1// SPDX-License-Identifier: GPL-2.0-or-later 2/* 3 * CIPSO - Commercial IP Security Option 4 * 5 * This is an implementation of the CIPSO 2.2 protocol as specified in 6 * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in 7 * FIPS-188. While CIPSO never became a full IETF RFC standard many vendors 8 * have chosen to adopt the protocol and over the years it has become a 9 * de-facto standard for labeled networking. 10 * 11 * The CIPSO draft specification can be found in the kernel's Documentation 12 * directory as well as the following URL: 13 * https://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt 14 * The FIPS-188 specification can be found at the following URL: 15 * https://www.itl.nist.gov/fipspubs/fip188.htm 16 * 17 * Author: Paul Moore <paul.moore@hp.com> 18 */ 19 20/* 21 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 22 */ 23 24#include <linux/init.h> 25#include <linux/types.h> 26#include <linux/rcupdate.h> 27#include <linux/list.h> 28#include <linux/spinlock.h> 29#include <linux/string.h> 30#include <linux/jhash.h> 31#include <linux/audit.h> 32#include <linux/slab.h> 33#include <net/ip.h> 34#include <net/icmp.h> 35#include <net/tcp.h> 36#include <net/netlabel.h> 37#include <net/cipso_ipv4.h> 38#include <linux/atomic.h> 39#include <linux/bug.h> 40#include <asm/unaligned.h> 41 42/* List of available DOI definitions */ 43/* XXX - This currently assumes a minimal number of different DOIs in use, 44 * if in practice there are a lot of different DOIs this list should 45 * probably be turned into a hash table or something similar so we 46 * can do quick lookups. */ 47static DEFINE_SPINLOCK(cipso_v4_doi_list_lock); 48static LIST_HEAD(cipso_v4_doi_list); 49 50/* Label mapping cache */ 51int cipso_v4_cache_enabled = 1; 52int cipso_v4_cache_bucketsize = 10; 53#define CIPSO_V4_CACHE_BUCKETBITS 7 54#define CIPSO_V4_CACHE_BUCKETS (1 << CIPSO_V4_CACHE_BUCKETBITS) 55#define CIPSO_V4_CACHE_REORDERLIMIT 10 56struct cipso_v4_map_cache_bkt { 57 spinlock_t lock; 58 u32 size; 59 struct list_head list; 60}; 61 62struct cipso_v4_map_cache_entry { 63 u32 hash; 64 unsigned char *key; 65 size_t key_len; 66 67 struct netlbl_lsm_cache *lsm_data; 68 69 u32 activity; 70 struct list_head list; 71}; 72 73static struct cipso_v4_map_cache_bkt *cipso_v4_cache; 74 75/* Restricted bitmap (tag #1) flags */ 76int cipso_v4_rbm_optfmt; 77int cipso_v4_rbm_strictvalid = 1; 78 79/* 80 * Protocol Constants 81 */ 82 83/* Maximum size of the CIPSO IP option, derived from the fact that the maximum 84 * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */ 85#define CIPSO_V4_OPT_LEN_MAX 40 86 87/* Length of the base CIPSO option, this includes the option type (1 byte), the 88 * option length (1 byte), and the DOI (4 bytes). */ 89#define CIPSO_V4_HDR_LEN 6 90 91/* Base length of the restrictive category bitmap tag (tag #1). */ 92#define CIPSO_V4_TAG_RBM_BLEN 4 93 94/* Base length of the enumerated category tag (tag #2). */ 95#define CIPSO_V4_TAG_ENUM_BLEN 4 96 97/* Base length of the ranged categories bitmap tag (tag #5). */ 98#define CIPSO_V4_TAG_RNG_BLEN 4 99/* The maximum number of category ranges permitted in the ranged category tag 100 * (tag #5). You may note that the IETF draft states that the maximum number 101 * of category ranges is 7, but if the low end of the last category range is 102 * zero then it is possible to fit 8 category ranges because the zero should 103 * be omitted. */ 104#define CIPSO_V4_TAG_RNG_CAT_MAX 8 105 106/* Base length of the local tag (non-standard tag). 107 * Tag definition (may change between kernel versions) 108 * 109 * 0 8 16 24 32 110 * +----------+----------+----------+----------+ 111 * | 10000000 | 00000110 | 32-bit secid value | 112 * +----------+----------+----------+----------+ 113 * | in (host byte order)| 114 * +----------+----------+ 115 * 116 */ 117#define CIPSO_V4_TAG_LOC_BLEN 6 118 119/* 120 * Helper Functions 121 */ 122 123/** 124 * cipso_v4_cache_entry_free - Frees a cache entry 125 * @entry: the entry to free 126 * 127 * Description: 128 * This function frees the memory associated with a cache entry including the 129 * LSM cache data if there are no longer any users, i.e. reference count == 0. 130 * 131 */ 132static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry) 133{ 134 if (entry->lsm_data) 135 netlbl_secattr_cache_free(entry->lsm_data); 136 kfree(entry->key); 137 kfree(entry); 138} 139 140/** 141 * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache 142 * @key: the hash key 143 * @key_len: the length of the key in bytes 144 * 145 * Description: 146 * The CIPSO tag hashing function. Returns a 32-bit hash value. 147 * 148 */ 149static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len) 150{ 151 return jhash(key, key_len, 0); 152} 153 154/* 155 * Label Mapping Cache Functions 156 */ 157 158/** 159 * cipso_v4_cache_init - Initialize the CIPSO cache 160 * 161 * Description: 162 * Initializes the CIPSO label mapping cache, this function should be called 163 * before any of the other functions defined in this file. Returns zero on 164 * success, negative values on error. 165 * 166 */ 167static int __init cipso_v4_cache_init(void) 168{ 169 u32 iter; 170 171 cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS, 172 sizeof(struct cipso_v4_map_cache_bkt), 173 GFP_KERNEL); 174 if (!cipso_v4_cache) 175 return -ENOMEM; 176 177 for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) { 178 spin_lock_init(&cipso_v4_cache[iter].lock); 179 cipso_v4_cache[iter].size = 0; 180 INIT_LIST_HEAD(&cipso_v4_cache[iter].list); 181 } 182 183 return 0; 184} 185 186/** 187 * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache 188 * 189 * Description: 190 * Invalidates and frees any entries in the CIPSO cache. 191 * 192 */ 193void cipso_v4_cache_invalidate(void) 194{ 195 struct cipso_v4_map_cache_entry *entry, *tmp_entry; 196 u32 iter; 197 198 for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) { 199 spin_lock_bh(&cipso_v4_cache[iter].lock); 200 list_for_each_entry_safe(entry, 201 tmp_entry, 202 &cipso_v4_cache[iter].list, list) { 203 list_del(&entry->list); 204 cipso_v4_cache_entry_free(entry); 205 } 206 cipso_v4_cache[iter].size = 0; 207 spin_unlock_bh(&cipso_v4_cache[iter].lock); 208 } 209} 210 211/** 212 * cipso_v4_cache_check - Check the CIPSO cache for a label mapping 213 * @key: the buffer to check 214 * @key_len: buffer length in bytes 215 * @secattr: the security attribute struct to use 216 * 217 * Description: 218 * This function checks the cache to see if a label mapping already exists for 219 * the given key. If there is a match then the cache is adjusted and the 220 * @secattr struct is populated with the correct LSM security attributes. The 221 * cache is adjusted in the following manner if the entry is not already the 222 * first in the cache bucket: 223 * 224 * 1. The cache entry's activity counter is incremented 225 * 2. The previous (higher ranking) entry's activity counter is decremented 226 * 3. If the difference between the two activity counters is geater than 227 * CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped 228 * 229 * Returns zero on success, -ENOENT for a cache miss, and other negative values 230 * on error. 231 * 232 */ 233static int cipso_v4_cache_check(const unsigned char *key, 234 u32 key_len, 235 struct netlbl_lsm_secattr *secattr) 236{ 237 u32 bkt; 238 struct cipso_v4_map_cache_entry *entry; 239 struct cipso_v4_map_cache_entry *prev_entry = NULL; 240 u32 hash; 241 242 if (!READ_ONCE(cipso_v4_cache_enabled)) 243 return -ENOENT; 244 245 hash = cipso_v4_map_cache_hash(key, key_len); 246 bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1); 247 spin_lock_bh(&cipso_v4_cache[bkt].lock); 248 list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) { 249 if (entry->hash == hash && 250 entry->key_len == key_len && 251 memcmp(entry->key, key, key_len) == 0) { 252 entry->activity += 1; 253 refcount_inc(&entry->lsm_data->refcount); 254 secattr->cache = entry->lsm_data; 255 secattr->flags |= NETLBL_SECATTR_CACHE; 256 secattr->type = NETLBL_NLTYPE_CIPSOV4; 257 if (!prev_entry) { 258 spin_unlock_bh(&cipso_v4_cache[bkt].lock); 259 return 0; 260 } 261 262 if (prev_entry->activity > 0) 263 prev_entry->activity -= 1; 264 if (entry->activity > prev_entry->activity && 265 entry->activity - prev_entry->activity > 266 CIPSO_V4_CACHE_REORDERLIMIT) { 267 __list_del(entry->list.prev, entry->list.next); 268 __list_add(&entry->list, 269 prev_entry->list.prev, 270 &prev_entry->list); 271 } 272 273 spin_unlock_bh(&cipso_v4_cache[bkt].lock); 274 return 0; 275 } 276 prev_entry = entry; 277 } 278 spin_unlock_bh(&cipso_v4_cache[bkt].lock); 279 280 return -ENOENT; 281} 282 283/** 284 * cipso_v4_cache_add - Add an entry to the CIPSO cache 285 * @cipso_ptr: pointer to CIPSO IP option 286 * @secattr: the packet's security attributes 287 * 288 * Description: 289 * Add a new entry into the CIPSO label mapping cache. Add the new entry to 290 * head of the cache bucket's list, if the cache bucket is out of room remove 291 * the last entry in the list first. It is important to note that there is 292 * currently no checking for duplicate keys. Returns zero on success, 293 * negative values on failure. 