1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Network node table 4 * 5 * SELinux must keep a mapping of network nodes to labels/SIDs. This 6 * mapping is maintained as part of the normal policy but a fast cache is 7 * needed to reduce the lookup overhead since most of these queries happen on 8 * a per-packet basis. 9 * 10 * Author: Paul Moore <paul@paul-moore.com> 11 * 12 * This code is heavily based on the "netif" concept originally developed by 13 * James Morris <jmorris@redhat.com> 14 * (see security/selinux/netif.c for more information) 15 */ 16 17 /* 18 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007 19 */ 20 21 #include <linux/types.h> 22 #include <linux/rcupdate.h> 23 #include <linux/list.h> 24 #include <linux/slab.h> 25 #include <linux/spinlock.h> 26 #include <linux/in.h> 27 #include <linux/in6.h> 28 #include <linux/ip.h> 29 #include <linux/ipv6.h> 30 #include <net/ip.h> 31 #include <net/ipv6.h> 32 33 #include "netnode.h" 34 #include "objsec.h" 35 36 #define SEL_NETNODE_HASH_SIZE 256 37 #define SEL_NETNODE_HASH_BKT_LIMIT 16 38 39 struct sel_netnode_bkt { 40 unsigned int size; 41 struct list_head list; 42 }; 43 44 struct sel_netnode { 45 struct netnode_security_struct nsec; 46 47 struct list_head list; 48 struct rcu_head rcu; 49 }; 50 51 /* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason 52 * for this is that I suspect most users will not make heavy use of both 53 * address families at the same time so one table will usually end up wasted, 54 * if this becomes a problem we can always add a hash table for each address 55 * family later */ 56 57 static LIST_HEAD(sel_netnode_list); 58 static DEFINE_SPINLOCK(sel_netnode_lock); 59 static struct sel_netnode_bkt sel_netnode_hash[SEL_NETNODE_HASH_SIZE]; 60 61 /** 62 * sel_netnode_hashfn_ipv4 - IPv4 hashing function for the node table 63 * @addr: IPv4 address 64 * 65 * Description: 66 * This is the IPv4 hashing function for the node interface table, it returns 67 * the bucket number for the given IP address. 68 * 69 */ 70 static unsigned int sel_netnode_hashfn_ipv4(__be32 addr) 71 { 72 /* at some point we should determine if the mismatch in byte order 73 * affects the hash function dramatically */ 74 return (addr & (SEL_NETNODE_HASH_SIZE - 1)); 75 } 76 77 /** 78 * sel_netnode_hashfn_ipv6 - IPv6 hashing function for the node table 79 * @addr: IPv6 address 80 * 81 * Description: 82 * This is the IPv6 hashing function for the node interface table, it returns 83 * the bucket number for the given IP address. 84 * 85 */ 86 static unsigned int sel_netnode_hashfn_ipv6(const struct in6_addr *addr) 87 { 88 /* just hash the least significant 32 bits to keep things fast (they 89 * are the most likely to be different anyway), we can revisit this 90 * later if needed */ 91 return (addr->s6_addr32[3] & (SEL_NETNODE_HASH_SIZE - 1)); 92 } 93 94 /** 95 * sel_netnode_find - Search for a node record 96 * @addr: IP address 97 * @family: address family 98 * 99 * Description: 100 * Search the network node table and return the record matching @addr. If an 101 * entry can not be found in the table return NULL. 102 * 103 */ 104 static struct sel_netnode *sel_netnode_find(const void *addr, u16 family) 105 { 106 unsigned int idx; 107 struct sel_netnode *node; 108 109 switch (family) { 110 case PF_INET: 111 idx = sel_netnode_hashfn_ipv4(*(__be32 *)addr); 112 break; 113 case PF_INET6: 114 idx = sel_netnode_hashfn_ipv6(addr); 115 break; 116 default: 117 BUG(); 118 return NULL; 119 } 120 121 list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list) 122 if (node->nsec.family == family) 123 switch (family) { 124 case PF_INET: 125 if (node->nsec.addr.ipv4 == *(__be32 *)addr) 126 return node; 127 break; 128 case PF_INET6: 129 if (ipv6_addr_equal(&node->nsec.addr.ipv6, 130 addr)) 131 return node; 132 break; 133 } 134 135 return NULL; 136 } 137 138 /** 139 * sel_netnode_insert - Insert a new node into the table 140 * @node: the new node record 141 * 142 * Description: 143 * Add a new node record to the network address hash table. 