1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * NetLabel Unlabeled Support 4 * 5 * This file defines functions for dealing with unlabeled packets for the 6 * NetLabel system. The NetLabel system manages static and dynamic label 7 * mappings for network protocols such as CIPSO and RIPSO. 8 * 9 * Author: Paul Moore <paul@paul-moore.com> 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008 14 */ 15 16 #include <linux/types.h> 17 #include <linux/rcupdate.h> 18 #include <linux/list.h> 19 #include <linux/spinlock.h> 20 #include <linux/socket.h> 21 #include <linux/string.h> 22 #include <linux/skbuff.h> 23 #include <linux/audit.h> 24 #include <linux/in.h> 25 #include <linux/in6.h> 26 #include <linux/ip.h> 27 #include <linux/ipv6.h> 28 #include <linux/notifier.h> 29 #include <linux/netdevice.h> 30 #include <linux/security.h> 31 #include <linux/slab.h> 32 #include <net/sock.h> 33 #include <net/netlink.h> 34 #include <net/genetlink.h> 35 #include <net/ip.h> 36 #include <net/ipv6.h> 37 #include <net/net_namespace.h> 38 #include <net/netlabel.h> 39 #include <asm/bug.h> 40 #include <linux/atomic.h> 41 42 #include "netlabel_user.h" 43 #include "netlabel_addrlist.h" 44 #include "netlabel_domainhash.h" 45 #include "netlabel_unlabeled.h" 46 #include "netlabel_mgmt.h" 47 48 /* NOTE: at present we always use init's network namespace since we don't 49 * presently support different namespaces even though the majority of 50 * the functions in this file are "namespace safe" */ 51 52 /* The unlabeled connection hash table which we use to map network interfaces 53 * and addresses of unlabeled packets to a user specified secid value for the 54 * LSM. The hash table is used to lookup the network interface entry 55 * (struct netlbl_unlhsh_iface) and then the interface entry is used to 56 * lookup an IP address match from an ordered list. If a network interface 57 * match can not be found in the hash table then the default entry 58 * (netlbl_unlhsh_def) is used. The IP address entry list 59 * (struct netlbl_unlhsh_addr) is ordered such that the entries with a 60 * larger netmask come first. 61 */ 62 struct netlbl_unlhsh_tbl { 63 struct list_head *tbl; 64 u32 size; 65 }; 66 #define netlbl_unlhsh_addr4_entry(iter) \ 67 container_of(iter, struct netlbl_unlhsh_addr4, list) 68 struct netlbl_unlhsh_addr4 { 69 u32 secid; 70 71 struct netlbl_af4list list; 72 struct rcu_head rcu; 73 }; 74 #define netlbl_unlhsh_addr6_entry(iter) \ 75 container_of(iter, struct netlbl_unlhsh_addr6, list) 76 struct netlbl_unlhsh_addr6 { 77 u32 secid; 78 79 struct netlbl_af6list list; 80 struct rcu_head rcu; 81 }; 82 struct netlbl_unlhsh_iface { 83 int ifindex; 84 struct list_head addr4_list; 85 struct list_head addr6_list; 86 87 u32 valid; 88 struct list_head list; 89 struct rcu_head rcu; 90 }; 91 92 /* Argument struct for netlbl_unlhsh_walk() */ 93 struct netlbl_unlhsh_walk_arg { 94 struct netlink_callback *nl_cb; 95 struct sk_buff *skb; 96 u32 seq; 97 }; 98 99 /* Unlabeled connection hash table */ 100 /* updates should be so rare that having one spinlock for the entire 101 * hash table should be okay */ 102 static DEFINE_SPINLOCK(netlbl_unlhsh_lock); 103 #define netlbl_unlhsh_rcu_deref(p) \ 104 rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock)) 105 static struct netlbl_unlhsh_tbl __rcu *netlbl_unlhsh; 106 static struct netlbl_unlhsh_iface __rcu *netlbl_unlhsh_def; 107 108 /* Accept unlabeled packets flag */ 109 static u8 netlabel_unlabel_acceptflg; 110 111 /* NetLabel Generic NETLINK unlabeled family */ 112 static struct genl_family netlbl_unlabel_gnl_family; 113 114 /* NetLabel Netlink attribute policy */ 115 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { 116 [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, 117 [NLBL_UNLABEL_A_IPV6ADDR] = 118 NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 119 [NLBL_UNLABEL_A_IPV6MASK] = 120 NLA_POLICY_EXACT_LEN(sizeof(struct in6_addr)), 121 [NLBL_UNLABEL_A_IPV4ADDR] = 122 NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)), 123 [NLBL_UNLABEL_A_IPV4MASK] = 124 NLA_POLICY_EXACT_LEN(sizeof(struct in_addr)), 125 [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING, 126 .len = IFNAMSIZ - 1 }, 127 [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY } 128 }; 129 130 /* 131 * Unlabeled Connection Hash Table Functions 132 */ 133 134 /** 135 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table 136 * @entry: the entry's RCU field 137 * 138 * Description: 139 * This function is designed to be used as a callback to the call_rcu() 140 * function so that memory allocated to a hash table interface entry can be 141 * released safely. It is important to note that this function does not free 142 * the IPv4 and IPv6 address lists contained as part of an interface entry. It 143 * is up to the rest of the code to make sure an interface entry is only freed 144 * once it's address lists are empty. 