294 * 295 */ 296int cipso_v4_cache_add(const unsigned char *cipso_ptr, 297 const struct netlbl_lsm_secattr *secattr) 298{ 299 int bkt_size = READ_ONCE(cipso_v4_cache_bucketsize); 300 int ret_val = -EPERM; 301 u32 bkt; 302 struct cipso_v4_map_cache_entry *entry = NULL; 303 struct cipso_v4_map_cache_entry *old_entry = NULL; 304 u32 cipso_ptr_len; 305 306 if (!READ_ONCE(cipso_v4_cache_enabled) || bkt_size <= 0) 307 return 0; 308 309 cipso_ptr_len = cipso_ptr[1]; 310 311 entry = kzalloc(sizeof(*entry), GFP_ATOMIC); 312 if (!entry) 313 return -ENOMEM; 314 entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC); 315 if (!entry->key) { 316 ret_val = -ENOMEM; 317 goto cache_add_failure; 318 } 319 entry->key_len = cipso_ptr_len; 320 entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len); 321 refcount_inc(&secattr->cache->refcount); 322 entry->lsm_data = secattr->cache; 323 324 bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1); 325 spin_lock_bh(&cipso_v4_cache[bkt].lock); 326 if (cipso_v4_cache[bkt].size < bkt_size) { 327 list_add(&entry->list, &cipso_v4_cache[bkt].list); 328 cipso_v4_cache[bkt].size += 1; 329 } else { 330 old_entry = list_entry(cipso_v4_cache[bkt].list.prev, 331 struct cipso_v4_map_cache_entry, list); 332 list_del(&old_entry->list); 333 list_add(&entry->list, &cipso_v4_cache[bkt].list); 334 cipso_v4_cache_entry_free(old_entry); 335 } 336 spin_unlock_bh(&cipso_v4_cache[bkt].lock); 337 338 return 0; 339 340cache_add_failure: 341 if (entry) 342 cipso_v4_cache_entry_free(entry); 343 return ret_val; 344} 345 346/* 347 * DOI List Functions 348 */ 349 350/** 351 * cipso_v4_doi_search - Searches for a DOI definition 352 * @doi: the DOI to search for 353 * 354 * Description: 355 * Search the DOI definition list for a DOI definition with a DOI value that 356 * matches @doi. The caller is responsible for calling rcu_read_[un]lock(). 357 * Returns a pointer to the DOI definition on success and NULL on failure. 358 */ 359static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi) 360{ 361 struct cipso_v4_doi *iter; 362 363 list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list) 364 if (iter->doi == doi && refcount_read(&iter->refcount)) 365 return iter; 366 return NULL; 367} 368 369/** 370 * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine 371 * @doi_def: the DOI structure 372 * @audit_info: NetLabel audit information 373 * 374 * Description: 375 * The caller defines a new DOI for use by the CIPSO engine and calls this 376 * function to add it to the list of acceptable domains. The caller must 377 * ensure that the mapping table specified in @doi_def->map meets all of the 378 * requirements of the mapping type (see cipso_ipv4.h for details). Returns 379 * zero on success and non-zero on failure. 380 * 381 */ 382int cipso_v4_doi_add(struct cipso_v4_doi *doi_def, 383 struct netlbl_audit *audit_info) 384{ 385 int ret_val = -EINVAL; 386 u32 iter; 387 u32 doi; 388 u32 doi_type; 389 struct audit_buffer *audit_buf; 390 391 doi = doi_def->doi; 392 doi_type = doi_def->type; 393 394 if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN) 395 goto doi_add_return; 396 for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) { 397 switch (doi_def->tags[iter]) { 398 case CIPSO_V4_TAG_RBITMAP: 399 break; 400 case CIPSO_V4_TAG_RANGE: 401 case CIPSO_V4_TAG_ENUM: 402 if (doi_def->type != CIPSO_V4_MAP_PASS) 403 goto doi_add_return; 404 break; 405 case CIPSO_V4_TAG_LOCAL: 406 if (doi_def->type != CIPSO_V4_MAP_LOCAL) 407 goto doi_add_return; 408 break; 409 case CIPSO_V4_TAG_INVALID: 410 if (iter == 0) 411 goto doi_add_return; 412 break; 413 default: 414 goto doi_add_return; 415 } 416 } 417 418 refcount_set(&doi_def->refcount, 1); 419 420 spin_lock(&cipso_v4_doi_list_lock); 421 if (cipso_v4_doi_search(doi_def->doi)) { 422 spin_unlock(&cipso_v4_doi_list_lock); 423 ret_val = -EEXIST; 424 goto doi_add_return; 425 } 426 list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list); 427 spin_unlock(&cipso_v4_doi_list_lock); 428 ret_val = 0; 429 430doi_add_return: 431 audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info); 432 if (audit_buf) { 433 const char *type_str; 434 switch (doi_type) { 435 case CIPSO_V4_MAP_TRANS: 436 type_str = "trans"; 437 break; 438 case CIPSO_V4_MAP_PASS: 439 type_str = "pass"; 440 break; 441 case CIPSO_V4_MAP_LOCAL: 442 type_str = "local"; 443 break; 444 default: 445 type_str = "(unknown)"; 446 } 447 audit_log_format(audit_buf, 448 " cipso_doi=%u cipso_type=%s res=%u", 449 doi, type_str, ret_val == 0 ? 1 : 0); 450 audit_log_end(audit_buf); 451 } 452 453 return ret_val; 454} 455 456/** 457 * cipso_v4_doi_free - Frees a DOI definition 458 * @doi_def: the DOI definition 459 * 460 * Description: 461 * This function frees all of the memory associated with a DOI definition. 462 * 463 */ 464void cipso_v4_doi_free(struct cipso_v4_doi *doi_def) 465{ 466 if (!doi_def) 467 return; 468 469 switch (doi_def->type) { 470 case CIPSO_V4_MAP_TRANS: 471 kfree(doi_def->map.std->lvl.cipso); 472 kfree(doi_def->map.std->lvl.local); 473 kfree(doi_def->map.std->cat.cipso); 474 kfree(doi_def->map.std->cat.local); 475 kfree(doi_def->map.std); 476 break; 477 } 478 kfree(doi_def); 479} 480 481/** 482 * cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer 483 * @entry: the entry's RCU field 484 * 485 * Description: 486 * This function is designed to be used as a callback to the call_rcu() 487 * function so that the memory allocated to the DOI definition can be released 488 * safely. 489 * 490 */ 491static void cipso_v4_doi_free_rcu(struct rcu_head *entry) 492{ 493 struct cipso_v4_doi *doi_def; 494 495 doi_def = container_of(entry, struct cipso_v4_doi, rcu); 496 cipso_v4_doi_free(doi_def); 497} 498 499/** 500 * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine 501 * @doi: the DOI value 502 * @audit_info: NetLabel audit information 503 * 504 * Description: 505 * Removes a DOI definition from the CIPSO engine. The NetLabel routines will 506 * be called to release their own LSM domain mappings as well as our own 507 * domain list. Returns zero on success and negative values on failure. 508 * 509 */ 510int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info) 511{ 512 int ret_val; 513 struct cipso_v4_doi *doi_def; 514 struct audit_buffer *audit_buf; 515 516 spin_lock(&cipso_v4_doi_list_lock); 517 doi_def = cipso_v4_doi_search(doi); 518 if (!doi_def) { 519 spin_unlock(&cipso_v4_doi_list_lock); 520 ret_val = -ENOENT; 521 goto doi_remove_return; 522 } 523 list_del_rcu(&doi_def->list); 524 spin_unlock(&cipso_v4_doi_list_lock); 525 526 cipso_v4_doi_putdef(doi_def); 527 ret_val = 0; 528 529doi_remove_return: 530 audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info); 531 if (audit_buf) { 532 audit_log_format(audit_buf, 533 " cipso_doi=%u res=%u", 534 doi, ret_val == 0 ? 1 : 0); 535 audit_log_end(audit_buf); 536 } 537 538 return ret_val; 539} 540 541/** 542 * cipso_v4_doi_getdef - Returns a reference to a valid DOI definition 543 * @doi: the DOI value 544 * 545 * Description: 546 * Searches for a valid DOI definition and if one is found it is returned to 547 * the caller. Otherwise NULL is returned. The caller must ensure that 548 * rcu_read_lock() is held while accessing the returned definition and the DOI 549 * definition reference count is decremented when the caller is done. 550 * 551 */ 552struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi) 553{ 554 struct cipso_v4_doi *doi_def; 555 556 rcu_read_lock(); 557 doi_def = cipso_v4_doi_search(doi); 558 if (!doi_def) 559 goto doi_getdef_return; 560 if (!refcount_inc_not_zero(&doi_def->refcount)) 561 doi_def = NULL; 562 563doi_getdef_return: 564 rcu_read_unlock(); 565 return doi_def; 566} 567 568/** 569 * cipso_v4_doi_putdef - Releases a reference for the given DOI definition 570 * @doi_def: the DOI definition 571 * 572 * Description: 573 * Releases a DOI definition reference obtained from cipso_v4_doi_getdef(). 