2 * NetLabel Unlabeled Support
4 * This file defines functions for dealing with unlabeled packets for the
5 * NetLabel system. The NetLabel system manages static and dynamic label
6 * mappings for network protocols such as CIPSO and RIPSO.
8 * Author: Paul Moore <paul.moore@hp.com>
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 #include <linux/types.h>
32 #include <linux/rcupdate.h>
33 #include <linux/list.h>
34 #include <linux/spinlock.h>
35 #include <linux/socket.h>
36 #include <linux/string.h>
37 #include <linux/skbuff.h>
38 #include <linux/audit.h>
40 #include <linux/in6.h>
42 #include <linux/ipv6.h>
43 #include <linux/notifier.h>
44 #include <linux/netdevice.h>
45 #include <linux/security.h>
46 #include <linux/slab.h>
48 #include <net/netlink.h>
49 #include <net/genetlink.h>
52 #include <net/net_namespace.h>
53 #include <net/netlabel.h>
55 #include <asm/atomic.h>
57 #include "netlabel_user.h"
58 #include "netlabel_addrlist.h"
59 #include "netlabel_domainhash.h"
60 #include "netlabel_unlabeled.h"
61 #include "netlabel_mgmt.h"
63 /* NOTE: at present we always use init's network namespace since we don't
64 * presently support different namespaces even though the majority of
65 * the functions in this file are "namespace safe" */
67 /* The unlabeled connection hash table which we use to map network interfaces
68 * and addresses of unlabeled packets to a user specified secid value for the
69 * LSM. The hash table is used to lookup the network interface entry
70 * (struct netlbl_unlhsh_iface) and then the interface entry is used to
71 * lookup an IP address match from an ordered list. If a network interface
72 * match can not be found in the hash table then the default entry
73 * (netlbl_unlhsh_def) is used. The IP address entry list
74 * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
75 * larger netmask come first.
77 struct netlbl_unlhsh_tbl {
78 struct list_head *tbl;
81 #define netlbl_unlhsh_addr4_entry(iter) \
82 container_of(iter, struct netlbl_unlhsh_addr4, list)
83 struct netlbl_unlhsh_addr4 {
86 struct netlbl_af4list list;
89 #define netlbl_unlhsh_addr6_entry(iter) \
90 container_of(iter, struct netlbl_unlhsh_addr6, list)
91 struct netlbl_unlhsh_addr6 {
94 struct netlbl_af6list list;
97 struct netlbl_unlhsh_iface {
99 struct list_head addr4_list;
100 struct list_head addr6_list;
103 struct list_head list;
107 /* Argument struct for netlbl_unlhsh_walk() */
108 struct netlbl_unlhsh_walk_arg {
109 struct netlink_callback *nl_cb;
114 /* Unlabeled connection hash table */
115 /* updates should be so rare that having one spinlock for the entire
116 * hash table should be okay */
117 static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
118 static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL;
119 static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL;
121 /* Accept unlabeled packets flag */
122 static u8 netlabel_unlabel_acceptflg = 0;
124 /* NetLabel Generic NETLINK unlabeled family */
125 static struct genl_family netlbl_unlabel_gnl_family = {
126 .id = GENL_ID_GENERATE,
128 .name = NETLBL_NLTYPE_UNLABELED_NAME,
129 .version = NETLBL_PROTO_VERSION,
130 .maxattr = NLBL_UNLABEL_A_MAX,
133 /* NetLabel Netlink attribute policy */
134 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
135 [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
136 [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
137 .len = sizeof(struct in6_addr) },
138 [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
139 .len = sizeof(struct in6_addr) },
140 [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
141 .len = sizeof(struct in_addr) },
142 [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
143 .len = sizeof(struct in_addr) },
144 [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
145 .len = IFNAMSIZ - 1 },
146 [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
150 * Unlabeled Connection Hash Table Functions
154 * netlbl_unlhsh_free_addr4 - Frees an IPv4 address entry from the hash table
155 * @entry: the entry's RCU field
158 * This function is designed to be used as a callback to the call_rcu()
159 * function so that memory allocated to a hash table address entry can be
163 static void netlbl_unlhsh_free_addr4(struct rcu_head *entry)
165 struct netlbl_unlhsh_addr4 *ptr;
167 ptr = container_of(entry, struct netlbl_unlhsh_addr4, rcu);
171 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
173 * netlbl_unlhsh_free_addr6 - Frees an IPv6 address entry from the hash table
174 * @entry: the entry's RCU field
177 * This function is designed to be used as a callback to the call_rcu()
178 * function so that memory allocated to a hash table address entry can be
182 static void netlbl_unlhsh_free_addr6(struct rcu_head *entry)
184 struct netlbl_unlhsh_addr6 *ptr;
186 ptr = container_of(entry, struct netlbl_unlhsh_addr6, rcu);
192 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
193 * @entry: the entry's RCU field
196 * This function is designed to be used as a callback to the call_rcu()
197 * function so that memory allocated to a hash table interface entry can be
198 * released safely. It is important to note that this function does not free
199 * the IPv4 and IPv6 address lists contained as part of an interface entry. It
200 * is up to the rest of the code to make sure an interface entry is only freed
201 * once it's address lists are empty.