145 * 146 */ 147 static void netlbl_unlhsh_free_iface(struct rcu_head *entry) 148 { 149 struct netlbl_unlhsh_iface *iface; 150 struct netlbl_af4list *iter4; 151 struct netlbl_af4list *tmp4; 152 #if IS_ENABLED(CONFIG_IPV6) 153 struct netlbl_af6list *iter6; 154 struct netlbl_af6list *tmp6; 155 #endif /* IPv6 */ 156 157 iface = container_of(entry, struct netlbl_unlhsh_iface, rcu); 158 159 /* no need for locks here since we are the only one with access to this 160 * structure */ 161 162 netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) { 163 netlbl_af4list_remove_entry(iter4); 164 kfree(netlbl_unlhsh_addr4_entry(iter4)); 165 } 166 #if IS_ENABLED(CONFIG_IPV6) 167 netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) { 168 netlbl_af6list_remove_entry(iter6); 169 kfree(netlbl_unlhsh_addr6_entry(iter6)); 170 } 171 #endif /* IPv6 */ 172 kfree(iface); 173 } 174 175 /** 176 * netlbl_unlhsh_hash - Hashing function for the hash table 177 * @ifindex: the network interface/device to hash 178 * 179 * Description: 180 * This is the hashing function for the unlabeled hash table, it returns the 181 * bucket number for the given device/interface. The caller is responsible for 182 * ensuring that the hash table is protected with either a RCU read lock or 183 * the hash table lock. 184 * 185 */ 186 static u32 netlbl_unlhsh_hash(int ifindex) 187 { 188 return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1); 189 } 190 191 /** 192 * netlbl_unlhsh_search_iface - Search for a matching interface entry 193 * @ifindex: the network interface 194 * 195 * Description: 196 * Searches the unlabeled connection hash table and returns a pointer to the 197 * interface entry which matches @ifindex, otherwise NULL is returned. The 198 * caller is responsible for ensuring that the hash table is protected with 199 * either a RCU read lock or the hash table lock. 200 * 201 */ 202 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex) 203 { 204 u32 bkt; 205 struct list_head *bkt_list; 206 struct netlbl_unlhsh_iface *iter; 207 208 bkt = netlbl_unlhsh_hash(ifindex); 209 bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]; 210 list_for_each_entry_rcu(iter, bkt_list, list, 211 lockdep_is_held(&netlbl_unlhsh_lock)) 212 if (iter->valid && iter->ifindex == ifindex) 213 return iter; 214 215 return NULL; 216 } 217 218 /** 219 * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table 220 * @iface: the associated interface entry 221 * @addr: IPv4 address in network byte order 222 * @mask: IPv4 address mask in network byte order 223 * @secid: LSM secid value for entry 224 * 225 * Description: 226 * Add a new address entry into the unlabeled connection hash table using the 227 * interface entry specified by @iface. On success zero is returned, otherwise 228 * a negative value is returned. 229 * 230 */ 231 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface, 232 const struct in_addr *addr, 233 const struct in_addr *mask, 234 u32 secid) 235 { 236 int ret_val; 237 struct netlbl_unlhsh_addr4 *entry; 238 239 entry = kzalloc_obj(*entry, GFP_ATOMIC); 240 if (entry == NULL) 241 return -ENOMEM; 242 243 entry->list.addr = addr->s_addr & mask->s_addr; 244 entry->list.mask = mask->s_addr; 245 entry->list.valid = 1; 246 entry->secid = secid; 247 248 spin_lock(&netlbl_unlhsh_lock); 249 ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list); 250 spin_unlock(&netlbl_unlhsh_lock); 251 252 if (ret_val != 0) 253 kfree(entry); 254 return ret_val; 255 } 256 257 #if IS_ENABLED(CONFIG_IPV6) 258 /** 259 * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table 260 * @iface: the associated interface entry 261 * @addr: IPv6 address in network byte order 262 * @mask: IPv6 address mask in network byte order 263 * @secid: LSM secid value for entry 264 * 265 * Description: 266 * Add a new address entry into the unlabeled connection hash table using the 267 * interface entry specified by @iface. On success zero is returned, otherwise 268 * a negative value is returned. 269 * 270 */ 271 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface, 272 const struct in6_addr *addr, 273 const struct in6_addr *mask, 274 u32 secid) 275 { 276 int ret_val; 277 struct netlbl_unlhsh_addr6 *entry; 278 279 entry = kzalloc_obj(*entry, GFP_ATOMIC); 280 if (entry == NULL) 281 return -ENOMEM; 282 283 entry->list.addr = *addr; 284 entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; 285 entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; 286 entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2]; 287 entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3]; 288 entry->list.mask = *mask; 289 entry->list.valid = 1; 290 entry->secid = secid; 291 292 spin_lock(&netlbl_unlhsh_lock); 293 ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list); 294 spin_unlock(&netlbl_unlhsh_lock); 295 296 if (ret_val != 0) 297 kfree(entry); 298 return ret_val; 299 } 300 #endif /* IPv6 */ 301 302 /** 303 * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table 304 * @ifindex: network interface 305 * 306 * Description: 307 * Add a new, empty, interface entry into the unlabeled connection hash table. 308 * On success a pointer to the new interface entry is returned, on failure NULL 309 * is returned. 310 * 311 */ 312 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex) 313 { 314 u32 bkt; 315 struct netlbl_unlhsh_iface *iface; 316 317 iface = kzalloc_obj(*iface, GFP_ATOMIC); 318 if (iface == NULL) 319 return NULL; 320 321 iface->ifindex = ifindex; 322 INIT_LIST_HEAD(&iface->addr4_list); 323 INIT_LIST_HEAD(&iface->addr6_list); 324 iface->valid = 1; 325 326 spin_lock(&netlbl_unlhsh_lock); 327 if (ifindex > 0) { 328 bkt = netlbl_unlhsh_hash(ifindex); 329 if (netlbl_unlhsh_search_iface(ifindex) != NULL) 330 goto add_iface_failure; 331 list_add_tail_rcu(&iface->list, 332 &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]); 333 } else { 334 INIT_LIST_HEAD(&iface->list); 335 if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL) 336 goto add_iface_failure; 337 rcu_assign_pointer(netlbl_unlhsh_def, iface); 338 } 339 spin_unlock(&netlbl_unlhsh_lock); 340 341 return iface; 342 343 add_iface_failure: 344 spin_unlock(&netlbl_unlhsh_lock); 345 kfree(iface); 346 return NULL; 347 } 348 349 /** 350 * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table 351 * @net: network namespace 352 * @dev_name: interface name 353 * @addr: IP address in network byte order 354 * @mask: address mask in network byte order 355 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) 356 * @secid: LSM secid value for the entry 357 * @audit_info: NetLabel audit information 358 * 359 * Description: 360 * Adds a new entry to the unlabeled connection hash table. Returns zero on 361 * success, negative values on failure. 