574 * 575 */ 576void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def) 577{ 578 if (!doi_def) 579 return; 580 581 if (!refcount_dec_and_test(&doi_def->refcount)) 582 return; 583 584 cipso_v4_cache_invalidate(); 585 call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu); 586} 587 588/** 589 * cipso_v4_doi_walk - Iterate through the DOI definitions 590 * @skip_cnt: skip past this number of DOI definitions, updated 591 * @callback: callback for each DOI definition 592 * @cb_arg: argument for the callback function 593 * 594 * Description: 595 * Iterate over the DOI definition list, skipping the first @skip_cnt entries. 596 * For each entry call @callback, if @callback returns a negative value stop 597 * 'walking' through the list and return. Updates the value in @skip_cnt upon 598 * return. Returns zero on success, negative values on failure. 599 * 600 */ 601int cipso_v4_doi_walk(u32 *skip_cnt, 602 int (*callback) (struct cipso_v4_doi *doi_def, void *arg), 603 void *cb_arg) 604{ 605 int ret_val = -ENOENT; 606 u32 doi_cnt = 0; 607 struct cipso_v4_doi *iter_doi; 608 609 rcu_read_lock(); 610 list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list) 611 if (refcount_read(&iter_doi->refcount) > 0) { 612 if (doi_cnt++ < *skip_cnt) 613 continue; 614 ret_val = callback(iter_doi, cb_arg); 615 if (ret_val < 0) { 616 doi_cnt--; 617 goto doi_walk_return; 618 } 619 } 620 621doi_walk_return: 622 rcu_read_unlock(); 623 *skip_cnt = doi_cnt; 624 return ret_val; 625} 626 627/* 628 * Label Mapping Functions 629 */ 630 631/** 632 * cipso_v4_map_lvl_valid - Checks to see if the given level is understood 633 * @doi_def: the DOI definition 634 * @level: the level to check 635 * 636 * Description: 637 * Checks the given level against the given DOI definition and returns a 638 * negative value if the level does not have a valid mapping and a zero value 639 * if the level is defined by the DOI. 640 * 641 */ 642static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level) 643{ 644 switch (doi_def->type) { 645 case CIPSO_V4_MAP_PASS: 646 return 0; 647 case CIPSO_V4_MAP_TRANS: 648 if ((level < doi_def->map.std->lvl.cipso_size) && 649 (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)) 650 return 0; 651 break; 652 } 653 654 return -EFAULT; 655} 656 657/** 658 * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network 659 * @doi_def: the DOI definition 660 * @host_lvl: the host MLS level 661 * @net_lvl: the network/CIPSO MLS level 662 * 663 * Description: 664 * Perform a label mapping to translate a local MLS level to the correct 665 * CIPSO level using the given DOI definition. Returns zero on success, 666 * negative values otherwise. 667 * 668 */ 669static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def, 670 u32 host_lvl, 671 u32 *net_lvl) 672{ 673 switch (doi_def->type) { 674 case CIPSO_V4_MAP_PASS: 675 *net_lvl = host_lvl; 676 return 0; 677 case CIPSO_V4_MAP_TRANS: 678 if (host_lvl < doi_def->map.std->lvl.local_size && 679 doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) { 680 *net_lvl = doi_def->map.std->lvl.local[host_lvl]; 681 return 0; 682 } 683 return -EPERM; 684 } 685 686 return -EINVAL; 687} 688 689/** 690 * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host 691 * @doi_def: the DOI definition 692 * @net_lvl: the network/CIPSO MLS level 693 * @host_lvl: the host MLS level 694 * 695 * Description: 696 * Perform a label mapping to translate a CIPSO level to the correct local MLS 697 * level using the given DOI definition. Returns zero on success, negative 698 * values otherwise. 699 * 700 */ 701static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def, 702 u32 net_lvl, 703 u32 *host_lvl) 704{ 705 struct cipso_v4_std_map_tbl *map_tbl; 706 707 switch (doi_def->type) { 708 case CIPSO_V4_MAP_PASS: 709 *host_lvl = net_lvl; 710 return 0; 711 case CIPSO_V4_MAP_TRANS: 712 map_tbl = doi_def->map.std; 713 if (net_lvl < map_tbl->lvl.cipso_size && 714 map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) { 715 *host_lvl = doi_def->map.std->lvl.cipso[net_lvl]; 716 return 0; 717 } 718 return -EPERM; 719 } 720 721 return -EINVAL; 722} 723 724/** 725 * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid 726 * @doi_def: the DOI definition 727 * @bitmap: category bitmap 728 * @bitmap_len: bitmap length in bytes 729 * 730 * Description: 731 * Checks the given category bitmap against the given DOI definition and 732 * returns a negative value if any of the categories in the bitmap do not have 733 * a valid mapping and a zero value if all of the categories are valid. 734 * 735 */ 736static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def, 737 const unsigned char *bitmap, 738 u32 bitmap_len) 739{ 740 int cat = -1; 741 u32 bitmap_len_bits = bitmap_len * 8; 742 u32 cipso_cat_size; 743 u32 *cipso_array; 744 745 switch (doi_def->type) { 746 case CIPSO_V4_MAP_PASS: 747 return 0; 748 case CIPSO_V4_MAP_TRANS: 749 cipso_cat_size = doi_def->map.std->cat.cipso_size; 750 cipso_array = doi_def->map.std->cat.cipso; 751 for (;;) { 752 cat = netlbl_bitmap_walk(bitmap, 753 bitmap_len_bits, 754 cat + 1, 755 1); 756 if (cat < 0) 757 break; 758 if (cat >= cipso_cat_size || 759 cipso_array[cat] >= CIPSO_V4_INV_CAT) 760 return -EFAULT; 761 } 762 763 if (cat == -1) 764 return 0; 765 break; 766 } 767 768 return -EFAULT; 769} 770 771/** 772 * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network 773 * @doi_def: the DOI definition 774 * @secattr: the security attributes 775 * @net_cat: the zero'd out category bitmap in network/CIPSO format 776 * @net_cat_len: the length of the CIPSO bitmap in bytes 777 * 778 * Description: 779 * Perform a label mapping to translate a local MLS category bitmap to the 780 * correct CIPSO bitmap using the given DOI definition. Returns the minimum 781 * size in bytes of the network bitmap on success, negative values otherwise. 782 * 783 */ 784static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def, 785 const struct netlbl_lsm_secattr *secattr, 786 unsigned char *net_cat, 787 u32 net_cat_len) 788{ 789 int host_spot = -1; 790 u32 net_spot = CIPSO_V4_INV_CAT; 791 u32 net_spot_max = 0; 792 u32 net_clen_bits = net_cat_len * 8; 793 u32 host_cat_size = 0; 794 u32 *host_cat_array = NULL; 795 796 if (doi_def->type == CIPSO_V4_MAP_TRANS) { 797 host_cat_size = doi_def->map.std->cat.local_size; 798 host_cat_array = doi_def->map.std->cat.local; 799 } 800 801 for (;;) { 802 host_spot = netlbl_catmap_walk(secattr->attr.mls.cat, 803 host_spot + 1); 804 if (host_spot < 0) 805 break; 806 807 switch (doi_def->type) { 808 case CIPSO_V4_MAP_PASS: 809 net_spot = host_spot; 810 break; 811 case CIPSO_V4_MAP_TRANS: 812 if (host_spot >= host_cat_size) 813 return -EPERM; 814 net_spot = host_cat_array[host_spot]; 815 if (net_spot >= CIPSO_V4_INV_CAT) 816 return -EPERM; 817 break; 818 } 819 if (net_spot >= net_clen_bits) 820 return -ENOSPC; 821 netlbl_bitmap_setbit(net_cat, net_spot, 1); 822 823 if (net_spot > net_spot_max) 824 net_spot_max = net_spot; 825 } 826 827 if (++net_spot_max % 8) 828 return net_spot_max / 8 + 1; 829 return net_spot_max / 8; 830} 831 832/** 833 * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host 834 * @doi_def: the DOI definition 835 * @net_cat: the category bitmap in network/CIPSO format 836 * @net_cat_len: the length of the CIPSO bitmap in bytes 837 * @secattr: the security attributes 838 * 839 * Description: 840 * Perform a label mapping to translate a CIPSO bitmap to the correct local 841 * MLS category bitmap using the given DOI definition. Returns zero on 842 * success, negative values on failure. 