144 * 145 */ 146 static void sel_netnode_insert(struct sel_netnode *node) 147 { 148 unsigned int idx; 149 150 switch (node->nsec.family) { 151 case PF_INET: 152 idx = sel_netnode_hashfn_ipv4(node->nsec.addr.ipv4); 153 break; 154 case PF_INET6: 155 idx = sel_netnode_hashfn_ipv6(&node->nsec.addr.ipv6); 156 break; 157 default: 158 BUG(); 159 return; 160 } 161 162 /* we need to impose a limit on the growth of the hash table so check 163 * this bucket to make sure it is within the specified bounds */ 164 list_add_rcu(&node->list, &sel_netnode_hash[idx].list); 165 if (sel_netnode_hash[idx].size == SEL_NETNODE_HASH_BKT_LIMIT) { 166 struct sel_netnode *tail; 167 tail = list_entry( 168 rcu_dereference_protected(sel_netnode_hash[idx].list.prev, 169 lockdep_is_held(&sel_netnode_lock)), 170 struct sel_netnode, list); 171 list_del_rcu(&tail->list); 172 kfree_rcu(tail, rcu); 173 } else 174 sel_netnode_hash[idx].size++; 175 } 176 177 /** 178 * sel_netnode_sid_slow - Lookup the SID of a network address using the policy 179 * @addr: the IP address 180 * @family: the address family 181 * @sid: node SID 182 * 183 * Description: 184 * This function determines the SID of a network address by quering the 185 * security policy. The result is added to the network address table to 186 * speedup future queries. Returns zero on success, negative values on 187 * failure. 188 * 189 */ 190 static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid) 191 { 192 int ret = -ENOMEM; 193 struct sel_netnode *node; 194 struct sel_netnode *new = NULL; 195 196 spin_lock_bh(&sel_netnode_lock); 197 node = sel_netnode_find(addr, family); 198 if (node != NULL) { 199 *sid = node->nsec.sid; 200 spin_unlock_bh(&sel_netnode_lock); 201 return 0; 202 } 203 new = kzalloc(sizeof(*new), GFP_ATOMIC); 204 if (new == NULL) 205 goto out; 206 switch (family) { 207 case PF_INET: 208 ret = security_node_sid(&selinux_state, PF_INET, 209 addr, sizeof(struct in_addr), sid); 210 new->nsec.addr.ipv4 = *(__be32 *)addr; 211 break; 212 case PF_INET6: 213 ret = security_node_sid(&selinux_state, PF_INET6, 214 addr, sizeof(struct in6_addr), sid); 215 new->nsec.addr.ipv6 = *(struct in6_addr *)addr; 216 break; 217 default: 218 BUG(); 219 ret = -EINVAL; 220 } 221 if (ret != 0) 222 goto out; 223 224 new->nsec.family = family; 225 new->nsec.sid = *sid; 226 sel_netnode_insert(new); 227 228 out: 229 spin_unlock_bh(&sel_netnode_lock); 230 if (unlikely(ret)) { 231 pr_warn("SELinux: failure in %s(), unable to determine network node label\n", 232 __func__); 233 kfree(new); 234 } 235 return ret; 236 } 237 238 /** 239 * sel_netnode_sid - Lookup the SID of a network address 240 * @addr: the IP address 241 * @family: the address family 242 * @sid: node SID 243 * 244 * Description: 245 * This function determines the SID of a network address using the fastest 246 * method possible. First the address table is queried, but if an entry 247 * can't be found then the policy is queried and the result is added to the 248 * table to speedup future queries. Returns zero on success, negative values 249 * on failure. 250 * 251 */ 252 int sel_netnode_sid(void *addr, u16 family, u32 *sid) 253 { 254 struct sel_netnode *node; 255 256 rcu_read_lock(); 257 node = sel_netnode_find(addr, family); 258 if (node != NULL) { 259 *sid = node->nsec.sid; 260 rcu_read_unlock(); 261 return 0; 262 } 263 rcu_read_unlock(); 264 265 return sel_netnode_sid_slow(addr, family, sid); 266 } 267 268 /** 269 * sel_netnode_flush - Flush the entire network address table 270 * 271 * Description: 272 * Remove all entries from the network address table. 273 * 274 */ 275 void sel_netnode_flush(void) 276 { 277 unsigned int idx; 278 struct sel_netnode *node, *node_tmp; 279 280 spin_lock_bh(&sel_netnode_lock); 281 for (idx = 0; idx < SEL_NETNODE_HASH_SIZE; idx++) { 282 list_for_each_entry_safe(node, node_tmp, 283 &sel_netnode_hash[idx].list, list) { 284 list_del_rcu(&node->list); 285 kfree_rcu(node, rcu); 286 } 287 sel_netnode_hash[idx].size = 0; 288 } 289 spin_unlock_bh(&sel_netnode_lock); 290 } 291 292 static __init int sel_netnode_init(void) 293 { 294 int iter; 295 296 if (!selinux_enabled) 297 return 0; 298 299 for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) { 300 INIT_LIST_HEAD(&sel_netnode_hash[iter].list); 301 sel_netnode_hash[iter].size = 0; 302 } 303 304 return 0; 305 } 306 307 __initcall(sel_netnode_init); 308