1 /*
2  * NetLabel Unlabeled Support
3  *
4  * This file defines functions for dealing with unlabeled packets for the
5  * NetLabel system.  The NetLabel system manages static and dynamic label
6  * mappings for network protocols such as CIPSO and RIPSO.
7  *
8  * Author: Paul Moore <paul.moore@hp.com>
9  *
10  */
11 
12 /*
13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
14  *
15  * This program is free software;  you can redistribute it and/or modify
16  * it under the terms of the GNU General Public License as published by
17  * the Free Software Foundation; either version 2 of the License, or
18  * (at your option) any later version.
19  *
20  * This program is distributed in the hope that it will be useful,
21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
23  * the GNU General Public License for more details.
24  *
25  * You should have received a copy of the GNU General Public License
26  * along with this program;  if not, write to the Free Software
27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28  *
29  */
30 
31 #include <linux/types.h>
32 #include <linux/rcupdate.h>
33 #include <linux/list.h>
34 #include <linux/spinlock.h>
35 #include <linux/socket.h>
36 #include <linux/string.h>
37 #include <linux/skbuff.h>
38 #include <linux/audit.h>
39 #include <linux/in.h>
40 #include <linux/in6.h>
41 #include <linux/ip.h>
42 #include <linux/ipv6.h>
43 #include <linux/notifier.h>
44 #include <linux/netdevice.h>
45 #include <linux/security.h>
46 #include <linux/slab.h>
47 #include <net/sock.h>
48 #include <net/netlink.h>
49 #include <net/genetlink.h>
50 #include <net/ip.h>
51 #include <net/ipv6.h>
52 #include <net/net_namespace.h>
53 #include <net/netlabel.h>
54 #include <asm/bug.h>
55 #include <asm/atomic.h>
56 
57 #include "netlabel_user.h"
58 #include "netlabel_addrlist.h"
59 #include "netlabel_domainhash.h"
60 #include "netlabel_unlabeled.h"
61 #include "netlabel_mgmt.h"
62 
63 /* NOTE: at present we always use init's network namespace since we don't
64  *       presently support different namespaces even though the majority of
65  *       the functions in this file are "namespace safe" */
66 
67 /* The unlabeled connection hash table which we use to map network interfaces
68  * and addresses of unlabeled packets to a user specified secid value for the
69  * LSM.  The hash table is used to lookup the network interface entry
70  * (struct netlbl_unlhsh_iface) and then the interface entry is used to
71  * lookup an IP address match from an ordered list.  If a network interface
72  * match can not be found in the hash table then the default entry
73  * (netlbl_unlhsh_def) is used.  The IP address entry list
74  * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
75  * larger netmask come first.
76  */
77 struct netlbl_unlhsh_tbl {
78 	struct list_head *tbl;
79 	u32 size;
80 };
81 #define netlbl_unlhsh_addr4_entry(iter) \
82 	container_of(iter, struct netlbl_unlhsh_addr4, list)
83 struct netlbl_unlhsh_addr4 {
84 	u32 secid;
85 
86 	struct netlbl_af4list list;
87 	struct rcu_head rcu;
88 };
89 #define netlbl_unlhsh_addr6_entry(iter) \
90 	container_of(iter, struct netlbl_unlhsh_addr6, list)
91 struct netlbl_unlhsh_addr6 {
92 	u32 secid;
93 
94 	struct netlbl_af6list list;
95 	struct rcu_head rcu;
96 };
97 struct netlbl_unlhsh_iface {
98 	int ifindex;
99 	struct list_head addr4_list;
100 	struct list_head addr6_list;
101 
102 	u32 valid;
103 	struct list_head list;
104 	struct rcu_head rcu;
105 };
106 
107 /* Argument struct for netlbl_unlhsh_walk() */
108 struct netlbl_unlhsh_walk_arg {
109 	struct netlink_callback *nl_cb;
110 	struct sk_buff *skb;
111 	u32 seq;
112 };
113 
114 /* Unlabeled connection hash table */
115 /* updates should be so rare that having one spinlock for the entire
116  * hash table should be okay */
117 static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
118 #define netlbl_unlhsh_rcu_deref(p) \
119 	rcu_dereference_check(p, rcu_read_lock_held() || \
120 				 lockdep_is_held(&netlbl_unlhsh_lock))
121 static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL;
122 static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL;
123 
124 /* Accept unlabeled packets flag */
125 static u8 netlabel_unlabel_acceptflg = 0;
126 
127 /* NetLabel Generic NETLINK unlabeled family */
128 static struct genl_family netlbl_unlabel_gnl_family = {
129 	.id = GENL_ID_GENERATE,
130 	.hdrsize = 0,
131 	.name = NETLBL_NLTYPE_UNLABELED_NAME,
132 	.version = NETLBL_PROTO_VERSION,
133 	.maxattr = NLBL_UNLABEL_A_MAX,
134 };
135 
136 /* NetLabel Netlink attribute policy */
137 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
138 	[NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
139 	[NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
140 				      .len = sizeof(struct in6_addr) },
141 	[NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
142 				      .len = sizeof(struct in6_addr) },
143 	[NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
144 				      .len = sizeof(struct in_addr) },
145 	[NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
146 				      .len = sizeof(struct in_addr) },
147 	[NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
148 				   .len = IFNAMSIZ - 1 },
149 	[NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
150 };
151 
152 /*
153  * Unlabeled Connection Hash Table Functions
154  */
155 
156 /**
157  * netlbl_unlhsh_free_addr4 - Frees an IPv4 address entry from the hash table
158  * @entry: the entry's RCU field
159  *
160  * Description:
161  * This function is designed to be used as a callback to the call_rcu()
162  * function so that memory allocated to a hash table address entry can be
163  * released safely.
164  *
165  */
netlbl_unlhsh_free_addr4(struct rcu_head * entry)166 static void netlbl_unlhsh_free_addr4(struct rcu_head *entry)
167 {
168 	struct netlbl_unlhsh_addr4 *ptr;
169 
170 	ptr = container_of(entry, struct netlbl_unlhsh_addr4, rcu);
171 	kfree(ptr);
172 }
173 
174 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
175 /**
176  * netlbl_unlhsh_free_addr6 - Frees an IPv6 address entry from the hash table
177  * @entry: the entry's RCU field
178  *
179  * Description:
180  * This function is designed to be used as a callback to the call_rcu()
181  * function so that memory allocated to a hash table address entry can be
182  * released safely.
183  *
184  */
netlbl_unlhsh_free_addr6(struct rcu_head * entry)185 static void netlbl_unlhsh_free_addr6(struct rcu_head *entry)
186 {
187 	struct netlbl_unlhsh_addr6 *ptr;
188 
189 	ptr = container_of(entry, struct netlbl_unlhsh_addr6, rcu);
190 	kfree(ptr);
191 }
192 #endif /* IPv6 */
193 
194 /**
195  * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
196  * @entry: the entry's RCU field
197  *
198  * Description:
199  * This function is designed to be used as a callback to the call_rcu()
200  * function so that memory allocated to a hash table interface entry can be
201  * released safely.  It is important to note that this function does not free
202  * the IPv4 and IPv6 address lists contained as part of an interface entry.  It
203  * is up to the rest of the code to make sure an interface entry is only freed
204  * once it's address lists are empty.