362 * 363 */ 364 int netlbl_unlhsh_add(struct net *net, 365 const char *dev_name, 366 const void *addr, 367 const void *mask, 368 u32 addr_len, 369 u32 secid, 370 struct netlbl_audit *audit_info) 371 { 372 int ret_val; 373 int ifindex; 374 struct net_device *dev; 375 struct netlbl_unlhsh_iface *iface; 376 struct audit_buffer *audit_buf = NULL; 377 struct lsm_context ctx; 378 379 if (addr_len != sizeof(struct in_addr) && 380 addr_len != sizeof(struct in6_addr)) 381 return -EINVAL; 382 383 rcu_read_lock(); 384 if (dev_name != NULL) { 385 dev = dev_get_by_name_rcu(net, dev_name); 386 if (dev == NULL) { 387 ret_val = -ENODEV; 388 goto unlhsh_add_return; 389 } 390 ifindex = dev->ifindex; 391 iface = netlbl_unlhsh_search_iface(ifindex); 392 } else { 393 ifindex = 0; 394 iface = rcu_dereference(netlbl_unlhsh_def); 395 } 396 if (iface == NULL) { 397 iface = netlbl_unlhsh_add_iface(ifindex); 398 if (iface == NULL) { 399 ret_val = -ENOMEM; 400 goto unlhsh_add_return; 401 } 402 } 403 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD, 404 audit_info); 405 switch (addr_len) { 406 case sizeof(struct in_addr): { 407 const struct in_addr *addr4 = addr; 408 const struct in_addr *mask4 = mask; 409 410 ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid); 411 if (audit_buf != NULL) 412 netlbl_af4list_audit_addr(audit_buf, 1, 413 dev_name, 414 addr4->s_addr, 415 mask4->s_addr); 416 break; 417 } 418 #if IS_ENABLED(CONFIG_IPV6) 419 case sizeof(struct in6_addr): { 420 const struct in6_addr *addr6 = addr; 421 const struct in6_addr *mask6 = mask; 422 423 ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid); 424 if (audit_buf != NULL) 425 netlbl_af6list_audit_addr(audit_buf, 1, 426 dev_name, 427 addr6, mask6); 428 break; 429 } 430 #endif /* IPv6 */ 431 default: 432 ret_val = -EINVAL; 433 } 434 if (ret_val == 0) 435 atomic_inc(&netlabel_mgmt_protocount); 436 437 unlhsh_add_return: 438 rcu_read_unlock(); 439 if (audit_buf != NULL) { 440 if (security_secid_to_secctx(secid, &ctx) >= 0) { 441 audit_log_format(audit_buf, " sec_obj=%s", ctx.context); 442 security_release_secctx(&ctx); 443 } 444 audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0); 445 audit_log_end(audit_buf); 446 } 447 return ret_val; 448 } 449 450 /** 451 * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry 452 * @net: network namespace 453 * @iface: interface entry 454 * @addr: IP address 455 * @mask: IP address mask 456 * @audit_info: NetLabel audit information 457 * 458 * Description: 459 * Remove an IP address entry from the unlabeled connection hash table. 460 * Returns zero on success, negative values on failure. 461 * 462 */ 463 static int netlbl_unlhsh_remove_addr4(struct net *net, 464 struct netlbl_unlhsh_iface *iface, 465 const struct in_addr *addr, 466 const struct in_addr *mask, 467 struct netlbl_audit *audit_info) 468 { 469 struct netlbl_af4list *list_entry; 470 struct netlbl_unlhsh_addr4 *entry; 471 struct audit_buffer *audit_buf; 472 struct net_device *dev; 473 struct lsm_context ctx; 474 475 spin_lock(&netlbl_unlhsh_lock); 476 list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr, 477 &iface->addr4_list); 478 spin_unlock(&netlbl_unlhsh_lock); 479 if (list_entry != NULL) 480 entry = netlbl_unlhsh_addr4_entry(list_entry); 481 else 482 entry = NULL; 483 484 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, 485 audit_info); 486 if (audit_buf != NULL) { 487 dev = dev_get_by_index(net, iface->ifindex); 488 netlbl_af4list_audit_addr(audit_buf, 1, 489 (dev != NULL ? dev->name : NULL), 490 addr->s_addr, mask->s_addr); 491 dev_put(dev); 492 if (entry != NULL && 493 security_secid_to_secctx(entry->secid, &ctx) >= 0) { 494 audit_log_format(audit_buf, " sec_obj=%s", ctx.context); 495 security_release_secctx(&ctx); 496 } 497 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); 498 audit_log_end(audit_buf); 499 } 500 501 if (entry == NULL) 502 return -ENOENT; 503 504 kfree_rcu(entry, rcu); 505 return 0; 506 } 507 508 #if IS_ENABLED(CONFIG_IPV6) 509 /** 510 * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry 511 * @net: network namespace 512 * @iface: interface entry 513 * @addr: IP address 514 * @mask: IP address mask 515 * @audit_info: NetLabel audit information 516 * 517 * Description: 518 * Remove an IP address entry from the unlabeled connection hash table. 519 * Returns zero on success, negative values on failure. 520 * 521 */ 522 static int netlbl_unlhsh_remove_addr6(struct net *net, 523 struct netlbl_unlhsh_iface *iface, 524 const struct in6_addr *addr, 525 const struct in6_addr *mask, 526 struct netlbl_audit *audit_info) 527 { 528 struct netlbl_af6list *list_entry; 529 struct netlbl_unlhsh_addr6 *entry; 530 struct audit_buffer *audit_buf; 531 struct net_device *dev; 532 struct lsm_context ctx; 533 534 spin_lock(&netlbl_unlhsh_lock); 535 list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list); 536 spin_unlock(&netlbl_unlhsh_lock); 537 if (list_entry != NULL) 538 entry = netlbl_unlhsh_addr6_entry(list_entry); 539 else 540 entry = NULL; 541 542 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, 543 audit_info); 544 if (audit_buf != NULL) { 545 dev = dev_get_by_index(net, iface->ifindex); 546 netlbl_af6list_audit_addr(audit_buf, 1, 547 (dev != NULL ? dev->name : NULL), 548 addr, mask); 549 dev_put(dev); 550 if (entry != NULL && 551 security_secid_to_secctx(entry->secid, &ctx) >= 0) { 552 audit_log_format(audit_buf, " sec_obj=%s", ctx.context); 553 security_release_secctx(&ctx); 554 } 555 