204 static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
206 struct netlbl_unlhsh_iface *iface;
207 struct netlbl_af4list *iter4;
208 struct netlbl_af4list *tmp4;
209 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
210 struct netlbl_af6list *iter6;
211 struct netlbl_af6list *tmp6;
214 iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
216 /* no need for locks here since we are the only one with access to this
219 netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
220 netlbl_af4list_remove_entry(iter4);
221 kfree(netlbl_unlhsh_addr4_entry(iter4));
223 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
224 netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
225 netlbl_af6list_remove_entry(iter6);
226 kfree(netlbl_unlhsh_addr6_entry(iter6));
233 * netlbl_unlhsh_hash - Hashing function for the hash table
234 * @ifindex: the network interface/device to hash
237 * This is the hashing function for the unlabeled hash table, it returns the
238 * bucket number for the given device/interface. The caller is responsible for
239 * calling the rcu_read_[un]lock() functions.
242 static u32 netlbl_unlhsh_hash(int ifindex)
244 /* this is taken _almost_ directly from
245 * security/selinux/netif.c:sel_netif_hasfn() as they do pretty much
247 return ifindex & (rcu_dereference(netlbl_unlhsh)->size - 1);
251 * netlbl_unlhsh_search_iface - Search for a matching interface entry
252 * @ifindex: the network interface
255 * Searches the unlabeled connection hash table and returns a pointer to the
256 * interface entry which matches @ifindex, otherwise NULL is returned. The
257 * caller is responsible for calling the rcu_read_[un]lock() functions.
260 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
263 struct list_head *bkt_list;
264 struct netlbl_unlhsh_iface *iter;
266 bkt = netlbl_unlhsh_hash(ifindex);
267 bkt_list = &rcu_dereference(netlbl_unlhsh)->tbl[bkt];
268 list_for_each_entry_rcu(iter, bkt_list, list)
269 if (iter->valid && iter->ifindex == ifindex)
276 * netlbl_unlhsh_search_iface_def - Search for a matching interface entry
277 * @ifindex: the network interface
280 * Searches the unlabeled connection hash table and returns a pointer to the
281 * interface entry which matches @ifindex. If an exact match can not be found
282 * and there is a valid default entry, the default entry is returned, otherwise
283 * NULL is returned. The caller is responsible for calling the
284 * rcu_read_[un]lock() functions.
287 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface_def(int ifindex)
289 struct netlbl_unlhsh_iface *entry;
291 entry = netlbl_unlhsh_search_iface(ifindex);
295 entry = rcu_dereference(netlbl_unlhsh_def);
296 if (entry != NULL && entry->valid)
303 * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
304 * @iface: the associated interface entry
305 * @addr: IPv4 address in network byte order
306 * @mask: IPv4 address mask in network byte order
307 * @secid: LSM secid value for entry
310 * Add a new address entry into the unlabeled connection hash table using the
311 * interface entry specified by @iface. On success zero is returned, otherwise
312 * a negative value is returned. The caller is responsible for calling the
313 * rcu_read_[un]lock() functions.
316 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
317 const struct in_addr *addr,
318 const struct in_addr *mask,
322 struct netlbl_unlhsh_addr4 *entry;
324 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
328 entry->list.addr = addr->s_addr & mask->s_addr;
329 entry->list.mask = mask->s_addr;
330 entry->list.valid = 1;
331 entry->secid = secid;
333 spin_lock(&netlbl_unlhsh_lock);
334 ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
335 spin_unlock(&netlbl_unlhsh_lock);
342 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
344 * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
345 * @iface: the associated interface entry
346 * @addr: IPv6 address in network byte order
347 * @mask: IPv6 address mask in network byte order
348 * @secid: LSM secid value for entry
351 * Add a new address entry into the unlabeled connection hash table using the
352 * interface entry specified by @iface. On success zero is returned, otherwise
353 * a negative value is returned. The caller is responsible for calling the
354 * rcu_read_[un]lock() functions.