205  *
206  */
netlbl_unlhsh_free_iface(struct rcu_head * entry)207 static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
208 {
209 	struct netlbl_unlhsh_iface *iface;
210 	struct netlbl_af4list *iter4;
211 	struct netlbl_af4list *tmp4;
212 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
213 	struct netlbl_af6list *iter6;
214 	struct netlbl_af6list *tmp6;
215 #endif /* IPv6 */
216 
217 	iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
218 
219 	/* no need for locks here since we are the only one with access to this
220 	 * structure */
221 
222 	netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
223 		netlbl_af4list_remove_entry(iter4);
224 		kfree(netlbl_unlhsh_addr4_entry(iter4));
225 	}
226 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
227 	netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
228 		netlbl_af6list_remove_entry(iter6);
229 		kfree(netlbl_unlhsh_addr6_entry(iter6));
230 	}
231 #endif /* IPv6 */
232 	kfree(iface);
233 }
234 
235 /**
236  * netlbl_unlhsh_hash - Hashing function for the hash table
237  * @ifindex: the network interface/device to hash
238  *
239  * Description:
240  * This is the hashing function for the unlabeled hash table, it returns the
241  * bucket number for the given device/interface.  The caller is responsible for
242  * ensuring that the hash table is protected with either a RCU read lock or
243  * the hash table lock.
244  *
245  */
netlbl_unlhsh_hash(int ifindex)246 static u32 netlbl_unlhsh_hash(int ifindex)
247 {
248 	return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
249 }
250 
251 /**
252  * netlbl_unlhsh_search_iface - Search for a matching interface entry
253  * @ifindex: the network interface
254  *
255  * Description:
256  * Searches the unlabeled connection hash table and returns a pointer to the
257  * interface entry which matches @ifindex, otherwise NULL is returned.  The
258  * caller is responsible for ensuring that the hash table is protected with
259  * either a RCU read lock or the hash table lock.
260  *
261  */
netlbl_unlhsh_search_iface(int ifindex)262 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
263 {
264 	u32 bkt;
265 	struct list_head *bkt_list;
266 	struct netlbl_unlhsh_iface *iter;
267 
268 	bkt = netlbl_unlhsh_hash(ifindex);
269 	bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
270 	list_for_each_entry_rcu(iter, bkt_list, list)
271 		if (iter->valid && iter->ifindex == ifindex)
272 			return iter;
273 
274 	return NULL;
275 }
276 
277 /**
278  * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
279  * @iface: the associated interface entry
280  * @addr: IPv4 address in network byte order
281  * @mask: IPv4 address mask in network byte order
282  * @secid: LSM secid value for entry
283  *
284  * Description:
285  * Add a new address entry into the unlabeled connection hash table using the
286  * interface entry specified by @iface.  On success zero is returned, otherwise
287  * a negative value is returned.
288  *
289  */
netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface * iface,const struct in_addr * addr,const struct in_addr * mask,u32 secid)290 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
291 				   const struct in_addr *addr,
292 				   const struct in_addr *mask,
293 				   u32 secid)
294 {
295 	int ret_val;
296 	struct netlbl_unlhsh_addr4 *entry;
297 
298 	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
299 	if (entry == NULL)
300 		return -ENOMEM;
301 
302 	entry->list.addr = addr->s_addr & mask->s_addr;
303 	entry->list.mask = mask->s_addr;
304 	entry->list.valid = 1;
305 	entry->secid = secid;
306 
307 	spin_lock(&netlbl_unlhsh_lock);
308 	ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
309 	spin_unlock(&netlbl_unlhsh_lock);
310 
311 	if (ret_val != 0)
312 		kfree(entry);
313 	return ret_val;
314 }
315 
316 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
317 /**
318  * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
319  * @iface: the associated interface entry
320  * @addr: IPv6 address in network byte order
321  * @mask: IPv6 address mask in network byte order
322  * @secid: LSM secid value for entry
323  *
324  * Description:
325  * Add a new address entry into the unlabeled connection hash table using the
326  * interface entry specified by @iface.  On success zero is returned, otherwise
327  * a negative value is returned.
328  *
329  */
netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface * iface,const struct in6_addr * addr,const struct in6_addr * mask,u32 secid)330 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
331 				   const struct in6_addr *addr,
332 				   const struct in6_addr *mask,
333 				   u32 secid)
334 {
335 	int ret_val;
336 	struct netlbl_unlhsh_addr6 *entry;
337 
338 	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
339 	if (entry == NULL)
340 		return -ENOMEM;
341 
342 	ipv6_addr_copy(&entry->list.addr, addr);
343 	entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
344 	entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
345 	entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
346 	entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
347 	ipv6_addr_copy(&entry->list.mask, mask);
348 	entry->list.valid = 1;
349 	entry->secid = secid;
350 
351 	spin_lock(&netlbl_unlhsh_lock);
352 	ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
353 	spin_unlock(&netlbl_unlhsh_lock);
354 
355 	if (ret_val != 0)
356 		kfree(entry);
357 	return 0;
358 }
359 #endif /* IPv6 */
360 
361 /**
362  * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
363  * @ifindex: network interface
364  *
365  * Description:
366  * Add a new, empty, interface entry into the unlabeled connection hash table.
367  * On success a pointer to the new interface entry is returned, on failure NULL
368  * is returned.
369  *
370  */
netlbl_unlhsh_add_iface(int ifindex)371 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
372 {
373 	u32 bkt;
374 	struct netlbl_unlhsh_iface *iface;
375 
376 	iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
377 	if (iface == NULL)
378 		return NULL;
379 
380 	iface->ifindex = ifindex;
381 	INIT_LIST_HEAD(&iface->addr4_list);
382 	INIT_LIST_HEAD(&iface->addr6_list);
383 	iface->valid = 1;
384 
385 	spin_lock(&netlbl_unlhsh_lock);
386 	if (ifindex > 0) {
387 		bkt = netlbl_unlhsh_hash(ifindex);
388 		if (netlbl_unlhsh_search_iface(ifindex) != NULL)
389 			goto add_iface_failure;
390 		list_add_tail_rcu(&iface->list,
391 			     &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
392 	} else {
393 		INIT_LIST_HEAD(&iface->list);
394 		if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
395 			goto add_iface_failure;
396 		rcu_assign_pointer(netlbl_unlhsh_def, iface);
397 	}
398 	spin_unlock(&netlbl_unlhsh_lock);
399 
400 	return iface;
401 
402 add_iface_failure:
403 	spin_unlock(&netlbl_unlhsh_lock);
404 	kfree(iface);
405 	return NULL;
406 }
407 
408 /**
409  * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
410  * @net: network namespace
411  * @dev_name: interface name
412  * @addr: IP address in network byte order
413  * @mask: address mask in network byte order
414  * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
415  * @secid: LSM secid value for the entry
416  * @audit_info: NetLabel audit information
417  *
418  * Description:
419  * Adds a new entry to the unlabeled connection hash table.  Returns zero on
420  * success, negative values on failure.
