1 /* 2 * NetLabel Kernel API 3 * 4 * This file defines the kernel API for the NetLabel system. The NetLabel 5 * system manages static and dynamic label mappings for network protocols such 6 * as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul.moore@hp.com> 9 * 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, write to the Free Software 27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28 * 29 */ 30 31 #include <linux/init.h> 32 #include <linux/types.h> 33 #include <net/ip.h> 34 #include <net/netlabel.h> 35 #include <net/cipso_ipv4.h> 36 #include <asm/bug.h> 37 38 #include "netlabel_domainhash.h" 39 #include "netlabel_unlabeled.h" 40 #include "netlabel_user.h" 41 #include "netlabel_mgmt.h" 42 43 /* 44 * Security Attribute Functions 45 */ 46 47 /** 48 * netlbl_secattr_catmap_walk - Walk a LSM secattr catmap looking for a bit 49 * @catmap: the category bitmap 50 * @offset: the offset to start searching at, in bits 51 * 52 * Description: 53 * This function walks a LSM secattr category bitmap starting at @offset and 54 * returns the spot of the first set bit or -ENOENT if no bits are set. 55 * 56 */ 57 int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap, 58 u32 offset) 59 { 60 struct netlbl_lsm_secattr_catmap *iter = catmap; 61 u32 node_idx; 62 u32 node_bit; 63 NETLBL_CATMAP_MAPTYPE bitmap; 64 65 if (offset > iter->startbit) { 66 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 67 iter = iter->next; 68 if (iter == NULL) 69 return -ENOENT; 70 } 71 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 72 node_bit = offset - iter->startbit - 73 (NETLBL_CATMAP_MAPSIZE * node_idx); 74 } else { 75 node_idx = 0; 76 node_bit = 0; 77 } 78 bitmap = iter->bitmap[node_idx] >> node_bit; 79 80 for (;;) { 81 if (bitmap != 0) { 82 while ((bitmap & NETLBL_CATMAP_BIT) == 0) { 83 bitmap >>= 1; 84 node_bit++; 85 } 86 return iter->startbit + 87 (NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit; 88 } 89 if (++node_idx >= NETLBL_CATMAP_MAPCNT) { 90 if (iter->next != NULL) { 91 iter = iter->next; 92 node_idx = 0; 93 } else 94 return -ENOENT; 95 } 96 bitmap = iter->bitmap[node_idx]; 97 node_bit = 0; 98 } 99 100 return -ENOENT; 101 } 102 103 /** 104 * netlbl_secattr_catmap_walk_rng - Find the end of a string of set bits 105 * @catmap: the category bitmap 106 * @offset: the offset to start searching at, in bits 107 * 108 * Description: 109 * This function walks a LSM secattr category bitmap starting at @offset and 110 * returns the spot of the first cleared bit or -ENOENT if the offset is past 111 * the end of the bitmap. 112 * 113 */ 114 int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap, 115 u32 offset) 116 { 117 struct netlbl_lsm_secattr_catmap *iter = catmap; 118 u32 node_idx; 119 u32 node_bit; 120 NETLBL_CATMAP_MAPTYPE bitmask; 121 NETLBL_CATMAP_MAPTYPE bitmap; 122 123 if (offset > iter->startbit) { 124 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 125 iter = iter->next; 126 if (iter == NULL) 127 return -ENOENT; 128 } 129 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 130 node_bit = offset - iter->startbit - 131 (NETLBL_CATMAP_MAPSIZE * node_idx); 132 } else { 133 node_idx = 0; 134 node_bit = 0; 135 } 136 bitmask = NETLBL_CATMAP_BIT << node_bit; 137 138 for (;;) { 139 bitmap = iter->bitmap[node_idx]; 140 while (bitmask != 0 && (bitmap & bitmask) != 0) { 141 bitmask <<= 1; 142 node_bit++; 143 } 144 145 if (bitmask != 0) 146 return iter->startbit + 147 (NETLBL_CATMAP_MAPSIZE * node_idx) + 148 node_bit - 1; 149 else if (++node_idx >= NETLBL_CATMAP_MAPCNT) { 150 if (iter->next == NULL) 151 return iter->startbit + NETLBL_CATMAP_SIZE - 1; 152 iter = iter->next; 153 node_idx = 0; 154 } 155 bitmask = NETLBL_CATMAP_BIT; 156 node_bit = 0; 157 } 158 159 return -ENOENT; 160 } 161 162 /** 163 * netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap 164 * @catmap: the category bitmap 165 * @bit: the bit to set 166 * @flags: memory allocation flags 167 * 168 * Description: 169 * Set the bit specified by @bit in @catmap. Returns zero on success, 170 * negative values on failure. 