_v4_doi *iter;
442 
443 	list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
444 		if (iter->doi == doi && atomic_read(&iter->refcount))
445 			return iter;
446 	return NULL;
447 }
448 
449 /**
450  * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
451  * @doi_def: the DOI structure
452  *
453  * Description:
454  * The caller defines a new DOI for use by the CIPSO engine and calls this
455  * function to add it to the list of acceptable domains.  The caller must
456  * ensure that the mapping table specified in @doi_def->map meets all of the
457  * requirements of the mapping type (see cipso_ipv4.h for details).  Returns
458  * zero on success and non-zero on failure.
459  *
460  */
461 int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
462 {
463 	u32 iter;
464 
465 	if (doi_def == NULL || doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
466 		return -EINVAL;
467 	for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
468 		switch (doi_def->tags[iter]) {
469 		case CIPSO_V4_TAG_RBITMAP:
470 			break;
471 		case CIPSO_V4_TAG_RANGE:
472 			if (doi_def->type != CIPSO_V4_MAP_PASS)
473 				return -EINVAL;
474 			break;
475 		case CIPSO_V4_TAG_INVALID:
476 			if (iter == 0)
477 				return -EINVAL;
478 			break;
479 		case CIPSO_V4_TAG_ENUM:
480 			if (doi_def->type != CIPSO_V4_MAP_PASS)
481 				return -EINVAL;
482 			break;
483 		case CIPSO_V4_TAG_LOCAL:
484 			if (doi_def->type != CIPSO_V4_MAP_LOCAL)
485 				return -EINVAL;
486 			break;
487 		default:
488 			return -EINVAL;
489 		}
490 	}
491 
492 	atomic_set(&doi_def->refcount, 1);
493 	INIT_RCU_HEAD(&doi_def->rcu);
494 
495 	spin_lock(&cipso_v4_doi_list_lock);
496 	if (cipso_v4_doi_search(doi_def->doi) != NULL)
497 		goto doi_add_failure;
498 	list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
499 	spin_unlock(&cipso_v4_doi_list_lock);
500 
501 	return 0;
502 
503 doi_add_failure:
504 	spin_unlock(&cipso_v4_doi_list_lock);
505 	return -EEXIST;
506 }
507 
508 /**
509  * cipso_v4_doi_free - Frees a DOI definition
510  * @entry: the entry's RCU field
511  *
512  * Description:
513  * This function frees all of the memory associated with a DOI definition.
514  *
515  */
516 void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
517 {
518 	if (doi_def == NULL)
519 		return;
520 
521 	switch (doi_def->type) {
522 	case CIPSO_V4_MAP_TRANS:
523 		kfree(doi_def->map.std->lvl.cipso);
524 		kfree(doi_def->map.std->lvl.local);
525 		kfree(doi_def->map.std->cat.cipso);
526 		kfree(doi_def->map.std->cat.local);
527 		break;
528 	}
529 	kfree(doi_def);
530 }
531 
532 /**
533  * cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer
534  * @entry: the entry's RCU field
535  *
536  * Description:
537  * This function is designed to be used as a callback to the call_rcu()
538  * function so that the memory allocated to the DOI definition can be released
539  * safely.
540  *
541  */
542 static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
543 {
544 	struct cipso_v4_doi *doi_def;
545 
546 	doi_def = container_of(entry, struct cipso_v4_doi, rcu);
547 	cipso_v4_doi_free(doi_def);
548 }
549 
550 /**
551  * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
552  * @doi: the DOI value
553  * @audit_secid: the LSM secid to use in the audit message
554  *
555  * Description:
556  * Removes a DOI definition from the CIPSO engine.  The NetLabel routines will
557  * be called to release their own LSM domain mappings as well as our own
558  * domain list.  Returns zero on success and negative values on failure.
559  *
560  */
561 int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
562 {
563 	struct cipso_v4_doi *doi_def;
564 
565 	spin_lock(&cipso_v4_doi_list_lock);
566 	doi_def = cipso_v4_doi_search(doi);
567 	if (doi_def == NULL) {
568 		spin_unlock(&cipso_v4_doi_list_lock);
569 		return -ENOENT;
570 	}
571 	if (!atomic_dec_and_test(&doi_def->refcount)) {
572 		spin_unlock(&cipso_v4_doi_list_lock);
573 		return -EBUSY;
574 	}
575 	list_del_rcu(&doi_def->list);
576 	spin_unlock(&cipso_v4_doi_list_lock);
577 
578 	cipso_v4_cache_invalidate();
579 	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
580 
581 	return 0;
582 }
583 
584 /**
585  * cipso_v4_doi_getdef - Returns a reference to a valid DOI definition
586  * @doi: the DOI value
587  *
588  * Description:
589  * Searches for a valid DOI definition and if one is found it is returned to
590  * the caller.  Otherwise NULL is returned.  The caller must ensure that
591  * rcu_read_lock() is held while accessing the returned definition and the DOI
592  * definition reference count is decremented when the caller is done.
593  *
594  */
595 struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
596 {
597 	struct cipso_v4_doi *doi_def;
598 
599 	rcu_read_lock();
600 	doi_def = cipso_v4_doi_search(doi);
601 	if (doi_def == NULL)
602 		goto doi_getdef_return;
603 	if (!atomic_inc_not_zero(&doi_def->refcount))
604 		doi_def = NULL;
605 
606 doi_getdef_return:
607 	rcu_read_unlock();
608 	return doi_def;
609 }
610 
611 /**
612  * cipso_v4_doi_putdef - Releases a reference for the given DOI definition
613  * @doi_def: the DOI definition
614  *
615  * Description:
616  * Releases a DOI definition reference obtained from cipso_v4_doi_getdef().
617  *
618  */
619 void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
620 {
621 	if (doi_def == NULL)
622 		return;
623 
624 	if (!atomic_dec_and_test(&doi_def->refcount))
625 		return;
626 	spin_lock(&cipso_v4_doi_list_lock);
627 	list_del_rcu(&doi_def->list);
628 	spin_unlock(&cipso_v4_doi_list_lock);
629 
630 	cipso_v4_cache_invalidate();
631 	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
632 }
633 
634 /**
635  * cipso_v4_doi_walk - Iterate through the DOI definitions
636  * @skip_cnt: skip past this number of DOI definitions, updated
637  * @callback: callback for each DOI definition
638  * @cb_arg: argument for the callback function
639  *
640  * Description:
641  * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
642  * For each entry call @callback, if @callback returns a negative value stop
643  * 'walking' through the list and return.  Updates the value in @skip_cnt upon
644  * return.  Returns zero on success, negative values on failure.
645  *
646  */
647 int cipso_v4_doi_walk(u32 *skip_cnt,
648 		     int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
649 		     void *cb_arg)
650 {
651 	int ret_val = -ENOENT;
652 	u32 doi_cnt = 0;
653 	struct cipso_v4_doi *iter_doi;
654 
655 	rcu_read_lock();
656 	list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
657 		if (atomic_read(&iter_doi->refcount) > 0) {
658 			if (doi_cnt++ < *skip_cnt)
659 				continue;
660 			ret_val = callback(iter_doi, cb_arg);
661 			if (ret_val < 0) {
662 				doi_cnt--;
663 				goto doi_walk_return;
664 			}
665 		}
666 
667 doi_walk_return:
668 	rcu_read_unlock();
669 	*skip_cnt = doi_cnt;
670 	return ret_val;
671 }
672 
673 /*
674  * Label Mapping Functions
675  */
676 
677 /**
678  * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
679  * @doi_def: the DOI definition
680  * @level: the level to check
681  *
682  * Description:
683  * Checks the given level against the given DOI definition and returns a
684  * negative value if the level does not have a valid mapping and a zero value
685  * if the level is defined by the DOI.