357 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
358 const struct in6_addr *addr,
359 const struct in6_addr *mask,
363 struct netlbl_unlhsh_addr6 *entry;
365 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
369 ipv6_addr_copy(&entry->list.addr, addr);
370 entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
371 entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
372 entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
373 entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
374 ipv6_addr_copy(&entry->list.mask, mask);
375 entry->list.valid = 1;
376 entry->secid = secid;
378 spin_lock(&netlbl_unlhsh_lock);
379 ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
380 spin_unlock(&netlbl_unlhsh_lock);
389 * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
390 * @ifindex: network interface
393 * Add a new, empty, interface entry into the unlabeled connection hash table.
394 * On success a pointer to the new interface entry is returned, on failure NULL
395 * is returned. The caller is responsible for calling the rcu_read_[un]lock()
399 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
402 struct netlbl_unlhsh_iface *iface;
404 iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
408 iface->ifindex = ifindex;
409 INIT_LIST_HEAD(&iface->addr4_list);
410 INIT_LIST_HEAD(&iface->addr6_list);
413 spin_lock(&netlbl_unlhsh_lock);
415 bkt = netlbl_unlhsh_hash(ifindex);
416 if (netlbl_unlhsh_search_iface(ifindex) != NULL)
417 goto add_iface_failure;
418 list_add_tail_rcu(&iface->list,
419 &rcu_dereference(netlbl_unlhsh)->tbl[bkt]);
421 INIT_LIST_HEAD(&iface->list);
422 if (rcu_dereference(netlbl_unlhsh_def) != NULL)
423 goto add_iface_failure;
424 rcu_assign_pointer(netlbl_unlhsh_def, iface);
426 spin_unlock(&netlbl_unlhsh_lock);
431 spin_unlock(&netlbl_unlhsh_lock);
437 * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
438 * @net: network namespace
439 * @dev_name: interface name
440 * @addr: IP address in network byte order
441 * @mask: address mask in network byte order
442 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
443 * @secid: LSM secid value for the entry
444 * @audit_info: NetLabel audit information
447 * Adds a new entry to the unlabeled connection hash table. Returns zero on
448 * success, negative values on failure.
451 int netlbl_unlhsh_add(struct net *net,
452 const char *dev_name,
457 struct netlbl_audit *audit_info)
461 struct net_device *dev;
462 struct netlbl_unlhsh_iface *iface;
463 struct audit_buffer *audit_buf = NULL;
467 if (addr_len != sizeof(struct in_addr) &&
468 addr_len != sizeof(struct in6_addr))
472 if (dev_name != NULL) {
473 dev = dev_get_by_name_rcu(net, dev_name);
476 goto unlhsh_add_return;
478 ifindex = dev->ifindex;
479 iface = netlbl_unlhsh_search_iface(ifindex);
482 iface = rcu_dereference(netlbl_unlhsh_def);
485 iface = netlbl_unlhsh_add_iface(ifindex);
488 goto unlhsh_add_return;
491 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
494 case sizeof(struct in_addr): {
495 struct in_addr *addr4, *mask4;
497 addr4 = (struct in_addr *)addr;
498 mask4 = (struct in_addr *)mask;
499 ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
500 if (audit_buf != NULL)
501 netlbl_af4list_audit_addr(audit_buf, 1,
507 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
508 case sizeof(struct in6_addr): {
509 struct in6_addr *addr6, *mask6;
511 addr6 = (struct in6_addr *)addr;
512 mask6 = (struct in6_addr *)mask;
513 ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
514 if (audit_buf != NULL)
515 netlbl_af6list_audit_addr(audit_buf, 1,
525 atomic_inc(&netlabel_mgmt_protocount);
529 if (audit_buf != NULL) {
530 if (security_secid_to_secctx(secid,
533 audit_log_format(audit_buf, " sec_obj=%s", secctx);
534 security_release_secctx(secctx, secctx_len);
536 audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
537 audit_log_end(audit_buf);
543 * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
544 * @net: network namespace
545 * @iface: interface entry
547 * @mask: IP address mask
548 * @audit_info: NetLabel audit information
551 * Remove an IP address entry from the unlabeled connection hash table.
552 * Returns zero on success, negative values on failure. The caller is
553 * responsible for calling the rcu_read_[un]lock() functions.
