1// SPDX-License-Identifier: GPL-2.0-or-later 2/* 3 * NetLabel Kernel API 4 * 5 * This file defines the kernel API for the NetLabel system. The NetLabel 6 * system manages static and dynamic label mappings for network protocols such 7 * as CIPSO and RIPSO. 8 * 9 * Author: Paul Moore <paul@paul-moore.com> 10 */ 11 12/* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 14 */ 15 16#include <linux/init.h> 17#include <linux/types.h> 18#include <linux/slab.h> 19#include <linux/audit.h> 20#include <linux/in.h> 21#include <linux/in6.h> 22#include <net/ip.h> 23#include <net/ipv6.h> 24#include <net/netlabel.h> 25#include <net/cipso_ipv4.h> 26#include <net/calipso.h> 27#include <asm/bug.h> 28#include <linux/atomic.h> 29 30#include "netlabel_domainhash.h" 31#include "netlabel_unlabeled.h" 32#include "netlabel_cipso_v4.h" 33#include "netlabel_calipso.h" 34#include "netlabel_user.h" 35#include "netlabel_mgmt.h" 36#include "netlabel_addrlist.h" 37 38/* 39 * Configuration Functions 40 */ 41 42/** 43 * netlbl_cfg_map_del - Remove a NetLabel/LSM domain mapping 44 * @domain: the domain mapping to remove 45 * @family: address family 46 * @addr: IP address 47 * @mask: IP address mask 48 * @audit_info: NetLabel audit information 49 * 50 * Description: 51 * Removes a NetLabel/LSM domain mapping. A @domain value of NULL causes the 52 * default domain mapping to be removed. Returns zero on success, negative 53 * values on failure. 54 * 55 */ 56int netlbl_cfg_map_del(const char *domain, 57 u16 family, 58 const void *addr, 59 const void *mask, 60 struct netlbl_audit *audit_info) 61{ 62 if (addr == NULL && mask == NULL) { 63 return netlbl_domhsh_remove(domain, family, audit_info); 64 } else if (addr != NULL && mask != NULL) { 65 switch (family) { 66 case AF_INET: 67 return netlbl_domhsh_remove_af4(domain, addr, mask, 68 audit_info); 69#if IS_ENABLED(CONFIG_IPV6) 70 case AF_INET6: 71 return netlbl_domhsh_remove_af6(domain, addr, mask, 72 audit_info); 73#endif /* IPv6 */ 74 default: 75 return -EPFNOSUPPORT; 76 } 77 } else 78 return -EINVAL; 79} 80 81/** 82 * netlbl_cfg_unlbl_map_add - Add a new unlabeled mapping 83 * @domain: the domain mapping to add 84 * @family: address family 85 * @addr: IP address 86 * @mask: IP address mask 87 * @audit_info: NetLabel audit information 88 * 89 * Description: 90 * Adds a new unlabeled NetLabel/LSM domain mapping. A @domain value of NULL 91 * causes a new default domain mapping to be added. Returns zero on success, 92 * negative values on failure. 93 * 94 */ 95int netlbl_cfg_unlbl_map_add(const char *domain, 96 u16 family, 97 const void *addr, 98 const void *mask, 99 struct netlbl_audit *audit_info) 100{ 101 int ret_val = -ENOMEM; 102 struct netlbl_dom_map *entry; 103 struct netlbl_domaddr_map *addrmap = NULL; 104 struct netlbl_domaddr4_map *map4 = NULL; 105 struct netlbl_domaddr6_map *map6 = NULL; 106 107 entry = kzalloc(sizeof(*entry), GFP_ATOMIC); 108 if (entry == NULL) 109 return -ENOMEM; 110 if (domain != NULL) { 111 entry->domain = kstrdup(domain, GFP_ATOMIC); 112 if (entry->domain == NULL) 113 goto cfg_unlbl_map_add_failure; 114 } 115 entry->family = family; 116 117 if (addr == NULL && mask == NULL) 118 entry->def.type = NETLBL_NLTYPE_UNLABELED; 119 else if (addr != NULL && mask != NULL) { 120 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC); 121 if (addrmap == NULL) 122 goto cfg_unlbl_map_add_failure; 123 INIT_LIST_HEAD(&addrmap->list4); 124 INIT_LIST_HEAD(&addrmap->list6); 125 126 switch (family) { 127 case AF_INET: { 128 const struct in_addr *addr4 = addr; 129 const struct in_addr *mask4 = mask; 130 map4 = kzalloc(sizeof(*map4), GFP_ATOMIC); 131 if (map4 == NULL) 132 goto cfg_unlbl_map_add_failure; 133 map4->def.type = NETLBL_NLTYPE_UNLABELED; 134 map4->list.addr = addr4->s_addr & mask4->s_addr; 135 map4->list.mask = mask4->s_addr; 136 map4->list.valid = 1; 137 ret_val = netlbl_af4list_add(&map4->list, 138 &addrmap->list4); 139 if (ret_val != 0) 140 goto cfg_unlbl_map_add_failure; 141 break; 142 } 143#if IS_ENABLED(CONFIG_IPV6) 144 case AF_INET6: { 145 const struct in6_addr *addr6 = addr; 146 const struct in6_addr *mask6 = mask; 147 map6 = kzalloc(sizeof(*map6), GFP_ATOMIC); 148 if (map6 == NULL) 149 goto cfg_unlbl_map_add_failure; 150 map6->def.type = NETLBL_NLTYPE_UNLABELED; 151 map6->list.addr = *addr6; 152 map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0]; 153 map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1]; 154 map6->list.addr.s6_addr32[2] &= mask6->s6_addr32[2]; 155 map6->list.addr.s6_addr32[3] &= mask6->s6_addr32[3]; 156 map6->list.mask = *mask6; 157 map6->list.valid = 1; 158 ret_val = netlbl_af6list_add(&map6->list, 159 &addrmap->list6); 160 if (ret_val != 0) 161 goto cfg_unlbl_map_add_failure; 162 break; 163 } 164#endif /* IPv6 */ 165 default: 166 goto cfg_unlbl_map_add_failure; 167 } 168 169 entry->def.addrsel = addrmap; 170 entry->def.type = NETLBL_NLTYPE_ADDRSELECT; 171 } else { 172 ret_val = -EINVAL; 173 goto cfg_unlbl_map_add_failure; 174 } 175 176 ret_val = netlbl_domhsh_add(entry, audit_info); 177 if (ret_val != 0) 178 goto cfg_unlbl_map_add_failure; 179 180 return 0; 181 182cfg_unlbl_map_add_failure: 183 kfree(entry->domain); 184 kfree(entry); 185 kfree(addrmap); 186 kfree(map4); 187 kfree(map6); 188 return ret_val; 189} 190 191 192/** 193 * netlbl_cfg_unlbl_static_add - Adds a new static label 194 * @net: network namespace 195 * @dev_name: interface name 196 * @addr: IP address in network byte order (struct in[6]_addr) 197 * @mask: address mask in network byte order (struct in[6]_addr) 198 * @family: address family 199 * @secid: LSM secid value for the entry 200 * @audit_info: NetLabel audit information 201 * 202 * Description: 203 * Adds a new NetLabel static label to be used when protocol provided labels 204 * are not present on incoming traffic. If @dev_name is NULL then the default 205 * interface will be used. Returns zero on success, negative values on failure. 