686  *
687  */
688 static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
689 {
690 	switch (doi_def->type) {
691 	case CIPSO_V4_MAP_PASS:
692 		return 0;
693 	case CIPSO_V4_MAP_TRANS:
694 		if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
695 			return 0;
696 		break;
697 	}
698 
699 	return -EFAULT;
700 }
701 
702 /**
703  * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
704  * @doi_def: the DOI definition
705  * @host_lvl: the host MLS level
706  * @net_lvl: the network/CIPSO MLS level
707  *
708  * Description:
709  * Perform a label mapping to translate a local MLS level to the correct
710  * CIPSO level using the given DOI definition.  Returns zero on success,
711  * negative values otherwise.
712  *
713  */
714 static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
715 				 u32 host_lvl,
716 				 u32 *net_lvl)
717 {
718 	switch (doi_def->type) {
719 	case CIPSO_V4_MAP_PASS:
720 		*net_lvl = host_lvl;
721 		return 0;
722 	case CIPSO_V4_MAP_TRANS:
723 		if (host_lvl < doi_def->map.std->lvl.local_size &&
724 		    doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
725 			*net_lvl = doi_def->map.std->lvl.local[host_lvl];
726 			return 0;
727 		}
728 		return -EPERM;
729 	}
730 
731 	return -EINVAL;
732 }
733 
734 /**
735  * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
736  * @doi_def: the DOI definition
737  * @net_lvl: the network/CIPSO MLS level
738  * @host_lvl: the host MLS level
739  *
740  * Description:
741  * Perform a label mapping to translate a CIPSO level to the correct local MLS
742  * level using the given DOI definition.  Returns zero on success, negative
743  * values otherwise.
744  *
745  */
746 static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
747 				 u32 net_lvl,
748 				 u32 *host_lvl)
749 {
750 	struct cipso_v4_std_map_tbl *map_tbl;
751 
752 	switch (doi_def->type) {
753 	case CIPSO_V4_MAP_PASS:
754 		*host_lvl = net_lvl;
755 		return 0;
756 	case CIPSO_V4_MAP_TRANS:
757 		map_tbl = doi_def->map.std;
758 		if (net_lvl < map_tbl->lvl.cipso_size &&
759 		    map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
760 			*host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
761 			return 0;
762 		}
763 		return -EPERM;
764 	}
765 
766 	return -EINVAL;
767 }
768 
769 /**
770  * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
771  * @doi_def: the DOI definition
772  * @bitmap: category bitmap
773  * @bitmap_len: bitmap length in bytes
774  *
775  * Description:
776  * Checks the given category bitmap against the given DOI definition and
777  * returns a negative value if any of the categories in the bitmap do not have
778  * a valid mapping and a zero value if all of the categories are valid.
779  *
780  */
781 static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
782 				      const unsigned char *bitmap,
783 				      u32 bitmap_len)
784 {
785 	int cat = -1;
786 	u32 bitmap_len_bits = bitmap_len * 8;
787 	u32 cipso_cat_size;
788 	u32 *cipso_array;
789 
790 	switch (doi_def->type) {
791 	case CIPSO_V4_MAP_PASS:
792 		return 0;
793 	case CIPSO_V4_MAP_TRANS:
794 		cipso_cat_size = doi_def->map.std->cat.cipso_size;
795 		cipso_array = doi_def->map.std->cat.cipso;
796 		for (;;) {
797 			cat = cipso_v4_bitmap_walk(bitmap,
798 						   bitmap_len_bits,
799 						   cat + 1,
800 						   1);
801 			if (cat < 0)
802 				break;
803 			if (cat >= cipso_cat_size ||
804 			    cipso_array[cat] >= CIPSO_V4_INV_CAT)
805 				return -EFAULT;
806 		}
807 
808 		if (cat == -1)
809 			return 0;
810 		break;
811 	}
812 
813 	return -EFAULT;
814 }
815 
816 /**
817  * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
818  * @doi_def: the DOI definition
819  * @secattr: the security attributes
820  * @net_cat: the zero'd out category bitmap in network/CIPSO format
821  * @net_cat_len: the length of the CIPSO bitmap in bytes
822  *
823  * Description:
824  * Perform a label mapping to translate a local MLS category bitmap to the
825  * correct CIPSO bitmap using the given DOI definition.  Returns the minimum
826  * size in bytes of the network bitmap on success, negative values otherwise.
827  *
828  */
829 static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
830 				     const struct netlbl_lsm_secattr *secattr,
831 				     unsigned char *net_cat,
832 				     u32 net_cat_len)
833 {
834 	int host_spot = -1;
835 	u32 net_spot = CIPSO_V4_INV_CAT;
836 	u32 net_spot_max = 0;
837 	u32 net_clen_bits = net_cat_len * 8;
838 	u32 host_cat_size = 0;
839 	u32 *host_cat_array = NULL;
840 
841 	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
842 		host_cat_size = doi_def->map.std->cat.local_size;
843 		host_cat_array = doi_def->map.std->cat.local;
844 	}
845 
846 	for (;;) {
847 		host_spot = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
848 						       host_spot + 1);
849 		if (host_spot < 0)
850 			break;
851 
852 		switch (doi_def->type) {
853 		case CIPSO_V4_MAP_PASS:
854 			net_spot = host_spot;
855 			break;
856 		case CIPSO_V4_MAP_TRANS:
857 			if (host_spot >= host_cat_size)
858 				return -EPERM;
859 			net_spot = host_cat_array[host_spot];
860 			if (net_spot >= CIPSO_V4_INV_CAT)
861 				return -EPERM;
862 			break;
863 		}
864 		if (net_spot >= net_clen_bits)
865 			return -ENOSPC;
866 		cipso_v4_bitmap_setbit(net_cat, net_spot, 1);
867 
868 		if (net_spot > net_spot_max)
869 			net_spot_max = net_spot;
870 	}
871 
872 	if (++net_spot_max % 8)
873 		return net_spot_max / 8 + 1;
874 	return net_spot_max / 8;
875 }
876 
877 /**
878  * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
879  * @doi_def: the DOI definition
880  * @net_cat: the category bitmap in network/CIPSO format
881  * @net_cat_len: the length of the CIPSO bitmap in bytes
882  * @secattr: the security attributes
883  *
884  * Description:
885  * Perform a label mapping to translate a CIPSO bitmap to the correct local
886  * MLS category bitmap using the given DOI definition.  Returns zero on
887  * success, negative values on failure.