421  *
422  */
netlbl_unlhsh_add(struct net * net,const char * dev_name,const void * addr,const void * mask,u32 addr_len,u32 secid,struct netlbl_audit * audit_info)423 int netlbl_unlhsh_add(struct net *net,
424 		      const char *dev_name,
425 		      const void *addr,
426 		      const void *mask,
427 		      u32 addr_len,
428 		      u32 secid,
429 		      struct netlbl_audit *audit_info)
430 {
431 	int ret_val;
432 	int ifindex;
433 	struct net_device *dev;
434 	struct netlbl_unlhsh_iface *iface;
435 	struct audit_buffer *audit_buf = NULL;
436 	char *secctx = NULL;
437 	u32 secctx_len;
438 
439 	if (addr_len != sizeof(struct in_addr) &&
440 	    addr_len != sizeof(struct in6_addr))
441 		return -EINVAL;
442 
443 	rcu_read_lock();
444 	if (dev_name != NULL) {
445 		dev = dev_get_by_name_rcu(net, dev_name);
446 		if (dev == NULL) {
447 			ret_val = -ENODEV;
448 			goto unlhsh_add_return;
449 		}
450 		ifindex = dev->ifindex;
451 		iface = netlbl_unlhsh_search_iface(ifindex);
452 	} else {
453 		ifindex = 0;
454 		iface = rcu_dereference(netlbl_unlhsh_def);
455 	}
456 	if (iface == NULL) {
457 		iface = netlbl_unlhsh_add_iface(ifindex);
458 		if (iface == NULL) {
459 			ret_val = -ENOMEM;
460 			goto unlhsh_add_return;
461 		}
462 	}
463 	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
464 					      audit_info);
465 	switch (addr_len) {
466 	case sizeof(struct in_addr): {
467 		struct in_addr *addr4, *mask4;
468 
469 		addr4 = (struct in_addr *)addr;
470 		mask4 = (struct in_addr *)mask;
471 		ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
472 		if (audit_buf != NULL)
473 			netlbl_af4list_audit_addr(audit_buf, 1,
474 						  dev_name,
475 						  addr4->s_addr,
476 						  mask4->s_addr);
477 		break;
478 	}
479 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
480 	case sizeof(struct in6_addr): {
481 		struct in6_addr *addr6, *mask6;
482 
483 		addr6 = (struct in6_addr *)addr;
484 		mask6 = (struct in6_addr *)mask;
485 		ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
486 		if (audit_buf != NULL)
487 			netlbl_af6list_audit_addr(audit_buf, 1,
488 						  dev_name,
489 						  addr6, mask6);
490 		break;
491 	}
492 #endif /* IPv6 */
493 	default:
494 		ret_val = -EINVAL;
495 	}
496 	if (ret_val == 0)
497 		atomic_inc(&netlabel_mgmt_protocount);
498 
499 unlhsh_add_return:
500 	rcu_read_unlock();
501 	if (audit_buf != NULL) {
502 		if (security_secid_to_secctx(secid,
503 					     &secctx,
504 					     &secctx_len) == 0) {
505 			audit_log_format(audit_buf, " sec_obj=%s", secctx);
506 			security_release_secctx(secctx, secctx_len);
507 		}
508 		audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
509 		audit_log_end(audit_buf);
510 	}
511 	return ret_val;
512 }
513 
514 /**
515  * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
516  * @net: network namespace
517  * @iface: interface entry
518  * @addr: IP address
519  * @mask: IP address mask
520  * @audit_info: NetLabel audit information
521  *
522  * Description:
523  * Remove an IP address entry from the unlabeled connection hash table.
524  * Returns zero on success, negative values on failure.
525  *
526  */
netlbl_unlhsh_remove_addr4(struct net * net,struct netlbl_unlhsh_iface * iface,const struct in_addr * addr,const struct in_addr * mask,struct netlbl_audit * audit_info)527 static int netlbl_unlhsh_remove_addr4(struct net *net,
528 				      struct netlbl_unlhsh_iface *iface,
529 				      const struct in_addr *addr,
530 				      const struct in_addr *mask,
531 				      struct netlbl_audit *audit_info)
532 {
533 	struct netlbl_af4list *list_entry;
534 	struct netlbl_unlhsh_addr4 *entry;
535 	struct audit_buffer *audit_buf;
536 	struct net_device *dev;
537 	char *secctx;
538 	u32 secctx_len;
539 
540 	spin_lock(&netlbl_unlhsh_lock);
541 	list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
542 					   &iface->addr4_list);
543 	spin_unlock(&netlbl_unlhsh_lock);
544 	if (list_entry != NULL)
545 		entry = netlbl_unlhsh_addr4_entry(list_entry);
546 	else
547 		entry = NULL;
548 
549 	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
550 					      audit_info);
551 	if (audit_buf != NULL) {
552 		dev = dev_get_by_index(net, iface->ifindex);
553 		netlbl_af4list_audit_addr(audit_buf, 1,
554 					  (dev != NULL ? dev->name : NULL),
555 					  addr->s_addr, mask->s_addr);
556 		if (dev != NULL)
557 			dev_put(dev);
558 		if (entry != NULL &&
559 		    security_secid_to_secctx(entry->secid,
560 					     &secctx, &secctx_len) == 0) {
561 			audit_log_format(audit_buf, " sec_obj=%s", secctx);
562 			security_release_secctx(secctx, secctx_len);
563 		}
564 		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
565 		audit_log_end(audit_buf);
566 	}
567 
568 	if (entry == NULL)
569 		return -ENOENT;
570 
571 	call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
572 	return 0;
573 }
574 
575 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
576 /**
577  * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
578  * @net: network namespace
579  * @iface: interface entry
580  * @addr: IP address
581  * @mask: IP address mask
582  * @audit_info: NetLabel audit information
583  *
584  * Description:
585  * Remove an IP address entry from the unlabeled connection hash table.
586  * Returns zero on success, negative values on failure.