556 static int netlbl_unlhsh_remove_addr4(struct net *net,
557 struct netlbl_unlhsh_iface *iface,
558 const struct in_addr *addr,
559 const struct in_addr *mask,
560 struct netlbl_audit *audit_info)
562 struct netlbl_af4list *list_entry;
563 struct netlbl_unlhsh_addr4 *entry;
564 struct audit_buffer *audit_buf;
565 struct net_device *dev;
569 spin_lock(&netlbl_unlhsh_lock);
570 list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
572 spin_unlock(&netlbl_unlhsh_lock);
573 if (list_entry != NULL)
574 entry = netlbl_unlhsh_addr4_entry(list_entry);
578 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
580 if (audit_buf != NULL) {
581 dev = dev_get_by_index(net, iface->ifindex);
582 netlbl_af4list_audit_addr(audit_buf, 1,
583 (dev != NULL ? dev->name : NULL),
584 addr->s_addr, mask->s_addr);
588 security_secid_to_secctx(entry->secid,
589 &secctx, &secctx_len) == 0) {
590 audit_log_format(audit_buf, " sec_obj=%s", secctx);
591 security_release_secctx(secctx, secctx_len);
593 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
594 audit_log_end(audit_buf);
600 call_rcu(&entry->rcu, netlbl_unlhsh_free_addr4);
604 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
606 * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
607 * @net: network namespace
608 * @iface: interface entry
610 * @mask: IP address mask
611 * @audit_info: NetLabel audit information
614 * Remove an IP address entry from the unlabeled connection hash table.
615 * Returns zero on success, negative values on failure. The caller is
616 * responsible for calling the rcu_read_[un]lock() functions.
619 static int netlbl_unlhsh_remove_addr6(struct net *net,
620 struct netlbl_unlhsh_iface *iface,
621 const struct in6_addr *addr,
622 const struct in6_addr *mask,
623 struct netlbl_audit *audit_info)
625 struct netlbl_af6list *list_entry;
626 struct netlbl_unlhsh_addr6 *entry;
627 struct audit_buffer *audit_buf;
628 struct net_device *dev;
632 spin_lock(&netlbl_unlhsh_lock);
633 list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
634 spin_unlock(&netlbl_unlhsh_lock);
635 if (list_entry != NULL)
636 entry = netlbl_unlhsh_addr6_entry(list_entry);
640 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
642 if (audit_buf != NULL) {
643 dev = dev_get_by_index(net, iface->ifindex);
644 netlbl_af6list_audit_addr(audit_buf, 1,
645 (dev != NULL ? dev->name : NULL),
650 security_secid_to_secctx(entry->secid,
651 &secctx, &secctx_len) == 0) {
652 audit_log_format(audit_buf, " sec_obj=%s", secctx);
653 security_release_secctx(secctx, secctx_len);
655 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
656 audit_log_end(audit_buf);
662 call_rcu(&entry->rcu, netlbl_unlhsh_free_addr6);
668 * netlbl_unlhsh_condremove_iface - Remove an interface entry
669 * @iface: the interface entry
672 * Remove an interface entry from the unlabeled connection hash table if it is
673 * empty. An interface entry is considered to be empty if there are no
674 * address entries assigned to it.
677 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
679 struct netlbl_af4list *iter4;
680 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
681 struct netlbl_af6list *iter6;
684 spin_lock(&netlbl_unlhsh_lock);
685 netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
686 goto unlhsh_condremove_failure;
687 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
688 netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
689 goto unlhsh_condremove_failure;
692 if (iface->ifindex > 0)
693 list_del_rcu(&iface->list);
695 rcu_assign_pointer(netlbl_unlhsh_def, NULL);
696 spin_unlock(&netlbl_unlhsh_lock);
698 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
701 unlhsh_condremove_failure:
702 spin_unlock(&netlbl_unlhsh_lock);
707 * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
708 * @net: network namespace
709 * @dev_name: interface name
710 * @addr: IP address in network byte order
711 * @mask: address mask in network byte order
712 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
713 * @audit_info: NetLabel audit information
716 * Removes and existing entry from the unlabeled connection hash table.
717 * Returns zero on success, negative values on failure.
720 int netlbl_unlhsh_remove(struct net *net,
721 const char *dev_name,
725 struct netlbl_audit *audit_info)
728 struct net_device *dev;
729 struct netlbl_unlhsh_iface *iface;
731 if (addr_len != sizeof(struct in_addr) &&
732 addr_len != sizeof(struct in6_addr))
736 if (dev_name != NULL) {
737 dev = dev_get_by_name_rcu(net, dev_name);
740 goto unlhsh_remove_return;
742 iface = netlbl_unlhsh_search_iface(dev->ifindex);
744 iface = rcu_dereference(netlbl_unlhsh_def);
747 goto unlhsh_remove_return;
750 case sizeof(struct in_addr):
751 ret_val = netlbl_unlhsh_remove_addr4(net,
755 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
756 case sizeof(struct in6_addr):
757 ret_val = netlbl_unlhsh_remove_addr6(net,
766 netlbl_unlhsh_condremove_iface(iface);
767 atomic_dec(&netlabel_mgmt_protocount);
770 unlhsh_remove_return:
776 * General Helper Functions
780 * netlbl_unlhsh_netdev_handler - Network device notification handler
781 * @this: notifier block
783 * @ptr: the network device (cast to void)
786 * Handle network device events, although at present all we care about is a
787 * network device going away. In the case of a device going away we clear any
788 * related entries from the unlabeled connection hash table.