206 * 207 */ 208int netlbl_cfg_unlbl_static_add(struct net *net, 209 const char *dev_name, 210 const void *addr, 211 const void *mask, 212 u16 family, 213 u32 secid, 214 struct netlbl_audit *audit_info) 215{ 216 u32 addr_len; 217 218 switch (family) { 219 case AF_INET: 220 addr_len = sizeof(struct in_addr); 221 break; 222#if IS_ENABLED(CONFIG_IPV6) 223 case AF_INET6: 224 addr_len = sizeof(struct in6_addr); 225 break; 226#endif /* IPv6 */ 227 default: 228 return -EPFNOSUPPORT; 229 } 230 231 return netlbl_unlhsh_add(net, 232 dev_name, addr, mask, addr_len, 233 secid, audit_info); 234} 235 236/** 237 * netlbl_cfg_unlbl_static_del - Removes an existing static label 238 * @net: network namespace 239 * @dev_name: interface name 240 * @addr: IP address in network byte order (struct in[6]_addr) 241 * @mask: address mask in network byte order (struct in[6]_addr) 242 * @family: address family 243 * @audit_info: NetLabel audit information 244 * 245 * Description: 246 * Removes an existing NetLabel static label used when protocol provided labels 247 * are not present on incoming traffic. If @dev_name is NULL then the default 248 * interface will be used. Returns zero on success, negative values on failure. 249 * 250 */ 251int netlbl_cfg_unlbl_static_del(struct net *net, 252 const char *dev_name, 253 const void *addr, 254 const void *mask, 255 u16 family, 256 struct netlbl_audit *audit_info) 257{ 258 u32 addr_len; 259 260 switch (family) { 261 case AF_INET: 262 addr_len = sizeof(struct in_addr); 263 break; 264#if IS_ENABLED(CONFIG_IPV6) 265 case AF_INET6: 266 addr_len = sizeof(struct in6_addr); 267 break; 268#endif /* IPv6 */ 269 default: 270 return -EPFNOSUPPORT; 271 } 272 273 return netlbl_unlhsh_remove(net, 274 dev_name, addr, mask, addr_len, 275 audit_info); 276} 277 278/** 279 * netlbl_cfg_cipsov4_add - Add a new CIPSOv4 DOI definition 280 * @doi_def: CIPSO DOI definition 281 * @audit_info: NetLabel audit information 282 * 283 * Description: 284 * Add a new CIPSO DOI definition as defined by @doi_def. Returns zero on 285 * success and negative values on failure. 286 * 287 */ 288int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def, 289 struct netlbl_audit *audit_info) 290{ 291 return cipso_v4_doi_add(doi_def, audit_info); 292} 293 294/** 295 * netlbl_cfg_cipsov4_del - Remove an existing CIPSOv4 DOI definition 296 * @doi: CIPSO DOI 297 * @audit_info: NetLabel audit information 298 * 299 * Description: 300 * Remove an existing CIPSO DOI definition matching @doi. Returns zero on 301 * success and negative values on failure. 302 * 303 */ 304void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info) 305{ 306 cipso_v4_doi_remove(doi, audit_info); 307} 308 309/** 310 * netlbl_cfg_cipsov4_map_add - Add a new CIPSOv4 DOI mapping 311 * @doi: the CIPSO DOI 312 * @domain: the domain mapping to add 313 * @addr: IP address 314 * @mask: IP address mask 315 * @audit_info: NetLabel audit information 316 * 317 * Description: 318 * Add a new NetLabel/LSM domain mapping for the given CIPSO DOI to the NetLabel 319 * subsystem. A @domain value of NULL adds a new default domain mapping. 320 * Returns zero on success, negative values on failure. 321 * 322 */ 323int netlbl_cfg_cipsov4_map_add(u32 doi, 324 const char *domain, 325 const struct in_addr *addr, 326 const struct in_addr *mask, 327 struct netlbl_audit *audit_info) 328{ 329 int ret_val = -ENOMEM; 330 struct cipso_v4_doi *doi_def; 331 struct netlbl_dom_map *entry; 332 struct netlbl_domaddr_map *addrmap = NULL; 333 struct netlbl_domaddr4_map *addrinfo = NULL; 334 335 doi_def = cipso_v4_doi_getdef(doi); 336 if (doi_def == NULL) 337 return -ENOENT; 338 339 entry = kzalloc(sizeof(*entry), GFP_ATOMIC); 340 if (entry == NULL) 341 goto out_entry; 342 entry->family = AF_INET; 343 if (domain != NULL) { 344 entry->domain = kstrdup(domain, GFP_ATOMIC); 345 if (entry->domain == NULL) 346 goto out_domain; 347 } 348 349 if (addr == NULL && mask == NULL) { 350 entry->def.cipso = doi_def; 351 entry->def.type = NETLBL_NLTYPE_CIPSOV4; 352 } else if (addr != NULL && mask != NULL) { 353 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC); 354 if (addrmap == NULL) 355 goto out_addrmap; 356 INIT_LIST_HEAD(&addrmap->list4); 357 INIT_LIST_HEAD(&addrmap->list6); 358 359 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC); 360 if (addrinfo == NULL) 361 goto out_addrinfo; 362 addrinfo->def.cipso = doi_def; 363 addrinfo->def.type = NETLBL_NLTYPE_CIPSOV4; 364 addrinfo->list.addr = addr->s_addr & mask->s_addr; 365 addrinfo->list.mask = mask->s_addr; 366 addrinfo->list.valid = 1; 