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); 556 audit_log_end(audit_buf); 557 } 558 559 if (entry == NULL) 560 return -ENOENT; 561 562 kfree_rcu(entry, rcu); 563 return 0; 564 } 565 #endif /* IPv6 */ 566 567 /** 568 * netlbl_unlhsh_condremove_iface - Remove an interface entry 569 * @iface: the interface entry 570 * 571 * Description: 572 * Remove an interface entry from the unlabeled connection hash table if it is 573 * empty. An interface entry is considered to be empty if there are no 574 * address entries assigned to it. 575 * 576 */ 577 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface) 578 { 579 struct netlbl_af4list *iter4; 580 #if IS_ENABLED(CONFIG_IPV6) 581 struct netlbl_af6list *iter6; 582 #endif /* IPv6 */ 583 584 spin_lock(&netlbl_unlhsh_lock); 585 netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list) 586 goto unlhsh_condremove_failure; 587 #if IS_ENABLED(CONFIG_IPV6) 588 netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list) 589 goto unlhsh_condremove_failure; 590 #endif /* IPv6 */ 591 iface->valid = 0; 592 if (iface->ifindex > 0) 593 list_del_rcu(&iface->list); 594 else 595 RCU_INIT_POINTER(netlbl_unlhsh_def, NULL); 596 spin_unlock(&netlbl_unlhsh_lock); 597 598 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); 599 return; 600 601 unlhsh_condremove_failure: 602 spin_unlock(&netlbl_unlhsh_lock); 603 } 604 605 /** 606 * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table 607 * @net: network namespace 608 * @dev_name: interface name 609 * @addr: IP address in network byte order 610 * @mask: address mask in network byte order 611 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) 612 * @audit_info: NetLabel audit information 613 * 614 * Description: 615 * Removes and existing entry from the unlabeled connection hash table. 616 * Returns zero on success, negative values on failure. 617 * 618 */ 619 int netlbl_unlhsh_remove(struct net *net, 620 const char *dev_name, 621 const void *addr, 622 const void *mask, 623 u32 addr_len, 624 struct netlbl_audit *audit_info) 625 { 626 int ret_val; 627 struct net_device *dev; 628 struct netlbl_unlhsh_iface *iface; 629 630 if (addr_len != sizeof(struct in_addr) && 631 addr_len != sizeof(struct in6_addr)) 632 return -EINVAL; 633 634 rcu_read_lock(); 635 if (dev_name != NULL) { 636 dev = dev_get_by_name_rcu(net, dev_name); 637 if (dev == NULL) { 638 ret_val = -ENODEV; 639 goto unlhsh_remove_return; 640 } 641 iface = netlbl_unlhsh_search_iface(dev->ifindex); 642 } else 643 iface = rcu_dereference(netlbl_unlhsh_def); 644 if (iface == NULL) { 645 ret_val = -ENOENT; 646 goto unlhsh_remove_return; 647 } 648 switch (addr_len) { 649 case sizeof(struct in_addr): 650 ret_val = netlbl_unlhsh_remove_addr4(net, 651 iface, addr, mask, 652 audit_info); 653 break; 654 #if IS_ENABLED(CONFIG_IPV6) 655 case sizeof(struct in6_addr): 656 ret_val = netlbl_unlhsh_remove_addr6(net, 657 iface, addr, mask, 658 audit_info); 659 break; 660 #endif /* IPv6 */ 661 default: 662 ret_val = -EINVAL; 663 } 664 if (ret_val == 0) { 665 netlbl_unlhsh_condremove_iface(iface); 666 atomic_dec(&netlabel_mgmt_protocount); 667 } 668 669 unlhsh_remove_return: 670 rcu_read_unlock(); 671 return ret_val; 672 } 673 674 /* 675 * General Helper Functions 676 */ 677 678 /** 679 * netlbl_unlhsh_netdev_handler - Network device notification handler 680 * @this: notifier block 681 * @event: the event 682 * @ptr: the netdevice notifier info (cast to void) 683 * 684 * Description: 685 * Handle network device events, although at present all we care about is a 686 * network device going away. In the case of a device going away we clear any 687 * related entries from the unlabeled connection hash table. 688 * 689 */ 690 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this, 691 unsigned long event, void *ptr) 692 { 693 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 694 struct netlbl_unlhsh_iface *iface = NULL; 695 696 if (!net_eq(dev_net(dev), &init_net)) 697 return NOTIFY_DONE; 698 699 /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */ 700 if (event == NETDEV_DOWN) { 701 spin_lock(&netlbl_unlhsh_lock); 702 iface = netlbl_unlhsh_search_iface(dev->ifindex); 703 if (iface != NULL && iface->valid) { 704 iface->valid = 0; 705 list_del_rcu(&iface->list); 706 } else 707 iface = NULL; 708 spin_unlock(&netlbl_unlhsh_lock); 709 } 710 711 if (iface != NULL) 712 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); 713 714 return NOTIFY_DONE; 715 } 716 717 /** 718 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag 719 * @value: desired value 720 * @audit_info: NetLabel audit information 721 * 722 * Description: 723 * Set the value of the unlabeled accept flag to @value. 724 * 725 */ 726 static void netlbl_unlabel_acceptflg_set(u8 value, 727 struct netlbl_audit *audit_info) 728 { 729 struct audit_buffer *audit_buf; 730 u8 old_val; 731 732 old_val = netlabel_unlabel_acceptflg; 733 netlabel_unlabel_acceptflg = value; 734 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW, 735 audit_info); 736 if (audit_buf != NULL) { 737 audit_log_format(audit_buf, 738 " unlbl_accept=%u old=%u", value, old_val); 739 audit_log_end(audit_buf); 740 } 741 } 742 743 /** 744 * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information 745 * @info: the Generic NETLINK info block 746 * @addr: the IP address 747 * @mask: the IP address mask 748 * @len: the address length 749 * 750 * Description: 751 * Examine the Generic NETLINK message and extract the IP address information. 752 * Returns zero on success, negative values on failure. 