linux/net/netlabel/netlabel_unlabeled.c
<<
>>
Prefs
   1/*
   2 * NetLabel Unlabeled Support
   3 *
   4 * This file defines functions for dealing with unlabeled packets for the
   5 * NetLabel system.  The NetLabel system manages static and dynamic label
   6 * mappings for network protocols such as CIPSO and RIPSO.
   7 *
   8 * Author: Paul Moore <paul@paul-moore.com>
   9 *
  10 */
  11
  12/*
  13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
  14 *
  15 * This program is free software;  you can redistribute it and/or modify
  16 * it under the terms of the GNU General Public License as published by
  17 * the Free Software Foundation; either version 2 of the License, or
  18 * (at your option) any later version.
  19 *
  20 * This program is distributed in the hope that it will be useful,
  21 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  23 * the GNU General Public License for more details.
  24 *
  25 * You should have received a copy of the GNU General Public License
  26 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  27 *
  28 */
  29
  30#include <linux/types.h>
  31#include <linux/rcupdate.h>
  32#include <linux/list.h>
  33#include <linux/spinlock.h>
  34#include <linux/socket.h>
  35#include <linux/string.h>
  36#include <linux/skbuff.h>
  37#include <linux/audit.h>
  38#include <linux/in.h>
  39#include <linux/in6.h>
  40#include <linux/ip.h>
  41#include <linux/ipv6.h>
  42#include <linux/notifier.h>
  43#include <linux/netdevice.h>
  44#include <linux/security.h>
  45#include <linux/slab.h>
  46#include <net/sock.h>
  47#include <net/netlink.h>
  48#include <net/genetlink.h>
  49#include <net/ip.h>
  50#include <net/ipv6.h>
  51#include <net/net_namespace.h>
  52#include <net/netlabel.h>
  53#include <asm/bug.h>
  54#include <linux/atomic.h>
  55
  56#include "netlabel_user.h"
  57#include "netlabel_addrlist.h"
  58#include "netlabel_domainhash.h"
  59#include "netlabel_unlabeled.h"
  60#include "netlabel_mgmt.h"
  61
  62/* NOTE: at present we always use init's network namespace since we don't
  63 *       presently support different namespaces even though the majority of
  64 *       the functions in this file are "namespace safe" */
  65
  66/* The unlabeled connection hash table which we use to map network interfaces
  67 * and addresses of unlabeled packets to a user specified secid value for the
  68 * LSM.  The hash table is used to lookup the network interface entry
  69 * (struct netlbl_unlhsh_iface) and then the interface entry is used to
  70 * lookup an IP address match from an ordered list.  If a network interface
  71 * match can not be found in the hash table then the default entry
  72 * (netlbl_unlhsh_def) is used.  The IP address entry list
  73 * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
  74 * larger netmask come first.
  75 */
  76struct netlbl_unlhsh_tbl {
  77        struct list_head *tbl;
  78        u32 size;
  79};
  80#define netlbl_unlhsh_addr4_entry(iter) \
  81        container_of(iter, struct netlbl_unlhsh_addr4, list)
  82struct netlbl_unlhsh_addr4 {
  83        u32 secid;
  84
  85        struct netlbl_af4list list;
  86        struct rcu_head rcu;
  87};
  88#define netlbl_unlhsh_addr6_entry(iter) \
  89        container_of(iter, struct netlbl_unlhsh_addr6, list)
  90struct netlbl_unlhsh_addr6 {
  91        u32 secid;
  92
  93        struct netlbl_af6list list;
  94        struct rcu_head rcu;
  95};
  96struct netlbl_unlhsh_iface {
  97        int ifindex;
  98        struct list_head addr4_list;
  99        struct list_head addr6_list;
 100
 101        u32 valid;
 102        struct list_head list;
 103        struct rcu_head rcu;
 104};
 105
 106/* Argument struct for netlbl_unlhsh_walk() */
 107struct netlbl_unlhsh_walk_arg {
 108        struct netlink_callback *nl_cb;
 109        struct sk_buff *skb;
 110        u32 seq;
 111};
 112
 113/* Unlabeled connection hash table */
 114/* updates should be so rare that having one spinlock for the entire
 115 * hash table should be okay */
 116static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
 117#define netlbl_unlhsh_rcu_deref(p) \
 118        rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
 119static struct netlbl_unlhsh_tbl *netlbl_unlhsh = NULL;
 120static struct netlbl_unlhsh_iface *netlbl_unlhsh_def = NULL;
 121
 122/* Accept unlabeled packets flag */
 123static u8 netlabel_unlabel_acceptflg = 0;
 124
 125/* NetLabel Generic NETLINK unlabeled family */
 126static struct genl_family netlbl_unlabel_gnl_family = {
 127        .id = GENL_ID_GENERATE,
 128        .hdrsize = 0,
 129        .name = NETLBL_NLTYPE_UNLABELED_NAME,
 130        .version = NETLBL_PROTO_VERSION,