587  *
588  */
netlbl_unlhsh_remove_addr6(struct net * net,struct netlbl_unlhsh_iface * iface,const struct in6_addr * addr,const struct in6_addr * mask,struct netlbl_audit * audit_info)589 static int netlbl_unlhsh_remove_addr6(struct net *net,
590 				      struct netlbl_unlhsh_iface *iface,
591 				      const struct in6_addr *addr,
592 				      const struct in6_addr *mask,
593 				      struct netlbl_audit *audit_info)
594 {
595 	struct netlbl_af6list *list_entry;
596 	struct netlbl_unlhsh_addr6 *entry;
597 	struct audit_buffer *audit_buf;
598 	struct net_device *dev;
599 	char *secctx;
600 	u32 secctx_len;
601 
602 	spin_lock(&netlbl_unlhsh_lock);
603 	list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
604 	spin_unlock(&netlbl_unlhsh_lock);
605 	if (list_entry != NULL)
606 		entry = netlbl_unlhsh_addr6_entry(list_entry);
607 	else
608 		entry = NULL;
609 
610 	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
611 					      audit_info);
612 	if (audit_buf != NULL) {
613 		dev = dev_get_by_index(net, iface->ifindex);
614 		netlbl_af6list_audit_addr(audit_buf, 1,
615 					  (dev != NULL ? dev->name : NULL),
616 					  addr, mask);
617 		if (dev != NULL)
618 			dev_put(dev);
619 		if (entry != NULL &&
620 		    security_secid_to_secctx(entry->secid,
621 					     &secctx, &secctx_len) == 0) {
622 			audit_log_format(audit_buf, " sec_obj=%s", secctx);
623 			security_release_secctx(secctx, secctx_len);
624 		}
625 		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
626 		audit_log_end(audit_buf);
627 	}
628 
629 	if (entry == NULL)
630 		return -ENOENT;
631 
632 	call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
633 	return 0;
634 }
635 #endif /* IPv6 */
636 
637 /**
638  * netlbl_unlhsh_condremove_iface - Remove an interface entry
639  * @iface: the interface entry
640  *
641  * Description:
642  * Remove an interface entry from the unlabeled connection hash table if it is
643  * empty.  An interface entry is considered to be empty if there are no
644  * address entries assigned to it.
645  *
646  */
netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface * iface)647 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
648 {
649 	struct netlbl_af4list *iter4;
650 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
651 	struct netlbl_af6list *iter6;
652 #endif /* IPv6 */
653 
654 	spin_lock(&netlbl_unlhsh_lock);
655 	netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
656 		goto unlhsh_condremove_failure;
657 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
658 	netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
659 		goto unlhsh_condremove_failure;
660 #endif /* IPv6 */
661 	iface->valid = 0;
662 	if (iface->ifindex > 0)
663 		list_del_rcu(&iface->list);
664 	else
665 		rcu_assign_pointer(netlbl_unlhsh_def, NULL);
666 	spin_unlock(&netlbl_unlhsh_lock);
667 
668 	call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
669 	return;
670 
671 unlhsh_condremove_failure:
672 	spin_unlock(&netlbl_unlhsh_lock);
673 }
674 
675 /**
676  * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
677  * @net: network namespace
678  * @dev_name: interface name
679  * @addr: IP address in network byte order
680  * @mask: address mask in network byte order
681  * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
682  * @audit_info: NetLabel audit information
683  *
684  * Description:
685  * Removes and existing entry from the unlabeled connection hash table.
686  * Returns zero on success, negative values on failure.
687  *
688  */
netlbl_unlhsh_remove(struct net * net,const char * dev_name,const void * addr,const void * mask,u32 addr_len,struct netlbl_audit * audit_info)689 int netlbl_unlhsh_remove(struct net *net,
690 			 const char *dev_name,
691 			 const void *addr,
692 			 const void *mask,
693 			 u32 addr_len,
694 			 struct netlbl_audit *audit_info)
695 {
696 	int ret_val;
697 	struct net_device *dev;
698 	struct netlbl_unlhsh_iface *iface;
699 
700 	if (addr_len != sizeof(struct in_addr) &&
701 	    addr_len != sizeof(struct in6_addr))
702 		return -EINVAL;
703 
704 	rcu_read_lock();
705 	if (dev_name != NULL) {
706 		dev = dev_get_by_name_rcu(net, dev_name);
707 		if (dev == NULL) {
708 			ret_val = -ENODEV;
709 			goto unlhsh_remove_return;
710 		}
711 		iface = netlbl_unlhsh_search_iface(dev->ifindex);
712 	} else
713 		iface = rcu_dereference(netlbl_unlhsh_def);
714 	if (iface == NULL) {
715 		ret_val = -ENOENT;
716 		goto unlhsh_remove_return;
717 	}
718 	switch (addr_len) {
719 	case sizeof(struct in_addr):
720 		ret_val = netlbl_unlhsh_remove_addr4(net,
721 						     iface, addr, mask,
722 						     audit_info);
723 		break;
724 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
725 	case sizeof(struct in6_addr):
726 		ret_val = netlbl_unlhsh_remove_addr6(net,
727 						     iface, addr, mask,
728 						     audit_info);
729 		break;
730 #endif /* IPv6 */
731 	default:
732 		ret_val = -EINVAL;
733 	}
734 	if (ret_val == 0) {
735 		netlbl_unlhsh_condremove_iface(iface);
736 		atomic_dec(&netlabel_mgmt_protocount);
737 	}
738 
739 unlhsh_remove_return:
740 	rcu_read_unlock();
741 	return ret_val;
742 }
743 
744 /*
745  * General Helper Functions
746  */
747 
748 /**
749  * netlbl_unlhsh_netdev_handler - Network device notification handler
750  * @this: notifier block
751  * @event: the event
752  * @ptr: the network device (cast to void)
753  *
754  * Description:
755  * Handle network device events, although at present all we care about is a
756  * network device going away.  In the case of a device going away we clear any
757  * related entries from the unlabeled connection hash table.
758  *
759  */
netlbl_unlhsh_netdev_handler(struct notifier_block * this,unsigned long event,void * ptr)760 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
761 					unsigned long event,
762 					void *ptr)
763 {
764 	struct net_device *dev = ptr;
765 	struct netlbl_unlhsh_iface *iface = NULL;
766 
767 	if (!net_eq(dev_net(dev), &init_net))
768 		return NOTIFY_DONE;
769 
770 	/* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
771 	if (event == NETDEV_DOWN) {
772 		spin_lock(&netlbl_unlhsh_lock);
773 		iface = netlbl_unlhsh_search_iface(dev->ifindex);
774 		if (iface != NULL && iface->valid) {
775 			iface->valid = 0;
776 			list_del_rcu(&iface->list);
777 		} else
778 			iface = NULL;
779 		spin_unlock(&netlbl_unlhsh_lock);
780 	}
781 
782 	if (iface != NULL)
783 		call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
784 
785 	return NOTIFY_DONE;
786 }
787 
788 /**
789  * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
790  * @value: desired value
791  * @audit_info: NetLabel audit information
792  *
793  * Description:
794  * Set the value of the unlabeled accept flag to @value.
795  *
796  */
netlbl_unlabel_acceptflg_set(u8 value,struct netlbl_audit * audit_info)797 static void netlbl_unlabel_acceptflg_set(u8 value,
798 					 struct netlbl_audit *audit_info)
799 {
800 	struct audit_buffer *audit_buf;
801 	u8 old_val;
802 
803 	old_val = netlabel_unlabel_acceptflg;
804 	netlabel_unlabel_acceptflg = value;
805 	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
806 					      audit_info);
807 	if (audit_buf != NULL) {
808 		audit_log_format(audit_buf,
809 				 " unlbl_accept=%u old=%u", value, old_val);
810 		audit_log_end(audit_buf);
811 	}
812 }
813 
814 /**
815  * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
816  * @info: the Generic NETLINK info block
817  * @addr: the IP address
818  * @mask: the IP address mask
819  * @len: the address length
820  *
821  * Description:
822  * Examine the Generic NETLINK message and extract the IP address information.