843 * 844 */ 845static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def, 846 const unsigned char *net_cat, 847 u32 net_cat_len, 848 struct netlbl_lsm_secattr *secattr) 849{ 850 int ret_val; 851 int net_spot = -1; 852 u32 host_spot = CIPSO_V4_INV_CAT; 853 u32 net_clen_bits = net_cat_len * 8; 854 u32 net_cat_size = 0; 855 u32 *net_cat_array = NULL; 856 857 if (doi_def->type == CIPSO_V4_MAP_TRANS) { 858 net_cat_size = doi_def->map.std->cat.cipso_size; 859 net_cat_array = doi_def->map.std->cat.cipso; 860 } 861 862 for (;;) { 863 net_spot = netlbl_bitmap_walk(net_cat, 864 net_clen_bits, 865 net_spot + 1, 866 1); 867 if (net_spot < 0) 868 return 0; 869 870 switch (doi_def->type) { 871 case CIPSO_V4_MAP_PASS: 872 host_spot = net_spot; 873 break; 874 case CIPSO_V4_MAP_TRANS: 875 if (net_spot >= net_cat_size) 876 return -EPERM; 877 host_spot = net_cat_array[net_spot]; 878 if (host_spot >= CIPSO_V4_INV_CAT) 879 return -EPERM; 880 break; 881 } 882 ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat, 883 host_spot, 884 GFP_ATOMIC); 885 if (ret_val != 0) 886 return ret_val; 887 } 888 889 return -EINVAL; 890} 891 892/** 893 * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid 894 * @doi_def: the DOI definition 895 * @enumcat: category list 896 * @enumcat_len: length of the category list in bytes 897 * 898 * Description: 899 * Checks the given categories against the given DOI definition and returns a 900 * negative value if any of the categories do not have a valid mapping and a 901 * zero value if all of the categories are valid. 902 * 903 */ 904static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def, 905 const unsigned char *enumcat, 906 u32 enumcat_len) 907{ 908 u16 cat; 909 int cat_prev = -1; 910 u32 iter; 911 912 if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01) 913 return -EFAULT; 914 915 for (iter = 0; iter < enumcat_len; iter += 2) { 916 cat = get_unaligned_be16(&enumcat[iter]); 917 if (cat <= cat_prev) 918 return -EFAULT; 919 cat_prev = cat; 920 } 921 922 return 0; 923} 924 925/** 926 * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network 927 * @doi_def: the DOI definition 928 * @secattr: the security attributes 929 * @net_cat: the zero'd out category list in network/CIPSO format 930 * @net_cat_len: the length of the CIPSO category list in bytes 931 * 932 * Description: 933 * Perform a label mapping to translate a local MLS category bitmap to the 934 * correct CIPSO category list using the given DOI definition. Returns the 935 * size in bytes of the network category bitmap on success, negative values 936 * otherwise. 937 * 938 */ 939static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def, 940 const struct netlbl_lsm_secattr *secattr, 941 unsigned char *net_cat, 942 u32 net_cat_len) 943{ 944 int cat = -1; 945 u32 cat_iter = 0; 946 947 for (;;) { 948 cat = netlbl_catmap_walk(secattr->attr.mls.cat, cat + 1); 949 if (cat < 0) 950 break; 951 if ((cat_iter + 2) > net_cat_len) 952 return -ENOSPC; 953 954 *((__be16 *)&net_cat[cat_iter]) = htons(cat); 955 cat_iter += 2; 956 } 957 958 return cat_iter; 959} 960 961/** 962 * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host 963 * @doi_def: the DOI definition 964 * @net_cat: the category list in network/CIPSO format 965 * @net_cat_len: the length of the CIPSO bitmap in bytes 966 * @secattr: the security attributes 967 * 968 * Description: 969 * Perform a label mapping to translate a CIPSO category list to the correct 970 * local MLS category bitmap using the given DOI definition. Returns zero on 971 * success, negative values on failure. 972 * 973 */ 974static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def, 975 const unsigned char *net_cat, 976 u32 net_cat_len, 977 struct netlbl_lsm_secattr *secattr) 978{ 979 int ret_val; 980 u32 iter; 981 982 for (iter = 0; iter < net_cat_len; iter += 2) { 983 ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat, 984 get_unaligned_be16(&net_cat[iter]), 985 GFP_ATOMIC); 986 if (ret_val != 0) 987 return ret_val; 988 } 989 990 return 0; 991} 992 993/** 994 * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid 995 * @doi_def: the DOI definition 996 * @rngcat: category list 997 * @rngcat_len: length of the category list in bytes 998 * 999 * Description: 1000 * Checks the given categories against the given DOI definition and returns a 1001 * negative value if any of the categories do not have a valid mapping and a 1002 * zero value if all of the categories are valid. 1003 * 1004 */ 1005static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def, 1006 const unsigned char *rngcat, 1007 u32 rngcat_len) 1008{ 1009 u16 cat_high; 1010 u16 cat_low; 1011 u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1; 1012 u32 iter; 1013 1014 if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01) 1015 return -EFAULT; 1016 1017 for (iter = 0; iter < rngcat_len; iter += 4) { 1018 cat_high = get_unaligned_be16(&rngcat[iter]); 1019 if ((iter + 4) <= rngcat_len) 1020 cat_low = get_unaligned_be16(&rngcat[iter + 2]); 1021 else 1022 cat_low = 0; 1023 1024 if (cat_high > cat_prev) 1025 return -EFAULT; 1026 1027 cat_prev = cat_low; 1028 } 1029 1030 return 0; 1031} 1032 1033/** 1034 * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network 1035 * @doi_def: the DOI definition 1036 * @secattr: the security attributes 1037 * @net_cat: the zero'd out category list in network/CIPSO format 1038 * @net_cat_len: the length of the CIPSO category list in bytes 1039 * 1040 * Description: 1041 * Perform a label mapping to translate a local MLS category bitmap to the 1042 * correct CIPSO category list using the given DOI definition. Returns the 1043 * size in bytes of the network category bitmap on success, negative values 1044 * otherwise. 1045 * 1046 */ 1047static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def, 1048 const struct netlbl_lsm_secattr *secattr, 1049 unsigned char *net_cat, 1050 u32 net_cat_len) 1051{ 1052 int iter = -1; 1053 u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2]; 1054 u32 array_cnt = 0; 1055 u32 cat_size = 0; 1056 1057 /* make sure we don't overflow the 'array[]' variable */ 1058 if (net_cat_len > 1059 (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN)) 1060 return -ENOSPC; 1061 1062 for (;;) { 1063 iter = netlbl_catmap_walk(secattr->attr.mls.cat, iter + 1); 1064 if (iter < 0) 1065 break; 1066 cat_size += (iter == 0 ? 0 : sizeof(u16)); 1067 if (cat_size > net_cat_len) 1068 return -ENOSPC; 1069 array[array_cnt++] = iter; 1070 1071 iter = netlbl_catmap_walkrng(secattr->attr.mls.cat, iter); 1072 if (iter < 0) 1073 return -EFAULT; 1074 cat_size += sizeof(u16); 1075 if (cat_size > net_cat_len) 1076 return -ENOSPC; 1077 array[array_cnt++] = iter; 1078 } 1079 1080 for (iter = 0; array_cnt > 0;) { 1081 *((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]); 1082 iter += 2; 1083 array_cnt--; 1084 if (array[array_cnt] != 0) { 1085 *((__be16 *)&net_cat[iter]) = htons(array[array_cnt]); 1086 iter += 2; 1087 } 1088 } 1089 1090 return cat_size; 1091} 1092 1093/** 1094 * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host 1095 * @doi_def: the DOI definition 1096 * @net_cat: the category list in network/CIPSO format 1097 * @net_cat_len: the length of the CIPSO bitmap in bytes 1098 * @secattr: the security attributes 1099 * 1100 * Description: 1101 * Perform a label mapping to translate a CIPSO category list to the correct 1102 * local MLS category bitmap using the given DOI definition. Returns zero on 1103 * success, negative values on failure. 1104 * 1105 */ 1106static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def, 1107 const unsigned char *net_cat, 1108 u32 net_cat_len, 1109 struct netlbl_lsm_secattr *secattr) 1110{ 1111 int ret_val; 1112 u32 net_iter; 1113 u16 cat_low; 1114 u16 cat_high; 1115 1116 for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) { 1117 cat_high = get_unaligned_be16(&net_cat[net_iter]); 1118 if ((net_iter + 4) <= net_cat_len) 1119 cat_low = get_unaligned_be16(&net_cat[net_iter + 2]); 1120 else 1121 cat_low = 0; 1122 1123 ret_val = netlbl_catmap_setrng(&secattr->attr.mls.cat, 1124 cat_low, 1125 cat_high, 1126 GFP_ATOMIC); 1127 if (ret_val != 0) 1128 return ret_val; 1129 } 1130 1131 return 0; 1132} 1133 1134/* 1135 * Protocol Handling Functions 1136 */ 1137 1138/** 1139 * cipso_v4_gentag_hdr - Generate a CIPSO option header 1140 * @doi_def: the DOI definition 1141 * @len: the total tag length in bytes, not including this header 1142 * @buf: the CIPSO option buffer 1143 * 1144 * Description: 1145 * Write a CIPSO header into the beginning of @buffer. 1146 * 1147 */ 1148static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def, 1149 unsigned char *buf, 1150 u32 len) 1151{ 1152 buf[0] = IPOPT_CIPSO; 1153 buf[1] = CIPSO_V4_HDR_LEN + len; 1154 put_unaligned_be32(doi_def->doi, &buf[2]); 1155} 1156 1157/** 1158 * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1) 1159 * @doi_def: the DOI definition 1160 * @secattr: the security attributes 1161 * @buffer: the option buffer 1162 * @buffer_len: length of buffer in bytes 1163 * 1164 * Description: 1165 * Generate a CIPSO option using the restricted bitmap tag, tag type #1. The 1166 * actual buffer length may be larger than the indicated size due to 1167 * translation between host and network category bitmaps. Returns the size of 1168 * the tag on success, negative values on failure. 