 131        .maxattr = NLBL_UNLABEL_A_MAX,
 132};
 133
 134/* NetLabel Netlink attribute policy */
 135static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
 136        [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
 137        [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
 138                                      .len = sizeof(struct in6_addr) },
 139        [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
 140                                      .len = sizeof(struct in6_addr) },
 141        [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
 142                                      .len = sizeof(struct in_addr) },
 143        [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
 144                                      .len = sizeof(struct in_addr) },
 145        [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
 146                                   .len = IFNAMSIZ - 1 },
 147        [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
 148};
 149
 150/*
 151 * Unlabeled Connection Hash Table Functions
 152 */
 153
 154/**
 155 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
 156 * @entry: the entry's RCU field
 157 *
 158 * Description:
 159 * This function is designed to be used as a callback to the call_rcu()
 160 * function so that memory allocated to a hash table interface entry can be
 161 * released safely.  It is important to note that this function does not free
 162 * the IPv4 and IPv6 address lists contained as part of an interface entry.  It
 163 * is up to the rest of the code to make sure an interface entry is only freed
 164 * once it's address lists are empty.
 165 *
 166 */
 167static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
 168{
 169        struct netlbl_unlhsh_iface *iface;
 170        struct netlbl_af4list *iter4;
 171        struct netlbl_af4list *tmp4;
 172#if IS_ENABLED(CONFIG_IPV6)
 173        struct netlbl_af6list *iter6;
 174        struct netlbl_af6list *tmp6;
 175#endif /* IPv6 */
 176
 177        iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
 178
 179        /* no need for locks here since we are the only one with access to this
 180         * structure */
 181
 182        netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
 183                netlbl_af4list_remove_entry(iter4);
 184                kfree(netlbl_unlhsh_addr4_entry(iter4));
 185        }
 186#if IS_ENABLED(CONFIG_IPV6)
 187        netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
 188                netlbl_af6list_remove_entry(iter6);
 189                kfree(netlbl_unlhsh_addr6_entry(iter6));
 190        }
 191#endif /* IPv6 */
 192        kfree(iface);
 193}
 194
 195/**
 196 * netlbl_unlhsh_hash - Hashing function for the hash table
 197 * @ifindex: the network interface/device to hash
 198 *
 199 * Description:
 200 * This is the hashing function for the unlabeled hash table, it returns the
 201 * bucket number for the given device/interface.  The caller is responsible for
 202 * ensuring that the hash table is protected with either a RCU read lock or
 203 * the hash table lock.
 204 *
 205 */
 206static u32 netlbl_unlhsh_hash(int ifindex)
 207{
 208        return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
 209}
 210
 211/**
 212 * netlbl_unlhsh_search_iface - Search for a matching interface entry
 213 * @ifindex: the network interface
 214 *
 215 * Description:
 216 * Searches the unlabeled connection hash table and returns a pointer to the
 217 * interface entry which matches @ifindex, otherwise NULL is returned.  The
 218 * caller is responsible for ensuring that the hash table is protected with
 219 * either a RCU read lock or the hash table lock.
 220 *
 221 */
 222static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
 223{
 224        u32 bkt;
 225        struct list_head *bkt_list;
 226        struct netlbl_unlhsh_iface *iter;
 227
 228        bkt = netlbl_unlhsh_hash(ifindex);
 229        bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
 230        list_for_each_entry_rcu(iter, bkt_list, list)
 231                if (iter->valid && iter->ifindex == ifindex)
 232                        return iter;
 233
 234        return NULL;
 235}
 236
 237/**
 238 * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
 239 * @iface: the associated interface entry
 240 * @addr: IPv4 address in network byte order
 241 * @mask: IPv4 address mask in network byte order
 242 * @secid: LSM secid value for entry
 243 *
 244 * Description:
 245 * Add a new address entry into the unlabeled connection hash table using the
 246 * interface entry specified by @iface.  On success zero is returned, otherwise
 247 * a negative value is returned.
