1 /* 2 * NetLabel Kernel API 3 * 4 * This file defines the kernel API for the NetLabel system. The NetLabel 5 * system manages static and dynamic label mappings for network protocols such 6 * as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul.moore@hp.com> 9 * 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, write to the Free Software 27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28 * 29 */ 30 31 #include <linux/init.h> 32 #include <linux/types.h> 33 #include <net/ip.h> 34 #include <net/netlabel.h> 35 #include <net/cipso_ipv4.h> 36 #include <asm/bug.h> 37 #include <asm/atomic.h> 38 39 #include "netlabel_domainhash.h" 40 #include "netlabel_unlabeled.h" 41 #include "netlabel_user.h" 42 #include "netlabel_mgmt.h" 43 44 /* 45 * Security Attribute Functions 46 */ 47 48 /** 49 * netlbl_secattr_catmap_walk - Walk a LSM secattr catmap looking for a bit 50 * @catmap: the category bitmap 51 * @offset: the offset to start searching at, in bits 52 * 53 * Description: 54 * This function walks a LSM secattr category bitmap starting at @offset and 55 * returns the spot of the first set bit or -ENOENT if no bits are set. 56 * 57 */ 58 int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap, 59 u32 offset) 60 { 61 struct netlbl_lsm_secattr_catmap *iter = catmap; 62 u32 node_idx; 63 u32 node_bit; 64 NETLBL_CATMAP_MAPTYPE bitmap; 65 66 if (offset > iter->startbit) { 67 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 68 iter = iter->next; 69 if (iter == NULL) 70 return -ENOENT; 71 } 72 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 73 node_bit = offset - iter->startbit - 74 (NETLBL_CATMAP_MAPSIZE * node_idx); 75 } else { 76 node_idx = 0; 77 node_bit = 0; 78 } 79 bitmap = iter->bitmap[node_idx] >> node_bit; 80 81 for (;;) { 82 if (bitmap != 0) { 83 while ((bitmap & NETLBL_CATMAP_BIT) == 0) { 84 bitmap >>= 1; 85 node_bit++; 86 } 87 return iter->startbit + 88 (NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit; 89 } 90 if (++node_idx >= NETLBL_CATMAP_MAPCNT) { 91 if (iter->next != NULL) { 92 iter = iter->next; 93 node_idx = 0; 94 } else 95 return -ENOENT; 96 } 97 bitmap = iter->bitmap[node_idx]; 98 node_bit = 0; 99 } 100 101 return -ENOENT; 102 } 103 104 /** 105 * netlbl_secattr_catmap_walk_rng - Find the end of a string of set bits 106 * @catmap: the category bitmap 107 * @offset: the offset to start searching at, in bits 108 * 109 * Description: 110 * This function walks a LSM secattr category bitmap starting at @offset and 111 * returns the spot of the first cleared bit or -ENOENT if the offset is past 112 * the end of the bitmap. 113 * 114 */ 115 int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap, 116 u32 offset) 117 { 118 struct netlbl_lsm_secattr_catmap *iter = catmap; 119 u32 node_idx; 120 u32 node_bit; 121 NETLBL_CATMAP_MAPTYPE bitmask; 122 NETLBL_CATMAP_MAPTYPE bitmap; 123 124 if (offset > iter->startbit) { 125 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 126 iter = iter->next; 127 if (iter == NULL) 128 return -ENOENT; 129 } 130 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 131 node_bit = offset - iter->startbit - 132 (NETLBL_CATMAP_MAPSIZE * node_idx); 133 } else { 134 node_idx = 0; 135 node_bit = 0; 136 } 137 bitmask = NETLBL_CATMAP_BIT << node_bit; 138 139 for (;;) { 140 bitmap = iter->bitmap[node_idx]; 141 while (bitmask != 0 && (bitmap & bitmask) != 0) { 142 bitmask <<= 1; 143 node_bit++; 144 } 145 146 if (bitmask != 0) 147 return iter->startbit + 148 (NETLBL_CATMAP_MAPSIZE * node_idx) + 149 node_bit - 1; 150 else if (++node_idx >= NETLBL_CATMAP_MAPCNT) { 151 if (iter->next == NULL) 152 return iter->startbit + NETLBL_CATMAP_SIZE - 1; 153 iter = iter->next; 154 node_idx = 0; 155 } 156 bitmask = NETLBL_CATMAP_BIT; 157 node_bit = 0; 158 } 159 160 return -ENOENT; 161 } 162 163 /** 164 * netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap 165 * @catmap: the category bitmap 166 * @bit: the bit to set 167 * @flags: memory allocation flags 168 * 169 * Description: 170 * Set the bit specified by @bit in @catmap. Returns zero on success, 171 * negative values on failure. 