888  *
889  */
890 static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
891 				     const unsigned char *net_cat,
892 				     u32 net_cat_len,
893 				     struct netlbl_lsm_secattr *secattr)
894 {
895 	int ret_val;
896 	int net_spot = -1;
897 	u32 host_spot = CIPSO_V4_INV_CAT;
898 	u32 net_clen_bits = net_cat_len * 8;
899 	u32 net_cat_size = 0;
900 	u32 *net_cat_array = NULL;
901 
902 	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
903 		net_cat_size = doi_def->map.std->cat.cipso_size;
904 		net_cat_array = doi_def->map.std->cat.cipso;
905 	}
906 
907 	for (;;) {
908 		net_spot = cipso_v4_bitmap_walk(net_cat,
909 						net_clen_bits,
910 						net_spot + 1,
911 						1);
912 		if (net_spot < 0) {
913 			if (net_spot == -2)
914 				return -EFAULT;
915 			return 0;
916 		}
917 
918 		switch (doi_def->type) {
919 		case CIPSO_V4_MAP_PASS:
920 			host_spot = net_spot;
921 			break;
922 		case CIPSO_V4_MAP_TRANS:
923 			if (net_spot >= net_cat_size)
924 				return -EPERM;
925 			host_spot = net_cat_array[net_spot];
926 			if (host_spot >= CIPSO_V4_INV_CAT)
927 				return -EPERM;
928 			break;
929 		}
930 		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
931 						       host_spot,
932 						       GFP_ATOMIC);
933 		if (ret_val != 0)
934 			return ret_val;
935 	}
936 
937 	return -EINVAL;
938 }
939 
940 /**
941  * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
942  * @doi_def: the DOI definition
943  * @enumcat: category list
944  * @enumcat_len: length of the category list in bytes
945  *
946  * Description:
947  * Checks the given categories against the given DOI definition and returns a
948  * negative value if any of the categories do not have a valid mapping and a
949  * zero value if all of the categories are valid.
950  *
951  */
952 static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
953 				       const unsigned char *enumcat,
954 				       u32 enumcat_len)
955 {
956 	u16 cat;
957 	int cat_prev = -1;
958 	u32 iter;
959 
960 	if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
961 		return -EFAULT;
962 
963 	for (iter = 0; iter < enumcat_len; iter += 2) {
964 		cat = get_unaligned_be16(&enumcat[iter]);
965 		if (cat <= cat_prev)
966 			return -EFAULT;
967 		cat_prev = cat;
968 	}
969 
970 	return 0;
971 }
972 
973 /**
974  * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
975  * @doi_def: the DOI definition
976  * @secattr: the security attributes
977  * @net_cat: the zero'd out category list in network/CIPSO format
978  * @net_cat_len: the length of the CIPSO category list in bytes
979  *
980  * Description:
981  * Perform a label mapping to translate a local MLS category bitmap to the
982  * correct CIPSO category list using the given DOI definition.   Returns the
983  * size in bytes of the network category bitmap on success, negative values
984  * otherwise.
985  *
986  */
987 static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
988 				      const struct netlbl_lsm_secattr *secattr,
989 				      unsigned char *net_cat,
990 				      u32 net_cat_len)
991 {
992 	int cat = -1;
993 	u32 cat_iter = 0;
994 
995 	for (;;) {
996 		cat = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
997 						 cat + 1);
998 		if (cat < 0)
999 			break;
1000 		if ((cat_iter + 2) > net_cat_len)
1001 			return -ENOSPC;
1002 
1003 		*((__be16 *)&net_cat[cat_iter]) = htons(cat);
1004 		cat_iter += 2;
1005 	}
1006 
1007 	return cat_iter;
1008 }
1009 
1010 /**
1011  * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
1012  * @doi_def: the DOI definition
1013  * @net_cat: the category list in network/CIPSO format
1014  * @net_cat_len: the length of the CIPSO bitmap in bytes
1015  * @secattr: the security attributes
1016  *
1017  * Description:
1018  * Perform a label mapping to translate a CIPSO category list to the correct
1019  * local MLS category bitmap using the given DOI definition.  Returns zero on
1020  * success, negative values on failure.
1021  *
1022  */
1023 static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
1024 				      const unsigned char *net_cat,
1025 				      u32 net_cat_len,
1026 				      struct netlbl_lsm_secattr *secattr)
1027 {
1028 	int ret_val;
1029 	u32 iter;
1030 
1031 	for (iter = 0; iter < net_cat_len; iter += 2) {
1032 		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
1033 				get_unaligned_be16(&net_cat[iter]),
1034 				GFP_ATOMIC);
1035 		if (ret_val != 0)
1036 			return ret_val;
1037 	}
1038 
1039 	return 0;
1040 }
1041 
1042 /**
1043  * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
1044  * @doi_def: the DOI definition
1045  * @rngcat: category list
1046  * @rngcat_len: length of the category list in bytes
1047  *
1048  * Description:
1049  * Checks the given categories against the given DOI definition and returns a
1050  * negative value if any of the categories do not have a valid mapping and a
1051  * zero value if all of the categories are valid.
1052  *
1053  */
1054 static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1055 				      const unsigned char *rngcat,
1056 				      u32 rngcat_len)
1057 {
1058 	u16 cat_high;
1059 	u16 cat_low;
1060 	u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1061 	u32 iter;
1062 
1063 	if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1064 		return -EFAULT;
1065 
1066 	for (iter = 0; iter < rngcat_len; iter += 4) {
1067 		cat_high = get_unaligned_be16(&rngcat[iter]);
1068 		if ((iter + 4) <= rngcat_len)
1069 			cat_low = get_unaligned_be16(&rngcat[iter + 2]);
1070 		else
1071 			cat_low = 0;
1072 
1073 		if (cat_high > cat_prev)
1074 			return -EFAULT;
1075 
1076 		cat_prev = cat_low;
1077 	}
1078 
1079 	return 0;
1080 }
1081 
1082 /**
1083  * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
1084  * @doi_def: the DOI definition
1085  * @secattr: the security attributes
1086  * @net_cat: the zero'd out category list in network/CIPSO format
1087  * @net_cat_len: the length of the CIPSO category list in bytes
1088  *
1089  * Description:
1090  * Perform a label mapping to translate a local MLS category bitmap to the
1091  * correct CIPSO category list using the given DOI definition.   Returns the
1092  * size in bytes of the network category bitmap on success, negative values
1093  * otherwise.
1094  *
1095  */
1096 static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1097 				     const struct netlbl_lsm_secattr *secattr,
1098 				     unsigned char *net_cat,
1099 				     u32 net_cat_len)
1100 {
1101 	int iter = -1;
1102 	u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1103 	u32 array_cnt = 0;
1104 	u32 cat_size = 0;
1105 
1106 	/* make sure we don't overflow the 'array[]' variable */
1107 	if (net_cat_len >
1108 	    (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1109 		return -ENOSPC;
1110 
1111 	for (;;) {
1112 		iter = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
1113 						  iter + 1);
1114 		if (iter < 0)
1115 			break;
1116 		cat_size += (iter == 0 ? 0 : sizeof(u16));
1117 		if (cat_size > net_cat_len)
1118 			return -ENOSPC;
1119 		array[array_cnt++] = iter;
1120 
1121 		iter = netlbl_secattr_catmap_walk_rng(secattr->attr.mls.cat,
1122 						      iter);
1123 		if (iter < 0)
1124 			return -EFAULT;
1125 		cat_size += sizeof(u16);
1126 		if (cat_size > net_cat_len)
1127 			return -ENOSPC;
1128 		array[array_cnt++] = iter;
1129 	}
1130 
1131 	for (iter = 0; array_cnt > 0;) {
1132 		*((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1133 		iter += 2;
1134 		array_cnt--;
1135 		if (array[array_cnt] != 0) {
1136 			*((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1137 			iter += 2;
1138 		}
1139 	}
1140 
1141 	return cat_size;
1142 }
1143 
1144 /**
1145  * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
1146  * @doi_def: the DOI definition
1147  * @net_cat: the category list in network/CIPSO format
1148  * @net_cat_len: the length of the CIPSO bitmap in bytes
1149  * @secattr: the security attributes
1150  *
1151  * Description:
1152  * Perform a label mapping to translate a CIPSO category list to the correct
1153  * local MLS category bitmap using the given DOI definition.  Returns zero on
1154  * success, negative values on failure.