171 * 172 */ 173 int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap, 174 u32 bit, 175 gfp_t flags) 176 { 177 struct netlbl_lsm_secattr_catmap *iter = catmap; 178 u32 node_bit; 179 u32 node_idx; 180 181 while (iter->next != NULL && 182 bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) 183 iter = iter->next; 184 if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 185 iter->next = netlbl_secattr_catmap_alloc(flags); 186 if (iter->next == NULL) 187 return -ENOMEM; 188 iter = iter->next; 189 iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1); 190 } 191 192 /* gcc always rounds to zero when doing integer division */ 193 node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 194 node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx); 195 iter->bitmap[node_idx] |= NETLBL_CATMAP_BIT << node_bit; 196 197 return 0; 198 } 199 200 /** 201 * netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap 202 * @catmap: the category bitmap 203 * @start: the starting bit 204 * @end: the last bit in the string 205 * @flags: memory allocation flags 206 * 207 * Description: 208 * Set a range of bits, starting at @start and ending with @end. Returns zero 209 * on success, negative values on failure. 210 * 211 */ 212 int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap, 213 u32 start, 214 u32 end, 215 gfp_t flags) 216 { 217 int ret_val = 0; 218 struct netlbl_lsm_secattr_catmap *iter = catmap; 219 u32 iter_max_spot; 220 u32 spot; 221 222 /* XXX - This could probably be made a bit faster by combining writes 223 * to the catmap instead of setting a single bit each time, but for 224 * right now skipping to the start of the range in the catmap should 225 * be a nice improvement over calling the individual setbit function 226 * repeatedly from a loop. */ 227 228 while (iter->next != NULL && 229 start >= (iter->startbit + NETLBL_CATMAP_SIZE)) 230 iter = iter->next; 231 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE; 232 233 for (spot = start; spot <= end && ret_val == 0; spot++) { 234 if (spot >= iter_max_spot && iter->next != NULL) { 235 iter = iter->next; 236 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE; 237 } 238 ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC); 239 } 240 241 return ret_val; 242 } 243 244 /* 245 * LSM Functions 246 */ 247 248 /** 249 * netlbl_enabled - Determine if the NetLabel subsystem is enabled 250 * 251 * Description: 252 * The LSM can use this function to determine if it should use NetLabel 253 * security attributes in it's enforcement mechanism. Currently, NetLabel is 254 * considered to be enabled when it's configuration contains a valid setup for 255 * at least one labeled protocol (i.e. NetLabel can understand incoming 256 * labeled packets of at least one type); otherwise NetLabel is considered to 257 * be disabled. 258 * 259 */ 260 int netlbl_enabled(void) 261 { 262 /* At some point we probably want to expose this mechanism to the user 263 * as well so that admins can toggle NetLabel regardless of the 264 * configuration */ 265 return (netlbl_mgmt_protocount_value() > 0 ? 1 : 0); 266 } 267 268 /** 269 * netlbl_socket_setattr - Label a socket using the correct protocol 270 * @sk: the socket to label 271 * @secattr: the security attributes 272 * 273 * Description: 274 * Attach the correct label to the given socket using the security attributes 275 * specified in @secattr. This function requires exclusive access to @sk, 276 * which means it either needs to be in the process of being created or locked. 277 * Returns zero on success, negative values on failure. 