1169 * 1170 */ 1171static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def, 1172 const struct netlbl_lsm_secattr *secattr, 1173 unsigned char *buffer, 1174 u32 buffer_len) 1175{ 1176 int ret_val; 1177 u32 tag_len; 1178 u32 level; 1179 1180 if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0) 1181 return -EPERM; 1182 1183 ret_val = cipso_v4_map_lvl_hton(doi_def, 1184 secattr->attr.mls.lvl, 1185 &level); 1186 if (ret_val != 0) 1187 return ret_val; 1188 1189 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 1190 ret_val = cipso_v4_map_cat_rbm_hton(doi_def, 1191 secattr, 1192 &buffer[4], 1193 buffer_len - 4); 1194 if (ret_val < 0) 1195 return ret_val; 1196 1197 /* This will send packets using the "optimized" format when 1198 * possible as specified in section 3.4.2.6 of the 1199 * CIPSO draft. */ 1200 if (READ_ONCE(cipso_v4_rbm_optfmt) && ret_val > 0 && 1201 ret_val <= 10) 1202 tag_len = 14; 1203 else 1204 tag_len = 4 + ret_val; 1205 } else 1206 tag_len = 4; 1207 1208 buffer[0] = CIPSO_V4_TAG_RBITMAP; 1209 buffer[1] = tag_len; 1210 buffer[3] = level; 1211 1212 return tag_len; 1213} 1214 1215/** 1216 * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag 1217 * @doi_def: the DOI definition 1218 * @tag: the CIPSO tag 1219 * @secattr: the security attributes 1220 * 1221 * Description: 1222 * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security 1223 * attributes in @secattr. Return zero on success, negatives values on 1224 * failure. 1225 * 1226 */ 1227static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def, 1228 const unsigned char *tag, 1229 struct netlbl_lsm_secattr *secattr) 1230{ 1231 int ret_val; 1232 u8 tag_len = tag[1]; 1233 u32 level; 1234 1235 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level); 1236 if (ret_val != 0) 1237 return ret_val; 1238 secattr->attr.mls.lvl = level; 1239 secattr->flags |= NETLBL_SECATTR_MLS_LVL; 1240 1241 if (tag_len > 4) { 1242 ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def, 1243 &tag[4], 1244 tag_len - 4, 1245 secattr); 1246 if (ret_val != 0) { 1247 netlbl_catmap_free(secattr->attr.mls.cat); 1248 return ret_val; 1249 } 1250 1251 if (secattr->attr.mls.cat) 1252 secattr->flags |= NETLBL_SECATTR_MLS_CAT; 1253 } 1254 1255 return 0; 1256} 1257 1258/** 1259 * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2) 1260 * @doi_def: the DOI definition 1261 * @secattr: the security attributes 1262 * @buffer: the option buffer 1263 * @buffer_len: length of buffer in bytes 1264 * 1265 * Description: 1266 * Generate a CIPSO option using the enumerated tag, tag type #2. Returns the 1267 * size of the tag on success, negative values on failure. 1268 * 1269 */ 1270static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def, 1271 const struct netlbl_lsm_secattr *secattr, 1272 unsigned char *buffer, 1273 u32 buffer_len) 1274{ 1275 int ret_val; 1276 u32 tag_len; 1277 u32 level; 1278 1279 if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL)) 1280 return -EPERM; 1281 1282 ret_val = cipso_v4_map_lvl_hton(doi_def, 1283 secattr->attr.mls.lvl, 1284 &level); 1285 if (ret_val != 0) 1286 return ret_val; 1287 1288 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 1289 ret_val = cipso_v4_map_cat_enum_hton(doi_def, 1290 secattr, 1291 &buffer[4], 1292 buffer_len - 4); 1293 if (ret_val < 0) 1294 return ret_val; 1295 1296 tag_len = 4 + ret_val; 1297 } else 1298 tag_len = 4; 1299 1300 buffer[0] = CIPSO_V4_TAG_ENUM; 1301 buffer[1] = tag_len; 1302 buffer[3] = level; 1303 1304 return tag_len; 1305} 1306 1307/** 1308 * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag 1309 * @doi_def: the DOI definition 1310 * @tag: the CIPSO tag 1311 * @secattr: the security attributes 1312 * 1313 * Description: 1314 * Parse a CIPSO enumerated tag (tag type #2) and return the security 1315 * attributes in @secattr. Return zero on success, negatives values on 1316 * failure. 1317 * 1318 */ 1319static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def, 1320 const unsigned char *tag, 1321 struct netlbl_lsm_secattr *secattr) 1322{ 1323 int ret_val; 1324 u8 tag_len = tag[1]; 1325 u32 level; 1326 1327 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level); 1328 if (ret_val != 0) 1329 return ret_val; 1330 secattr->attr.mls.lvl = level; 1331 secattr->flags |= NETLBL_SECATTR_MLS_LVL; 1332 1333 if (tag_len > 4) { 1334 ret_val = cipso_v4_map_cat_enum_ntoh(doi_def, 1335 &tag[4], 1336 tag_len - 4, 1337 secattr); 1338 if (ret_val != 0) { 1339 netlbl_catmap_free(secattr->attr.mls.cat); 1340 return ret_val; 1341 } 1342 1343 secattr->flags |= NETLBL_SECATTR_MLS_CAT; 1344 } 1345 1346 return 0; 1347} 1348 1349/** 1350 * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5) 1351 * @doi_def: the DOI definition 1352 * @secattr: the security attributes 1353 * @buffer: the option buffer 1354 * @buffer_len: length of buffer in bytes 1355 * 1356 * Description: 1357 * Generate a CIPSO option using the ranged tag, tag type #5. Returns the 1358 * size of the tag on success, negative values on failure. 1359 * 1360 */ 1361static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def, 1362 const struct netlbl_lsm_secattr *secattr, 1363 unsigned char *buffer, 1364 u32 buffer_len) 1365{ 1366 int ret_val; 1367 u32 tag_len; 1368 u32 level; 1369 1370 if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL)) 1371 return -EPERM; 1372 1373 ret_val = cipso_v4_map_lvl_hton(doi_def, 1374 secattr->attr.mls.lvl, 1375 &level); 1376 if (ret_val != 0) 1377 return ret_val; 1378 1379 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) { 1380 ret_val = cipso_v4_map_cat_rng_hton(doi_def, 1381 secattr, 1382 &buffer[4], 1383 buffer_len - 4); 1384 if (ret_val < 0) 1385 return ret_val; 1386 1387 tag_len = 4 + ret_val; 1388 } else 1389 tag_len = 4; 1390 1391 buffer[0] = CIPSO_V4_TAG_RANGE; 1392 buffer[1] = tag_len; 1393 buffer[3] = level; 1394 1395 return tag_len; 1396} 1397 1398/** 1399 * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag 1400 * @doi_def: the DOI definition 1401 * @tag: the CIPSO tag 1402 * @secattr: the security attributes 1403 * 1404 * Description: 1405 * Parse a CIPSO ranged tag (tag type #5) and return the security attributes 1406 * in @secattr. Return zero on success, negatives values on failure. 1407 * 1408 */ 1409static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def, 1410 const unsigned char *tag, 1411 struct netlbl_lsm_secattr *secattr) 1412{ 1413 int ret_val; 1414 u8 tag_len = tag[1]; 1415 u32 level; 1416 1417 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level); 1418 if (ret_val != 0) 1419 return ret_val; 1420 secattr->attr.mls.lvl = level; 1421 secattr->flags |= NETLBL_SECATTR_MLS_LVL; 1422 1423 if (tag_len > 4) { 1424 ret_val = cipso_v4_map_cat_rng_ntoh(doi_def, 1425 &tag[4], 1426 tag_len - 4, 1427 secattr); 1428 if (ret_val != 0) { 1429 netlbl_catmap_free(secattr->attr.mls.cat); 1430 return ret_val; 1431 } 1432 1433 if (secattr->attr.mls.cat) 1434 secattr->flags |= NETLBL_SECATTR_MLS_CAT; 1435 } 1436 1437 return 0; 1438} 1439 1440/** 1441 * cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard) 1442 * @doi_def: the DOI definition 1443 * @secattr: the security attributes 1444 * @buffer: the option buffer 1445 * @buffer_len: length of buffer in bytes 1446 * 1447 * Description: 1448 * Generate a CIPSO option using the local tag. Returns the size of the tag 1449 * on success, negative values on failure. 1450 * 1451 */ 1452static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def, 1453 const struct netlbl_lsm_secattr *secattr, 1454 unsigned char *buffer, 1455 u32 buffer_len) 1456{ 1457 if (!(secattr->flags & NETLBL_SECATTR_SECID)) 1458 return -EPERM; 1459 1460 buffer[0] = CIPSO_V4_TAG_LOCAL; 1461 buffer[1] = CIPSO_V4_TAG_LOC_BLEN; 1462 *(u32 *)&buffer[2] = secattr->attr.secid; 1463 1464 return CIPSO_V4_TAG_LOC_BLEN; 1465} 1466 1467/** 1468 * cipso_v4_parsetag_loc - Parse a CIPSO local tag 1469 * @doi_def: the DOI definition 1470 * @tag: the CIPSO tag 1471 * @secattr: the security attributes 1472 * 1473 * Description: 1474 * Parse a CIPSO local tag and return the security attributes in @secattr. 1475 * Return zero on success, negatives values on failure. 