1b886d83cSThomas Gleixner /* SPDX-License-Identifier: GPL-2.0-only */
2e06f75a6SJohn Johansen /*
3e06f75a6SJohn Johansen * AppArmor security module
4e06f75a6SJohn Johansen *
5e06f75a6SJohn Johansen * This file contains AppArmor policy dfa matching engine definitions.
6e06f75a6SJohn Johansen *
7e06f75a6SJohn Johansen * Copyright (C) 1998-2008 Novell/SUSE
88e4ff109SJohn Johansen * Copyright 2009-2012 Canonical Ltd.
9e06f75a6SJohn Johansen */
10e06f75a6SJohn Johansen
11e06f75a6SJohn Johansen #ifndef __AA_MATCH_H
12e06f75a6SJohn Johansen #define __AA_MATCH_H
13e06f75a6SJohn Johansen
1457cc7215SAlexey Dobriyan #include <linux/kref.h>
15e06f75a6SJohn Johansen
16e06f75a6SJohn Johansen #define DFA_NOMATCH 0
17e06f75a6SJohn Johansen #define DFA_START 1
18e06f75a6SJohn Johansen
19e06f75a6SJohn Johansen
20e06f75a6SJohn Johansen /**
21e06f75a6SJohn Johansen * The format used for transition tables is based on the GNU flex table
22e06f75a6SJohn Johansen * file format (--tables-file option; see Table File Format in the flex
23e06f75a6SJohn Johansen * info pages and the flex sources for documentation). The magic number
24b595076aSUwe Kleine-König * used in the header is 0x1B5E783D instead of 0xF13C57B1 though, because
258e4ff109SJohn Johansen * new tables have been defined and others YY_ID_CHK (check) and YY_ID_DEF
268e4ff109SJohn Johansen * (default) tables are used slightly differently (see the apparmor-parser
278e4ff109SJohn Johansen * package).
288e4ff109SJohn Johansen *
298e4ff109SJohn Johansen *
308e4ff109SJohn Johansen * The data in the packed dfa is stored in network byte order, and the tables
318e4ff109SJohn Johansen * are arranged for flexibility. We convert the table data to host native
328e4ff109SJohn Johansen * byte order.
338e4ff109SJohn Johansen *
348e4ff109SJohn Johansen * The dfa begins with a table set header, and is followed by the actual
358e4ff109SJohn Johansen * tables.
36e06f75a6SJohn Johansen */
37e06f75a6SJohn Johansen
38e06f75a6SJohn Johansen #define YYTH_MAGIC 0x1B5E783D
39031dcc8fSJohn Johansen #define YYTH_FLAG_DIFF_ENCODE 1
400df34a64SJohn Johansen #define YYTH_FLAG_OOB_TRANS 2
410df34a64SJohn Johansen #define YYTH_FLAGS (YYTH_FLAG_DIFF_ENCODE | YYTH_FLAG_OOB_TRANS)
420df34a64SJohn Johansen
430df34a64SJohn Johansen #define MAX_OOB_SUPPORTED 1
44e06f75a6SJohn Johansen
45e06f75a6SJohn Johansen struct table_set_header {
46e06f75a6SJohn Johansen u32 th_magic; /* YYTH_MAGIC */
47e06f75a6SJohn Johansen u32 th_hsize;
48e06f75a6SJohn Johansen u32 th_ssize;
49e06f75a6SJohn Johansen u16 th_flags;
50e06f75a6SJohn Johansen char th_version[];
51e06f75a6SJohn Johansen };
52e06f75a6SJohn Johansen
53e06f75a6SJohn Johansen /* The YYTD_ID are one less than flex table mappings. The flex id
54e06f75a6SJohn Johansen * has 1 subtracted at table load time, this allows us to directly use the
55e06f75a6SJohn Johansen * ID's as indexes.