753 * 754 */ 755 static int netlbl_unlabel_addrinfo_get(struct genl_info *info, 756 void **addr, 757 void **mask, 758 u32 *len) 759 { 760 if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] && 761 info->attrs[NLBL_UNLABEL_A_IPV4MASK]) { 762 *len = sizeof(struct in_addr); 763 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); 764 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]); 765 return 0; 766 } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) { 767 *len = sizeof(struct in6_addr); 768 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); 769 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]); 770 return 0; 771 } 772 773 return -EINVAL; 774 } 775 776 /* 777 * NetLabel Command Handlers 778 */ 779 780 /** 781 * netlbl_unlabel_accept - Handle an ACCEPT message 782 * @skb: the NETLINK buffer 783 * @info: the Generic NETLINK info block 784 * 785 * Description: 786 * Process a user generated ACCEPT message and set the accept flag accordingly. 787 * Returns zero on success, negative values on failure. 788 * 789 */ 790 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info) 791 { 792 u8 value; 793 struct netlbl_audit audit_info; 794 795 if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) { 796 value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]); 797 if (value == 1 || value == 0) { 798 netlbl_netlink_auditinfo(&audit_info); 799 netlbl_unlabel_acceptflg_set(value, &audit_info); 800 return 0; 801 } 802 } 803 804 return -EINVAL; 805 } 806 807 /** 808 * netlbl_unlabel_list - Handle a LIST message 809 * @skb: the NETLINK buffer 810 * @info: the Generic NETLINK info block 811 * 812 * Description: 813 * Process a user generated LIST message and respond with the current status. 814 * Returns zero on success, negative values on failure. 815 * 816 */ 817 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info) 818 { 819 int ret_val = -EINVAL; 820 struct sk_buff *ans_skb; 821 void *data; 822 823 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 824 if (ans_skb == NULL) 825 goto list_failure; 826 data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family, 827 0, NLBL_UNLABEL_C_LIST); 828 if (data == NULL) { 829 ret_val = -ENOMEM; 830 goto list_failure; 831 } 832 833 ret_val = nla_put_u8(ans_skb, 834 NLBL_UNLABEL_A_ACPTFLG, 835 netlabel_unlabel_acceptflg); 836 if (ret_val != 0) 837 goto list_failure; 838 839 genlmsg_end(ans_skb, data); 840 return genlmsg_reply(ans_skb, info); 841 842 list_failure: 843 kfree_skb(ans_skb); 844 return ret_val; 845 } 846 847 /** 848 * netlbl_unlabel_staticadd - Handle a STATICADD message 849 * @skb: the NETLINK buffer 850 * @info: the Generic NETLINK info block 851 * 852 * Description: 853 * Process a user generated STATICADD message and add a new unlabeled 854 * connection entry to the hash table. Returns zero on success, negative 855 * values on failure. 856 * 857 */ 858 static int netlbl_unlabel_staticadd(struct sk_buff *skb, 859 struct genl_info *info) 860 { 861 int ret_val; 862 char *dev_name; 863 void *addr; 864 void *mask; 865 u32 addr_len; 866 u32 secid; 867 struct netlbl_audit audit_info; 868 869 /* Don't allow users to add both IPv4 and IPv6 addresses for a 870 * single entry. However, allow users to create two entries, one each 871 * for IPv4 and IPv6, with the same LSM security context which should 872 * achieve the same result. */ 873 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || 874 !info->attrs[NLBL_UNLABEL_A_IFACE] || 875 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 876 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 877 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 878 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 879 return -EINVAL; 880 881 netlbl_netlink_auditinfo(&audit_info); 882 883 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 884 if (ret_val != 0) 885 return ret_val; 886 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); 887 ret_val = security_secctx_to_secid( 888 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), 889 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), 890 &secid); 891 if (ret_val != 0) 892 return ret_val; 893 894 return netlbl_unlhsh_add(&init_net, 895 dev_name, addr, mask, addr_len, secid, 896 &audit_info); 897 } 898 899 /** 900 * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message 901 * @skb: the NETLINK buffer 902 * @info: the Generic NETLINK info block 903 * 904 * Description: 905 * Process a user generated STATICADDDEF message and add a new default 906 * unlabeled connection entry. Returns zero on success, negative values on 907 * failure. 908 * 909 */ 910 static int netlbl_unlabel_staticadddef(struct sk_buff *skb, 911 struct genl_info *info) 912 { 913 int ret_val; 914 void *addr; 915 void *mask; 916 u32 addr_len; 917 u32 secid; 918 struct netlbl_audit audit_info; 919 920 /* Don't allow users to add both IPv4 and IPv6 addresses for a 921 * single entry. However, allow users to create two entries, one each 922 * for IPv4 and IPv6, with the same LSM security context which should 923 * achieve the same result. */ 924 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || 925 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 926 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 927 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 928 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 929 return -EINVAL; 930 931 netlbl_netlink_auditinfo(&audit_info); 932 933 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 934 if (ret_val != 0) 935 return ret_val; 936 ret_val = security_secctx_to_secid( 937 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), 938 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), 939 &secid); 940 if (ret_val != 0) 941 return ret_val; 942 943 return netlbl_unlhsh_add(&init_net, 944 NULL, addr, mask, addr_len, secid, 945 &audit_info); 946 } 947 948 /** 949 * netlbl_unlabel_staticremove - Handle a STATICREMOVE message 950 * @skb: the NETLINK buffer 951 * @info: the Generic NETLINK info block 952 * 953 * Description: 954 * Process a user generated STATICREMOVE message and remove the specified 955 * unlabeled connection entry. Returns zero on success, negative values on 956 * failure. 