791 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
795 struct net_device *dev = ptr;
796 struct netlbl_unlhsh_iface *iface = NULL;
798 if (!net_eq(dev_net(dev), &init_net))
801 /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
802 if (event == NETDEV_DOWN) {
803 spin_lock(&netlbl_unlhsh_lock);
804 iface = netlbl_unlhsh_search_iface(dev->ifindex);
805 if (iface != NULL && iface->valid) {
807 list_del_rcu(&iface->list);
810 spin_unlock(&netlbl_unlhsh_lock);
814 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
820 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
821 * @value: desired value
822 * @audit_info: NetLabel audit information
825 * Set the value of the unlabeled accept flag to @value.
828 static void netlbl_unlabel_acceptflg_set(u8 value,
829 struct netlbl_audit *audit_info)
831 struct audit_buffer *audit_buf;
834 old_val = netlabel_unlabel_acceptflg;
835 netlabel_unlabel_acceptflg = value;
836 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
838 if (audit_buf != NULL) {
839 audit_log_format(audit_buf,
840 " unlbl_accept=%u old=%u", value, old_val);
841 audit_log_end(audit_buf);
846 * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
847 * @info: the Generic NETLINK info block
848 * @addr: the IP address
849 * @mask: the IP address mask
850 * @len: the address length
853 * Examine the Generic NETLINK message and extract the IP address information.
854 * Returns zero on success, negative values on failure.
857 static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
864 if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) {
865 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
866 if (addr_len != sizeof(struct in_addr) &&
867 addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
870 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
871 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
873 } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
874 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
875 if (addr_len != sizeof(struct in6_addr) &&
876 addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
879 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
880 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
888 * NetLabel Command Handlers
892 * netlbl_unlabel_accept - Handle an ACCEPT message
893 * @skb: the NETLINK buffer
894 * @info: the Generic NETLINK info block
897 * Process a user generated ACCEPT message and set the accept flag accordingly.
898 * Returns zero on success, negative values on failure.
901 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
904 struct netlbl_audit audit_info;
906 if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
907 value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
908 if (value == 1 || value == 0) {
909 netlbl_netlink_auditinfo(skb, &audit_info);
910 netlbl_unlabel_acceptflg_set(value, &audit_info);
919 * netlbl_unlabel_list - Handle a LIST message
920 * @skb: the NETLINK buffer
921 * @info: the Generic NETLINK info block
924 * Process a user generated LIST message and respond with the current status.
925 * Returns zero on success, negative values on failure.
928 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
930 int ret_val = -EINVAL;
931 struct sk_buff *ans_skb;
934 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
937 data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
938 0, NLBL_UNLABEL_C_LIST);
944 ret_val = nla_put_u8(ans_skb,
945 NLBL_UNLABEL_A_ACPTFLG,
946 netlabel_unlabel_acceptflg);
950 genlmsg_end(ans_skb, data);
951 return genlmsg_reply(ans_skb, info);
959 * netlbl_unlabel_staticadd - Handle a STATICADD message
960 * @skb: the NETLINK buffer
961 * @info: the Generic NETLINK info block
964 * Process a user generated STATICADD message and add a new unlabeled
965 * connection entry to the hash table. Returns zero on success, negative
969 static int netlbl_unlabel_staticadd(struct sk_buff *skb,
970 struct genl_info *info)
978 struct netlbl_audit audit_info;
980 /* Don't allow users to add both IPv4 and IPv6 addresses for a
981 * single entry. However, allow users to create two entries, one each
982 * for IPv4 and IPv4, with the same LSM security context which should
983 * achieve the same result. */
984 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
985 !info->attrs[NLBL_UNLABEL_A_IFACE] ||
986 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
987 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
988 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
989 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
992 netlbl_netlink_auditinfo(skb, &audit_info);
994 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
997 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
998 ret_val = security_secctx_to_secid(
999 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1000 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1005 return netlbl_unlhsh_add(&init_net,
1006 dev_name, addr, mask, addr_len, secid,
1011 * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
1012 * @skb: the NETLINK buffer
1013 * @info: the Generic NETLINK info block
1016 * Process a user generated STATICADDDEF message and add a new default
1017 * unlabeled connection entry. Returns zero on success, negative values on
1021 static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
1022 struct genl_info *info)
1029 struct netlbl_audit audit_info;
1031 /* Don't allow users to add both IPv4 and IPv6 addresses for a
