1 /* 2 * Network port table 3 * 4 * SELinux must keep a mapping of network ports to labels/SIDs. This 5 * mapping is maintained as part of the normal policy but a fast cache is 6 * needed to reduce the lookup overhead. 7 * 8 * Author: Paul Moore <paul@paul-moore.com> 9 * 10 * This code is heavily based on the "netif" concept originally developed by 11 * James Morris <jmorris@redhat.com> 12 * (see security/selinux/netif.c for more information) 13 * 14 */ 15 16 /* 17 * (c) Copyright Hewlett-Packard Development Company, L.P., 2008 18 * 19 * This program is free software: you can redistribute it and/or modify 20 * it under the terms of version 2 of the GNU General Public License as 21 * published by the Free Software Foundation. 22 * 23 * This program is distributed in the hope that it will be useful, 24 * but WITHOUT ANY WARRANTY; without even the implied warranty of 25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 26 * GNU General Public License for more details. 27 * 28 */ 29 30 #include <linux/types.h> 31 #include <linux/rcupdate.h> 32 #include <linux/list.h> 33 #include <linux/slab.h> 34 #include <linux/spinlock.h> 35 #include <linux/in.h> 36 #include <linux/in6.h> 37 #include <linux/ip.h> 38 #include <linux/ipv6.h> 39 #include <net/ip.h> 40 #include <net/ipv6.h> 41 42 #include "netport.h" 43 #include "objsec.h" 44 45 #define SEL_NETPORT_HASH_SIZE 256 46 #define SEL_NETPORT_HASH_BKT_LIMIT 16 47 48 struct sel_netport_bkt { 49 int size; 50 struct list_head list; 51 }; 52 53 struct sel_netport { 54 struct netport_security_struct psec; 55 56 struct list_head list; 57 struct rcu_head rcu; 58 }; 59 60 /* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason 61 * for this is that I suspect most users will not make heavy use of both 62 * address families at the same time so one table will usually end up wasted, 63 * if this becomes a problem we can always add a hash table for each address 64 * family later */ 65 66 static LIST_HEAD(sel_netport_list); 67 static DEFINE_SPINLOCK(sel_netport_lock); 68 static struct sel_netport_bkt sel_netport_hash[SEL_NETPORT_HASH_SIZE]; 69 70 /** 71 * sel_netport_hashfn - Hashing function for the port table 72 * @pnum: port number 73 * 74 * Description: 75 * This is the hashing function for the port table, it returns the bucket 76 * number for the given port. 77 * 78 */ 79 static unsigned int sel_netport_hashfn(u16 pnum) 80 { 81 return (pnum & (SEL_NETPORT_HASH_SIZE - 1)); 82 } 83 84 /** 85 * sel_netport_find - Search for a port record 86 * @protocol: protocol 87 * @port: pnum 88 * 89 * Description: 90 * Search the network port table and return the matching record. If an entry 91 * can not be found in the table return NULL. 92 * 93 */ 94 static struct sel_netport *sel_netport_find(u8 protocol, u16 pnum) 95 { 96 unsigned int idx; 97 struct sel_netport *port; 98 99 idx = sel_netport_hashfn(pnum); 100 list_for_each_entry_rcu(port, &sel_netport_hash[idx].list, list) 101 if (port->psec.port == pnum && port->psec.protocol == protocol) 102 return port; 103 104 return NULL; 105 } 106 107 /** 108 * sel_netport_insert - Insert a new port into the table 109 * @port: the new port record 110 * 111 * Description: 112 * Add a new port record to the network address hash table. 