823  * Returns zero on success, negative values on failure.
824  *
825  */
netlbl_unlabel_addrinfo_get(struct genl_info * info,void ** addr,void ** mask,u32 * len)826 static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
827 				       void **addr,
828 				       void **mask,
829 				       u32 *len)
830 {
831 	u32 addr_len;
832 
833 	if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) {
834 		addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
835 		if (addr_len != sizeof(struct in_addr) &&
836 		    addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
837 			return -EINVAL;
838 		*len = addr_len;
839 		*addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
840 		*mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
841 		return 0;
842 	} else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
843 		addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
844 		if (addr_len != sizeof(struct in6_addr) &&
845 		    addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
846 			return -EINVAL;
847 		*len = addr_len;
848 		*addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
849 		*mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
850 		return 0;
851 	}
852 
853 	return -EINVAL;
854 }
855 
856 /*
857  * NetLabel Command Handlers
858  */
859 
860 /**
861  * netlbl_unlabel_accept - Handle an ACCEPT message
862  * @skb: the NETLINK buffer
863  * @info: the Generic NETLINK info block
864  *
865  * Description:
866  * Process a user generated ACCEPT message and set the accept flag accordingly.
867  * Returns zero on success, negative values on failure.
868  *
869  */
netlbl_unlabel_accept(struct sk_buff * skb,struct genl_info * info)870 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
871 {
872 	u8 value;
873 	struct netlbl_audit audit_info;
874 
875 	if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
876 		value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
877 		if (value == 1 || value == 0) {
878 			netlbl_netlink_auditinfo(skb, &audit_info);
879 			netlbl_unlabel_acceptflg_set(value, &audit_info);
880 			return 0;
881 		}
882 	}
883 
884 	return -EINVAL;
885 }
886 
887 /**
888  * netlbl_unlabel_list - Handle a LIST message
889  * @skb: the NETLINK buffer
890  * @info: the Generic NETLINK info block
891  *
892  * Description:
893  * Process a user generated LIST message and respond with the current status.
894  * Returns zero on success, negative values on failure.
895  *
896  */
netlbl_unlabel_list(struct sk_buff * skb,struct genl_info * info)897 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
898 {
899 	int ret_val = -EINVAL;
900 	struct sk_buff *ans_skb;
901 	void *data;
902 
903 	ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
904 	if (ans_skb == NULL)
905 		goto list_failure;
906 	data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
907 				 0, NLBL_UNLABEL_C_LIST);
908 	if (data == NULL) {
909 		ret_val = -ENOMEM;
910 		goto list_failure;
911 	}
912 
913 	ret_val = nla_put_u8(ans_skb,
914 			     NLBL_UNLABEL_A_ACPTFLG,
915 			     netlabel_unlabel_acceptflg);
916 	if (ret_val != 0)
917 		goto list_failure;
918 
919 	genlmsg_end(ans_skb, data);
920 	return genlmsg_reply(ans_skb, info);
921 
922 list_failure:
923 	kfree_skb(ans_skb);
924 	return ret_val;
925 }
926 
927 /**
928  * netlbl_unlabel_staticadd - Handle a STATICADD message
929  * @skb: the NETLINK buffer
930  * @info: the Generic NETLINK info block
931  *
932  * Description:
933  * Process a user generated STATICADD message and add a new unlabeled
934  * connection entry to the hash table.  Returns zero on success, negative
935  * values on failure.
936  *
937  */
netlbl_unlabel_staticadd(struct sk_buff * skb,struct genl_info * info)938 static int netlbl_unlabel_staticadd(struct sk_buff *skb,
939 				    struct genl_info *info)
940 {
941 	int ret_val;
942 	char *dev_name;
943 	void *addr;
944 	void *mask;
945 	u32 addr_len;
946 	u32 secid;
947 	struct netlbl_audit audit_info;
948 
949 	/* Don't allow users to add both IPv4 and IPv6 addresses for a
950 	 * single entry.  However, allow users to create two entries, one each
951 	 * for IPv4 and IPv4, with the same LSM security context which should
952 	 * achieve the same result. */
953 	if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
954 	    !info->attrs[NLBL_UNLABEL_A_IFACE] ||
955 	    !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
956 	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
957 	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
958 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
959 		return -EINVAL;
960 
961 	netlbl_netlink_auditinfo(skb, &audit_info);
962 
963 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
964 	if (ret_val != 0)
965 		return ret_val;
966 	dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
967 	ret_val = security_secctx_to_secid(
968 		                  nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
969 				  nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
970 				  &secid);
971 	if (ret_val != 0)
972 		return ret_val;
973 
974 	return netlbl_unlhsh_add(&init_net,
975 				 dev_name, addr, mask, addr_len, secid,
976 				 &audit_info);
977 }
978 
979 /**
980  * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
981  * @skb: the NETLINK buffer
982  * @info: the Generic NETLINK info block
983  *
984  * Description:
985  * Process a user generated STATICADDDEF message and add a new default
986  * unlabeled connection entry.  Returns zero on success, negative values on
987  * failure.
988  *
989  */
netlbl_unlabel_staticadddef(struct sk_buff * skb,struct genl_info * info)990 static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
991 				       struct genl_info *info)
992 {
993 	int ret_val;
994 	void *addr;
995 	void *mask;
996 	u32 addr_len;
997 	u32 secid;
998 	struct netlbl_audit audit_info;
999 
1000 	/* Don't allow users to add both IPv4 and IPv6 addresses for a
1001 	 * single entry.  However, allow users to create two entries, one each
1002 	 * for IPv4 and IPv6, with the same LSM security context which should
1003 	 * achieve the same result. */
1004 	if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
1005 	    !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1006 	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1007 	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1008 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1009 		return -EINVAL;
1010 
1011 	netlbl_netlink_auditinfo(skb, &audit_info);
1012 
1013 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1014 	if (ret_val != 0)
1015 		return ret_val;
1016 	ret_val = security_secctx_to_secid(
1017 		                  nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1018 				  nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1019 				  &secid);
1020 	if (ret_val != 0)
1021 		return ret_val;
1022 
1023 	return netlbl_unlhsh_add(&init_net,
1024 				 NULL, addr, mask, addr_len, secid,
1025 				 &audit_info);
1026 }
1027 
1028 /**
1029  * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
1030  * @skb: the NETLINK buffer
1031  * @info: the Generic NETLINK info block
1032  *
1033  * Description:
1034  * Process a user generated STATICREMOVE message and remove the specified
1035  * unlabeled connection entry.  Returns zero on success, negative values on
1036  * failure.