367 ret_val = netlbl_af4list_add(&addrinfo->list, &addrmap->list4); 368 if (ret_val != 0) 369 goto cfg_cipsov4_map_add_failure; 370 371 entry->def.addrsel = addrmap; 372 entry->def.type = NETLBL_NLTYPE_ADDRSELECT; 373 } else { 374 ret_val = -EINVAL; 375 goto out_addrmap; 376 } 377 378 ret_val = netlbl_domhsh_add(entry, audit_info); 379 if (ret_val != 0) 380 goto cfg_cipsov4_map_add_failure; 381 382 return 0; 383 384cfg_cipsov4_map_add_failure: 385 kfree(addrinfo); 386out_addrinfo: 387 kfree(addrmap); 388out_addrmap: 389 kfree(entry->domain); 390out_domain: 391 kfree(entry); 392out_entry: 393 cipso_v4_doi_putdef(doi_def); 394 return ret_val; 395} 396 397/** 398 * netlbl_cfg_calipso_add - Add a new CALIPSO DOI definition 399 * @doi_def: CALIPSO DOI definition 400 * @audit_info: NetLabel audit information 401 * 402 * Description: 403 * Add a new CALIPSO DOI definition as defined by @doi_def. Returns zero on 404 * success and negative values on failure. 405 * 406 */ 407int netlbl_cfg_calipso_add(struct calipso_doi *doi_def, 408 struct netlbl_audit *audit_info) 409{ 410#if IS_ENABLED(CONFIG_IPV6) 411 return calipso_doi_add(doi_def, audit_info); 412#else /* IPv6 */ 413 return -ENOSYS; 414#endif /* IPv6 */ 415} 416 417/** 418 * netlbl_cfg_calipso_del - Remove an existing CALIPSO DOI definition 419 * @doi: CALIPSO DOI 420 * @audit_info: NetLabel audit information 421 * 422 * Description: 423 * Remove an existing CALIPSO DOI definition matching @doi. Returns zero on 424 * success and negative values on failure. 425 * 426 */ 427void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info) 428{ 429#if IS_ENABLED(CONFIG_IPV6) 430 calipso_doi_remove(doi, audit_info); 431#endif /* IPv6 */ 432} 433 434/** 435 * netlbl_cfg_calipso_map_add - Add a new CALIPSO DOI mapping 436 * @doi: the CALIPSO DOI 437 * @domain: the domain mapping to add 438 * @addr: IP address 439 * @mask: IP address mask 440 * @audit_info: NetLabel audit information 441 * 442 * Description: 443 * Add a new NetLabel/LSM domain mapping for the given CALIPSO DOI to the 444 * NetLabel subsystem. A @domain value of NULL adds a new default domain 445 * mapping. Returns zero on success, negative values on failure. 446 * 447 */ 448int netlbl_cfg_calipso_map_add(u32 doi, 449 const char *domain, 450 const struct in6_addr *addr, 451 const struct in6_addr *mask, 452 struct netlbl_audit *audit_info) 453{ 454#if IS_ENABLED(CONFIG_IPV6) 455 int ret_val = -ENOMEM; 456 struct calipso_doi *doi_def; 457 struct netlbl_dom_map *entry; 458 struct netlbl_domaddr_map *addrmap = NULL; 459 struct netlbl_domaddr6_map *addrinfo = NULL; 460 461 doi_def = calipso_doi_getdef(doi); 462 if (doi_def == NULL) 463 return -ENOENT; 464 465 entry = kzalloc(sizeof(*entry), GFP_ATOMIC); 466 if (entry == NULL) 467 goto out_entry; 468 entry->family = AF_INET6; 469 if (domain != NULL) { 470 entry->domain = kstrdup(domain, GFP_ATOMIC); 471 if (entry->domain == NULL) 472 goto out_domain; 473 } 474 475 if (addr == NULL && mask == NULL) { 476 entry->def.calipso = doi_def; 477 entry->def.type = NETLBL_NLTYPE_CALIPSO; 478 } else if (addr != NULL && mask != NULL) { 479 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC); 480 if (addrmap == NULL) 481 goto out_addrmap; 482 INIT_LIST_HEAD(&addrmap->list4); 483 INIT_LIST_HEAD(&addrmap->list6); 484 485 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC); 486 if (addrinfo == NULL) 487 goto out_addrinfo; 488 addrinfo->def.calipso = doi_def; 489 addrinfo->def.type = NETLBL_NLTYPE_CALIPSO; 490 addrinfo->list.addr = *addr; 491 addrinfo->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; 492 addrinfo->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; 493 addrinfo->list.addr.s6_addr32[2] &= mask->s6_addr32[2]; 494 addrinfo->list.addr.s6_addr32[3] &= mask->s6_addr32[3]; 495 addrinfo->list.mask = *mask; 496 addrinfo->list.valid = 1; 497 ret_val = netlbl_af6list_add(&addrinfo->list, &addrmap->list6); 498 if (ret_val != 0) 499 goto cfg_calipso_map_add_failure; 500 501 entry->def.addrsel = addrmap; 502 entry->def.type = NETLBL_NLTYPE_ADDRSELECT; 503 } else { 504 ret_val = -EINVAL; 505 goto out_addrmap; 506 } 507 508 ret_val = netlbl_domhsh_add(entry, audit_info); 509 if (ret_val != 0) 510 goto cfg_calipso_map_add_failure; 511 512 return 0; 513 514cfg_calipso_map_add_failure: 515 kfree(addrinfo); 516out_addrinfo: 517 kfree(addrmap); 518out_addrmap: 519 kfree(entry->domain); 520out_domain: 521 kfree(entry); 522out_entry: 523 calipso_doi_putdef(doi_def); 524 return ret_val; 525#else /* IPv6 */ 526 return -ENOSYS; 527#endif /* IPv6 */ 528} 529 530/* 531 * Security Attribute Functions 532 */ 533 534#define _CM_F_NONE 0x00000000 535#define _CM_F_ALLOC 0x00000001 536#define _CM_F_WALK 0x00000002 537 538/** 539 * _netlbl_catmap_getnode - Get a individual node from a catmap 540 * @catmap: pointer to the category bitmap 541 * @offset: the requested offset 542 * @cm_flags: catmap flags, see _CM_F_* 543 * @gfp_flags: memory allocation flags 544 * 545 * Description: 546 * Iterate through the catmap looking for the node associated with @offset. 547 * If the _CM_F_ALLOC flag is set in @cm_flags and there is no associated node, 548 * one will be created and inserted into the catmap. If the _CM_F_WALK flag is 549 * set in @cm_flags and there is no associated node, the next highest node will 550 * be returned. Returns a pointer to the node on success, NULL on failure. 