278 * 279 */ 280 int netlbl_sock_setattr(struct sock *sk, 281 const struct netlbl_lsm_secattr *secattr) 282 { 283 int ret_val = -ENOENT; 284 struct netlbl_dom_map *dom_entry; 285 286 rcu_read_lock(); 287 dom_entry = netlbl_domhsh_getentry(secattr->domain); 288 if (dom_entry == NULL) 289 goto socket_setattr_return; 290 switch (dom_entry->type) { 291 case NETLBL_NLTYPE_CIPSOV4: 292 ret_val = cipso_v4_sock_setattr(sk, 293 dom_entry->type_def.cipsov4, 294 secattr); 295 break; 296 case NETLBL_NLTYPE_UNLABELED: 297 ret_val = 0; 298 break; 299 default: 300 ret_val = -ENOENT; 301 } 302 303 socket_setattr_return: 304 rcu_read_unlock(); 305 return ret_val; 306 } 307 308 /** 309 * netlbl_sock_getattr - Determine the security attributes of a sock 310 * @sk: the sock 311 * @secattr: the security attributes 312 * 313 * Description: 314 * Examines the given sock to see any NetLabel style labeling has been 315 * applied to the sock, if so it parses the socket label and returns the 316 * security attributes in @secattr. Returns zero on success, negative values 317 * on failure. 318 * 319 */ 320 int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) 321 { 322 int ret_val; 323 324 ret_val = cipso_v4_sock_getattr(sk, secattr); 325 if (ret_val == 0) 326 return 0; 327 328 return netlbl_unlabel_getattr(secattr); 329 } 330 331 /** 332 * netlbl_skbuff_getattr - Determine the security attributes of a packet 333 * @skb: the packet 334 * @secattr: the security attributes 335 * 336 * Description: 337 * Examines the given packet to see if a recognized form of packet labeling 338 * is present, if so it parses the packet label and returns the security 339 * attributes in @secattr. Returns zero on success, negative values on 340 * failure. 341 * 342 */ 343 int netlbl_skbuff_getattr(const struct sk_buff *skb, 344 struct netlbl_lsm_secattr *secattr) 345 { 346 if (CIPSO_V4_OPTEXIST(skb) && 347 cipso_v4_skbuff_getattr(skb, secattr) == 0) 348 return 0; 349 350 return netlbl_unlabel_getattr(secattr); 351 } 352 353 /** 354 * netlbl_skbuff_err - Handle a LSM error on a sk_buff 355 * @skb: the packet 356 * @error: the error code 357 * 358 * Description: 359 * Deal with a LSM problem when handling the packet in @skb, typically this is 360 * a permission denied problem (-EACCES). The correct action is determined 361 * according to the packet's labeling protocol. 362 * 363 */ 364 void netlbl_skbuff_err(struct sk_buff *skb, int error) 365 { 366 if (CIPSO_V4_OPTEXIST(skb)) 367 cipso_v4_error(skb, error, 0); 368 } 369 370 /** 371 * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches 372 * 373 * Description: 374 * For all of the NetLabel protocols that support some form of label mapping 375 * cache, invalidate the cache. Returns zero on success, negative values on 376 * error. 377 * 378 */ 379 void netlbl_cache_invalidate(void) 380 { 381 cipso_v4_cache_invalidate(); 382 } 383 384 /** 385 * netlbl_cache_add - Add an entry to a NetLabel protocol cache 386 * @skb: the packet 387 * @secattr: the packet's security attributes 388 * 389 * Description: 390 * Add the LSM security attributes for the given packet to the underlying 391 * NetLabel protocol's label mapping cache. Returns zero on success, negative 392 * values on error. 393 * 394 */ 395 int netlbl_cache_add(const struct sk_buff *skb, 396 const struct netlbl_lsm_secattr *secattr) 397 { 398 if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0) 399 return -ENOMSG; 400 401 if (CIPSO_V4_OPTEXIST(skb)) 402 return cipso_v4_cache_add(skb, secattr); 403 404 return -ENOMSG; 405 } 406 407 /* 408 * Setup Functions 409 */ 410 411 /** 412 * netlbl_init - Initialize NetLabel 413 * 414 * Description: 415 * Perform the required NetLabel initialization before first use. 416 * 417 */ 418 static int __init netlbl_init(void) 419 { 420 int ret_val; 421 422 printk(KERN_INFO "NetLabel: Initializing\n"); 423 printk(KERN_INFO "NetLabel: domain hash size = %u\n", 424 (1 << NETLBL_DOMHSH_BITSIZE)); 425 printk(KERN_INFO "NetLabel: protocols =" 426 " UNLABELED" 427 " CIPSOv4" 428 "\n"); 429 430 ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE); 431 if (ret_val != 0) 432 goto init_failure; 433 434 ret_val = netlbl_netlink_init(); 435 if (ret_val != 0) 436 goto init_failure; 437 438 ret_val = netlbl_unlabel_defconf(); 439 if (ret_val != 0) 440 goto init_failure; 441 printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n"); 442 443 return 0; 444 445 init_failure: 446 panic("NetLabel: failed to initialize properly (%d)\n", ret_val); 447 } 448 449 subsys_initcall(netlbl_init); 450