113 * 114 */ 115 static void sel_netport_insert(struct sel_netport *port) 116 { 117 unsigned int idx; 118 119 /* we need to impose a limit on the growth of the hash table so check 120 * this bucket to make sure it is within the specified bounds */ 121 idx = sel_netport_hashfn(port->psec.port); 122 list_add_rcu(&port->list, &sel_netport_hash[idx].list); 123 if (sel_netport_hash[idx].size == SEL_NETPORT_HASH_BKT_LIMIT) { 124 struct sel_netport *tail; 125 tail = list_entry( 126 rcu_dereference(sel_netport_hash[idx].list.prev), 127 struct sel_netport, list); 128 list_del_rcu(&tail->list); 129 kfree_rcu(tail, rcu); 130 } else 131 sel_netport_hash[idx].size++; 132 } 133 134 /** 135 * sel_netport_sid_slow - Lookup the SID of a network address using the policy 136 * @protocol: protocol 137 * @pnum: port 138 * @sid: port SID 139 * 140 * Description: 141 * This function determines the SID of a network port by quering the security 142 * policy. The result is added to the network port table to speedup future 143 * queries. Returns zero on success, negative values on failure. 144 * 145 */ 146 static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid) 147 { 148 int ret = -ENOMEM; 149 struct sel_netport *port; 150 struct sel_netport *new = NULL; 151 152 spin_lock_bh(&sel_netport_lock); 153 port = sel_netport_find(protocol, pnum); 154 if (port != NULL) { 155 *sid = port->psec.sid; 156 spin_unlock_bh(&sel_netport_lock); 157 return 0; 158 } 159 new = kzalloc(sizeof(*new), GFP_ATOMIC); 160 if (new == NULL) 161 goto out; 162 ret = security_port_sid(protocol, pnum, sid); 163 if (ret != 0) 164 goto out; 165 166 new->psec.port = pnum; 167 new->psec.protocol = protocol; 168 new->psec.sid = *sid; 169 sel_netport_insert(new); 170 171 out: 172 spin_unlock_bh(&sel_netport_lock); 173 if (unlikely(ret)) { 174 printk(KERN_WARNING 175 "SELinux: failure in sel_netport_sid_slow()," 176 " unable to determine network port label\n"); 177 kfree(new); 178 } 179 return ret; 180 } 181 182 /** 183 * sel_netport_sid - Lookup the SID of a network port 184 * @protocol: protocol 185 * @pnum: port 186 * @sid: port SID 187 * 188 * Description: 189 * This function determines the SID of a network port using the fastest method 190 * possible. First the port table is queried, but if an entry can't be found 191 * then the policy is queried and the result is added to the table to speedup 192 * future queries. Returns zero on success, negative values on failure. 193 * 194 */ 195 int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid) 196 { 197 struct sel_netport *port; 198 199 rcu_read_lock(); 200 port = sel_netport_find(protocol, pnum); 201 if (port != NULL) { 202 *sid = port->psec.sid; 203 rcu_read_unlock(); 204 return 0; 205 } 206 rcu_read_unlock(); 207 208 return sel_netport_sid_slow(protocol, pnum, sid); 209 } 210 211 /** 212 * sel_netport_flush - Flush the entire network port table 213 * 214 * Description: 215 * Remove all entries from the network address table. 216 * 217 */ 218 static void sel_netport_flush(void) 219 { 220 unsigned int idx; 221 struct sel_netport *port, *port_tmp; 222 223 spin_lock_bh(&sel_netport_lock); 224 for (idx = 0; idx < SEL_NETPORT_HASH_SIZE; idx++) { 225 list_for_each_entry_safe(port, port_tmp, 226 &sel_netport_hash[idx].list, list) { 227 list_del_rcu(&port->list); 228 kfree_rcu(port, rcu); 229 } 230 sel_netport_hash[idx].size = 0; 231 } 232 spin_unlock_bh(&sel_netport_lock); 233 } 234 235 static int sel_netport_avc_callback(u32 event, u32 ssid, u32 tsid, 236 u16 class, u32 perms, u32 *retained) 237 { 238 if (event == AVC_CALLBACK_RESET) { 239 sel_netport_flush(); 240 synchronize_net(); 241 } 242 return 0; 243 } 244 245 static __init int sel_netport_init(void) 246 { 247 int iter; 248 int ret; 249 250 if (!selinux_enabled) 251 return 0; 252 253 for (iter = 0; iter < SEL_NETPORT_HASH_SIZE; iter++) { 254 INIT_LIST_HEAD(&sel_netport_hash[iter].list); 255 sel_netport_hash[iter].size = 0; 256 } 257 258 ret = avc_add_callback(sel_netport_avc_callback, AVC_CALLBACK_RESET, 259 SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0); 260 if (ret != 0) 261 panic("avc_add_callback() failed, error %d\n", ret); 262 263 return ret; 264 } 265 266 __initcall(sel_netport_init); 267