172 * 173 */ 174 int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap, 175 u32 bit, 176 gfp_t flags) 177 { 178 struct netlbl_lsm_secattr_catmap *iter = catmap; 179 u32 node_bit; 180 u32 node_idx; 181 182 while (iter->next != NULL && 183 bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) 184 iter = iter->next; 185 if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) { 186 iter->next = netlbl_secattr_catmap_alloc(flags); 187 if (iter->next == NULL) 188 return -ENOMEM; 189 iter = iter->next; 190 iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1); 191 } 192 193 /* gcc always rounds to zero when doing integer division */ 194 node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE; 195 node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx); 196 iter->bitmap[node_idx] |= NETLBL_CATMAP_BIT << node_bit; 197 198 return 0; 199 } 200 201 /** 202 * netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap 203 * @catmap: the category bitmap 204 * @start: the starting bit 205 * @end: the last bit in the string 206 * @flags: memory allocation flags 207 * 208 * Description: 209 * Set a range of bits, starting at @start and ending with @end. Returns zero 210 * on success, negative values on failure. 211 * 212 */ 213 int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap, 214 u32 start, 215 u32 end, 216 gfp_t flags) 217 { 218 int ret_val = 0; 219 struct netlbl_lsm_secattr_catmap *iter = catmap; 220 u32 iter_max_spot; 221 u32 spot; 222 223 /* XXX - This could probably be made a bit faster by combining writes 224 * to the catmap instead of setting a single bit each time, but for 225 * right now skipping to the start of the range in the catmap should 226 * be a nice improvement over calling the individual setbit function 227 * repeatedly from a loop. */ 228 229 while (iter->next != NULL && 230 start >= (iter->startbit + NETLBL_CATMAP_SIZE)) 231 iter = iter->next; 232 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE; 233 234 for (spot = start; spot <= end && ret_val == 0; spot++) { 235 if (spot >= iter_max_spot && iter->next != NULL) { 236 iter = iter->next; 237 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE; 238 } 239 ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC); 240 } 241 242 return ret_val; 243 } 244 245 /* 246 * LSM Functions 247 */ 248 249 /** 250 * netlbl_enabled - Determine if the NetLabel subsystem is enabled 251 * 252 * Description: 253 * The LSM can use this function to determine if it should use NetLabel 254 * security attributes in it's enforcement mechanism. Currently, NetLabel is 255 * considered to be enabled when it's configuration contains a valid setup for 256 * at least one labeled protocol (i.e. NetLabel can understand incoming 257 * labeled packets of at least one type); otherwise NetLabel is considered to 258 * be disabled. 259 * 260 */ 261 int netlbl_enabled(void) 262 { 263 /* At some point we probably want to expose this mechanism to the user 264 * as well so that admins can toggle NetLabel regardless of the 265 * configuration */ 266 return (atomic_read(&netlabel_mgmt_protocount) > 0); 267 } 268 269 /** 270 * netlbl_socket_setattr - Label a socket using the correct protocol 271 * @sk: the socket to label 272 * @secattr: the security attributes 273 * 274 * Description: 275 * Attach the correct label to the given socket using the security attributes 276 * specified in @secattr. This function requires exclusive access to @sk, 277 * which means it either needs to be in the process of being created or locked. 278 * Returns zero on success, negative values on failure. 