957 * 958 */ 959 static int netlbl_unlabel_staticremove(struct sk_buff *skb, 960 struct genl_info *info) 961 { 962 int ret_val; 963 char *dev_name; 964 void *addr; 965 void *mask; 966 u32 addr_len; 967 struct netlbl_audit audit_info; 968 969 /* See the note in netlbl_unlabel_staticadd() about not allowing both 970 * IPv4 and IPv6 in the same entry. */ 971 if (!info->attrs[NLBL_UNLABEL_A_IFACE] || 972 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 973 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 974 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 975 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 976 return -EINVAL; 977 978 netlbl_netlink_auditinfo(&audit_info); 979 980 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 981 if (ret_val != 0) 982 return ret_val; 983 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); 984 985 return netlbl_unlhsh_remove(&init_net, 986 dev_name, addr, mask, addr_len, 987 &audit_info); 988 } 989 990 /** 991 * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message 992 * @skb: the NETLINK buffer 993 * @info: the Generic NETLINK info block 994 * 995 * Description: 996 * Process a user generated STATICREMOVEDEF message and remove the default 997 * unlabeled connection entry. Returns zero on success, negative values on 998 * failure. 999 * 1000 */ 1001 static int netlbl_unlabel_staticremovedef(struct sk_buff *skb, 1002 struct genl_info *info) 1003 { 1004 int ret_val; 1005 void *addr; 1006 void *mask; 1007 u32 addr_len; 1008 struct netlbl_audit audit_info; 1009 1010 /* See the note in netlbl_unlabel_staticadd() about not allowing both 1011 * IPv4 and IPv6 in the same entry. */ 1012 if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 1013 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 1014 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 1015 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 1016 return -EINVAL; 1017 1018 netlbl_netlink_auditinfo(&audit_info); 1019 1020 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 1021 if (ret_val != 0) 1022 return ret_val; 1023 1024 return netlbl_unlhsh_remove(&init_net, 1025 NULL, addr, mask, addr_len, 1026 &audit_info); 1027 } 1028 1029 1030 /** 1031 * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF] 1032 * @cmd: command/message 1033 * @iface: the interface entry 1034 * @addr4: the IPv4 address entry 1035 * @addr6: the IPv6 address entry 1036 * @arg: the netlbl_unlhsh_walk_arg structure 1037 * 1038 * Description: 1039 * This function is designed to be used to generate a response for a 1040 * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6 1041 * can be specified, not both, the other unspecified entry should be set to 1042 * NULL by the caller. Returns the size of the message on success, negative 1043 * values on failure. 1044 * 1045 */ 1046 static int netlbl_unlabel_staticlist_gen(u32 cmd, 1047 const struct netlbl_unlhsh_iface *iface, 1048 const struct netlbl_unlhsh_addr4 *addr4, 1049 const struct netlbl_unlhsh_addr6 *addr6, 1050 void *arg) 1051 { 1052 int ret_val = -ENOMEM; 1053 struct netlbl_unlhsh_walk_arg *cb_arg = arg; 1054 struct net_device *dev; 1055 struct lsm_context ctx; 1056 void *data; 1057 u32 secid; 1058 1059 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, 1060 cb_arg->seq, &netlbl_unlabel_gnl_family, 1061 NLM_F_MULTI, cmd); 1062 if (data == NULL) 1063 goto list_cb_failure; 1064 1065 if (iface->ifindex > 0) { 1066 dev = dev_get_by_index(&init_net, iface->ifindex); 1067 if (!dev) { 1068 ret_val = -ENODEV; 1069 goto list_cb_failure; 1070 } 1071 ret_val = nla_put_string(cb_arg->skb, 1072 NLBL_UNLABEL_A_IFACE, dev->name); 1073 dev_put(dev); 1074 if (ret_val != 0) 1075 goto list_cb_failure; 1076 } 1077 1078 if (addr4) { 1079 struct in_addr addr_struct; 1080 1081 addr_struct.s_addr = addr4->list.addr; 1082 ret_val = nla_put_in_addr(cb_arg->skb, 1083 NLBL_UNLABEL_A_IPV4ADDR, 1084 addr_struct.s_addr); 1085 if (ret_val != 0) 1086 goto list_cb_failure; 1087 1088 addr_struct.s_addr = addr4->list.mask; 1089 ret_val = nla_put_in_addr(cb_arg->skb, 1090 NLBL_UNLABEL_A_IPV4MASK, 1091 addr_struct.s_addr); 1092 if (ret_val != 0) 1093 goto list_cb_failure; 1094 1095 secid = addr4->secid; 1096 } else { 1097 ret_val = nla_put_in6_addr(cb_arg->skb, 1098 NLBL_UNLABEL_A_IPV6ADDR, 1099 &addr6->list.addr); 1100 if (ret_val != 0) 1101 goto list_cb_failure; 1102 1103 ret_val = nla_put_in6_addr(cb_arg->skb, 1104 NLBL_UNLABEL_A_IPV6MASK, 1105 &addr6->list.mask); 1106 if (ret_val != 0) 1107 goto list_cb_failure; 1108 1109 secid = addr6->secid; 1110 } 1111 1112 ret_val = security_secid_to_secctx(secid, &ctx); 1113 if (ret_val < 0) 1114 goto list_cb_failure; 1115 ret_val = nla_put(cb_arg->skb, 1116 NLBL_UNLABEL_A_SECCTX, 1117 ctx.len, 1118 ctx.context); 1119 security_release_secctx(&ctx); 1120 if (ret_val != 0) 1121 goto list_cb_failure; 1122 1123 cb_arg->seq++; 1124 genlmsg_end(cb_arg->skb, data); 1125 return 0; 1126 1127 list_cb_failure: 1128 genlmsg_cancel(cb_arg->skb, data); 1129 return ret_val; 1130 } 1131 1132 /** 1133 * netlbl_unlabel_staticlist - Handle a STATICLIST message 1134 * @skb: the NETLINK buffer 1135 * @cb: the NETLINK callback 1136 * 1137 * Description: 1138 * Process a user generated STATICLIST message and dump the unlabeled 1139 * connection hash table in a form suitable for use in a kernel generated 1140 * STATICLIST message. Returns