1155  *
1156  */
1157 static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1158 				     const unsigned char *net_cat,
1159 				     u32 net_cat_len,
1160 				     struct netlbl_lsm_secattr *secattr)
1161 {
1162 	int ret_val;
1163 	u32 net_iter;
1164 	u16 cat_low;
1165 	u16 cat_high;
1166 
1167 	for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
1168 		cat_high = get_unaligned_be16(&net_cat[net_iter]);
1169 		if ((net_iter + 4) <= net_cat_len)
1170 			cat_low = get_unaligned_be16(&net_cat[net_iter + 2]);
1171 		else
1172 			cat_low = 0;
1173 
1174 		ret_val = netlbl_secattr_catmap_setrng(secattr->attr.mls.cat,
1175 						       cat_low,
1176 						       cat_high,
1177 						       GFP_ATOMIC);
1178 		if (ret_val != 0)
1179 			return ret_val;
1180 	}
1181 
1182 	return 0;
1183 }
1184 
1185 /*
1186  * Protocol Handling Functions
1187  */
1188 
1189 /**
1190  * cipso_v4_gentag_hdr - Generate a CIPSO option header
1191  * @doi_def: the DOI definition
1192  * @len: the total tag length in bytes, not including this header
1193  * @buf: the CIPSO option buffer
1194  *
1195  * Description:
1196  * Write a CIPSO header into the beginning of @buffer.
1197  *
1198  */
1199 static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1200 				unsigned char *buf,
1201 				u32 len)
1202 {
1203 	buf[0] = IPOPT_CIPSO;
1204 	buf[1] = CIPSO_V4_HDR_LEN + len;
1205 	*(__be32 *)&buf[2] = htonl(doi_def->doi);
1206 }
1207 
1208 /**
1209  * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
1210  * @doi_def: the DOI definition
1211  * @secattr: the security attributes
1212  * @buffer: the option buffer
1213  * @buffer_len: length of buffer in bytes
1214  *
1215  * Description:
1216  * Generate a CIPSO option using the restricted bitmap tag, tag type #1.  The
1217  * actual buffer length may be larger than the indicated size due to
1218  * translation between host and network category bitmaps.  Returns the size of
1219  * the tag on success, negative values on failure.
1220  *
1221  */
1222 static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1223 			       const struct netlbl_lsm_secattr *secattr,
1224 			       unsigned char *buffer,
1225 			       u32 buffer_len)
1226 {
1227 	int ret_val;
1228 	u32 tag_len;
1229 	u32 level;
1230 
1231 	if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1232 		return -EPERM;
1233 
1234 	ret_val = cipso_v4_map_lvl_hton(doi_def,
1235 					secattr->attr.mls.lvl,
1236 					&level);
1237 	if (ret_val != 0)
1238 		return ret_val;
1239 
1240 	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1241 		ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
1242 						    secattr,
1243 						    &buffer[4],
1244 						    buffer_len - 4);
1245 		if (ret_val < 0)
1246 			return ret_val;
1247 
1248 		/* This will send packets using the "optimized" format when
1249 		 * possibile as specified in  section 3.4.2.6 of the
1250 		 * CIPSO draft. */
1251 		if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
1252 			tag_len = 14;
1253 		else
1254 			tag_len = 4 + ret_val;
1255 	} else
1256 		tag_len = 4;
1257 
1258 	buffer[0] = CIPSO_V4_TAG_RBITMAP;
1259 	buffer[1] = tag_len;
1260 	buffer[3] = level;
1261 
1262 	return tag_len;
1263 }
1264 
1265 /**
1266  * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
1267  * @doi_def: the DOI definition
1268  * @tag: the CIPSO tag
1269  * @secattr: the security attributes
1270  *
1271  * Description:
1272  * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
1273  * attributes in @secattr.  Return zero on success, negatives values on
1274  * failure.
1275  *
1276  */
1277 static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1278 				 const unsigned char *tag,
1279 				 struct netlbl_lsm_secattr *secattr)
1280 {
1281 	int ret_val;
1282 	u8 tag_len = tag[1];
1283 	u32 level;
1284 
1285 	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1286 	if (ret_val != 0)
1287 		return ret_val;
1288 	secattr->attr.mls.lvl = level;
1289 	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1290 
1291 	if (tag_len > 4) {
1292 		secattr->attr.mls.cat =
1293 		                       netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1294 		if (secattr->attr.mls.cat == NULL)
1295 			return -ENOMEM;
1296 
1297 		ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1298 						    &tag[4],
1299 						    tag_len - 4,
1300 						    secattr);
1301 		if (ret_val != 0) {
1302 			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1303 			return ret_val;
1304 		}
1305 
1306 		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1307 	}
1308 
1309 	return 0;
1310 }
1311 
1312 /**
1313  * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
1314  * @doi_def: the DOI definition
1315  * @secattr: the security attributes
1316  * @buffer: the option buffer
1317  * @buffer_len: length of buffer in bytes
1318  *
1319  * Description:
1320  * Generate a CIPSO option using the enumerated tag, tag type #2.  Returns the
1321  * size of the tag on success, negative values on failure.
1322  *
1323  */
1324 static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1325 				const struct netlbl_lsm_secattr *secattr,
1326 				unsigned char *buffer,
1327 				u32 buffer_len)
1328 {
1329 	int ret_val;
1330 	u32 tag_len;
1331 	u32 level;
1332 
1333 	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1334 		return -EPERM;
1335 
1336 	ret_val = cipso_v4_map_lvl_hton(doi_def,
1337 					secattr->attr.mls.lvl,
1338 					&level);
1339 	if (ret_val != 0)
1340 		return ret_val;
1341 
1342 	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1343 		ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1344 						     secattr,
1345 						     &buffer[4],
1346 						     buffer_len - 4);
1347 		if (ret_val < 0)
1348 			return ret_val;
1349 
1350 		tag_len = 4 + ret_val;
1351 	} else
1352 		tag_len = 4;
1353 
1354 	buffer[0] = CIPSO_V4_TAG_ENUM;
1355 	buffer[1] = tag_len;
1356 	buffer[3] = level;
1357 
1358 	return tag_len;
1359 }
1360 
1361 /**
1362  * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
1363  * @doi_def: the DOI definition
1364  * @tag: the CIPSO tag
1365  * @secattr: the security attributes
1366  *
1367  * Description:
1368  * Parse a CIPSO enumerated tag (tag type #2) and return the security
1369  * attributes in @secattr.  Return zero on success, negatives values on
1370  * failure.