1037  *
1038  */
netlbl_unlabel_staticremove(struct sk_buff * skb,struct genl_info * info)1039 static int netlbl_unlabel_staticremove(struct sk_buff *skb,
1040 				       struct genl_info *info)
1041 {
1042 	int ret_val;
1043 	char *dev_name;
1044 	void *addr;
1045 	void *mask;
1046 	u32 addr_len;
1047 	struct netlbl_audit audit_info;
1048 
1049 	/* See the note in netlbl_unlabel_staticadd() about not allowing both
1050 	 * IPv4 and IPv6 in the same entry. */
1051 	if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
1052 	    !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1053 	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1054 	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1055 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1056 		return -EINVAL;
1057 
1058 	netlbl_netlink_auditinfo(skb, &audit_info);
1059 
1060 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1061 	if (ret_val != 0)
1062 		return ret_val;
1063 	dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
1064 
1065 	return netlbl_unlhsh_remove(&init_net,
1066 				    dev_name, addr, mask, addr_len,
1067 				    &audit_info);
1068 }
1069 
1070 /**
1071  * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1072  * @skb: the NETLINK buffer
1073  * @info: the Generic NETLINK info block
1074  *
1075  * Description:
1076  * Process a user generated STATICREMOVEDEF message and remove the default
1077  * unlabeled connection entry.  Returns zero on success, negative values on
1078  * failure.
1079  *
1080  */
netlbl_unlabel_staticremovedef(struct sk_buff * skb,struct genl_info * info)1081 static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
1082 					  struct genl_info *info)
1083 {
1084 	int ret_val;
1085 	void *addr;
1086 	void *mask;
1087 	u32 addr_len;
1088 	struct netlbl_audit audit_info;
1089 
1090 	/* See the note in netlbl_unlabel_staticadd() about not allowing both
1091 	 * IPv4 and IPv6 in the same entry. */
1092 	if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1093 	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1094 	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1095 	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1096 		return -EINVAL;
1097 
1098 	netlbl_netlink_auditinfo(skb, &audit_info);
1099 
1100 	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1101 	if (ret_val != 0)
1102 		return ret_val;
1103 
1104 	return netlbl_unlhsh_remove(&init_net,
1105 				    NULL, addr, mask, addr_len,
1106 				    &audit_info);
1107 }
1108 
1109 
1110 /**
1111  * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1112  * @cmd: command/message
1113  * @iface: the interface entry
1114  * @addr4: the IPv4 address entry
1115  * @addr6: the IPv6 address entry
1116  * @arg: the netlbl_unlhsh_walk_arg structure
1117  *
1118  * Description:
1119  * This function is designed to be used to generate a response for a
1120  * STATICLIST or STATICLISTDEF message.  When called either @addr4 or @addr6
1121  * can be specified, not both, the other unspecified entry should be set to
1122  * NULL by the caller.  Returns the size of the message on success, negative
1123  * values on failure.
1124  *
1125  */
netlbl_unlabel_staticlist_gen(u32 cmd,const struct netlbl_unlhsh_iface * iface,const struct netlbl_unlhsh_addr4 * addr4,const struct netlbl_unlhsh_addr6 * addr6,void * arg)1126 static int netlbl_unlabel_staticlist_gen(u32 cmd,
1127 				       const struct netlbl_unlhsh_iface *iface,
1128 				       const struct netlbl_unlhsh_addr4 *addr4,
1129 				       const struct netlbl_unlhsh_addr6 *addr6,
1130 				       void *arg)
1131 {
1132 	int ret_val = -ENOMEM;
1133 	struct netlbl_unlhsh_walk_arg *cb_arg = arg;
1134 	struct net_device *dev;
1135 	void *data;
1136 	u32 secid;
1137 	char *secctx;
1138 	u32 secctx_len;
1139 
1140 	data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
1141 			   cb_arg->seq, &netlbl_unlabel_gnl_family,
1142 			   NLM_F_MULTI, cmd);
1143 	if (data == NULL)
1144 		goto list_cb_failure;
1145 
1146 	if (iface->ifindex > 0) {
1147 		dev = dev_get_by_index(&init_net, iface->ifindex);
1148 		if (!dev) {
1149 			ret_val = -ENODEV;
1150 			goto list_cb_failure;
1151 		}
1152 		ret_val = nla_put_string(cb_arg->skb,
1153 					 NLBL_UNLABEL_A_IFACE, dev->name);
1154 		dev_put(dev);
1155 		if (ret_val != 0)
1156 			goto list_cb_failure;
1157 	}
1158 
1159 	if (addr4) {
1160 		struct in_addr addr_struct;
1161 
1162 		addr_struct.s_addr = addr4->list.addr;
1163 		ret_val = nla_put(cb_arg->skb,
1164 				  NLBL_UNLABEL_A_IPV4ADDR,
1165 				  sizeof(struct in_addr),
1166 				  &addr_struct);
1167 		if (ret_val != 0)
1168 			goto list_cb_failure;
1169 
1170 		addr_struct.s_addr = addr4->list.mask;
1171 		ret_val = nla_put(cb_arg->skb,
1172 				  NLBL_UNLABEL_A_IPV4MASK,
1173 				  sizeof(struct in_addr),
1174 				  &addr_struct);
1175 		if (ret_val != 0)
1176 			goto list_cb_failure;
1177 
1178 		secid = addr4->secid;
1179 	} else {
1180 		ret_val = nla_put(cb_arg->skb,
1181 				  NLBL_UNLABEL_A_IPV6ADDR,
1182 				  sizeof(struct in6_addr),
1183 				  &addr6->list.addr);
1184 		if (ret_val != 0)
1185 			goto list_cb_failure;
1186 
1187 		ret_val = nla_put(cb_arg->skb,
1188 				  NLBL_UNLABEL_A_IPV6MASK,
1189 				  sizeof(struct in6_addr),
1190 				  &addr6->list.mask);
1191 		if (ret_val != 0)
1192 			goto list_cb_failure;
1193 
1194 		secid = addr6->secid;
1195 	}
1196 
1197 	ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
1198 	if (ret_val != 0)
1199 		goto list_cb_failure;
1200 	ret_val = nla_put(cb_arg->skb,
1201 			  NLBL_UNLABEL_A_SECCTX,
1202 			  secctx_len,
1203 			  secctx);
1204 	security_release_secctx(secctx, secctx_len);
1205 	if (ret_val != 0)
1206 		goto list_cb_failure;
1207 
1208 	cb_arg->seq++;
1209 	return genlmsg_end(cb_arg->skb, data);
1210 
1211 list_cb_failure:
1212 	genlmsg_cancel(cb_arg->skb, data);
1213 	return ret_val;
1214 }
1215 
1216 /**
1217  * netlbl_unlabel_staticlist - Handle a STATICLIST message
1218  * @skb: the NETLINK buffer
1219  * @cb: the NETLINK callback
1220  *
1221  * Description:
1222  * Process a user generated STATICLIST message and dump the unlabeled
1223  * connection hash table in a form suitable for use in a kernel generated
1224  * STATICLIST message.  Returns the length of @skb.