551 * 552 */ 553static struct netlbl_lsm_catmap *_netlbl_catmap_getnode( 554 struct netlbl_lsm_catmap **catmap, 555 u32 offset, 556 unsigned int cm_flags, 557 gfp_t gfp_flags) 558{ 559 struct netlbl_lsm_catmap *iter = *catmap; 560 struct netlbl_lsm_catmap *prev = NULL; 561 562 if (iter == NULL) 563 goto catmap_getnode_alloc; 564 if (offset < iter->startbit) 565 goto catmap_getnode_walk; 566 while (iter && offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 567 prev = iter; 568 iter = iter->next; 569 } 570 if (iter == NULL || offset < iter->startbit) 571 goto catmap_getnode_walk; 572 573 return iter; 574 575catmap_getnode_walk: 576 if (cm_flags & _CM_F_WALK) 577 return iter; 578catmap_getnode_alloc: 579 if (!(cm_flags & _CM_F_ALLOC)) 580 return NULL; 581 582 iter = netlbl_catmap_alloc(gfp_flags); 583 if (iter == NULL) 584 return NULL; 585 iter->startbit = offset & ~(NETLBL_CATMAP_SIZE - 1); 586 587 if (prev == NULL) { 588 iter->next = *catmap; 589 *catmap = iter; 590 } else { 591 iter->next = prev->next; 592 prev->next = iter; 593 } 594 595 return iter; 596} 597 598/** 599 * netlbl_catmap_walk - Walk a LSM secattr catmap looking for a bit 600 * @catmap: the category bitmap 601 * @offset: the offset to start searching at, in bits 602 * 603 * Description: 604 * This function walks a LSM secattr category bitmap starting at @offset and 605 * returns the spot of the first set bit or -ENOENT if no bits are set. 606 * 607 */ 608int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset) 609{ 610 struct netlbl_lsm_catmap *iter; 611 u32 idx; 612 u32 bit; 613 u64 bitmap; 614 615 iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0); 616 if (iter == NULL) 617 return -ENOENT; 618 if (offset > iter->startbit) { 619 offset -= iter->startbit; 620 idx = offset / NETLBL_CATMAP_MAPSIZE; 621 bit = offset % NETLBL_CATMAP_MAPSIZE; 622 } else { 623 idx = 0; 624 bit = 0; 625 } 626 bitmap = iter->bitmap[idx] >> bit; 627 628 for (;;) { 629 if (bitmap != 0) { 630 while ((bitmap & NETLBL_CATMAP_BIT) == 0) { 631 bitmap >>= 1; 632 bit++; 633 } 634 return iter->startbit + 635 (NETLBL_CATMAP_MAPSIZE * idx) + bit; 636 } 637 if (++idx >= NETLBL_CATMAP_MAPCNT) { 638 if (iter->next != NULL) { 639 iter = iter->next; 640 idx = 0; 641 } else 642 return -ENOENT; 643 } 644 bitmap = iter->bitmap[idx]; 645 bit = 0; 646 } 647 648 return -ENOENT; 649} 650EXPORT_SYMBOL(netlbl_catmap_walk); 651 652/** 653 * netlbl_catmap_walkrng - Find the end of a string of set bits 654 * @catmap: the category bitmap 655 * @offset: the offset to start searching at, in bits 656 * 657 * Description: 658 * This function walks a LSM secattr category bitmap starting at @offset and 659 * returns the spot of the first cleared bit or -ENOENT if the offset is past 660 * the end of the bitmap. 661 * 662 */ 663int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset) 664{ 665 struct netlbl_lsm_catmap *iter; 666 struct netlbl_lsm_catmap *prev = NULL; 667 u32 idx; 668 u32 bit; 669 u64 bitmask; 670 u64 bitmap; 671 672 iter = _netlbl_catmap_getnode(&catmap, offset, _CM_F_WALK, 0); 673 if (iter == NULL) 674 return -ENOENT; 675 if (offset > iter->startbit) { 676 offset -= iter->startbit; 677 idx = offset / NETLBL_CATMAP_MAPSIZE; 678 bit = offset % NETLBL_CATMAP_MAPSIZE; 679 } else { 680 idx = 0; 681 bit = 0; 682 } 683 bitmask = NETLBL_CATMAP_BIT << bit; 684 685 for (;;) { 686 bitmap = iter->bitmap[idx]; 687 while (bitmask != 0 && (bitmap & bitmask) != 0) { 688 bitmask <<= 1; 689 bit++; 690 } 691 692 if (prev && idx == 0 && bit == 0) 693 return prev->startbit + NETLBL_CATMAP_SIZE - 1; 694 else if (bitmask != 0) 695 return iter->startbit + 696 (NETLBL_CATMAP_MAPSIZE * idx) + bit - 1; 697 else if (++idx >= NETLBL_CATMAP_MAPCNT) { 698 if (iter->next == NULL) 699 return iter->startbit + NETLBL_CATMAP_SIZE - 1; 700 prev = iter; 701 iter = iter->next; 702 idx = 0; 703 } 704 bitmask = NETLBL_CATMAP_BIT; 705 bit = 0; 706 } 707 708 return -ENOENT; 709} 710 711/** 712 * netlbl_catmap_getlong - Export an unsigned long bitmap 713 * @catmap: pointer to the category bitmap 714 * @offset: pointer to the requested offset 715 * @bitmap: the exported bitmap 716 * 717 * Description: 718 * Export a bitmap with an offset greater than or equal to @offset and return 719 * it in @bitmap. The @offset must be aligned to an unsigned long and will be 720 * updated on return if different from what was requested; if the catmap is 721 * empty at the requested offset and beyond, the @offset is set to (u32)-1. 722 * Returns zero on success, negative values on failure. 