1371  *
1372  */
1373 static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1374 				  const unsigned char *tag,
1375 				  struct netlbl_lsm_secattr *secattr)
1376 {
1377 	int ret_val;
1378 	u8 tag_len = tag[1];
1379 	u32 level;
1380 
1381 	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1382 	if (ret_val != 0)
1383 		return ret_val;
1384 	secattr->attr.mls.lvl = level;
1385 	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1386 
1387 	if (tag_len > 4) {
1388 		secattr->attr.mls.cat =
1389 			               netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1390 		if (secattr->attr.mls.cat == NULL)
1391 			return -ENOMEM;
1392 
1393 		ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1394 						     &tag[4],
1395 						     tag_len - 4,
1396 						     secattr);
1397 		if (ret_val != 0) {
1398 			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1399 			return ret_val;
1400 		}
1401 
1402 		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1403 	}
1404 
1405 	return 0;
1406 }
1407 
1408 /**
1409  * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
1410  * @doi_def: the DOI definition
1411  * @secattr: the security attributes
1412  * @buffer: the option buffer
1413  * @buffer_len: length of buffer in bytes
1414  *
1415  * Description:
1416  * Generate a CIPSO option using the ranged tag, tag type #5.  Returns the
1417  * size of the tag on success, negative values on failure.
1418  *
1419  */
1420 static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1421 			       const struct netlbl_lsm_secattr *secattr,
1422 			       unsigned char *buffer,
1423 			       u32 buffer_len)
1424 {
1425 	int ret_val;
1426 	u32 tag_len;
1427 	u32 level;
1428 
1429 	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1430 		return -EPERM;
1431 
1432 	ret_val = cipso_v4_map_lvl_hton(doi_def,
1433 					secattr->attr.mls.lvl,
1434 					&level);
1435 	if (ret_val != 0)
1436 		return ret_val;
1437 
1438 	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1439 		ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1440 						    secattr,
1441 						    &buffer[4],
1442 						    buffer_len - 4);
1443 		if (ret_val < 0)
1444 			return ret_val;
1445 
1446 		tag_len = 4 + ret_val;
1447 	} else
1448 		tag_len = 4;
1449 
1450 	buffer[0] = CIPSO_V4_TAG_RANGE;
1451 	buffer[1] = tag_len;
1452 	buffer[3] = level;
1453 
1454 	return tag_len;
1455 }
1456 
1457 /**
1458  * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
1459  * @doi_def: the DOI definition
1460  * @tag: the CIPSO tag
1461  * @secattr: the security attributes
1462  *
1463  * Description:
1464  * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
1465  * in @secattr.  Return zero on success, negatives values on failure.
1466  *
1467  */
1468 static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1469 				 const unsigned char *tag,
1470 				 struct netlbl_lsm_secattr *secattr)
1471 {
1472 	int ret_val;
1473 	u8 tag_len = tag[1];
1474 	u32 level;
1475 
1476 	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1477 	if (ret_val != 0)
1478 		return ret_val;
1479 	secattr->attr.mls.lvl = level;
1480 	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1481 
1482 	if (tag_len > 4) {
1483 		secattr->attr.mls.cat =
1484 			               netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1485 		if (secattr->attr.mls.cat == NULL)
1486 			return -ENOMEM;
1487 
1488 		ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1489 						    &tag[4],
1490 						    tag_len - 4,
1491 						    secattr);
1492 		if (ret_val != 0) {
1493 			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1494 			return ret_val;
1495 		}
1496 
1497 		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1498 	}
1499 
1500 	return 0;
1501 }
1502 
1503 /**
1504  * cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard)
1505  * @doi_def: the DOI definition
1506  * @secattr: the security attributes
1507  * @buffer: the option buffer
1508  * @buffer_len: length of buffer in bytes
1509  *
1510  * Description:
1511  * Generate a CIPSO option using the local tag.  Returns the size of the tag
1512  * on success, negative values on failure.
1513  *
1514  */
1515 static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
1516 			       const struct netlbl_lsm_secattr *secattr,
1517 			       unsigned char *buffer,
1518 			       u32 buffer_len)
1519 {
1520 	if (!(secattr->flags & NETLBL_SECATTR_SECID))
1521 		return -EPERM;
1522 
1523 	buffer[0] = CIPSO_V4_TAG_LOCAL;
1524 	buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
1525 	*(u32 *)&buffer[2] = secattr->attr.secid;
1526 
1527 	return CIPSO_V4_TAG_LOC_BLEN;
1528 }
1529 
1530 /**
1531  * cipso_v4_parsetag_loc - Parse a CIPSO local tag
1532  * @doi_def: the DOI definition
1533  * @tag: the CIPSO tag
1534  * @secattr: the security attributes
1535  *
1536  * Description:
1537  * Parse a CIPSO local tag and return the security attributes in @secattr.
1538  * Return zero on success, negatives values on failure.
1539  *
1540  */
1541 static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
1542 				 const unsigned char *tag,
1543 				 struct netlbl_lsm_secattr *secattr)
1544 {
1545 	secattr->attr.secid = *(u32 *)&tag[2];
1546 	secattr->flags |= NETLBL_SECATTR_SECID;
1547 
1548 	return 0;
1549 }
1550 
1551 /**
1552  * cipso_v4_validate - Validate a CIPSO option
1553  * @option: the start of the option, on error it is set to point to the error
1554  *
1555  * Description:
1556  * This routine is called to validate a CIPSO option, it checks all of the
1557  * fields to ensure that they are at least valid, see the draft snippet below
1558  * for details.  If the option is valid then a zero value is returned and
1559  * the value of @option is unchanged.  If the option is invalid then a
1560  * non-zero value is returned and @option is adjusted to point to the
1561  * offending portion of the option.  From the IETF draft ...
1562  *
1563  *  "If any field within the CIPSO options, such as the DOI identifier, is not
1564  *   recognized the IP datagram is discarded and an ICMP 'parameter problem'
1565  *   (type 12) is generated and returned.  The ICMP code field is set to 'bad
1566  *   parameter' (code 0) and the pointer is set to the start of the CIPSO field
1567  *   that is unrecognized."