 248 *
 249 */
 250static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
 251                                   const struct in_addr *addr,
 252                                   const struct in_addr *mask,
 253                                   u32 secid)
 254{
 255        int ret_val;
 256        struct netlbl_unlhsh_addr4 *entry;
 257
 258        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 259        if (entry == NULL)
 260                return -ENOMEM;
 261
 262        entry->list.addr = addr->s_addr & mask->s_addr;
 263        entry->list.mask = mask->s_addr;
 264        entry->list.valid = 1;
 265        entry->secid = secid;
 266
 267        spin_lock(&netlbl_unlhsh_lock);
 268        ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
 269        spin_unlock(&netlbl_unlhsh_lock);
 270
 271        if (ret_val != 0)
 272                kfree(entry);
 273        return ret_val;
 274}
 275
 276#if IS_ENABLED(CONFIG_IPV6)
 277/**
 278 * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
 279 * @iface: the associated interface entry
 280 * @addr: IPv6 address in network byte order
 281 * @mask: IPv6 address mask in network byte order
 282 * @secid: LSM secid value for entry
 283 *
 284 * Description:
 285 * Add a new address entry into the unlabeled connection hash table using the
 286 * interface entry specified by @iface.  On success zero is returned, otherwise
 287 * a negative value is returned.
 288 *
 289 */
 290static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
 291                                   const struct in6_addr *addr,
 292                                   const struct in6_addr *mask,
 293                                   u32 secid)
 294{
 295        int ret_val;
 296        struct netlbl_unlhsh_addr6 *entry;
 297
 298        entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 299        if (entry == NULL)
 300                return -ENOMEM;
 301
 302        entry->list.addr = *addr;
 303        entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
 304        entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
 305        entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
 306        entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
 307        entry->list.mask = *mask;
 308        entry->list.valid = 1;
 309        entry->secid = secid;
 310
 311        spin_lock(&netlbl_unlhsh_lock);
 312        ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
 313        spin_unlock(&netlbl_unlhsh_lock);
 314
 315        if (ret_val != 0)
 316                kfree(entry);
 317        return 0;
 318}
 319#endif /* IPv6 */
 320
 321/**
 322 * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
 323 * @ifindex: network interface
 324 *
 325 * Description:
 326 * Add a new, empty, interface entry into the unlabeled connection hash table.
 327 * On success a pointer to the new interface entry is returned, on failure NULL
 328 * is returned.
 329 *
 330 */
 331static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
 332{
 333        u32 bkt;
 334        struct netlbl_unlhsh_iface *iface;
 335
 336        iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
 337        if (iface == NULL)
 338                return NULL;
 339
 340        iface->ifindex = ifindex;
 341        INIT_LIST_HEAD(&iface->addr4_list);
 342        INIT_LIST_HEAD(&iface->addr6_list);
 343        iface->valid = 1;
 344
 345        spin_lock(&netlbl_unlhsh_lock);
 346        if (ifindex > 0) {
 347                bkt = netlbl_unlhsh_hash(ifindex);
 348                if (netlbl_unlhsh_search_iface(ifindex) != NULL)
 349                        goto add_iface_failure;
 350                list_add_tail_rcu(&iface->list,
 351                             &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
 352        } else {
 353                INIT_LIST_HEAD(&iface->list);
 354                if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
 355                        goto add_iface_failure;
 356                rcu_assign_pointer(netlbl_unlhsh_def, iface);
 357        }
 358        spin_unlock(&netlbl_unlhsh_lock);
 359
 360        return iface;
 361
 362add_iface_failure:
 363        spin_unlock(&netlbl_unlhsh_lock);
 364        kfree(iface);
 365        return NULL;
 366}
 367
 368/**
 369 * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
 370 * @net: network namespace
 371 * @dev_name: interface name
 372 * @addr: IP address in network byte order
 373 * @mask: address mask in network byte order
 374 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
 375 * @secid: LSM secid value for the entry
 376 * @audit_info: NetLabel audit information
 377 *
 378 * Description:
 379 * Adds a new entry to the unlabeled connection hash table.  Returns zero on
 380 * success, negative values on failure.