723 * 724 */ 725int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap, 726 u32 *offset, 727 unsigned long *bitmap) 728{ 729 struct netlbl_lsm_catmap *iter; 730 u32 off = *offset; 731 u32 idx; 732 733 /* only allow aligned offsets */ 734 if ((off & (BITS_PER_LONG - 1)) != 0) 735 return -EINVAL; 736 737 /* a null catmap is equivalent to an empty one */ 738 if (!catmap) { 739 *offset = (u32)-1; 740 return 0; 741 } 742 743 if (off < catmap->startbit) { 744 off = catmap->startbit; 745 *offset = off; 746 } 747 iter = _netlbl_catmap_getnode(&catmap, off, _CM_F_WALK, 0); 748 if (iter == NULL) { 749 *offset = (u32)-1; 750 return 0; 751 } 752 753 if (off < iter->startbit) { 754 *offset = iter->startbit; 755 off = 0; 756 } else 757 off -= iter->startbit; 758 idx = off / NETLBL_CATMAP_MAPSIZE; 759 *bitmap = iter->bitmap[idx] >> (off % NETLBL_CATMAP_MAPSIZE); 760 761 return 0; 762} 763 764/** 765 * netlbl_catmap_setbit - Set a bit in a LSM secattr catmap 766 * @catmap: pointer to the category bitmap 767 * @bit: the bit to set 768 * @flags: memory allocation flags 769 * 770 * Description: 771 * Set the bit specified by @bit in @catmap. Returns zero on success, 772 * negative values on failure. 773 * 774 */ 775int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, 776 u32 bit, 777 gfp_t flags) 778{ 779 struct netlbl_lsm_catmap *iter; 780 u32 idx; 781 782 iter = _netlbl_catmap_getnode(catmap, bit, _CM_F_ALLOC, flags); 783 if (iter == NULL) 784 return -ENOMEM; 785 786 bit -= iter->startbit; 787 idx = bit / NETLBL_CATMAP_MAPSIZE; 788 iter->bitmap[idx] |= NETLBL_CATMAP_BIT << (bit % NETLBL_CATMAP_MAPSIZE); 789 790 return 0; 791} 792EXPORT_SYMBOL(netlbl_catmap_setbit); 793 794/** 795 * netlbl_catmap_setrng - Set a range of bits in a LSM secattr catmap 796 * @catmap: pointer to the category bitmap 797 * @start: the starting bit 798 * @end: the last bit in the string 799 * @flags: memory allocation flags 800 * 801 * Description: 802 * Set a range of bits, starting at @start and ending with @end. Returns zero 803 * on success, negative values on failure. 804 * 805 */ 806int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap, 807 u32 start, 808 u32 end, 809 gfp_t flags) 810{ 811 int rc = 0; 812 u32 spot = start; 813 814 while (rc == 0 && spot <= end) { 815 if (((spot & (BITS_PER_LONG - 1)) == 0) && 816 ((end - spot) > BITS_PER_LONG)) { 817 rc = netlbl_catmap_setlong(catmap, 818 spot, 819 (unsigned long)-1, 820 flags); 821 spot += BITS_PER_LONG; 822 } else 823 rc = netlbl_catmap_setbit(catmap, spot++, flags); 824 } 825 826 return rc; 827} 828 829/** 830 * netlbl_catmap_setlong - Import an unsigned long bitmap 831 * @catmap: pointer to the category bitmap 832 * @offset: offset to the start of the imported bitmap 833 * @bitmap: the bitmap to import 834 * @flags: memory allocation flags 835 * 836 * Description: 837 * Import the bitmap specified in @bitmap into @catmap, using the offset 838 * in @offset. The offset must be aligned to an unsigned long. Returns zero 839 * on success, negative values on failure. 840 * 841 */ 842int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap, 843 u32 offset, 844 unsigned long bitmap, 845 gfp_t flags) 846{ 847 struct netlbl_lsm_catmap *iter; 848 u32 idx; 849 850 /* only allow aligned offsets */ 851 if ((offset & (BITS_PER_LONG - 1)) != 0) 852 return -EINVAL; 853 854 iter = _netlbl_catmap_getnode(catmap, offset, _CM_F_ALLOC, flags); 855 if (iter == NULL) 856 return -ENOMEM; 857 858 offset -= iter->startbit; 859 idx = offset / NETLBL_CATMAP_MAPSIZE; 860 iter->bitmap[idx] |= (u64)bitmap 861 << (offset % NETLBL_CATMAP_MAPSIZE); 862 863 return 0; 864} 865 866/* Bitmap functions 867 */ 868 869/** 870 * netlbl_bitmap_walk - Walk a bitmap looking for a bit 871 * @bitmap: the bitmap 872 * @bitmap_len: length in bits 873 * @offset: starting offset 874 * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit 875 * 876 * Description: 877 * Starting at @offset, walk the bitmap from left to right until either the 878 * desired bit is found or we reach the end. Return the bit offset, -1 if 879 * not found. 880 */ 881int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, 882 u32 offset, u8 state) 883{ 884 u32 bit_spot; 885 u32 byte_offset; 886 unsigned char bitmask; 887 unsigned char byte; 888 889 if (offset >= bitmap_len) 890 return -1; 891 byte_offset = offset / 8; 892 byte = bitmap[byte_offset]; 893 bit_spot = offset; 894 bitmask = 0x80 >> (offset % 8); 895 896 while (bit_spot < bitmap_len) { 897 if ((state && (byte & bitmask) == bitmask) || 898 (state == 0 && (byte & bitmask) == 0)) 899 return bit_spot; 900 901 if (++bit_spot >= bitmap_len) 902 return -1; 903 bitmask >>= 1; 904 if (bitmask == 0) { 905 byte = bitmap[++byte_offset]; 906 bitmask = 0x80; 907 } 908 } 909 910 return -1; 911} 912EXPORT_SYMBOL(netlbl_bitmap_walk); 913 914/** 915 * netlbl_bitmap_setbit - Sets a single bit in a bitmap 916 * @bitmap: the bitmap 917 * @bit: the bit 918 * @state: if non-zero, set the bit (1) else clear the bit (0) 919 * 920 * Description: 921 * Set a single bit in the bitmask. Returns zero on success, negative values 922 * on error. 923 */ 924void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state) 925{ 926 u32 byte_spot; 927 u8 bitmask; 928 929 /* gcc always rounds to zero when doing integer division */ 930 byte_spot = bit / 8; 931 bitmask = 0x80 >> (bit % 8); 932 if (state) 933 bitmap[byte_spot] |= bitmask; 934 else 935 bitmap[byte_spot] &= ~bitmask; 936} 937EXPORT_SYMBOL(netlbl_bitmap_setbit); 938 939/* 940 * LSM Functions 941 */ 942 943/** 944 * netlbl_enabled - Determine if the NetLabel subsystem is enabled 945 * 946 * Description: 947 * The LSM can use this function to determine if it should use NetLabel 948 * security attributes in it's enforcement mechanism. Currently, NetLabel is 949 * considered to be enabled when it's configuration contains a valid setup for 950 * at least one labeled protocol (i.e. NetLabel can understand incoming 951 * labeled packets of at least one type); otherwise NetLabel is considered to 952 * be disabled. 