1225  *
1226  */
netlbl_unlabel_staticlist(struct sk_buff * skb,struct netlink_callback * cb)1227 static int netlbl_unlabel_staticlist(struct sk_buff *skb,
1228 				     struct netlink_callback *cb)
1229 {
1230 	struct netlbl_unlhsh_walk_arg cb_arg;
1231 	u32 skip_bkt = cb->args[0];
1232 	u32 skip_chain = cb->args[1];
1233 	u32 skip_addr4 = cb->args[2];
1234 	u32 skip_addr6 = cb->args[3];
1235 	u32 iter_bkt;
1236 	u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
1237 	struct netlbl_unlhsh_iface *iface;
1238 	struct list_head *iter_list;
1239 	struct netlbl_af4list *addr4;
1240 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1241 	struct netlbl_af6list *addr6;
1242 #endif
1243 
1244 	cb_arg.nl_cb = cb;
1245 	cb_arg.skb = skb;
1246 	cb_arg.seq = cb->nlh->nlmsg_seq;
1247 
1248 	rcu_read_lock();
1249 	for (iter_bkt = skip_bkt;
1250 	     iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
1251 	     iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
1252 		iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
1253 		list_for_each_entry_rcu(iface, iter_list, list) {
1254 			if (!iface->valid ||
1255 			    iter_chain++ < skip_chain)
1256 				continue;
1257 			netlbl_af4list_foreach_rcu(addr4,
1258 						   &iface->addr4_list) {
1259 				if (iter_addr4++ < skip_addr4)
1260 					continue;
1261 				if (netlbl_unlabel_staticlist_gen(
1262 					      NLBL_UNLABEL_C_STATICLIST,
1263 					      iface,
1264 					      netlbl_unlhsh_addr4_entry(addr4),
1265 					      NULL,
1266 					      &cb_arg) < 0) {
1267 					iter_addr4--;
1268 					iter_chain--;
1269 					goto unlabel_staticlist_return;
1270 				}
1271 			}
1272 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1273 			netlbl_af6list_foreach_rcu(addr6,
1274 						   &iface->addr6_list) {
1275 				if (iter_addr6++ < skip_addr6)
1276 					continue;
1277 				if (netlbl_unlabel_staticlist_gen(
1278 					      NLBL_UNLABEL_C_STATICLIST,
1279 					      iface,
1280 					      NULL,
1281 					      netlbl_unlhsh_addr6_entry(addr6),
1282 					      &cb_arg) < 0) {
1283 					iter_addr6--;
1284 					iter_chain--;
1285 					goto unlabel_staticlist_return;
1286 				}
1287 			}
1288 #endif /* IPv6 */
1289 		}
1290 	}
1291 
1292 unlabel_staticlist_return:
1293 	rcu_read_unlock();
1294 	cb->args[0] = skip_bkt;
1295 	cb->args[1] = skip_chain;
1296 	cb->args[2] = skip_addr4;
1297 	cb->args[3] = skip_addr6;
1298 	return skb->len;
1299 }
1300 
1301 /**
1302  * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1303  * @skb: the NETLINK buffer
1304  * @cb: the NETLINK callback
1305  *
1306  * Description:
1307  * Process a user generated STATICLISTDEF message and dump the default
1308  * unlabeled connection entry in a form suitable for use in a kernel generated
1309  * STATICLISTDEF message.  Returns the length of @skb.
1310  *
1311  */
netlbl_unlabel_staticlistdef(struct sk_buff * skb,struct netlink_callback * cb)1312 static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
1313 					struct netlink_callback *cb)
1314 {
1315 	struct netlbl_unlhsh_walk_arg cb_arg;
1316 	struct netlbl_unlhsh_iface *iface;
1317 	u32 skip_addr4 = cb->args[0];
1318 	u32 skip_addr6 = cb->args[1];
1319 	u32 iter_addr4 = 0;
1320 	struct netlbl_af4list *addr4;
1321 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1322 	u32 iter_addr6 = 0;
1323 	struct netlbl_af6list *addr6;
1324 #endif
1325 
1326 	cb_arg.nl_cb = cb;
1327 	cb_arg.skb = skb;
1328 	cb_arg.seq = cb->nlh->nlmsg_seq;
1329 
1330 	rcu_read_lock();
1331 	iface = rcu_dereference(netlbl_unlhsh_def);
1332 	if (iface == NULL || !iface->valid)
1333 		goto unlabel_staticlistdef_return;
1334 
1335 	netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
1336 		if (iter_addr4++ < skip_addr4)
1337 			continue;
1338 		if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1339 					      iface,
1340 					      netlbl_unlhsh_addr4_entry(addr4),
1341 					      NULL,
1342 					      &cb_arg) < 0) {
1343 			iter_addr4--;
1344 			goto unlabel_staticlistdef_return;
1345 		}
1346 	}
1347 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1348 	netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
1349 		if (iter_addr6++ < skip_addr6)
1350 			continue;
1351 		if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1352 					      iface,
1353 					      NULL,
1354 					      netlbl_unlhsh_addr6_entry(addr6),
1355 					      &cb_arg) < 0) {
1356 			iter_addr6--;
1357 			goto unlabel_staticlistdef_return;
1358 		}
1359 	}
1360 #endif /* IPv6 */
1361 
1362 unlabel_staticlistdef_return:
1363 	rcu_read_unlock();
1364 	cb->args[0] = skip_addr4;
1365 	cb->args[1] = skip_addr6;
1366 	return skb->len;
1367 }
1368 
1369 /*
1370  * NetLabel Generic NETLINK Command Definitions
1371  */
1372 
1373 static struct genl_ops netlbl_unlabel_genl_ops[] = {
1374 	{
1375 	.cmd = NLBL_UNLABEL_C_STATICADD,
1376 	.flags = GENL_ADMIN_PERM,
1377 	.policy = netlbl_unlabel_genl_policy,
1378 	.doit = netlbl_unlabel_staticadd,
1379 	.dumpit = NULL,
1380 	},
1381 	{
1382 	.cmd = NLBL_UNLABEL_C_STATICREMOVE,
1383 	.flags = GENL_ADMIN_PERM,
1384 	.policy = netlbl_unlabel_genl_policy,
1385 	.doit = netlbl_unlabel_staticremove,
1386 	.dumpit = NULL,
1387 	},
1388 	{
1389 	.cmd = NLBL_UNLABEL_C_STATICLIST,
1390 	.flags = 0,
1391 	.policy = netlbl_unlabel_genl_policy,
1392 	.doit = NULL,
1393 	.dumpit = netlbl_unlabel_staticlist,
1394 	},
1395 	{
1396 	.cmd = NLBL_UNLABEL_C_STATICADDDEF,
1397 	.flags = GENL_ADMIN_PERM,
1398 	.policy = netlbl_unlabel_genl_policy,
1399 	.doit = netlbl_unlabel_staticadddef,
1400 	.dumpit = NULL,
1401 	},
1402 	{
1403 	.cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
1404 	.flags = GENL_ADMIN_PERM,
1405 	.policy = netlbl_unlabel_genl_policy,
1406 	.doit = netlbl_unlabel_staticremovedef,
1407 	.dumpit = NULL,
1408 	},
1409 	{
1410 	.cmd = NLBL_UNLABEL_C_STATICLISTDEF,
1411 	.flags = 0,
1412 	.policy = netlbl_unlabel_genl_policy,
1413 	.doit = NULL,
1414 	.dumpit = netlbl_unlabel_staticlistdef,
1415 	},
1416 	{
1417 	.cmd = NLBL_UNLABEL_C_ACCEPT,
1418 	.flags = GENL_ADMIN_PERM,
1419 	.policy = netlbl_unlabel_genl_policy,
1420 	.doit = netlbl_unlabel_accept,
1421 	.dumpit = NULL,
1422 	},
1423 	{
1424 	.cmd = NLBL_UNLABEL_C_LIST,
1425 	.flags = 0,
1426 	.policy = netlbl_unlabel_genl_policy,
1427 	.doit = netlbl_unlabel_list,
1428 	.dumpit = NULL,
1429 	},
1430 };
1431 
1432 /*
1433  * NetLabel Generic NETLINK Protocol Functions
1434  */
1435 
1436 /**
1437  * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1438  *
1439  * Description:
1440  * Register the unlabeled packet NetLabel component with the Generic NETLINK
1441  * mechanism.  Returns zero on success, negative values on failure.