1032 * single entry. However, allow users to create two entries, one each
1033 * for IPv4 and IPv6, with the same LSM security context which should
1034 * achieve the same result. */
1035 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
1036 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1037 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1038 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1039 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1042 netlbl_netlink_auditinfo(skb, &audit_info);
1044 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1047 ret_val = security_secctx_to_secid(
1048 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1049 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
1054 return netlbl_unlhsh_add(&init_net,
1055 NULL, addr, mask, addr_len, secid,
1060 * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
1061 * @skb: the NETLINK buffer
1062 * @info: the Generic NETLINK info block
1065 * Process a user generated STATICREMOVE message and remove the specified
1066 * unlabeled connection entry. Returns zero on success, negative values on
1070 static int netlbl_unlabel_staticremove(struct sk_buff *skb,
1071 struct genl_info *info)
1078 struct netlbl_audit audit_info;
1080 /* See the note in netlbl_unlabel_staticadd() about not allowing both
1081 * IPv4 and IPv6 in the same entry. */
1082 if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
1083 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1084 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1085 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1086 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1089 netlbl_netlink_auditinfo(skb, &audit_info);
1091 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1094 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
1096 return netlbl_unlhsh_remove(&init_net,
1097 dev_name, addr, mask, addr_len,
1102 * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1103 * @skb: the NETLINK buffer
1104 * @info: the Generic NETLINK info block
1107 * Process a user generated STATICREMOVEDEF message and remove the default
1108 * unlabeled connection entry. Returns zero on success, negative values on
1112 static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
1113 struct genl_info *info)
1119 struct netlbl_audit audit_info;
1121 /* See the note in netlbl_unlabel_staticadd() about not allowing both
1122 * IPv4 and IPv6 in the same entry. */
1123 if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1124 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1125 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1126 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1129 netlbl_netlink_auditinfo(skb, &audit_info);
1131 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1135 return netlbl_unlhsh_remove(&init_net,
1136 NULL, addr, mask, addr_len,
1142 * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1143 * @cmd: command/message
1144 * @iface: the interface entry
1145 * @addr4: the IPv4 address entry
1146 * @addr6: the IPv6 address entry
1147 * @arg: the netlbl_unlhsh_walk_arg structure
1150 * This function is designed to be used to generate a response for a
1151 * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6
1152 * can be specified, not both, the other unspecified entry should be set to
1153 * NULL by the caller. Returns the size of the message on success, negative
1154 * values on failure.
1157 static int netlbl_unlabel_staticlist_gen(u32 cmd,
1158 const struct netlbl_unlhsh_iface *iface,
1159 const struct netlbl_unlhsh_addr4 *addr4,
1160 const struct netlbl_unlhsh_addr6 *addr6,
1163 int ret_val = -ENOMEM;
1164 struct netlbl_unlhsh_walk_arg *cb_arg = arg;
1165 struct net_device *dev;
1171 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
1172 cb_arg->seq, &netlbl_unlabel_gnl_family,
1175 goto list_cb_failure;
1177 if (iface->ifindex > 0) {
1178 dev = dev_get_by_index(&init_net, iface->ifindex);
1181 goto list_cb_failure;
1183 ret_val = nla_put_string(cb_arg->skb,
1184 NLBL_UNLABEL_A_IFACE, dev->name);
1187 goto list_cb_failure;
1191 struct in_addr addr_struct;
1193 addr_struct.s_addr = addr4->list.addr;
1194 ret_val = nla_put(cb_arg->skb,
1195 NLBL_UNLABEL_A_IPV4ADDR,
1196 sizeof(struct in_addr),
1199 goto list_cb_failure;
1201 addr_struct.s_addr = addr4->list.mask;
1202 ret_val = nla_put(cb_arg->skb,
1203 NLBL_UNLABEL_A_IPV4MASK,
1204 sizeof(struct in_addr),
1207 goto list_cb_failure;
1209 secid = addr4->secid;
1211 ret_val = nla_put(cb_arg->skb,
1212 NLBL_UNLABEL_A_IPV6ADDR,
1213 sizeof(struct in6_addr),
1216 goto list_cb_failure;
1218 ret_val = nla_put(cb_arg->skb,
1219 NLBL_UNLABEL_A_IPV6MASK,
1220 sizeof(struct in6_addr),
1223 goto list_cb_failure;
1225 secid = addr6->secid;
1228 ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
1230 goto list_cb_failure;
1231 ret_val = nla_put(cb_arg->skb,
1232 NLBL_UNLABEL_A_SECCTX,
1235 security_release_secctx(secctx, secctx_len);
1237 goto list_cb_failure;
1240 return genlmsg_end(cb_arg->skb, data);
1243 genlmsg_cancel(cb_arg->skb, data);
1248 * netlbl_unlabel_staticlist - Handle a STATICLIST message
1249 * @skb: the NETLINK buffer
1250 * @cb: the NETLINK callback
1253 * Process a user generated STATICLIST message and dump the unlabeled
1254 * connection hash table in a form suitable for use in a kernel generated
1255 * STATICLIST message. Returns the length of @skb.