56e06f75a6SJohn Johansen */
57e06f75a6SJohn Johansen #define YYTD_ID_ACCEPT 0
58e06f75a6SJohn Johansen #define YYTD_ID_BASE 1
59e06f75a6SJohn Johansen #define YYTD_ID_CHK 2
60e06f75a6SJohn Johansen #define YYTD_ID_DEF 3
61e06f75a6SJohn Johansen #define YYTD_ID_EC 4
62e06f75a6SJohn Johansen #define YYTD_ID_META 5
63e06f75a6SJohn Johansen #define YYTD_ID_ACCEPT2 6
64e06f75a6SJohn Johansen #define YYTD_ID_NXT 7
65e06f75a6SJohn Johansen #define YYTD_ID_TSIZE 8
6615756178SJohn Johansen #define YYTD_ID_MAX 8
67e06f75a6SJohn Johansen
68e06f75a6SJohn Johansen #define YYTD_DATA8 1
69e06f75a6SJohn Johansen #define YYTD_DATA16 2
70e06f75a6SJohn Johansen #define YYTD_DATA32 4
71e06f75a6SJohn Johansen #define YYTD_DATA64 8
72e06f75a6SJohn Johansen
738e4ff109SJohn Johansen /* ACCEPT & ACCEPT2 tables gets 6 dedicated flags, YYTD_DATAX define the
74e06f75a6SJohn Johansen * first flags
75e06f75a6SJohn Johansen */
76e06f75a6SJohn Johansen #define ACCEPT1_FLAGS(X) ((X) & 0x3f)
77e06f75a6SJohn Johansen #define ACCEPT2_FLAGS(X) ACCEPT1_FLAGS((X) >> YYTD_ID_ACCEPT2)
78e06f75a6SJohn Johansen #define TO_ACCEPT1_FLAG(X) ACCEPT1_FLAGS(X)
79e06f75a6SJohn Johansen #define TO_ACCEPT2_FLAG(X) (ACCEPT1_FLAGS(X) << YYTD_ID_ACCEPT2)
80e06f75a6SJohn Johansen #define DFA_FLAG_VERIFY_STATES 0x1000
81e06f75a6SJohn Johansen
82e06f75a6SJohn Johansen struct table_header {
83e06f75a6SJohn Johansen u16 td_id;
84e06f75a6SJohn Johansen u16 td_flags;
85e06f75a6SJohn Johansen u32 td_hilen;
86e06f75a6SJohn Johansen u32 td_lolen;
87e06f75a6SJohn Johansen char td_data[];
88e06f75a6SJohn Johansen };
89e06f75a6SJohn Johansen
90e06f75a6SJohn Johansen #define DEFAULT_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_DEF]->td_data))
91e06f75a6SJohn Johansen #define BASE_TABLE(DFA) ((u32 *)((DFA)->tables[YYTD_ID_BASE]->td_data))
92e06f75a6SJohn Johansen #define NEXT_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_NXT]->td_data))
93e06f75a6SJohn Johansen #define CHECK_TABLE(DFA) ((u16 *)((DFA)->tables[YYTD_ID_CHK]->td_data))
94e06f75a6SJohn Johansen #define EQUIV_TABLE(DFA) ((u8 *)((DFA)->tables[YYTD_ID_EC]->td_data))
95e06f75a6SJohn Johansen #define ACCEPT_TABLE(DFA) ((u32 *)((DFA)->tables[YYTD_ID_ACCEPT]->td_data))
96e06f75a6SJohn Johansen #define ACCEPT_TABLE2(DFA) ((u32 *)((DFA)->tables[YYTD_ID_ACCEPT2]->td_data))
97e06f75a6SJohn Johansen
98e06f75a6SJohn Johansen struct aa_dfa {
99e06f75a6SJohn Johansen struct kref count;
100e06f75a6SJohn Johansen u16 flags;
1010df34a64SJohn Johansen u32 max_oob;
102e06f75a6SJohn Johansen struct table_header *tables[YYTD_ID_TSIZE];
103e06f75a6SJohn Johansen };
104e06f75a6SJohn Johansen
10511c236b8SJohn Johansen extern struct aa_dfa *nulldfa;
1066e0654d2SJohn Johansen extern struct aa_dfa *stacksplitdfa;
10711c236b8SJohn Johansen
108e06f75a6SJohn Johansen #define byte_to_byte(X) (X)
109e06f75a6SJohn Johansen
110e6e8bf41SJohn Johansen #define UNPACK_ARRAY(TABLE, BLOB, LEN, TTYPE, BTYPE, NTOHX) \
111e06f75a6SJohn Johansen do { \
112e06f75a6SJohn Johansen typeof(LEN) __i; \
113e6e8bf41SJohn Johansen TTYPE *__t = (TTYPE *) TABLE; \
114e6e8bf41SJohn Johansen BTYPE *__b = (BTYPE *) BLOB; \
115e06f75a6SJohn Johansen for (__i = 0; __i < LEN; __i++) { \
116e06f75a6SJohn Johansen __t[__i] = NTOHX(__b[__i]); \
117e06f75a6SJohn Johansen } \
118e06f75a6SJohn Johansen } while (0)
119e06f75a6SJohn Johansen
table_size(size_t len,size_t el_size)120e06f75a6SJohn Johansen static inline size_t table_size(size_t len, size_t el_size)
121e06f75a6SJohn Johansen {
122e06f75a6SJohn Johansen return ALIGN(sizeof(struct table_header) + len * el_size, 8);
123e06f75a6SJohn Johansen }
124e06f75a6SJohn Johansen
12511c236b8SJohn Johansen int aa_setup_dfa_engine(void);
12611c236b8SJohn Johansen void aa_teardown_dfa_engine(void);
12711c236b8SJohn Johansen
128*33fc95d8SJohn Johansen #define aa_state_t unsigned int