1442  *
1443  */
netlbl_unlabel_genl_init(void)1444 int __init netlbl_unlabel_genl_init(void)
1445 {
1446 	return genl_register_family_with_ops(&netlbl_unlabel_gnl_family,
1447 		netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops));
1448 }
1449 
1450 /*
1451  * NetLabel KAPI Hooks
1452  */
1453 
1454 static struct notifier_block netlbl_unlhsh_netdev_notifier = {
1455 	.notifier_call = netlbl_unlhsh_netdev_handler,
1456 };
1457 
1458 /**
1459  * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1460  * @size: the number of bits to use for the hash buckets
1461  *
1462  * Description:
1463  * Initializes the unlabeled connection hash table and registers a network
1464  * device notification handler.  This function should only be called by the
1465  * NetLabel subsystem itself during initialization.  Returns zero on success,
1466  * non-zero values on error.
1467  *
1468  */
netlbl_unlabel_init(u32 size)1469 int __init netlbl_unlabel_init(u32 size)
1470 {
1471 	u32 iter;
1472 	struct netlbl_unlhsh_tbl *hsh_tbl;
1473 
1474 	if (size == 0)
1475 		return -EINVAL;
1476 
1477 	hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
1478 	if (hsh_tbl == NULL)
1479 		return -ENOMEM;
1480 	hsh_tbl->size = 1 << size;
1481 	hsh_tbl->tbl = kcalloc(hsh_tbl->size,
1482 			       sizeof(struct list_head),
1483 			       GFP_KERNEL);
1484 	if (hsh_tbl->tbl == NULL) {
1485 		kfree(hsh_tbl);
1486 		return -ENOMEM;
1487 	}
1488 	for (iter = 0; iter < hsh_tbl->size; iter++)
1489 		INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
1490 
1491 	rcu_read_lock();
1492 	spin_lock(&netlbl_unlhsh_lock);
1493 	rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
1494 	spin_unlock(&netlbl_unlhsh_lock);
1495 	rcu_read_unlock();
1496 
1497 	register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
1498 
1499 	return 0;
1500 }
1501 
1502 /**
1503  * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1504  * @skb: the packet
1505  * @family: protocol family
1506  * @secattr: the security attributes
1507  *
1508  * Description:
1509  * Determine the security attributes, if any, for an unlabled packet and return
1510  * them in @secattr.  Returns zero on success and negative values on failure.
1511  *
1512  */
netlbl_unlabel_getattr(const struct sk_buff * skb,u16 family,struct netlbl_lsm_secattr * secattr)1513 int netlbl_unlabel_getattr(const struct sk_buff *skb,
1514 			   u16 family,
1515 			   struct netlbl_lsm_secattr *secattr)
1516 {
1517 	struct netlbl_unlhsh_iface *iface;
1518 
1519 	rcu_read_lock();
1520 	iface = netlbl_unlhsh_search_iface(skb->skb_iif);
1521 	if (iface == NULL)
1522 		iface = rcu_dereference(netlbl_unlhsh_def);
1523 	if (iface == NULL || !iface->valid)
1524 		goto unlabel_getattr_nolabel;
1525 	switch (family) {
1526 	case PF_INET: {
1527 		struct iphdr *hdr4;
1528 		struct netlbl_af4list *addr4;
1529 
1530 		hdr4 = ip_hdr(skb);
1531 		addr4 = netlbl_af4list_search(hdr4->saddr,
1532 					      &iface->addr4_list);
1533 		if (addr4 == NULL)
1534 			goto unlabel_getattr_nolabel;
1535 		secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
1536 		break;
1537 	}
1538 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1539 	case PF_INET6: {
1540 		struct ipv6hdr *hdr6;
1541 		struct netlbl_af6list *addr6;
1542 
1543 		hdr6 = ipv6_hdr(skb);
1544 		addr6 = netlbl_af6list_search(&hdr6->saddr,
1545 					      &iface->addr6_list);
1546 		if (addr6 == NULL)
1547 			goto unlabel_getattr_nolabel;
1548 		secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
1549 		break;
1550 	}
1551 #endif /* IPv6 */
1552 	default:
1553 		goto unlabel_getattr_nolabel;
1554 	}
1555 	rcu_read_unlock();
1556 
1557 	secattr->flags |= NETLBL_SECATTR_SECID;
1558 	secattr->type = NETLBL_NLTYPE_UNLABELED;
1559 	return 0;
1560 
1561 unlabel_getattr_nolabel:
1562 	rcu_read_unlock();
1563 	if (netlabel_unlabel_acceptflg == 0)
1564 		return -ENOMSG;
1565 	secattr->type = NETLBL_NLTYPE_UNLABELED;
1566 	return 0;
1567 }
1568 
1569 /**
1570  * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1571  *
1572  * Description:
1573  * Set the default NetLabel configuration to allow incoming unlabeled packets
1574  * and to send unlabeled network traffic by default.
1575  *
1576  */
netlbl_unlabel_defconf(void)1577 int __init netlbl_unlabel_defconf(void)
1578 {
1579 	int ret_val;
1580 	struct netlbl_dom_map *entry;
1581 	struct netlbl_audit audit_info;
1582 
1583 	/* Only the kernel is allowed to call this function and the only time
1584 	 * it is called is at bootup before the audit subsystem is reporting
1585 	 * messages so don't worry to much about these values. */
1586 	security_task_getsecid(current, &audit_info.secid);
1587 	audit_info.loginuid = 0;
1588 	audit_info.sessionid = 0;
1589 
1590 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1591 	if (entry == NULL)
1592 		return -ENOMEM;
1593 	entry->type = NETLBL_NLTYPE_UNLABELED;
1594 	ret_val = netlbl_domhsh_add_default(entry, &audit_info);
1595 	if (ret_val != 0)
1596 		return ret_val;
1597 
1598 	netlbl_unlabel_acceptflg_set(1, &audit_info);
1599 
1600 	return 0;
1601 }
1602