953 * 954 */ 955int netlbl_enabled(void) 956{ 957 /* At some point we probably want to expose this mechanism to the user 958 * as well so that admins can toggle NetLabel regardless of the 959 * configuration */ 960 return (atomic_read(&netlabel_mgmt_protocount) > 0); 961} 962 963/** 964 * netlbl_sock_setattr - Label a socket using the correct protocol 965 * @sk: the socket to label 966 * @family: protocol family 967 * @secattr: the security attributes 968 * 969 * Description: 970 * Attach the correct label to the given socket using the security attributes 971 * specified in @secattr. This function requires exclusive access to @sk, 972 * which means it either needs to be in the process of being created or locked. 973 * Returns zero on success, -EDESTADDRREQ if the domain is configured to use 974 * network address selectors (can't blindly label the socket), and negative 975 * values on all other failures. 976 * 977 */ 978int netlbl_sock_setattr(struct sock *sk, 979 u16 family, 980 const struct netlbl_lsm_secattr *secattr) 981{ 982 int ret_val; 983 struct netlbl_dom_map *dom_entry; 984 985 rcu_read_lock(); 986 dom_entry = netlbl_domhsh_getentry(secattr->domain, family); 987 if (dom_entry == NULL) { 988 ret_val = -ENOENT; 989 goto socket_setattr_return; 990 } 991 switch (family) { 992 case AF_INET: 993 switch (dom_entry->def.type) { 994 case NETLBL_NLTYPE_ADDRSELECT: 995 ret_val = -EDESTADDRREQ; 996 break; 997 case NETLBL_NLTYPE_CIPSOV4: 998 ret_val = cipso_v4_sock_setattr(sk, 999 dom_entry->def.cipso, 1000 secattr); 1001 break; 1002 case NETLBL_NLTYPE_UNLABELED: 1003 ret_val = 0; 1004 break; 1005 default: 1006 ret_val = -ENOENT; 1007 } 1008 break; 1009#if IS_ENABLED(CONFIG_IPV6) 1010 case AF_INET6: 1011 switch (dom_entry->def.type) { 1012 case NETLBL_NLTYPE_ADDRSELECT: 1013 ret_val = -EDESTADDRREQ; 1014 break; 1015 case NETLBL_NLTYPE_CALIPSO: 1016 ret_val = calipso_sock_setattr(sk, 1017 dom_entry->def.calipso, 1018 secattr); 1019 break; 1020 case NETLBL_NLTYPE_UNLABELED: 1021 ret_val = 0; 1022 break; 1023 default: 1024 ret_val = -ENOENT; 1025 } 1026 break; 1027#endif /* IPv6 */ 1028 default: 1029 ret_val = -EPROTONOSUPPORT; 1030 } 1031 1032socket_setattr_return: 1033 rcu_read_unlock(); 1034 return ret_val; 1035} 1036 1037/** 1038 * netlbl_sock_delattr - Delete all the NetLabel labels on a socket 1039 * @sk: the socket 1040 * 1041 * Description: 1042 * Remove all the NetLabel labeling from @sk. The caller is responsible for 1043 * ensuring that @sk is locked. 1044 * 1045 */ 1046void netlbl_sock_delattr(struct sock *sk) 1047{ 1048 switch (sk->sk_family) { 1049 case AF_INET: 1050 cipso_v4_sock_delattr(sk); 1051 break; 1052#if IS_ENABLED(CONFIG_IPV6) 1053 case AF_INET6: 1054 calipso_sock_delattr(sk); 1055 break; 1056#endif /* IPv6 */ 1057 } 1058} 1059 1060/** 1061 * netlbl_sock_getattr - Determine the security attributes of a sock 1062 * @sk: the sock 1063 * @secattr: the security attributes 1064 * 1065 * Description: 1066 * Examines the given sock to see if any NetLabel style labeling has been 1067 * applied to the sock, if so it parses the socket label and returns the 1068 * security attributes in @secattr. Returns zero on success, negative values 1069 * on failure. 1070 * 1071 */ 1072int netlbl_sock_getattr(struct sock *sk, 1073 struct netlbl_lsm_secattr *secattr) 1074{ 1075 int ret_val; 1076 1077 switch (sk->sk_family) { 1078 case AF_INET: 1079 ret_val = cipso_v4_sock_getattr(sk, secattr); 1080 break; 1081#if IS_ENABLED(CONFIG_IPV6) 1082 case AF_INET6: 1083 ret_val = calipso_sock_getattr(sk, secattr); 1084 break; 1085#endif /* IPv6 */ 1086 default: 1087 ret_val = -EPROTONOSUPPORT; 1088 } 1089 1090 return ret_val; 1091} 1092 1093/** 1094 * netlbl_conn_setattr - Label a connected socket using the correct protocol 1095 * @sk: the socket to label 1096 * @addr: the destination address 1097 * @secattr: the security attributes 1098 * 1099 * Description: 1100 * Attach the correct label to the given connected socket using the security 1101 * attributes specified in @secattr. The caller is responsible for ensuring 1102 * that @sk is locked. Returns zero on success, negative values on failure. 1103 * 1104 */ 1105int netlbl_conn_setattr(struct sock *sk, 1106 struct sockaddr *addr, 1107 const struct netlbl_lsm_secattr *secattr) 1108{ 1109 int ret_val; 1110 struct sockaddr_in *addr4; 1111#if IS_ENABLED(CONFIG_IPV6) 1112 struct sockaddr_in6 *addr6; 1113#endif 1114 struct netlbl_dommap_def *entry; 1115 1116 rcu_read_lock(); 1117 switch (addr->sa_family) { 1118 case AF_INET: 1119 addr4 = (struct sockaddr_in *)addr; 1120 entry = netlbl_domhsh_getentry_af4(secattr->domain, 1121 addr4->sin_addr.s_addr); 1122 if (entry == NULL) { 1123 ret_val = -ENOENT; 1124 goto conn_setattr_return; 1125 } 1126 switch (entry->type) { 1127 case NETLBL_NLTYPE_CIPSOV4: 1128 ret_val = cipso_v4_sock_setattr(sk, 1129 entry->cipso, secattr); 1130 break; 1131 case NETLBL_NLTYPE_UNLABELED: 1132 /* just delete the protocols we support for right now 1133 * but we could remove