1476 * 1477 */ 1478static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def, 1479 const unsigned char *tag, 1480 struct netlbl_lsm_secattr *secattr) 1481{ 1482 secattr->attr.secid = *(u32 *)&tag[2]; 1483 secattr->flags |= NETLBL_SECATTR_SECID; 1484 1485 return 0; 1486} 1487 1488/** 1489 * cipso_v4_optptr - Find the CIPSO option in the packet 1490 * @skb: the packet 1491 * 1492 * Description: 1493 * Parse the packet's IP header looking for a CIPSO option. Returns a pointer 1494 * to the start of the CIPSO option on success, NULL if one is not found. 1495 * 1496 */ 1497unsigned char *cipso_v4_optptr(const struct sk_buff *skb) 1498{ 1499 const struct iphdr *iph = ip_hdr(skb); 1500 unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]); 1501 int optlen; 1502 int taglen; 1503 1504 for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) { 1505 switch (optptr[0]) { 1506 case IPOPT_END: 1507 return NULL; 1508 case IPOPT_NOOP: 1509 taglen = 1; 1510 break; 1511 default: 1512 taglen = optptr[1]; 1513 } 1514 if (!taglen || taglen > optlen) 1515 return NULL; 1516 if (optptr[0] == IPOPT_CIPSO) 1517 return optptr; 1518 1519 optlen -= taglen; 1520 optptr += taglen; 1521 } 1522 1523 return NULL; 1524} 1525 1526/** 1527 * cipso_v4_validate - Validate a CIPSO option 1528 * @skb: the packet 1529 * @option: the start of the option, on error it is set to point to the error 1530 * 1531 * Description: 1532 * This routine is called to validate a CIPSO option, it checks all of the 1533 * fields to ensure that they are at least valid, see the draft snippet below 1534 * for details. If the option is valid then a zero value is returned and 1535 * the value of @option is unchanged. If the option is invalid then a 1536 * non-zero value is returned and @option is adjusted to point to the 1537 * offending portion of the option. From the IETF draft ... 1538 * 1539 * "If any field within the CIPSO options, such as the DOI identifier, is not 1540 * recognized the IP datagram is discarded and an ICMP 'parameter problem' 1541 * (type 12) is generated and returned. The ICMP code field is set to 'bad 1542 * parameter' (code 0) and the pointer is set to the start of the CIPSO field 1543 * that is unrecognized." 1544 * 1545 */ 1546int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) 1547{ 1548 unsigned char *opt = *option; 1549 unsigned char *tag; 1550 unsigned char opt_iter; 1551 unsigned char err_offset = 0; 1552 u8 opt_len; 1553 u8 tag_len; 1554 struct cipso_v4_doi *doi_def = NULL; 1555 u32 tag_iter; 1556 1557 /* caller already checks for length values that are too large */ 1558 opt_len = opt[1]; 1559 if (opt_len < 8) { 1560 err_offset = 1; 1561 goto validate_return; 1562 } 1563 1564 rcu_read_lock(); 1565 doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2])); 1566 if (!doi_def) { 1567 err_offset = 2; 1568 goto validate_return_locked; 1569 } 1570 1571 opt_iter = CIPSO_V4_HDR_LEN; 1572 tag = opt + opt_iter; 1573 while (opt_iter < opt_len) { 1574 for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];) 1575 if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID || 1576 ++tag_iter == CIPSO_V4_TAG_MAXCNT) { 1577 err_offset = opt_iter; 1578 goto validate_return_locked; 1579 } 1580 1581 if (opt_iter + 1 == opt_len) { 1582 err_offset = opt_iter; 1583 goto validate_return_locked; 1584 } 1585 tag_len = tag[1]; 1586 if (tag_len > (opt_len - opt_iter)) { 1587 err_offset = opt_iter + 1; 1588 goto validate_return_locked; 1589 } 1590 1591 switch (tag[0]) { 1592 case CIPSO_V4_TAG_RBITMAP: 1593 if (tag_len < CIPSO_V4_TAG_RBM_BLEN) { 1594 err_offset = opt_iter + 1; 1595 goto validate_return_locked; 1596 } 1597 1598 /* We are already going to do all the verification 1599 * necessary at the socket layer so from our point of 1600 * view it is safe to turn these checks off (and less 1601 * work), however, the CIPSO draft says we should do 1602 * all the CIPSO validations here but it doesn't 1603 * really specify _exactly_ what we need to validate 1604 * ... so, just make it a sysctl tunable. */ 1605 if (READ_ONCE(cipso_v4_rbm_strictvalid)) { 1606 if (cipso_v4_map_lvl_valid(doi_def, 1607 tag[3]) < 0) { 1608 err_offset = opt_iter + 3; 1609 goto validate_return_locked; 1610 } 1611 if (tag_len > CIPSO_V4_TAG_RBM_BLEN && 1612 cipso_v4_map_cat_rbm_valid(doi_def, 1613 &tag[4], 1614 tag_len - 4) < 0) { 1615 err_offset = opt_iter + 4; 1616 goto validate_return_locked; 1617 } 1618 } 1619 break; 1620 case CIPSO_V4_TAG_ENUM: 1621 if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) { 1622 err_offset = opt_iter + 1; 1623 goto validate_return_locked; 1624 } 1625 1626 if (cipso_v4_map_lvl_valid(doi_def, 1627 tag[3]) < 0) { 1628 err_offset = opt_iter + 3; 1629 goto validate_return_locked; 1630 } 1631 if (tag_len > CIPSO_V4_TAG_ENUM_BLEN && 1632 cipso_v4_map_cat_enum_valid(doi_def, 1633 &tag[4], 1634 tag_len - 4) < 0) { 1635 err_offset = opt_iter + 4; 1636 goto validate_return_locked; 1637 } 1638 break; 1639 case CIPSO_V4_TAG_RANGE: 1640 if (tag_len < CIPSO_V4_TAG_RNG_BLEN) { 1641 err_offset = opt_iter + 1; 1642 goto validate_return_locked; 1643 } 1644 1645 if (cipso_v4_map_lvl_valid(doi_def, 1646 tag[3]) < 0) { 1647 err_offset = opt_iter + 3; 1648 goto validate_return_locked; 1649 } 1650 if (tag_len > CIPSO_V4_TAG_RNG_BLEN && 1651 cipso_v4_map_cat_rng_valid(doi_def, 1652 &tag[4], 1653 tag_len - 4) < 0) { 1654 err_offset = opt_iter + 4; 1655 goto validate_return_locked; 1656 } 1657 break; 1658 case CIPSO_V4_TAG_LOCAL: 1659 /* This is a non-standard tag that we only allow for 1660 * local connections, so if the incoming interface is 1661 * not the loopback device drop the packet. Further, 1662 * there is no legitimate reason for setting this from 1663 * userspace so reject it if skb is NULL. */ 1664 if (!skb || !(skb->dev->flags & IFF_LOOPBACK)) { 1665 err_offset = opt_iter; 1666 goto validate_return_locked; 1667 } 1668 if (tag_len != CIPSO_V4_TAG_LOC_BLEN) { 1669 err_offset = opt_iter + 1; 1670 goto validate_return_locked; 1671 } 1672 break; 1673 default: 1674 err_offset = opt_iter; 1675 goto validate_return_locked; 1676 } 1677 1678 tag += tag_len; 1679 opt_iter += tag_len; 1680 } 1681 1682validate_return_locked: 1683 rcu_read_unlock(); 1684validate_return: 1685 *option = opt + err_offset; 1686 return err_offset; 1687} 1688 1689/** 1690 * cipso_v4_error - Send the correct response for a bad packet 1691 * @skb: the packet 1692 * @error: the error code 1693 * @gateway: CIPSO gateway flag 1694 * 1695 * Description: 1696 * Based on the error code given in @error, send an ICMP error message back to 1697 * the originating host. From the IETF draft ... 1698 * 1699 * "If the contents of the CIPSO [option] are valid but the security label is 1700 * outside of the configured host or port label range, the datagram is 1701 * discarded and an ICMP 'destination unreachable' (type 3) is generated and 1702 * returned. The code field of the ICMP is set to 'communication with 1703 * destination network administratively prohibited' (code 9) or to 1704 * 'communication with destination host administratively prohibited' 1705 * (code 10). The value of the code is dependent on whether the originator 1706 * of the ICMP message is acting as a CIPSO host or a CIPSO gateway. The 1707 * recipient of the ICMP message MUST be able to handle either value. The 1708 * same procedure is performed if a CIPSO [option] can not be added to an 1709 * IP packet because it is too large to fit in the IP options area." 1710 * 1711 * "If the error is triggered by receipt of an ICMP message, the message is 1712 * discarded and no response is permitted (consistent with general ICMP 1713 * processing rules)." 1714 * 1715 */ 1716void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway) 1717{ 1718 unsigned char optbuf[sizeof(struct ip_options) + 40]; 1719 struct ip_options *opt = (struct ip_options *)optbuf; 1720 int res; 1721 1722 if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES) 1723 return; 1724 1725 /* 1726 * We might be called above the IP layer, 1727 * so we can not use icmp_send and IPCB here. 1728 */ 1729 1730 memset(opt, 0, sizeof(struct ip_options)); 1731 opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr); 1732 rcu_read_lock(); 1733 res = __ip_options_compile(dev_net(skb->dev), opt, skb, NULL); 1734 rcu_read_unlock(); 1735 1736 if (res) 1737 return; 1738 1739 if (gateway) 1740 __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0, opt); 1741 else 1742 __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0, opt); 1743} 1744 1745/** 1746 * cipso_v4_genopt - Generate a CIPSO option 1747 * @buf: the option buffer 1748 * @buf_len: the size of opt_buf 1749 * @doi_def: the CIPSO DOI to use 1750 * @secattr: the security attributes 1751 * 1752 * Description: 1753 * Generate a CIPSO option using the DOI definition and security attributes 1754 * passed to the function. Returns the length of the option on success and 1755 * negative values on failure. 