1568  *
1569  */
1570 int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
1571 {
1572 	unsigned char *opt = *option;
1573 	unsigned char *tag;
1574 	unsigned char opt_iter;
1575 	unsigned char err_offset = 0;
1576 	u8 opt_len;
1577 	u8 tag_len;
1578 	struct cipso_v4_doi *doi_def = NULL;
1579 	u32 tag_iter;
1580 
1581 	/* caller already checks for length values that are too large */
1582 	opt_len = opt[1];
1583 	if (opt_len < 8) {
1584 		err_offset = 1;
1585 		goto validate_return;
1586 	}
1587 
1588 	rcu_read_lock();
1589 	doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2]));
1590 	if (doi_def == NULL) {
1591 		err_offset = 2;
1592 		goto validate_return_locked;
1593 	}
1594 
1595 	opt_iter = CIPSO_V4_HDR_LEN;
1596 	tag = opt + opt_iter;
1597 	while (opt_iter < opt_len) {
1598 		for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1599 			if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1600 			    ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1601 				err_offset = opt_iter;
1602 				goto validate_return_locked;
1603 			}
1604 
1605 		tag_len = tag[1];
1606 		if (tag_len > (opt_len - opt_iter)) {
1607 			err_offset = opt_iter + 1;
1608 			goto validate_return_locked;
1609 		}
1610 
1611 		switch (tag[0]) {
1612 		case CIPSO_V4_TAG_RBITMAP:
1613 			if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
1614 				err_offset = opt_iter + 1;
1615 				goto validate_return_locked;
1616 			}
1617 
1618 			/* We are already going to do all the verification
1619 			 * necessary at the socket layer so from our point of
1620 			 * view it is safe to turn these checks off (and less
1621 			 * work), however, the CIPSO draft says we should do
1622 			 * all the CIPSO validations here but it doesn't
1623 			 * really specify _exactly_ what we need to validate
1624 			 * ... so, just make it a sysctl tunable. */
1625 			if (cipso_v4_rbm_strictvalid) {
1626 				if (cipso_v4_map_lvl_valid(doi_def,
1627 							   tag[3]) < 0) {
1628 					err_offset = opt_iter + 3;
1629 					goto validate_return_locked;
1630 				}
1631 				if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
1632 				    cipso_v4_map_cat_rbm_valid(doi_def,
1633 							    &tag[4],
1634 							    tag_len - 4) < 0) {
1635 					err_offset = opt_iter + 4;
1636 					goto validate_return_locked;
1637 				}
1638 			}
1639 			break;
1640 		case CIPSO_V4_TAG_ENUM:
1641 			if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
1642 				err_offset = opt_iter + 1;
1643 				goto validate_return_locked;
1644 			}
1645 
1646 			if (cipso_v4_map_lvl_valid(doi_def,
1647 						   tag[3]) < 0) {
1648 				err_offset = opt_iter + 3;
1649 				goto validate_return_locked;
1650 			}
1651 			if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
1652 			    cipso_v4_map_cat_enum_valid(doi_def,
1653 							&tag[4],
1654 							tag_len - 4) < 0) {
1655 				err_offset = opt_iter + 4;
1656 				goto validate_return_locked;
1657 			}
1658 			break;
1659 		case CIPSO_V4_TAG_RANGE:
1660 			if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
1661 				err_offset = opt_iter + 1;
1662 				goto validate_return_locked;
1663 			}
1664 
1665 			if (cipso_v4_map_lvl_valid(doi_def,
1666 						   tag[3]) < 0) {
1667 				err_offset = opt_iter + 3;
1668 				goto validate_return_locked;
1669 			}
1670 			if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
1671 			    cipso_v4_map_cat_rng_valid(doi_def,
1672 						       &tag[4],
1673 						       tag_len - 4) < 0) {
1674 				err_offset = opt_iter + 4;
1675 				goto validate_return_locked;
1676 			}
1677 			break;
1678 		case CIPSO_V4_TAG_LOCAL:
1679 			/* This is a non-standard tag that we only allow for
1680 			 * local connections, so if the incoming interface is
1681 			 * not the loopback device drop the packet. */
1682 			if (!(skb->dev->flags & IFF_LOOPBACK)) {
1683 				err_offset = opt_iter;
1684 				goto validate_return_locked;
1685 			}
1686 			if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
1687 				err_offset = opt_iter + 1;
1688 				goto validate_return_locked;
1689 			}
1690 			break;
1691 		default:
1692 			err_offset = opt_iter;
1693 			goto validate_return_locked;
1694 		}
1695 
1696 		tag += tag_len;
1697 		opt_iter += tag_len;
1698 	}
1699 
1700 validate_return_locked:
1701 	rcu_read_unlock();
1702 validate_return:
1703 	*option = opt + err_offset;
1704 	return err_offset;
1705 }
1706 
1707 /**
1708  * cipso_v4_error - Send the correct reponse for a bad packet
1709  * @skb: the packet
1710  * @error: the error code
1711  * @gateway: CIPSO gateway flag
1712  *
1713  * Description:
1714  * Based on the error code given in @error, send an ICMP error message back to
1715  * the originating host.  From the IETF draft ...
1716  *
1717  *  "If the contents of the CIPSO [option] are valid but the security label is
1718  *   outside of the configured host or port label range, the datagram is
1719  *   discarded and an ICMP 'destination unreachable' (type 3) is generated and
1720  *   returned.  The code field of the ICMP is set to 'communication with
1721  *   destination network administratively prohibited' (code 9) or to
1722  *   'communication with destination host administratively prohibited'
1723  *   (code 10).  The value of the code is dependent on whether the originator
1724  *   of the ICMP message is acting as a CIPSO host or a CIPSO gateway.  The
1725  *   recipient of the ICMP message MUST be able to handle either value.  The
1726  *   same procedure is performed if a CIPSO [option] can not be added to an
1727  *   IP packet because it is too large to fit in the IP options area."
1728  *
1729  *  "If the error is triggered by receipt of an ICMP message, the message is
1730  *   discarded and no response is permitted (consistent with general ICMP
1731  *   processing rules)."
1732  *
1733  */
1734 void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1735 {
1736 	if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
1737 		return;
1738 
1739 	if (gateway)
1740 		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
1741 	else
1742 		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
1743 }
1744 
1745 /**
1746  * cipso_v4_genopt - Generate a CIPSO option
1747  * @buf: the option buffer
1748  * @buf_len: the size of opt_buf
1749  * @doi_def: the CIPSO DOI to use
1750  * @secattr: the security attributes
1751  *
1752  * Description:
1753  * Generate a CIPSO option using the DOI definition and security attributes
1754  * passed to the function.  Returns the length of the option on success and
1755  * negative values on failure.
1756  *
1757  */
1758 static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
1759 			   const struct cipso_v4_doi *doi_def,
1760 			   const struct netlbl_lsm_secattr *secattr)
1761 {
1762 	int ret_val;
1763 	u32 iter;
1764 
1765 	if (buf_len <= CIPSO_V4_HDR_LEN)
1766 		return -ENOSPC;
1767 
1768 	/* XXX - This code assumes only one tag per CIPSO option which isn't
1769 	 * really a good assumption to make but since we only support the MAC
1770 	 * tags right now it is a safe assumption. */
1771 	iter = 0;
1772 	do {
1773 		memset(buf, 0, buf_len);
1774 		switch (doi_def->tags[iter]) {
1775 		case CIPSO_V4_TAG_RBITMAP:
1776 			ret_val = cipso_v4_gentag_rbm(doi_def,
1777 						   secattr,
1778 						   &buf[CIPSO_V4_HDR_LEN],
1779 						   buf_len - CIPSO_V4_HDR_LEN);
1780 			break;
1781 		case CIPSO_V4_TAG_ENUM:
1782 			ret_val = cipso_v4_gentag_enum(doi_def,
1783 						   secattr,
1784 						   &buf[CIPSO_V4_HDR_LEN],
1785 						   buf_len - CIPSO_V4_HDR_LEN);
1786 			break;
1787 		case CIPSO_V4_TAG_RANGE:
1788 			ret_val = cipso_v4_gentag_rng(doi_def,
1789 						   secattr,
1790 						   &buf[CIPSO_V4_HDR_LEN],
1791 						   buf_len - CIPSO_V4_HDR_LEN);
1792 			break;
1793 		case CIPSO_V4_TAG_LOCAL:
1794 			ret_val = cipso_v4_gentag_loc(doi_def,
1795 						   secattr,
1796 						   &buf[CIPSO_V4_HDR_LEN],
1797 						   buf_len - CIPSO_V4_HDR_LEN);
1798 			break;
1799 		default:
1800 			return -EPERM;
1801 		}
1802 
1803 		iter++;
1804 	} while (ret_val < 0 &&
1805 		 iter < CIPSO_V4_TAG_MAXCNT &&
1806 		 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
1807 	if (ret_val < 0)
1808 		return ret_val;
1809 	cipso_v4_gentag_hdr(doi_def, buf, ret_val);
1810 	return CIPSO_V4_HDR_LEN + ret_val;
1811 }
1812 
1813 /**
1814  * cipso_v4_sock_setattr - Add a CIPSO option to a socket
1815  * @sk: the socket
1816  * @doi_def: the CIPSO DOI to use
1817  * @secattr: the specific security attributes of the socket
1818  *
1819  * Description:
1820  * Set the CIPSO option on the given socket using the DOI definition and
1821  * security attributes passed to the function.  This function requires
1822  * exclusive access to @sk, which means it either needs to be in the
1823  * process of being created or locked.  Returns zero on success and negative
1824  * values on failure.