other protocols if needed */ 1134 netlbl_sock_delattr(sk); 1135 ret_val = 0; 1136 break; 1137 default: 1138 ret_val = -ENOENT; 1139 } 1140 break; 1141#if IS_ENABLED(CONFIG_IPV6) 1142 case AF_INET6: 1143 addr6 = (struct sockaddr_in6 *)addr; 1144 entry = netlbl_domhsh_getentry_af6(secattr->domain, 1145 &addr6->sin6_addr); 1146 if (entry == NULL) { 1147 ret_val = -ENOENT; 1148 goto conn_setattr_return; 1149 } 1150 switch (entry->type) { 1151 case NETLBL_NLTYPE_CALIPSO: 1152 ret_val = calipso_sock_setattr(sk, 1153 entry->calipso, secattr); 1154 break; 1155 case NETLBL_NLTYPE_UNLABELED: 1156 /* just delete the protocols we support for right now 1157 * but we could remove other protocols if needed */ 1158 netlbl_sock_delattr(sk); 1159 ret_val = 0; 1160 break; 1161 default: 1162 ret_val = -ENOENT; 1163 } 1164 break; 1165#endif /* IPv6 */ 1166 default: 1167 ret_val = -EPROTONOSUPPORT; 1168 } 1169 1170conn_setattr_return: 1171 rcu_read_unlock(); 1172 return ret_val; 1173} 1174 1175/** 1176 * netlbl_req_setattr - Label a request socket using the correct protocol 1177 * @req: the request socket to label 1178 * @secattr: the security attributes 1179 * 1180 * Description: 1181 * Attach the correct label to the given socket using the security attributes 1182 * specified in @secattr. Returns zero on success, negative values on failure. 1183 * 1184 */ 1185int netlbl_req_setattr(struct request_sock *req, 1186 const struct netlbl_lsm_secattr *secattr) 1187{ 1188 int ret_val; 1189 struct netlbl_dommap_def *entry; 1190 struct inet_request_sock *ireq = inet_rsk(req); 1191 1192 rcu_read_lock(); 1193 switch (req->rsk_ops->family) { 1194 case AF_INET: 1195 entry = netlbl_domhsh_getentry_af4(secattr->domain, 1196 ireq->ir_rmt_addr); 1197 if (entry == NULL) { 1198 ret_val = -ENOENT; 1199 goto req_setattr_return; 1200 } 1201 switch (entry->type) { 1202 case NETLBL_NLTYPE_CIPSOV4: 1203 ret_val = cipso_v4_req_setattr(req, 1204 entry->cipso, secattr); 1205 break; 1206 case NETLBL_NLTYPE_UNLABELED: 1207 netlbl_req_delattr(req); 1208 ret_val = 0; 1209 break; 1210 default: 1211 ret_val = -ENOENT; 1212 } 1213 break; 1214#if IS_ENABLED(CONFIG_IPV6) 1215 case AF_INET6: 1216 entry = netlbl_domhsh_getentry_af6(secattr->domain, 1217 &ireq->ir_v6_rmt_addr); 1218 if (entry == NULL) { 1219 ret_val = -ENOENT; 1220 goto req_setattr_return; 1221 } 1222 switch (entry->type) { 1223 case NETLBL_NLTYPE_CALIPSO: 1224 ret_val = calipso_req_setattr(req, 1225 entry->calipso, secattr); 1226 break; 1227 case NETLBL_NLTYPE_UNLABELED: 1228 netlbl_req_delattr(req); 1229 ret_val = 0; 1230 break; 1231 default: 1232 ret_val = -ENOENT; 1233 } 1234 break; 1235#endif /* IPv6 */ 1236 default: 1237 ret_val = -EPROTONOSUPPORT; 1238 } 1239 1240req_setattr_return: 1241 rcu_read_unlock(); 1242 return ret_val; 1243} 1244 1245/** 1246* netlbl_req_delattr - Delete all the NetLabel labels on a socket 1247* @req: the socket 1248* 1249* Description: 1250* Remove all the NetLabel labeling from @req. 1251* 1252*/ 1253void netlbl_req_delattr(struct request_sock *req) 1254{ 1255 switch (req->rsk_ops->family) { 1256 case AF_INET: 1257 cipso_v4_req_delattr(req); 1258 break; 1259#if IS_ENABLED(CONFIG_IPV6) 1260 case AF_INET6: 1261 calipso_req_delattr(req); 1262 break; 1263#endif /* IPv6 */ 1264 } 1265} 1266 1267/** 1268 * netlbl_skbuff_setattr - Label a packet using the correct protocol 1269 * @skb: the packet 1270 * @family: protocol family 1271 * @secattr: the security attributes 1272 * 1273 * Description: 1274 * Attach the correct label to the given packet using the security attributes 1275 * specified in @secattr. Returns zero on success, negative values on failure. 1276 * 1277 */ 1278int netlbl_skbuff_setattr(struct sk_buff *skb, 1279 u16 family, 1280 const struct netlbl_lsm_secattr *secattr) 1281{ 1282 int ret_val; 1283 struct iphdr *hdr4; 1284#if IS_ENABLED(CONFIG_IPV6) 1285 struct ipv6hdr *hdr6; 1286#endif 1287 struct netlbl_dommap_def *entry; 1288 1289 rcu_read_lock(); 1290 switch (family) { 1291 case AF_INET: 1292 hdr4 = ip_hdr(skb); 1293 entry = netlbl_domhsh_getentry_af4(secattr->domain, 1294 hdr4->daddr); 1295 if (entry == NULL) { 1296 ret_val = -ENOENT; 1297 goto skbuff_setattr_return; 1298 } 1299 switch (entry->type) { 1300 case NETLBL_NLTYPE_CIPSOV4: 1301 ret_val = cipso_v4_skbuff_setattr(skb, entry->cipso, 1302 secattr); 1303 break; 1304 case NETLBL_NLTYPE_UNLABELED: 1305 /* just delete the protocols we support for right now 1306 * but we could remove other protocols if needed */ 1307 ret_val = cipso_v4_skbuff_delattr(skb); 1308 break; 1309 default: 1310 ret_val = -ENOENT; 1311 } 1312 break; 1313#if IS_ENABLED(CONFIG_IPV6) 1314 case AF_INET6: 1315 hdr6 = ipv6_hdr(skb); 1316 entry = netlbl_domhsh_getentry_af6(secattr->domain, 1317 &hdr6->daddr); 1318 if (entry == NULL) { 1319 ret_val = -ENOENT; 1320 goto skbuff_setattr_return; 1321 } 1322 switch (entry->type) { 1323 case NETLBL_NLTYPE_CALIPSO: 1324 ret_val = calipso_skbuff_setattr(skb, entry->calipso, 1325 secattr); 1326 break; 1327 case NETLBL_NLTYPE_UNLABELED: 1328 /* just delete the protocols we support for right now 1329 * but we could remove other protocols if needed */ 1330 ret_val = calipso_skbuff_delattr(skb); 1331 break; 1332 default: 1333 ret_val = -ENOENT; 1334 } 1335 break; 1336#endif /* IPv6 */ 1337 default: 1338 ret_val = -EPROTONOSUPPORT; 1339 } 1340 1341skbuff_setattr_return: 1342 rcu_read_unlock(); 1343 return ret_val; 1344} 1345 1346/** 1347 * netlbl_skbuff_getattr - Determine the security attributes of a packet 1348 * @skb: the packet 1349 * @family: protocol family 1350 * @secattr: the security attributes 1351 * 1352 * Description: 1353 * Examines the given packet to see if a recognized form of packet labeling 1354 * is present, if so it parses the packet label and returns the security 1355 * attributes in @secattr. Returns zero on success, negative values on 1356 * failure. 