1756 * 1757 */ 1758static int cipso_v4_genopt(unsigned char *buf, u32 buf_len, 1759 const struct cipso_v4_doi *doi_def, 1760 const struct netlbl_lsm_secattr *secattr) 1761{ 1762 int ret_val; 1763 u32 iter; 1764 1765 if (buf_len <= CIPSO_V4_HDR_LEN) 1766 return -ENOSPC; 1767 1768 /* XXX - This code assumes only one tag per CIPSO option which isn't 1769 * really a good assumption to make but since we only support the MAC 1770 * tags right now it is a safe assumption. */ 1771 iter = 0; 1772 do { 1773 memset(buf, 0, buf_len); 1774 switch (doi_def->tags[iter]) { 1775 case CIPSO_V4_TAG_RBITMAP: 1776 ret_val = cipso_v4_gentag_rbm(doi_def, 1777 secattr, 1778 &buf[CIPSO_V4_HDR_LEN], 1779 buf_len - CIPSO_V4_HDR_LEN); 1780 break; 1781 case CIPSO_V4_TAG_ENUM: 1782 ret_val = cipso_v4_gentag_enum(doi_def, 1783 secattr, 1784 &buf[CIPSO_V4_HDR_LEN], 1785 buf_len - CIPSO_V4_HDR_LEN); 1786 break; 1787 case CIPSO_V4_TAG_RANGE: 1788 ret_val = cipso_v4_gentag_rng(doi_def, 1789 secattr, 1790 &buf[CIPSO_V4_HDR_LEN], 1791 buf_len - CIPSO_V4_HDR_LEN); 1792 break; 1793 case CIPSO_V4_TAG_LOCAL: 1794 ret_val = cipso_v4_gentag_loc(doi_def, 1795 secattr, 1796 &buf[CIPSO_V4_HDR_LEN], 1797 buf_len - CIPSO_V4_HDR_LEN); 1798 break; 1799 default: 1800 return -EPERM; 1801 } 1802 1803 iter++; 1804 } while (ret_val < 0 && 1805 iter < CIPSO_V4_TAG_MAXCNT && 1806 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID); 1807 if (ret_val < 0) 1808 return ret_val; 1809 cipso_v4_gentag_hdr(doi_def, buf, ret_val); 1810 return CIPSO_V4_HDR_LEN + ret_val; 1811} 1812 1813/** 1814 * cipso_v4_sock_setattr - Add a CIPSO option to a socket 1815 * @sk: the socket 1816 * @doi_def: the CIPSO DOI to use 1817 * @secattr: the specific security attributes of the socket 1818 * 1819 * Description: 1820 * Set the CIPSO option on the given socket using the DOI definition and 1821 * security attributes passed to the function. This function requires 1822 * exclusive access to @sk, which means it either needs to be in the 1823 * process of being created or locked. Returns zero on success and negative 1824 * values on failure. 1825 * 1826 */ 1827int cipso_v4_sock_setattr(struct sock *sk, 1828 const struct cipso_v4_doi *doi_def, 1829 const struct netlbl_lsm_secattr *secattr) 1830{ 1831 int ret_val = -EPERM; 1832 unsigned char *buf = NULL; 1833 u32 buf_len; 1834 u32 opt_len; 1835 struct ip_options_rcu *old, *opt = NULL; 1836 struct inet_sock *sk_inet; 1837 struct inet_connection_sock *sk_conn; 1838 1839 /* In the case of sock_create_lite(), the sock->sk field is not 1840 * defined yet but it is not a problem as the only users of these 1841 * "lite" PF_INET sockets are functions which do an accept() call 1842 * afterwards so we will label the socket as part of the accept(). */ 1843 if (!sk) 1844 return 0; 1845 1846 /* We allocate the maximum CIPSO option size here so we are probably 1847 * being a little wasteful, but it makes our life _much_ easier later 1848 * on and after all we are only talking about 40 bytes. */ 1849 buf_len = CIPSO_V4_OPT_LEN_MAX; 1850 buf = kmalloc(buf_len, GFP_ATOMIC); 1851 if (!buf) { 1852 ret_val = -ENOMEM; 1853 goto socket_setattr_failure; 1854 } 1855 1856 ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr); 1857 if (ret_val < 0) 1858 goto socket_setattr_failure; 1859 buf_len = ret_val; 1860 1861 /* We can't use ip_options_get() directly because it makes a call to 1862 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and 1863 * we won't always have CAP_NET_RAW even though we _always_ want to 1864 * set the IPOPT_CIPSO option. */ 1865 opt_len = (buf_len + 3) & ~3; 1866 opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC); 1867 if (!opt) { 1868 ret_val = -ENOMEM; 1869 goto socket_setattr_failure; 1870 } 1871 memcpy(opt->opt.__data, buf, buf_len); 1872 opt->opt.optlen = opt_len; 1873 opt->opt.cipso = sizeof(struct iphdr); 1874 kfree(buf); 1875 buf = NULL; 1876 1877 sk_inet = inet_sk(sk); 1878 1879 old = rcu_dereference_protected(sk_inet->inet_opt, 1880 lockdep_sock_is_held(sk)); 1881 if (inet_test_bit(IS_ICSK, sk)) { 1882 sk_conn = inet_csk(sk); 1883 if (old) 1884 sk_conn->icsk_ext_hdr_len -= old->opt.optlen; 1885 sk_conn->icsk_ext_hdr_len += opt->opt.optlen; 1886 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie); 1887 } 1888 rcu_assign_pointer(sk_inet->inet_opt, opt); 1889 if (old) 1890 kfree_rcu(old, rcu); 1891 1892 return 0; 1893 1894socket_setattr_failure: 1895 kfree(buf); 1896 kfree(opt); 1897 return ret_val; 1898} 1899 1900/** 1901 * cipso_v4_req_setattr - Add a CIPSO option to a connection request socket 1902 * @req: the connection request socket 1903 * @doi_def: the CIPSO DOI to use 1904 * @secattr: the specific security attributes of the socket 1905 * 1906 * Description: 1907 * Set the CIPSO option on the given socket using the DOI definition and 1908 * security attributes passed to the function. Returns zero on success and 1909 * negative values on failure. 1910 * 1911 */ 1912int cipso_v4_req_setattr(struct request_sock *req, 1913 const struct cipso_v4_doi *doi_def, 1914 const struct netlbl_lsm_secattr *secattr) 1915{ 1916 int ret_val = -EPERM; 1917 unsigned char *buf = NULL; 1918 u32 buf_len; 1919 u32 opt_len; 1920 struct ip_options_rcu *opt = NULL; 1921 struct inet_request_sock *req_inet; 1922 1923 /* We allocate the maximum CIPSO option size here so we are probably 1924 * being a little wasteful, but it makes our life _much_ easier later 1925 * on and after all we are only talking about 40 bytes. */ 1926 buf_len = CIPSO_V4_OPT_LEN_MAX; 1927 buf = kmalloc(buf_len, GFP_ATOMIC); 1928 if (!buf) { 1929 ret_val = -ENOMEM; 1930 goto req_setattr_failure; 1931 } 1932 1933 ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr); 1934 if (ret_val < 0) 1935 goto req_setattr_failure; 1936 buf_len = ret_val; 1937 1938 /* We can't use ip_options_get() directly because it makes a call to 1939 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and 1940 * we won't always have CAP_NET_RAW even though we _always_ want to 1941 * set the IPOPT_CIPSO option. */ 1942 opt_len = (buf_len + 3) & ~3; 1943 opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC); 1944 if (!opt) { 1945 ret_val = -ENOMEM; 1946 goto req_setattr_failure; 1947 } 1948 memcpy(opt->opt.__data, buf, buf_len); 1949 opt->opt.optlen = opt_len; 1950 opt->opt.cipso = sizeof(struct iphdr); 1951 kfree(buf); 1952 buf = NULL; 1953 1954 req_inet = inet_rsk(req); 1955 opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt); 1956 if (opt) 1957 kfree_rcu(opt, rcu); 1958 1959 return 0; 1960 1961req_setattr_failure: 1962 kfree(buf); 1963 kfree(opt); 1964 return ret_val; 1965} 1966 1967/** 1968 * cipso_v4_delopt - Delete the CIPSO option from a set of IP options 1969 * @opt_ptr: IP option pointer 1970 * 1971 * Description: 1972 * Deletes the CIPSO IP option from a set of IP options and makes the necessary 1973 * adjustments to the IP option structure. Returns zero on success, negative 1974 * values on failure. 1975 * 1976 */ 1977static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr) 1978{ 1979 struct ip_options_rcu *opt = rcu_dereference_protected(*opt_ptr, 1); 1980 int hdr_delta = 0; 1981 1982 if (!opt || opt->opt.cipso == 0) 1983 return 0; 1984 if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) { 1985 u8 cipso_len; 1986 u8 cipso_off; 1987 unsigned char *cipso_ptr; 1988 int iter; 1989 int optlen_new; 1990 1991 cipso_off = opt->opt.cipso - sizeof(struct iphdr); 1992 cipso_ptr = &opt->opt.__data[cipso_off]; 1993 cipso_len = cipso_ptr[1]; 1994 1995 if (opt->opt.srr > opt->opt.cipso) 1996 opt->opt.srr -= cipso_len; 1997 if (opt->opt.rr > opt->opt.cipso) 1998 opt->opt.rr -= cipso_len; 1999 if (opt->opt.ts > opt->opt.cipso) 2000 opt->opt.ts -= cipso_len; 2001 if (opt->opt.router_alert > opt->opt.cipso) 2002 opt->opt.router_alert -= cipso_len; 2003 opt->opt.cipso = 0; 2004 2005 memmove(cipso_ptr, cipso_ptr + cipso_len, 2006 opt->opt.optlen - cipso_off - cipso_len); 2007 2008 /* determining the new total option length is tricky because of 2009 * the padding necessary, the only thing i can think to do at 2010 * this point is walk the options one-by-one, skipping the 2011 * padding at the end to determine the actual option size and 2012 * from there we can determine the new total option length */ 2013 iter = 0; 2014 optlen_new = 0; 2015 while (iter < opt->opt.optlen) 2016 if (opt->opt.