1825  *
1826  */
1827 int cipso_v4_sock_setattr(struct sock *sk,
1828 			  const struct cipso_v4_doi *doi_def,
1829 			  const struct netlbl_lsm_secattr *secattr)
1830 {
1831 	int ret_val = -EPERM;
1832 	unsigned char *buf = NULL;
1833 	u32 buf_len;
1834 	u32 opt_len;
1835 	struct ip_options *opt = NULL;
1836 	struct inet_sock *sk_inet;
1837 	struct inet_connection_sock *sk_conn;
1838 
1839 	/* In the case of sock_create_lite(), the sock->sk field is not
1840 	 * defined yet but it is not a problem as the only users of these
1841 	 * "lite" PF_INET sockets are functions which do an accept() call
1842 	 * afterwards so we will label the socket as part of the accept(). */
1843 	if (sk == NULL)
1844 		return 0;
1845 
1846 	/* We allocate the maximum CIPSO option size here so we are probably
1847 	 * being a little wasteful, but it makes our life _much_ easier later
1848 	 * on and after all we are only talking about 40 bytes. */
1849 	buf_len = CIPSO_V4_OPT_LEN_MAX;
1850 	buf = kmalloc(buf_len, GFP_ATOMIC);
1851 	if (buf == NULL) {
1852 		ret_val = -ENOMEM;
1853 		goto socket_setattr_failure;
1854 	}
1855 
1856 	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1857 	if (ret_val < 0)
1858 		goto socket_setattr_failure;
1859 	buf_len = ret_val;
1860 
1861 	/* We can't use ip_options_get() directly because it makes a call to
1862 	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1863 	 * we won't always have CAP_NET_RAW even though we _always_ want to
1864 	 * set the IPOPT_CIPSO option. */
1865 	opt_len = (buf_len + 3) & ~3;
1866 	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1867 	if (opt == NULL) {
1868 		ret_val = -ENOMEM;
1869 		goto socket_setattr_failure;
1870 	}
1871 	memcpy(opt->__data, buf, buf_len);
1872 	opt->optlen = opt_len;
1873 	opt->cipso = sizeof(struct iphdr);
1874 	kfree(buf);
1875 	buf = NULL;
1876 
1877 	sk_inet = inet_sk(sk);
1878 	if (sk_inet->is_icsk) {
1879 		sk_conn = inet_csk(sk);
1880 		if (sk_inet->opt)
1881 			sk_conn->icsk_ext_hdr_len -= sk_inet->opt->optlen;
1882 		sk_conn->icsk_ext_hdr_len += opt->optlen;
1883 		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1884 	}
1885 	opt = xchg(&sk_inet->opt, opt);
1886 	kfree(opt);
1887 
1888 	return 0;
1889 
1890 socket_setattr_failure:
1891 	kfree(buf);
1892 	kfree(opt);
1893 	return ret_val;
1894 }
1895 
1896 /**
1897  * cipso_v4_sock_delattr - Delete the CIPSO option from a socket
1898  * @sk: the socket
1899  *
1900  * Description:
1901  * Removes the CIPSO option from a socket, if present.
1902  *
1903  */
1904 void cipso_v4_sock_delattr(struct sock *sk)
1905 {
1906 	u8 hdr_delta;
1907 	struct ip_options *opt;
1908 	struct inet_sock *sk_inet;
1909 
1910 	sk_inet = inet_sk(sk);
1911 	opt = sk_inet->opt;
1912 	if (opt == NULL || opt->cipso == 0)
1913 		return;
1914 
1915 	if (opt->srr || opt->rr || opt->ts || opt->router_alert) {
1916 		u8 cipso_len;
1917 		u8 cipso_off;
1918 		unsigned char *cipso_ptr;
1919 		int iter;
1920 		int optlen_new;
1921 
1922 		cipso_off = opt->cipso - sizeof(struct iphdr);
1923 		cipso_ptr = &opt->__data[cipso_off];
1924 		cipso_len = cipso_ptr[1];
1925 
1926 		if (opt->srr > opt->cipso)
1927 			opt->srr -= cipso_len;
1928 		if (opt->rr > opt->cipso)
1929 			opt->rr -= cipso_len;
1930 		if (opt->ts > opt->cipso)
1931 			opt->ts -= cipso_len;
1932 		if (opt->router_alert > opt->cipso)
1933 			opt->router_alert -= cipso_len;
1934 		opt->cipso = 0;
1935 
1936 		memmove(cipso_ptr, cipso_ptr + cipso_len,
1937 			opt->optlen - cipso_off - cipso_len);
1938 
1939 		/* determining the new total option length is tricky because of
1940 		 * the padding necessary, the only thing i can think to do at
1941 		 * this point is walk the options one-by-one, skipping the
1942 		 * padding at the end to determine the actual option size and
1943 		 * from there we can determine the new total option length */
1944 		iter = 0;
1945 		optlen_new = 0;
1946 		while (iter < opt->optlen)
1947 			if (opt->__data[iter] != IPOPT_NOP) {
1948 				iter += opt->__data[iter + 1];
1949 				optlen_new = iter;
1950 			} else
1951 				iter++;
1952 		hdr_delta = opt->optlen;
1953 		opt->optlen = (optlen_new + 3) & ~3;
1954 		hdr_delta -= opt->optlen;
1955 	} else {
1956 		/* only the cipso option was present on the socket so we can
1957 		 * remove the entire option struct */
1958 		sk_inet->opt = NULL;
1959 		hdr_delta = opt->optlen;
1960 		kfree(opt);
1961 	}
1962 
1963 	if (sk_inet->is_icsk && hdr_delta > 0) {
1964 		struct inet_connection_sock *sk_conn = inet_csk(sk);
1965 		sk_conn->icsk_ext_hdr_len -= hdr_delta;
1966 		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1967 	}
1968 }
1969 
1970 /**
1971  * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
1972  * @cipso: the CIPSO v4 option
1973  * @secattr: the security attributes
1974  *
1975  * Description:
1976  * Inspect @cipso and return the security attributes in @secattr.  Returns zero
1977  * on success and negative values on failure.