279 * 280 */ 281 int netlbl_sock_setattr(struct sock *sk, 282 const struct netlbl_lsm_secattr *secattr) 283 { 284 int ret_val = -ENOENT; 285 struct netlbl_dom_map *dom_entry; 286 287 rcu_read_lock(); 288 dom_entry = netlbl_domhsh_getentry(secattr->domain); 289 if (dom_entry == NULL) 290 goto socket_setattr_return; 291 switch (dom_entry->type) { 292 case NETLBL_NLTYPE_CIPSOV4: 293 ret_val = cipso_v4_sock_setattr(sk, 294 dom_entry->type_def.cipsov4, 295 secattr); 296 break; 297 case NETLBL_NLTYPE_UNLABELED: 298 ret_val = 0; 299 break; 300 default: 301 ret_val = -ENOENT; 302 } 303 304 socket_setattr_return: 305 rcu_read_unlock(); 306 return ret_val; 307 } 308 309 /** 310 * netlbl_sock_getattr - Determine the security attributes of a sock 311 * @sk: the sock 312 * @secattr: the security attributes 313 * 314 * Description: 315 * Examines the given sock to see if any NetLabel style labeling has been 316 * applied to the sock, if so it parses the socket label and returns the 317 * security attributes in @secattr. Returns zero on success, negative values 318 * on failure. 319 * 320 */ 321 int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) 322 { 323 return cipso_v4_sock_getattr(sk, secattr); 324 } 325 326 /** 327 * netlbl_skbuff_getattr - Determine the security attributes of a packet 328 * @skb: the packet 329 * @family: protocol family 330 * @secattr: the security attributes 331 * 332 * Description: 333 * Examines the given packet to see if a recognized form of packet labeling 334 * is present, if so it parses the packet label and returns the security 335 * attributes in @secattr. Returns zero on success, negative values on 336 * failure. 337 * 338 */ 339 int netlbl_skbuff_getattr(const struct sk_buff *skb, 340 u16 family, 341 struct netlbl_lsm_secattr *secattr) 342 { 343 if (CIPSO_V4_OPTEXIST(skb) && 344 cipso_v4_skbuff_getattr(skb, secattr) == 0) 345 return 0; 346 347 return netlbl_unlabel_getattr(skb, family, secattr); 348 } 349 350 /** 351 * netlbl_skbuff_err - Handle a LSM error on a sk_buff 352 * @skb: the packet 353 * @error: the error code 354 * 355 * Description: 356 * Deal with a LSM problem when handling the packet in @skb, typically this is 357 * a permission denied problem (-EACCES). The correct action is determined 358 * according to the packet's labeling protocol. 359 * 360 */ 361 void netlbl_skbuff_err(struct sk_buff *skb, int error) 362 { 363 if (CIPSO_V4_OPTEXIST(skb)) 364 cipso_v4_error(skb, error, 0); 365 } 366 367 /** 368 * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches 369 * 370 * Description: 371 * For all of the NetLabel protocols that support some form of label mapping 372 * cache, invalidate the cache. Returns zero on success, negative values on 373 * error. 374 * 375 */ 376 void netlbl_cache_invalidate(void) 377 { 378 cipso_v4_cache_invalidate(); 379 } 380 381 /** 382 * netlbl_cache_add - Add an entry to a NetLabel protocol cache 383 * @skb: the packet 384 * @secattr: the packet's security attributes 385 * 386 * Description: 387 * Add the LSM security attributes for the given packet to the underlying 388 * NetLabel protocol's label mapping cache. Returns zero on success, negative 389 * values on error. 390 * 391 */ 392 int netlbl_cache_add(const struct sk_buff *skb, 393 const struct netlbl_lsm_secattr *secattr) 394 { 395 if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0) 396 return -ENOMSG; 397 398 if (CIPSO_V4_OPTEXIST(skb)) 399 return cipso_v4_cache_add(skb, secattr); 400 401 return -ENOMSG; 402 } 403 404 /* 405 * Setup Functions 406 */ 407 408 /** 409 * netlbl_init - Initialize NetLabel 410 * 411 * Description: 412 * Perform the required NetLabel initialization before first use. 413 * 414 */ 415 static int __init netlbl_init(void) 416 { 417 int ret_val; 418 419 printk(KERN_INFO "NetLabel: Initializing\n"); 420 printk(KERN_INFO "NetLabel: domain hash size = %u\n", 421 (1 << NETLBL_DOMHSH_BITSIZE)); 422 printk(KERN_INFO "NetLabel: protocols =" 423 " UNLABELED" 424 " CIPSOv4" 425 "\n"); 426 427 ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE); 428 if (ret_val != 0) 429 goto init_failure; 430 431 ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE); 432 if (ret_val != 0) 433 goto init_failure; 434 435 ret_val = netlbl_netlink_init(); 436 if (ret_val != 0) 437 goto init_failure; 438 439 ret_val = netlbl_unlabel_defconf(); 440 if (ret_val != 0) 441 goto init_failure; 442 printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n"); 443 444 return 0; 445 446 init_failure: 447 panic("NetLabel: failed to initialize properly (%d)\n", ret_val); 448 } 449 450 subsys_initcall(netlbl_init); 451