__data[iter] != IPOPT_NOP) { 2017 iter += opt->opt.__data[iter + 1]; 2018 optlen_new = iter; 2019 } else 2020 iter++; 2021 hdr_delta = opt->opt.optlen; 2022 opt->opt.optlen = (optlen_new + 3) & ~3; 2023 hdr_delta -= opt->opt.optlen; 2024 } else { 2025 /* only the cipso option was present on the socket so we can 2026 * remove the entire option struct */ 2027 *opt_ptr = NULL; 2028 hdr_delta = opt->opt.optlen; 2029 kfree_rcu(opt, rcu); 2030 } 2031 2032 return hdr_delta; 2033} 2034 2035/** 2036 * cipso_v4_sock_delattr - Delete the CIPSO option from a socket 2037 * @sk: the socket 2038 * 2039 * Description: 2040 * Removes the CIPSO option from a socket, if present. 2041 * 2042 */ 2043void cipso_v4_sock_delattr(struct sock *sk) 2044{ 2045 struct inet_sock *sk_inet; 2046 int hdr_delta; 2047 2048 sk_inet = inet_sk(sk); 2049 2050 hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt); 2051 if (inet_test_bit(IS_ICSK, sk) && hdr_delta > 0) { 2052 struct inet_connection_sock *sk_conn = inet_csk(sk); 2053 sk_conn->icsk_ext_hdr_len -= hdr_delta; 2054 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie); 2055 } 2056} 2057 2058/** 2059 * cipso_v4_req_delattr - Delete the CIPSO option from a request socket 2060 * @req: the request socket 2061 * 2062 * Description: 2063 * Removes the CIPSO option from a request socket, if present. 2064 * 2065 */ 2066void cipso_v4_req_delattr(struct request_sock *req) 2067{ 2068 cipso_v4_delopt(&inet_rsk(req)->ireq_opt); 2069} 2070 2071/** 2072 * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions 2073 * @cipso: the CIPSO v4 option 2074 * @secattr: the security attributes 2075 * 2076 * Description: 2077 * Inspect @cipso and return the security attributes in @secattr. Returns zero 2078 * on success and negative values on failure. 2079 * 2080 */ 2081int cipso_v4_getattr(const unsigned char *cipso, 2082 struct netlbl_lsm_secattr *secattr) 2083{ 2084 int ret_val = -ENOMSG; 2085 u32 doi; 2086 struct cipso_v4_doi *doi_def; 2087 2088 if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0) 2089 return 0; 2090 2091 doi = get_unaligned_be32(&cipso[2]); 2092 rcu_read_lock(); 2093 doi_def = cipso_v4_doi_search(doi); 2094 if (!doi_def) 2095 goto getattr_return; 2096 /* XXX - This code assumes only one tag per CIPSO option which isn't 2097 * really a good assumption to make but since we only support the MAC 2098 * tags right now it is a safe assumption. */ 2099 switch (cipso[6]) { 2100 case CIPSO_V4_TAG_RBITMAP: 2101 ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr); 2102 break; 2103 case CIPSO_V4_TAG_ENUM: 2104 ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr); 2105 break; 2106 case CIPSO_V4_TAG_RANGE: 2107 ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr); 2108 break; 2109 case CIPSO_V4_TAG_LOCAL: 2110 ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr); 2111 break; 2112 } 2113 if (ret_val == 0) 2114 secattr->type = NETLBL_NLTYPE_CIPSOV4; 2115 2116getattr_return: 2117 rcu_read_unlock(); 2118 return ret_val; 2119} 2120 2121/** 2122 * cipso_v4_sock_getattr - Get the security attributes from a sock 2123 * @sk: the sock 2124 * @secattr: the security attributes 2125 * 2126 * Description: 2127 * Query @sk to see if there is a CIPSO option attached to the sock and if 2128 * there is return the CIPSO security attributes in @secattr. This function 2129 * requires that @sk be locked, or privately held, but it does not do any 2130 * locking itself. Returns zero on success and negative values on failure. 2131 * 2132 */ 2133int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) 2134{ 2135 struct ip_options_rcu *opt; 2136 int res = -ENOMSG; 2137 2138 rcu_read_lock(); 2139 opt = rcu_dereference(inet_sk(sk)->inet_opt); 2140 if (opt && opt->opt.cipso) 2141 res = cipso_v4_getattr(opt->opt.__data + 2142 opt->opt.cipso - 2143 sizeof(struct iphdr), 2144 secattr); 2145 rcu_read_unlock(); 2146 return res; 2147} 2148 2149/** 2150 * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet 2151 * @skb: the packet 2152 * @doi_def: the DOI structure 2153 * @secattr: the security attributes 2154 * 2155 * Description: 2156 * Set the CIPSO option on the given packet based on the security attributes. 2157 * Returns a pointer to the IP header on success and NULL on failure. 2158 * 2159 */ 2160int cipso_v4_skbuff_setattr(struct sk_buff *skb, 2161 const struct cipso_v4_doi *doi_def, 2162 const struct netlbl_lsm_secattr *secattr) 2163{ 2164 int ret_val; 2165 struct iphdr *iph; 2166 struct ip_options *opt = &IPCB(skb)->opt; 2167 unsigned char buf[CIPSO_V4_OPT_LEN_MAX]; 2168 u32 buf_len = CIPSO_V4_OPT_LEN_MAX; 2169 u32 opt_len; 2170 int len_delta; 2171 2172 ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr); 2173 if (ret_val < 0) 2174 return ret_val; 2175 buf_len = ret_val; 2176 opt_len = (buf_len + 3) & ~3; 2177 2178 /* we overwrite any existing options to ensure that we have enough 2179 * room for the CIPSO option, the reason is that we _need_ to guarantee 2180 * that the security label is applied to the packet - we do the same 2181 * thing when using the socket options and it hasn't caused a problem, 2182 * if we need to we can always revisit this choice later */ 2183 2184 len_delta = opt_len - opt->optlen; 2185 /* if we don't ensure enough headroom we could panic on the skb_push() 2186 * call below so make sure we have enough, we are also "mangling" the 2187 * packet so we should probably do a copy-on-write call anyway */ 2188 ret_val = skb_cow(skb, skb_headroom(skb) + len_delta); 2189 if (ret_val < 0) 2190 return ret_val; 2191 2192 if (len_delta > 0) { 2193 /* we assume that the header + opt->optlen have already been 2194 * "pushed" in ip_options_build() or similar */ 2195 iph = ip_hdr(skb); 2196 skb_push(skb, len_delta); 2197 memmove((char *)iph - len_delta, iph, iph->ihl << 2); 2198 skb_reset_network_header(skb); 2199 iph = ip_hdr(skb); 2200 } else if (len_delta < 0) { 2201 iph = ip_hdr(skb); 2202 memset(iph + 1, IPOPT_NOP, opt->optlen); 2203 } else 2204 iph = ip_hdr(skb); 2205 2206 if (opt->optlen > 0) 2207 memset(opt, 0, sizeof(*opt)); 2208 opt->optlen = opt_len; 2209 opt->cipso = sizeof(struct iphdr); 2210 opt->is_changed = 1; 2211 2212 /* we have to do the following because we are being called from a 2213 * netfilter hook which means the packet already has had the header 2214 * fields populated and the checksum calculated - yes this means we 2215 * are doing more work than needed but we do it to keep the core 2216 * stack clean and tidy */ 2217 memcpy(iph + 1, buf, buf_len); 2218 if (opt_len > buf_len) 2219 memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len); 2220 if (len_delta != 0) { 2221 iph->ihl = 5 + (opt_len >> 2); 2222 iph_set_totlen(iph, skb->len); 2223 } 2224 ip_send_check(iph); 2225 2226 return 0; 2227} 2228 2229/** 2230 * cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet 2231 * @skb: the packet 2232 * 2233 * Description: 2234 * Removes any and all CIPSO options from the given packet. Returns zero on 2235 * success, negative values on failure. 2236 * 2237 */ 2238int cipso_v4_skbuff_delattr(struct sk_buff *skb) 2239{ 2240 int ret_val; 2241 struct iphdr *iph; 2242 struct ip_options *opt = &IPCB(skb)->opt; 2243 unsigned char *cipso_ptr; 2244 2245 if (opt->cipso == 0) 2246 return 0; 2247 2248 /* since we are changing the packet we should make a copy */ 2249 ret_val = skb_cow(skb, skb_headroom(skb)); 2250 if (ret_val < 0) 2251 return ret_val; 2252 2253 /* the easiest thing to do is just replace the cipso option with noop 2254 * options since we don't change the size of the packet, although we 2255 * still need to recalculate the checksum */ 2256 2257 iph = ip_hdr(skb); 2258 cipso_ptr = (unsigned char *)iph + opt->cipso; 2259 memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]); 2260 opt->cipso = 0; 2261 opt->is_changed = 1; 2262 2263 ip_send_check(iph); 2264 2265 return 0; 2266} 2267 2268/* 2269 * Setup Functions 2270 */ 2271 2272/** 2273 * cipso_v4_init - Initialize the CIPSO module 2274 * 2275 * Description: 2276 * Initialize the CIPSO module and prepare it for use. Returns zero on success 2277 * and negative values on failure. 2278 * 2279 */ 2280static int __init cipso_v4_init(void) 2281{ 2282 int ret_val; 2283 2284 ret_val = cipso_v4_cache_init(); 2285 if (ret_val != 0) 2286 panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n", 2287 ret_val); 2288 2289 return 0; 2290} 2291 2292subsys_initcall(cipso_v4_init); 2293