1357 * 1358 */ 1359int netlbl_skbuff_getattr(const struct sk_buff *skb, 1360 u16 family, 1361 struct netlbl_lsm_secattr *secattr) 1362{ 1363 unsigned char *ptr; 1364 1365 switch (family) { 1366 case AF_INET: 1367 ptr = cipso_v4_optptr(skb); 1368 if (ptr && cipso_v4_getattr(ptr, secattr) == 0) 1369 return 0; 1370 break; 1371#if IS_ENABLED(CONFIG_IPV6) 1372 case AF_INET6: 1373 ptr = calipso_optptr(skb); 1374 if (ptr && calipso_getattr(ptr, secattr) == 0) 1375 return 0; 1376 break; 1377#endif /* IPv6 */ 1378 } 1379 1380 return netlbl_unlabel_getattr(skb, family, secattr); 1381} 1382 1383/** 1384 * netlbl_skbuff_err - Handle a LSM error on a sk_buff 1385 * @skb: the packet 1386 * @family: the family 1387 * @error: the error code 1388 * @gateway: true if host is acting as a gateway, false otherwise 1389 * 1390 * Description: 1391 * Deal with a LSM problem when handling the packet in @skb, typically this is 1392 * a permission denied problem (-EACCES). The correct action is determined 1393 * according to the packet's labeling protocol. 1394 * 1395 */ 1396void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway) 1397{ 1398 switch (family) { 1399 case AF_INET: 1400 if (cipso_v4_optptr(skb)) 1401 cipso_v4_error(skb, error, gateway); 1402 break; 1403 } 1404} 1405 1406/** 1407 * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches 1408 * 1409 * Description: 1410 * For all of the NetLabel protocols that support some form of label mapping 1411 * cache, invalidate the cache. Returns zero on success, negative values on 1412 * error. 1413 * 1414 */ 1415void netlbl_cache_invalidate(void) 1416{ 1417 cipso_v4_cache_invalidate(); 1418#if IS_ENABLED(CONFIG_IPV6) 1419 calipso_cache_invalidate(); 1420#endif /* IPv6 */ 1421} 1422 1423/** 1424 * netlbl_cache_add - Add an entry to a NetLabel protocol cache 1425 * @skb: the packet 1426 * @family: the family 1427 * @secattr: the packet's security attributes 1428 * 1429 * Description: 1430 * Add the LSM security attributes for the given packet to the underlying 1431 * NetLabel protocol's label mapping cache. Returns zero on success, negative 1432 * values on error. 1433 * 1434 */ 1435int netlbl_cache_add(const struct sk_buff *skb, u16 family, 1436 const struct netlbl_lsm_secattr *secattr) 1437{ 1438 unsigned char *ptr; 1439 1440 if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0) 1441 return -ENOMSG; 1442 1443 switch (family) { 1444 case AF_INET: 1445 ptr = cipso_v4_optptr(skb); 1446 if (ptr) 1447 return cipso_v4_cache_add(ptr, secattr); 1448 break; 1449#if IS_ENABLED(CONFIG_IPV6) 1450 case AF_INET6: 1451 ptr = calipso_optptr(skb); 1452 if (ptr) 1453 return calipso_cache_add(ptr, secattr); 1454 break; 1455#endif /* IPv6 */ 1456 } 1457 return -ENOMSG; 1458} 1459 1460/* 1461 * Protocol Engine Functions 1462 */ 1463 1464/** 1465 * netlbl_audit_start - Start an audit message 1466 * @type: audit message type 1467 * @audit_info: NetLabel audit information 1468 * 1469 * Description: 1470 * Start an audit message using the type specified in @type and fill the audit 1471 * message with some fields common to all NetLabel audit messages. This 1472 * function should only be used by protocol engines, not LSMs. Returns a 1473 * pointer to the audit buffer on success, NULL on failure. 1474 * 1475 */ 1476struct audit_buffer *netlbl_audit_start(int type, 1477 struct netlbl_audit *audit_info) 1478{ 1479 return netlbl_audit_start_common(type, audit_info); 1480} 1481EXPORT_SYMBOL(netlbl_audit_start); 1482 1483/* 1484 * Setup Functions 1485 */ 1486 1487/** 1488 * netlbl_init - Initialize NetLabel 1489 * 1490 * Description: 1491 * Perform the required NetLabel initialization before first use. 1492 * 1493 */ 1494static int __init netlbl_init(void) 1495{ 1496 int ret_val; 1497 1498 printk(KERN_INFO "NetLabel: Initializing\n"); 1499 printk(KERN_INFO "NetLabel: domain hash size = %u\n", 1500 (1 << NETLBL_DOMHSH_BITSIZE)); 1501 printk(KERN_INFO "NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO\n"); 1502 1503 ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE); 1504 if (ret_val != 0) 1505 goto init_failure; 1506 1507 ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE); 1508 if (ret_val != 0) 1509 goto init_failure; 1510 1511 ret_val = netlbl_netlink_init(); 1512 if (ret_val != 0) 1513 goto init_failure; 1514 1515 ret_val = netlbl_unlabel_defconf(); 1516 if (ret_val != 0) 1517 goto init_failure; 1518 printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n"); 1519 1520 return 0; 1521 1522init_failure: 1523 panic("NetLabel: failed to initialize properly (%d)\n", ret_val); 1524} 1525 1526subsys_initcall(netlbl_init); 1527