1258 static int netlbl_unlabel_staticlist(struct sk_buff *skb,
1259 struct netlink_callback *cb)
1261 struct netlbl_unlhsh_walk_arg cb_arg;
1262 u32 skip_bkt = cb->args[0];
1263 u32 skip_chain = cb->args[1];
1264 u32 skip_addr4 = cb->args[2];
1265 u32 skip_addr6 = cb->args[3];
1267 u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
1268 struct netlbl_unlhsh_iface *iface;
1269 struct list_head *iter_list;
1270 struct netlbl_af4list *addr4;
1271 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1272 struct netlbl_af6list *addr6;
1277 cb_arg.seq = cb->nlh->nlmsg_seq;
1280 for (iter_bkt = skip_bkt;
1281 iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
1282 iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
1283 iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
1284 list_for_each_entry_rcu(iface, iter_list, list) {
1285 if (!iface->valid ||
1286 iter_chain++ < skip_chain)
1288 netlbl_af4list_foreach_rcu(addr4,
1289 &iface->addr4_list) {
1290 if (iter_addr4++ < skip_addr4)
1292 if (netlbl_unlabel_staticlist_gen(
1293 NLBL_UNLABEL_C_STATICLIST,
1295 netlbl_unlhsh_addr4_entry(addr4),
1300 goto unlabel_staticlist_return;
1303 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1304 netlbl_af6list_foreach_rcu(addr6,
1305 &iface->addr6_list) {
1306 if (iter_addr6++ < skip_addr6)
1308 if (netlbl_unlabel_staticlist_gen(
1309 NLBL_UNLABEL_C_STATICLIST,
1312 netlbl_unlhsh_addr6_entry(addr6),
1316 goto unlabel_staticlist_return;
1323 unlabel_staticlist_return:
1325 cb->args[0] = skip_bkt;
1326 cb->args[1] = skip_chain;
1327 cb->args[2] = skip_addr4;
1328 cb->args[3] = skip_addr6;
1333 * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1334 * @skb: the NETLINK buffer
1335 * @cb: the NETLINK callback
1338 * Process a user generated STATICLISTDEF message and dump the default
1339 * unlabeled connection entry in a form suitable for use in a kernel generated
1340 * STATICLISTDEF message. Returns the length of @skb.
1343 static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
1344 struct netlink_callback *cb)
1346 struct netlbl_unlhsh_walk_arg cb_arg;
1347 struct netlbl_unlhsh_iface *iface;
1348 u32 skip_addr4 = cb->args[0];
1349 u32 skip_addr6 = cb->args[1];
1351 struct netlbl_af4list *addr4;
1352 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1354 struct netlbl_af6list *addr6;
1359 cb_arg.seq = cb->nlh->nlmsg_seq;
1362 iface = rcu_dereference(netlbl_unlhsh_def);
1363 if (iface == NULL || !iface->valid)
1364 goto unlabel_staticlistdef_return;
1366 netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
1367 if (iter_addr4++ < skip_addr4)
1369 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1371 netlbl_unlhsh_addr4_entry(addr4),
1375 goto unlabel_staticlistdef_return;
1378 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1379 netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
1380 if (iter_addr6++ < skip_addr6)
1382 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1385 netlbl_unlhsh_addr6_entry(addr6),
1388 goto unlabel_staticlistdef_return;
1393 unlabel_staticlistdef_return:
1395 cb->args[0] = skip_addr4;
1396 cb->args[1] = skip_addr6;
1401 * NetLabel Generic NETLINK Command Definitions
1404 static struct genl_ops netlbl_unlabel_genl_ops[] = {
1406 .cmd = NLBL_UNLABEL_C_STATICADD,
1407 .flags = GENL_ADMIN_PERM,
1408 .policy = netlbl_unlabel_genl_policy,
1409 .doit = netlbl_unlabel_staticadd,
1413 .cmd = NLBL_UNLABEL_C_STATICREMOVE,
1414 .flags = GENL_ADMIN_PERM,
1415 .policy = netlbl_unlabel_genl_policy,
1416 .doit = netlbl_unlabel_staticremove,
1420 .cmd = NLBL_UNLABEL_C_STATICLIST,
1422 .policy = netlbl_unlabel_genl_policy,
1424 .dumpit = netlbl_unlabel_staticlist,
1427 .cmd = NLBL_UNLABEL_C_STATICADDDEF,
1428 .flags = GENL_ADMIN_PERM,
1429 .policy = netlbl_unlabel_genl_policy,
1430 .doit = netlbl_unlabel_staticadddef,
1434 .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
1435 .flags = GENL_ADMIN_PERM,
1436 .policy = netlbl_unlabel_genl_policy,
1437 .doit = netlbl_unlabel_staticremovedef,
1441 .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
1443 .policy = netlbl_unlabel_genl_policy,
1445 .dumpit = netlbl_unlabel_staticlistdef,
1448 .cmd = NLBL_UNLABEL_C_ACCEPT,
1449 .flags = GENL_ADMIN_PERM,
1450 .policy = netlbl_unlabel_genl_policy,
1451 .doit = netlbl_unlabel_accept,
1455 .cmd = NLBL_UNLABEL_C_LIST,
1457 .policy = netlbl_unlabel_genl_policy,
1458 .doit = netlbl_unlabel_list,
1464 * NetLabel Generic NETLINK Protocol Functions
1468 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1471 * Register the unlabeled packet NetLabel component with the Generic NETLINK
1472 * mechanism. Returns zero on success, negative values on failure.
