1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31#include <linux/types.h>
32#include <linux/rcupdate.h>
33#include <linux/list.h>
34#include <linux/spinlock.h>
35#include <linux/in.h>
36#include <linux/in6.h>
37#include <linux/ip.h>
38#include <linux/ipv6.h>
39#include <net/ip.h>
40#include <net/ipv6.h>
41
42#include "netnode.h"
43#include "objsec.h"
44
45#define SEL_NETNODE_HASH_SIZE 256
46#define SEL_NETNODE_HASH_BKT_LIMIT 16
47
48struct sel_netnode_bkt {
49 unsigned int size;
50 struct list_head list;
51};
52
53struct sel_netnode {
54 struct netnode_security_struct nsec;
55
56 struct list_head list;
57 struct rcu_head rcu;
58};
59
60
61
62
63
64
65
66static LIST_HEAD(sel_netnode_list);
67static DEFINE_SPINLOCK(sel_netnode_lock);
68static struct sel_netnode_bkt sel_netnode_hash[SEL_NETNODE_HASH_SIZE];
69
70
71
72
73
74
75
76
77
78
79
80static void sel_netnode_free(struct rcu_head *p)
81{
82 struct sel_netnode *node = container_of(p, struct sel_netnode, rcu);
83 kfree(node);
84}
85
86
87
88
89
90
91
92
93
94
95static unsigned int sel_netnode_hashfn_ipv4(__be32 addr)
96{
97
98
99 return (addr & (SEL_NETNODE_HASH_SIZE - 1));
100}
101
102
103
104
105
106
107
108
109
110
111static unsigned int sel_netnode_hashfn_ipv6(const struct in6_addr *addr)
112{
113
114
115
116 return (addr->s6_addr32[3] & (SEL_NETNODE_HASH_SIZE - 1));
117}
118
119
120
121
122
123
124
125
126
127
128
129static struct sel_netnode *sel_netnode_find(const void *addr, u16 family)
130{
131 unsigned int idx;
132 struct sel_netnode *node;
133
134 switch (family) {
135 case PF_INET:
136 idx = sel_netnode_hashfn_ipv4(*(__be32 *)addr);
137 break;
138 case PF_INET6:
139 idx = sel_netnode_hashfn_ipv6(addr);
140 break;
141 default:
142 BUG();
143 }
144
145 list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list)
146 if (node->nsec.family == family)
147 switch (family) {
148 case PF_INET:
149 if (node->nsec.addr.ipv4 == *(__be32 *)addr)
150 return node;
151 break;
152 case PF_INET6:
153 if (ipv6_addr_equal(&node->nsec.addr.ipv6,
154 addr))
155 return node;
156 break;
157 }
158
159 return NULL;
160}
161
162
163
164
165
166
167
168
169
170static void sel_netnode_insert(struct sel_netnode *node)
171{
172 unsigned int idx;
173
174 switch (node->nsec.family) {
175 case PF_INET:
176 idx = sel_netnode_hashfn_ipv4(node->nsec.addr.ipv4);
177 break;
178 case PF_INET6:
179 idx = sel_netnode_hashfn_ipv6(&node->nsec.addr.ipv6);
180 break;
181 default:
182 BUG();
183 }
184
185 INIT_RCU_HEAD(&node->rcu);
186
187
188
189 list_add_rcu(&node->list, &sel_netnode_hash[idx].list);
190 if (sel_netnode_hash[idx].size == SEL_NETNODE_HASH_BKT_LIMIT) {
191 struct sel_netnode *tail;
192 tail = list_entry(
193 rcu_dereference(sel_netnode_hash[idx].list.prev),
194 struct sel_netnode, list);
195 list_del_rcu(&tail->list);
196 call_rcu(&tail->rcu, sel_netnode_free);
197 } else
198 sel_netnode_hash[idx].size++;
199}
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
215{
216 int ret = -ENOMEM;
217 struct sel_netnode *node;
218 struct sel_netnode *new = NULL;
219
220 spin_lock_bh(&sel_netnode_lock);
221 node = sel_netnode_find(addr, family);
222 if (node != NULL) {
223 *sid = node->nsec.sid;
224 spin_unlock_bh(&sel_netnode_lock);
225 return 0;
226 }
227 new = kzalloc(sizeof(*new), GFP_ATOMIC);
228 if (new == NULL)
229 goto out;
230 switch (family) {
231 case PF_INET:
232 ret = security_node_sid(PF_INET,
233 addr, sizeof(struct in_addr), sid);
234 new->nsec.addr.ipv4 = *(__be32 *)addr;
235 break;
236 case PF_INET6:
237 ret = security_node_sid(PF_INET6,
238 addr, sizeof(struct in6_addr), sid);
239 ipv6_addr_copy(&new->nsec.addr.ipv6, addr);
240 break;
241 default:
242 BUG();
243 }
244 if (ret != 0)
245 goto out;
246
247 new->nsec.family = family;
248 new->nsec.sid = *sid;
249 sel_netnode_insert(new);
250
251out:
252 spin_unlock_bh(&sel_netnode_lock);
253 if (unlikely(ret)) {
254 printk(KERN_WARNING
255 "SELinux: failure in sel_netnode_sid_slow(),"
256 " unable to determine network node label\n");
257 kfree(new);
258 }
259 return ret;
260}
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276int sel_netnode_sid(void *addr, u16 family, u32 *sid)
277{
278 struct sel_netnode *node;
279
280 rcu_read_lock();
281 node = sel_netnode_find(addr, family);
282 if (node != NULL) {
283 *sid = node->nsec.sid;
284 rcu_read_unlock();
285 return 0;
286 }
287 rcu_read_unlock();
288
289 return sel_netnode_sid_slow(addr, family, sid);
290}
291
292
293
294
295
296
297
298
299static void sel_netnode_flush(void)
300{
301 unsigned int idx;
302 struct sel_netnode *node, *node_tmp;
303
304 spin_lock_bh(&sel_netnode_lock);
305 for (idx = 0; idx < SEL_NETNODE_HASH_SIZE; idx++) {
306 list_for_each_entry_safe(node, node_tmp,
307 &sel_netnode_hash[idx].list, list) {
308 list_del_rcu(&node->list);
309 call_rcu(&node->rcu, sel_netnode_free);
310 }
311 sel_netnode_hash[idx].size = 0;
312 }
313 spin_unlock_bh(&sel_netnode_lock);
314}
315
316static int sel_netnode_avc_callback(u32 event, u32 ssid, u32 tsid,
317 u16 class, u32 perms, u32 *retained)
318{
319 if (event == AVC_CALLBACK_RESET) {
320 sel_netnode_flush();
321 synchronize_net();
322 }
323 return 0;
324}
325
326static __init int sel_netnode_init(void)
327{
328 int iter;
329 int ret;
330
331 if (!selinux_enabled)
332 return 0;
333
334 for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) {
335 INIT_LIST_HEAD(&sel_netnode_hash[iter].list);
336 sel_netnode_hash[iter].size = 0;
337 }
338
339 ret = avc_add_callback(sel_netnode_avc_callback, AVC_CALLBACK_RESET,
340 SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0);
341 if (ret != 0)
342 panic("avc_add_callback() failed, error %d\n", ret);
343
344 return ret;
345}
346
347__initcall(sel_netnode_init);
348