the length of @skb. 1141 * 1142 */ 1143 static int netlbl_unlabel_staticlist(struct sk_buff *skb, 1144 struct netlink_callback *cb) 1145 { 1146 struct netlbl_unlhsh_walk_arg cb_arg; 1147 u32 skip_bkt = cb->args[0]; 1148 u32 skip_chain = cb->args[1]; 1149 u32 skip_addr4 = cb->args[2]; 1150 u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; 1151 struct netlbl_unlhsh_iface *iface; 1152 struct list_head *iter_list; 1153 struct netlbl_af4list *addr4; 1154 #if IS_ENABLED(CONFIG_IPV6) 1155 u32 skip_addr6 = cb->args[3]; 1156 struct netlbl_af6list *addr6; 1157 #endif 1158 1159 cb_arg.nl_cb = cb; 1160 cb_arg.skb = skb; 1161 cb_arg.seq = cb->nlh->nlmsg_seq; 1162 1163 rcu_read_lock(); 1164 for (iter_bkt = skip_bkt; 1165 iter_bkt < rcu_dereference(netlbl_unlhsh)->size; 1166 iter_bkt++) { 1167 iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt]; 1168 list_for_each_entry_rcu(iface, iter_list, list) { 1169 if (!iface->valid || 1170 iter_chain++ < skip_chain) 1171 continue; 1172 netlbl_af4list_foreach_rcu(addr4, 1173 &iface->addr4_list) { 1174 if (iter_addr4++ < skip_addr4) 1175 continue; 1176 if (netlbl_unlabel_staticlist_gen( 1177 NLBL_UNLABEL_C_STATICLIST, 1178 iface, 1179 netlbl_unlhsh_addr4_entry(addr4), 1180 NULL, 1181 &cb_arg) < 0) { 1182 iter_addr4--; 1183 iter_chain--; 1184 goto unlabel_staticlist_return; 1185 } 1186 } 1187 iter_addr4 = 0; 1188 skip_addr4 = 0; 1189 #if IS_ENABLED(CONFIG_IPV6) 1190 netlbl_af6list_foreach_rcu(addr6, 1191 &iface->addr6_list) { 1192 if (iter_addr6++ < skip_addr6) 1193 continue; 1194 if (netlbl_unlabel_staticlist_gen( 1195 NLBL_UNLABEL_C_STATICLIST, 1196 iface, 1197 NULL, 1198 netlbl_unlhsh_addr6_entry(addr6), 1199 &cb_arg) < 0) { 1200 iter_addr6--; 1201 iter_chain--; 1202 goto unlabel_staticlist_return; 1203 } 1204 } 1205 iter_addr6 = 0; 1206 skip_addr6 = 0; 1207 #endif /* IPv6 */ 1208 } 1209 iter_chain = 0; 1210 skip_chain = 0; 1211 } 1212 1213 unlabel_staticlist_return: 1214 rcu_read_unlock(); 1215 cb->args[0] = iter_bkt; 1216 cb->args[1] = iter_chain; 1217 cb->args[2] = iter_addr4; 1218 cb->args[3] = iter_addr6; 1219 return skb->len; 1220 } 1221 1222 /** 1223 * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message 1224 * @skb: the NETLINK buffer 1225 * @cb: the NETLINK callback 1226 * 1227 * Description: 1228 * Process a user generated STATICLISTDEF message and dump the default 1229 * unlabeled connection entry in a form suitable for use in a kernel generated 1230 * STATICLISTDEF message. Returns the length of @skb. 1231 * 1232 */ 1233 static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, 1234 struct netlink_callback *cb) 1235 { 1236 struct netlbl_unlhsh_walk_arg cb_arg; 1237 struct netlbl_unlhsh_iface *iface; 1238 u32 iter_addr4 = 0, iter_addr6 = 0; 1239 struct netlbl_af4list *addr4; 1240 #if IS_ENABLED(CONFIG_IPV6) 1241 struct netlbl_af6list *addr6; 1242 #endif 1243 1244 cb_arg.nl_cb = cb; 1245 cb_arg.skb = skb; 1246 cb_arg.seq = cb->nlh->nlmsg_seq; 1247 1248 rcu_read_lock(); 1249 iface = rcu_dereference(netlbl_unlhsh_def); 1250 if (iface == NULL || !iface->valid) 1251 goto unlabel_staticlistdef_return; 1252 1253 netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) { 1254 if (iter_addr4++ < cb->args[0]) 1255 continue; 1256 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, 1257 iface, 1258 netlbl_unlhsh_addr4_entry(addr4), 1259 NULL, 1260 &cb_arg) < 0) { 1261 iter_addr4--; 1262 goto unlabel_staticlistdef_return; 1263 } 1264 } 1265 #if IS_ENABLED(CONFIG_IPV6) 1266 netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) { 1267 if (iter_addr6++ < cb->args[1]) 1268 continue; 1269 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, 1270 iface, 1271 NULL, 1272 netlbl_unlhsh_addr6_entry(addr6), 1273 &cb_arg) < 0) { 1274 iter_addr6--; 1275 goto unlabel_staticlistdef_return; 1276 } 1277 } 1278 #endif /* IPv6 */ 1279 1280 unlabel_staticlistdef_return: 1281 rcu_read_unlock(); 1282 cb->args[0] = iter_addr4; 1283 cb->args[1] = iter_addr6; 1284 return skb->len; 1285 } 1286 1287 /* 1288 * NetLabel Generic NETLINK Command Definitions 1289 */ 1290 1291 static const struct genl_small_ops netlbl_unlabel_genl_ops[] = { 1292 { 1293 .cmd = NLBL_UNLABEL_C_STATICADD, 1294 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1295 .flags = GENL_ADMIN_PERM, 1296 .doit = netlbl_unlabel_staticadd, 1297 .dumpit = NULL, 1298 }, 1299 { 1300 .cmd = NLBL_UNLABEL_C_STATICREMOVE, 1301 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1302 .flags = GENL_ADMIN_PERM, 1303 .doit = netlbl_unlabel_staticremove, 1304 .dumpit = NULL, 1305 }, 1306 { 1307 .cmd = NLBL_UNLABEL_C_STATICLIST, 1308 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1309 .flags = 0, 1310 .doit = NULL, 1311 .dumpit = netlbl_unlabel_staticlist, 1312 }, 1313 { 1314 .cmd = NLBL_UNLABEL_C_STATICADDDEF, 1315 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1316 .flags = GENL_ADMIN_PERM, 1317 .doit = netlbl_unlabel_staticadddef, 1318 .dumpit = NULL, 1319 }, 1320 { 1321 .