1978  *
1979  */
1980 static int cipso_v4_getattr(const unsigned char *cipso,
1981 			    struct netlbl_lsm_secattr *secattr)
1982 {
1983 	int ret_val = -ENOMSG;
1984 	u32 doi;
1985 	struct cipso_v4_doi *doi_def;
1986 
1987 	if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0)
1988 		return 0;
1989 
1990 	doi = get_unaligned_be32(&cipso[2]);
1991 	rcu_read_lock();
1992 	doi_def = cipso_v4_doi_search(doi);
1993 	if (doi_def == NULL)
1994 		goto getattr_return;
1995 	/* XXX - This code assumes only one tag per CIPSO option which isn't
1996 	 * really a good assumption to make but since we only support the MAC
1997 	 * tags right now it is a safe assumption. */
1998 	switch (cipso[6]) {
1999 	case CIPSO_V4_TAG_RBITMAP:
2000 		ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr);
2001 		break;
2002 	case CIPSO_V4_TAG_ENUM:
2003 		ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr);
2004 		break;
2005 	case CIPSO_V4_TAG_RANGE:
2006 		ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr);
2007 		break;
2008 	case CIPSO_V4_TAG_LOCAL:
2009 		ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr);
2010 		break;
2011 	}
2012 	if (ret_val == 0)
2013 		secattr->type = NETLBL_NLTYPE_CIPSOV4;
2014 
2015 getattr_return:
2016 	rcu_read_unlock();
2017 	return ret_val;
2018 }
2019 
2020 /**
2021  * cipso_v4_sock_getattr - Get the security attributes from a sock
2022  * @sk: the sock
2023  * @secattr: the security attributes
2024  *
2025  * Description:
2026  * Query @sk to see if there is a CIPSO option attached to the sock and if
2027  * there is return the CIPSO security attributes in @secattr.  This function
2028  * requires that @sk be locked, or privately held, but it does not do any
2029  * locking itself.  Returns zero on success and negative values on failure.
2030  *
2031  */
2032 int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
2033 {
2034 	struct ip_options *opt;
2035 
2036 	opt = inet_sk(sk)->opt;
2037 	if (opt == NULL || opt->cipso == 0)
2038 		return -ENOMSG;
2039 
2040 	return cipso_v4_getattr(opt->__data + opt->cipso - sizeof(struct iphdr),
2041 				secattr);
2042 }
2043 
2044 /**
2045  * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
2046  * @skb: the packet
2047  * @secattr: the security attributes
2048  *
2049  * Description:
2050  * Set the CIPSO option on the given packet based on the security attributes.
2051  * Returns a pointer to the IP header on success and NULL on failure.
2052  *
2053  */
2054 int cipso_v4_skbuff_setattr(struct sk_buff *skb,
2055 			    const struct cipso_v4_doi *doi_def,
2056 			    const struct netlbl_lsm_secattr *secattr)
2057 {
2058 	int ret_val;
2059 	struct iphdr *iph;
2060 	struct ip_options *opt = &IPCB(skb)->opt;
2061 	unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
2062 	u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
2063 	u32 opt_len;
2064 	int len_delta;
2065 
2066 	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
2067 	if (ret_val < 0)
2068 		return ret_val;
2069 	buf_len = ret_val;
2070 	opt_len = (buf_len + 3) & ~3;
2071 
2072 	/* we overwrite any existing options to ensure that we have enough
2073 	 * room for the CIPSO option, the reason is that we _need_ to guarantee
2074 	 * that the security label is applied to the packet - we do the same
2075 	 * thing when using the socket options and it hasn't caused a problem,
2076 	 * if we need to we can always revisit this choice later */
2077 
2078 	len_delta = opt_len - opt->optlen;
2079 	/* if we don't ensure enough headroom we could panic on the skb_push()
2080 	 * call below so make sure we have enough, we are also "mangling" the
2081 	 * packet so we should probably do a copy-on-write call anyway */
2082 	ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
2083 	if (ret_val < 0)
2084 		return ret_val;
2085 
2086 	if (len_delta > 0) {
2087 		/* we assume that the header + opt->optlen have already been
2088 		 * "pushed" in ip_options_build() or similar */
2089 		iph = ip_hdr(skb);
2090 		skb_push(skb, len_delta);
2091 		memmove((char *)iph - len_delta, iph, iph->ihl << 2);
2092 		skb_reset_network_header(skb);
2093 		iph = ip_hdr(skb);
2094 	} else if (len_delta < 0) {
2095 		iph = ip_hdr(skb);
2096 		memset(iph + 1, IPOPT_NOP, opt->optlen);
2097 	} else
2098 		iph = ip_hdr(skb);
2099 
2100 	if (opt->optlen > 0)
2101 		memset(opt, 0, sizeof(*opt));
2102 	opt->optlen = opt_len;
2103 	opt->cipso = sizeof(struct iphdr);
2104 	opt->is_changed = 1;
2105 
2106 	/* we have to do the following because we are being called from a
2107 	 * netfilter hook which means the packet already has had the header
2108 	 * fields populated and the checksum calculated - yes this means we
2109 	 * are doing more work than needed but we do it to keep the core
2110 	 * stack clean and tidy */
2111 	memcpy(iph + 1, buf, buf_len);
2112 	if (opt_len > buf_len)
2113 		memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
2114 	if (len_delta != 0) {
2115 		iph->ihl = 5 + (opt_len >> 2);
2116 		iph->tot_len = htons(skb->len);
2117 	}
2118 	ip_send_check(iph);
2119 
2120 	return 0;
2121 }
2122 
2123 /**
2124  * cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet
2125  * @skb: the packet
2126  *
2127  * Description:
2128  * Removes any and all CIPSO options from the given packet.  Returns zero on
2129  * success, negative values on failure.
2130  *
2131  */
2132 int cipso_v4_skbuff_delattr(struct sk_buff *skb)
2133 {
2134 	int ret_val;
2135 	struct iphdr *iph;
2136 	struct ip_options *opt = &IPCB(skb)->opt;
2137 	unsigned char *cipso_ptr;
2138 
2139 	if (opt->cipso == 0)
2140 		return 0;
2141 
2142 	/* since we are changing the packet we should make a copy */
2143 	ret_val = skb_cow(skb, skb_headroom(skb));
2144 	if (ret_val < 0)
2145 		return ret_val;
2146 
2147 	/* the easiest thing to do is just replace the cipso option with noop
2148 	 * options since we don't change the size of the packet, although we
2149 	 * still need to recalculate the checksum */
2150 
2151 	iph = ip_hdr(skb);
2152 	cipso_ptr = (unsigned char *)iph + opt->cipso;
2153 	memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
2154 	opt->cipso = 0;
2155 	opt->is_changed = 1;
2156 
2157 	ip_send_check(iph);
2158 
2159 	return 0;
2160 }
2161 
2162 /**
2163  * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
2164  * @skb: the packet
2165  * @secattr: the security attributes
2166  *
2167  * Description:
2168  * Parse the given packet's CIPSO option and return the security attributes.
2169  * Returns zero on success and negative values on failure.
2170  *
2171  */
2172 int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
2173 			    struct netlbl_lsm_secattr *secattr)
2174 {
2175 	return cipso_v4_getattr(CIPSO_V4_OPTPTR(skb), secattr);
2176 }
2177 
2178 /*
2179  * Setup Functions
2180  */
2181 
2182 /**
2183  * cipso_v4_init - Initialize the CIPSO module
2184  *
2185  * Description:
2186  * Initialize the CIPSO module and prepare it for use.  Returns zero on success
2187  * and negative values on failure.
2188  *
2189  */
2190 static int __init cipso_v4_init(void)
2191 {
2192 	int ret_val;
2193 
2194 	ret_val = cipso_v4_cache_init();
2195 	if (ret_val != 0)
2196 		panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
2197 		      ret_val);
2198 
2199 	return 0;
2200 }
2201 
2202 subsys_initcall(cipso_v4_init);
2203