129*33fc95d8SJohn Johansen
130e06f75a6SJohn Johansen struct aa_dfa *aa_dfa_unpack(void *blob, size_t size, int flags);
131*33fc95d8SJohn Johansen aa_state_t aa_dfa_match_len(struct aa_dfa *dfa, aa_state_t start,
132e06f75a6SJohn Johansen const char *str, int len);
133*33fc95d8SJohn Johansen aa_state_t aa_dfa_match(struct aa_dfa *dfa, aa_state_t start,
134e06f75a6SJohn Johansen const char *str);
135*33fc95d8SJohn Johansen aa_state_t aa_dfa_next(struct aa_dfa *dfa, aa_state_t state, const char c);
136*33fc95d8SJohn Johansen aa_state_t aa_dfa_outofband_transition(struct aa_dfa *dfa, aa_state_t state);
137*33fc95d8SJohn Johansen aa_state_t aa_dfa_match_until(struct aa_dfa *dfa, aa_state_t start,
138cf65fabcSJohn Johansen const char *str, const char **retpos);
139*33fc95d8SJohn Johansen aa_state_t aa_dfa_matchn_until(struct aa_dfa *dfa, aa_state_t start,
140cf65fabcSJohn Johansen const char *str, int n, const char **retpos);
1410fe1212dSJohn Johansen
142e06f75a6SJohn Johansen void aa_dfa_free_kref(struct kref *kref);
143e06f75a6SJohn Johansen
144136db994SJohn Johansen #define WB_HISTORY_SIZE 24
14521f60661SJohn Johansen struct match_workbuf {
14621f60661SJohn Johansen unsigned int count;
14721f60661SJohn Johansen unsigned int pos;
14821f60661SJohn Johansen unsigned int len;
14921f60661SJohn Johansen unsigned int size; /* power of 2, same as history size */
15021f60661SJohn Johansen unsigned int history[WB_HISTORY_SIZE];
15121f60661SJohn Johansen };
15221f60661SJohn Johansen #define DEFINE_MATCH_WB(N) \
15321f60661SJohn Johansen struct match_workbuf N = { \
15421f60661SJohn Johansen .count = 0, \
15521f60661SJohn Johansen .pos = 0, \
15621f60661SJohn Johansen .len = 0, \
15721f60661SJohn Johansen }
15821f60661SJohn Johansen
159*33fc95d8SJohn Johansen aa_state_t aa_dfa_leftmatch(struct aa_dfa *dfa, aa_state_t start,
16021f60661SJohn Johansen const char *str, unsigned int *count);
16121f60661SJohn Johansen
162e06f75a6SJohn Johansen /**
163293a4886SJohn Johansen * aa_get_dfa - increment refcount on dfa @p
164293a4886SJohn Johansen * @dfa: dfa (MAYBE NULL)
165293a4886SJohn Johansen *
166293a4886SJohn Johansen * Returns: pointer to @dfa if @dfa is NULL will return NULL
167293a4886SJohn Johansen * Requires: @dfa must be held with valid refcount when called
168293a4886SJohn Johansen */
aa_get_dfa(struct aa_dfa * dfa)169293a4886SJohn Johansen static inline struct aa_dfa *aa_get_dfa(struct aa_dfa *dfa)
170293a4886SJohn Johansen {
171293a4886SJohn Johansen if (dfa)
172293a4886SJohn Johansen kref_get(&(dfa->count));
173293a4886SJohn Johansen
174293a4886SJohn Johansen return dfa;
175293a4886SJohn Johansen }
176293a4886SJohn Johansen
177293a4886SJohn Johansen /**
178e06f75a6SJohn Johansen * aa_put_dfa - put a dfa refcount
179e06f75a6SJohn Johansen * @dfa: dfa to put refcount (MAYBE NULL)
180e06f75a6SJohn Johansen *
181e06f75a6SJohn Johansen * Requires: if @dfa != NULL that a valid refcount be held
182e06f75a6SJohn Johansen */
aa_put_dfa(struct aa_dfa * dfa)183e06f75a6SJohn Johansen static inline void aa_put_dfa(struct aa_dfa *dfa)
184e06f75a6SJohn Johansen {
185e06f75a6SJohn Johansen if (dfa)
186e06f75a6SJohn Johansen kref_put(&dfa->count, aa_dfa_free_kref);
187e06f75a6SJohn Johansen }
188e06f75a6SJohn Johansen
189031dcc8fSJohn Johansen #define MATCH_FLAG_DIFF_ENCODE 0x80000000
190031dcc8fSJohn Johansen #define MARK_DIFF_ENCODE 0x40000000
191c6596969SJohn Johansen #define MATCH_FLAG_OOB_TRANSITION 0x20000000
192c6596969SJohn Johansen #define MATCH_FLAGS_MASK 0xff000000
1930df34a64SJohn Johansen #define MATCH_FLAGS_VALID (MATCH_FLAG_DIFF_ENCODE | MATCH_FLAG_OOB_TRANSITION)
194c6596969SJohn Johansen #define MATCH_FLAGS_INVALID (MATCH_FLAGS_MASK & ~MATCH_FLAGS_VALID)
195031dcc8fSJohn Johansen
196e06f75a6SJohn Johansen #endif /* __AA_MATCH_H */
197