1475 int __init netlbl_unlabel_genl_init(void)
1477 return genl_register_family_with_ops(&netlbl_unlabel_gnl_family,
1478 netlbl_unlabel_genl_ops, ARRAY_SIZE(netlbl_unlabel_genl_ops));
1482 * NetLabel KAPI Hooks
1485 static struct notifier_block netlbl_unlhsh_netdev_notifier = {
1486 .notifier_call = netlbl_unlhsh_netdev_handler,
1490 * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1491 * @size: the number of bits to use for the hash buckets
1494 * Initializes the unlabeled connection hash table and registers a network
1495 * device notification handler. This function should only be called by the
1496 * NetLabel subsystem itself during initialization. Returns zero on success,
1497 * non-zero values on error.
1500 int __init netlbl_unlabel_init(u32 size)
1503 struct netlbl_unlhsh_tbl *hsh_tbl;
1508 hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
1509 if (hsh_tbl == NULL)
1511 hsh_tbl->size = 1 << size;
1512 hsh_tbl->tbl = kcalloc(hsh_tbl->size,
1513 sizeof(struct list_head),
1515 if (hsh_tbl->tbl == NULL) {
1519 for (iter = 0; iter < hsh_tbl->size; iter++)
1520 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
1523 spin_lock(&netlbl_unlhsh_lock);
1524 rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
1525 spin_unlock(&netlbl_unlhsh_lock);
1528 register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
1534 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1536 * @family: protocol family
1537 * @secattr: the security attributes
1540 * Determine the security attributes, if any, for an unlabled packet and return
1541 * them in @secattr. Returns zero on success and negative values on failure.
1544 int netlbl_unlabel_getattr(const struct sk_buff *skb,
1546 struct netlbl_lsm_secattr *secattr)
1548 struct netlbl_unlhsh_iface *iface;
1551 iface = netlbl_unlhsh_search_iface_def(skb->skb_iif);
1553 goto unlabel_getattr_nolabel;
1557 struct netlbl_af4list *addr4;
1560 addr4 = netlbl_af4list_search(hdr4->saddr,
1561 &iface->addr4_list);
1563 goto unlabel_getattr_nolabel;
1564 secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
1567 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
1569 struct ipv6hdr *hdr6;
1570 struct netlbl_af6list *addr6;
1572 hdr6 = ipv6_hdr(skb);
1573 addr6 = netlbl_af6list_search(&hdr6->saddr,
1574 &iface->addr6_list);
1576 goto unlabel_getattr_nolabel;
1577 secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
1582 goto unlabel_getattr_nolabel;
1586 secattr->flags |= NETLBL_SECATTR_SECID;
1587 secattr->type = NETLBL_NLTYPE_UNLABELED;
1590 unlabel_getattr_nolabel:
1592 if (netlabel_unlabel_acceptflg == 0)
1594 secattr->type = NETLBL_NLTYPE_UNLABELED;
1599 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1602 * Set the default NetLabel configuration to allow incoming unlabeled packets
1603 * and to send unlabeled network traffic by default.
1606 int __init netlbl_unlabel_defconf(void)
1609 struct netlbl_dom_map *entry;
1610 struct netlbl_audit audit_info;
1612 /* Only the kernel is allowed to call this function and the only time
1613 * it is called is at bootup before the audit subsystem is reporting
1614 * messages so don't worry to much about these values. */
1615 security_task_getsecid(current, &audit_info.secid);
1616 audit_info.loginuid = 0;
1617 audit_info.sessionid = 0;
1619 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1622 entry->type = NETLBL_NLTYPE_UNLABELED;
1623 ret_val = netlbl_domhsh_add_default(entry, &audit_info);
1627 netlbl_unlabel_acceptflg_set(1, &audit_info);