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF, 1322 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1323 .flags = GENL_ADMIN_PERM, 1324 .doit = netlbl_unlabel_staticremovedef, 1325 .dumpit = NULL, 1326 }, 1327 { 1328 .cmd = NLBL_UNLABEL_C_STATICLISTDEF, 1329 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1330 .flags = 0, 1331 .doit = NULL, 1332 .dumpit = netlbl_unlabel_staticlistdef, 1333 }, 1334 { 1335 .cmd = NLBL_UNLABEL_C_ACCEPT, 1336 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1337 .flags = GENL_ADMIN_PERM, 1338 .doit = netlbl_unlabel_accept, 1339 .dumpit = NULL, 1340 }, 1341 { 1342 .cmd = NLBL_UNLABEL_C_LIST, 1343 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1344 .flags = 0, 1345 .doit = netlbl_unlabel_list, 1346 .dumpit = NULL, 1347 }, 1348 }; 1349 1350 static struct genl_family netlbl_unlabel_gnl_family __ro_after_init = { 1351 .hdrsize = 0, 1352 .name = NETLBL_NLTYPE_UNLABELED_NAME, 1353 .version = NETLBL_PROTO_VERSION, 1354 .maxattr = NLBL_UNLABEL_A_MAX, 1355 .policy = netlbl_unlabel_genl_policy, 1356 .module = THIS_MODULE, 1357 .small_ops = netlbl_unlabel_genl_ops, 1358 .n_small_ops = ARRAY_SIZE(netlbl_unlabel_genl_ops), 1359 .resv_start_op = NLBL_UNLABEL_C_STATICLISTDEF + 1, 1360 }; 1361 1362 /* 1363 * NetLabel Generic NETLINK Protocol Functions 1364 */ 1365 1366 /** 1367 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component 1368 * 1369 * Description: 1370 * Register the unlabeled packet NetLabel component with the Generic NETLINK 1371 * mechanism. Returns zero on success, negative values on failure. 1372 * 1373 */ 1374 int __init netlbl_unlabel_genl_init(void) 1375 { 1376 return genl_register_family(&netlbl_unlabel_gnl_family); 1377 } 1378 1379 /* 1380 * NetLabel KAPI Hooks 1381 */ 1382 1383 static struct notifier_block netlbl_unlhsh_netdev_notifier = { 1384 .notifier_call = netlbl_unlhsh_netdev_handler, 1385 }; 1386 1387 /** 1388 * netlbl_unlabel_init - Initialize the unlabeled connection hash table 1389 * @size: the number of bits to use for the hash buckets 1390 * 1391 * Description: 1392 * Initializes the unlabeled connection hash table and registers a network 1393 * device notification handler. This function should only be called by the 1394 * NetLabel subsystem itself during initialization. Returns zero on success, 1395 * non-zero values on error. 1396 * 1397 */ 1398 int __init netlbl_unlabel_init(u32 size) 1399 { 1400 u32 iter; 1401 struct netlbl_unlhsh_tbl *hsh_tbl; 1402 1403 if (size == 0) 1404 return -EINVAL; 1405 1406 hsh_tbl = kmalloc_obj(*hsh_tbl); 1407 if (hsh_tbl == NULL) 1408 return -ENOMEM; 1409 hsh_tbl->size = 1 << size; 1410 hsh_tbl->tbl = kzalloc_objs(struct list_head, hsh_tbl->size); 1411 if (hsh_tbl->tbl == NULL) { 1412 kfree(hsh_tbl); 1413 return -ENOMEM; 1414 } 1415 for (iter = 0; iter < hsh_tbl->size; iter++) 1416 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]); 1417 1418 spin_lock(&netlbl_unlhsh_lock); 1419 rcu_assign_pointer(netlbl_unlhsh, hsh_tbl); 1420 spin_unlock(&netlbl_unlhsh_lock); 1421 1422 register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier); 1423 1424 return 0; 1425 } 1426 1427 /** 1428 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet 1429 * @skb: the packet 1430 * @family: protocol family 1431 * @secattr: the security attributes 1432 * 1433 * Description: 1434 * Determine the security attributes, if any, for an unlabled packet and return 1435 * them in @secattr. Returns zero on success and negative values on failure. 1436 * 1437 */ 1438 int netlbl_unlabel_getattr(const struct sk_buff *skb, 1439 u16 family, 1440 struct netlbl_lsm_secattr *secattr) 1441 { 1442 struct netlbl_unlhsh_iface *iface; 1443 1444 rcu_read_lock(); 1445 iface = netlbl_unlhsh_search_iface(skb->skb_iif); 1446 if (iface == NULL) 1447 iface = rcu_dereference(netlbl_unlhsh_def); 1448 if (iface == NULL || !iface->valid) 1449 goto unlabel_getattr_nolabel; 1450 1451 #if IS_ENABLED(CONFIG_IPV6) 1452 /* When resolving a fallback label, check the sk_buff version as 1453 * it is possible (e.g. SCTP) to have family = PF_INET6 while 1454 * receiving ip_hdr(skb)->version = 4. 1455 */ 1456 if (family == PF_INET6 && ip_hdr(skb)->version == 4) 1457 family = PF_INET; 1458 #endif /* IPv6 */ 1459 1460 switch (family) { 1461 case PF_INET: { 1462 struct iphdr *hdr4; 1463 struct netlbl_af4list *addr4; 1464 1465 hdr4 = ip_hdr(skb); 1466 addr4 = netlbl_af4list_search(hdr4->saddr, 1467 &iface->addr4_list); 1468 if (addr4 == NULL) 1469 goto unlabel_getattr_nolabel; 1470 secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid; 1471 break; 1472 } 1473 #if IS_ENABLED(CONFIG_IPV6) 1474 case PF_INET6: { 1475 struct ipv6hdr *hdr6; 1476 struct netlbl_af6list *addr6; 1477 1478 hdr6 = ipv6_hdr(skb); 1479 addr6 = netlbl_af6list_search(&hdr6->saddr, 1480 &iface->addr6_list); 1481 if (addr6 == NULL) 1482 goto unlabel_getattr_nolabel; 1483 secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid; 1484 break; 1485 } 1486 #endif /* IPv6 */ 1487 default: 1488 goto unlabel_getattr_nolabel; 1489 } 1490 rcu_read_unlock(); 1491 1492 secattr->flags |= NETLBL_SECATTR_SECID; 1493 secattr->type = NETLBL_NLTYPE_UNLABELED; 1494 return 0; 1495 1496 unlabel_getattr_nolabel: 1497 rcu_read_unlock(); 1498 if (netlabel_unlabel_acceptflg == 0) 1499 return -ENOMSG; 1500 secattr->type = NETLBL_NLTYPE_UNLABELED; 1501 return 0; 1502 } 1503 1504 /** 1505 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets 1506 * 1507 * Description: 1508 * Set the default NetLabel configuration to allow incoming unlabeled packets 1509 * and to send unlabeled network traffic by default. 1510 * 1511 */ 1512 int __init netlbl_unlabel_defconf(void) 1513 { 1514 int ret_val; 1515 struct netlbl_dom_map *entry; 1516 struct netlbl_audit audit_info; 1517 1518 /* Only the kernel is allowed to call this function and the only time 1519 * it is called is at bootup before the audit subsystem is reporting 1520 * messages so don't worry to much about these values. */ 1521 security_current_getlsmprop_subj(&audit_info.prop); 1522 audit_info.loginuid = GLOBAL_ROOT_UID; 1523 audit_info.sessionid = 0; 1524 1525 entry = kzalloc_obj(*entry); 1526 if (entry == NULL) 1527 return -ENOMEM; 1528 entry->family = AF_UNSPEC; 1529 entry->def.type = NETLBL_NLTYPE_UNLABELED; 1530 ret_val = netlbl_domhsh_add_default(entry, &audit_info); 1531 if (ret_val != 0) 1532 return ret_val; 1533 1534 netlbl_unlabel_acceptflg_set(1, &audit_info); 1535 1536 return 0; 1537 } 1538