 381 *
 382 */
 383int netlbl_unlhsh_add(struct net *net,
 384                      const char *dev_name,
 385                      const void *addr,
 386                      const void *mask,
 387                      u32 addr_len,
 388                      u32 secid,
 389                      struct netlbl_audit *audit_info)
 390{
 391        int ret_val;
 392        int ifindex;
 393        struct net_device *dev;
 394        struct netlbl_unlhsh_iface *iface;
 395        struct audit_buffer *audit_buf = NULL;
 396        char *secctx = NULL;
 397        u32 secctx_len;
 398
 399        if (addr_len != sizeof(struct in_addr) &&
 400            addr_len != sizeof(struct in6_addr))
 401                return -EINVAL;
 402
 403        rcu_read_lock();
 404        if (dev_name != NULL) {
 405                dev = dev_get_by_name_rcu(net, dev_name);
 406                if (dev == NULL) {
 407                        ret_val = -ENODEV;
 408                        goto unlhsh_add_return;
 409                }
 410                ifindex = dev->ifindex;
 411                iface = netlbl_unlhsh_search_iface(ifindex);
 412        } else {
 413                ifindex = 0;
 414                iface = rcu_dereference(netlbl_unlhsh_def);
 415        }
 416        if (iface == NULL) {
 417                iface = netlbl_unlhsh_add_iface(ifindex);
 418                if (iface == NULL) {
 419                        ret_val = -ENOMEM;
 420                        goto unlhsh_add_return;
 421                }
 422        }
 423        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
 424                                              audit_info);
 425        switch (addr_len) {
 426        case sizeof(struct in_addr): {
 427                const struct in_addr *addr4 = addr;
 428                const struct in_addr *mask4 = mask;
 429
 430                ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
 431                if (audit_buf != NULL)
 432                        netlbl_af4list_audit_addr(audit_buf, 1,
 433                                                  dev_name,
 434                                                  addr4->s_addr,
 435                                                  mask4->s_addr);
 436                break;
 437        }
 438#if IS_ENABLED(CONFIG_IPV6)
 439        case sizeof(struct in6_addr): {
 440                const struct in6_addr *addr6 = addr;
 441                const struct in6_addr *mask6 = mask;
 442
 443                ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
 444                if (audit_buf != NULL)
 445                        netlbl_af6list_audit_addr(audit_buf, 1,
 446                                                  dev_name,
 447                                                  addr6, mask6);
 448                break;
 449        }
 450#endif /* IPv6 */
 451        default:
 452                ret_val = -EINVAL;
 453        }
 454        if (ret_val == 0)
 455                atomic_inc(&netlabel_mgmt_protocount);
 456
 457unlhsh_add_return:
 458        rcu_read_unlock();
 459        if (audit_buf != NULL) {
 460                if (security_secid_to_secctx(secid,
 461                                             &secctx,
 462                                             &secctx_len) == 0) {
 463                        audit_log_format(audit_buf, " sec_obj=%s", secctx);
 464                        security_release_secctx(secctx, secctx_len);
 465                }
 466                audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
 467                audit_log_end(audit_buf);
 468        }
 469        return ret_val;
 470}
 471
 472/**
 473 * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
 474 * @net: network namespace
 475 * @iface: interface entry
 476 * @addr: IP address
 477 * @mask: IP address mask
 478 * @audit_info: NetLabel audit information
 479 *
 480 * Description:
 481 * Remove an IP address entry from the unlabeled connection hash table.
 482 * Returns zero on success, negative values on failure.
 483 *
 484 */
 485static int netlbl_unlhsh_remove_addr4(struct net *net,
 486                                      struct netlbl_unlhsh_iface *iface,
 487                                      const struct in_addr *addr,
 488                                      const struct in_addr *mask,
 489                                      struct netlbl_audit *audit_info)
 490{
 491        struct netlbl_af4list *list_entry;
 492        struct netlbl_unlhsh_addr4 *entry;
 493        struct audit_buffer *audit_buf;
 494        struct net_device *dev;
 495        char *secctx;
 496        u32 secctx_len;
 497
 498        spin_lock(&netlbl_unlhsh_lock);
 499        list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
 500                                           &iface->addr4_list);
 501        spin_unlock(&netlbl_unlhsh_lock);
 502        if (list_entry != NULL)
 503                entry = netlbl_unlhsh_addr4_entry(list_entry);
 504        else
 505                entry = NULL;
 506
 507        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
 508                                              audit_info);
 509        if (audit_buf != NULL) {
 510                dev = dev_get_by_index(net, iface->ifindex);
 511                netlbl_af4list_audit_addr(audit_buf, 1,
 512                                          (dev != NULL ? dev->name : NULL),
 513                                          addr->s_addr, mask->s_addr);
 514                if (dev != NULL)
 515                        dev_put(dev);
 516                if (entry != NULL &&
 517                    security_secid_to_secctx(entry->secid,
 518                                             &secctx, &secctx_len) == 0) {
 519                        audit_log_format(audit_buf, " sec_obj=%s", secctx);
 520                        security_release_secctx(secctx, secctx_len);
 521                }
 522                audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
 523                audit_log_end(audit_buf);
 524        }
 525
 526        if (entry == NULL)
 527                return -ENOENT;
 528
 529        kfree_rcu(entry, rcu);
 530        return 0;
 531}
 532
 533#if IS_ENABLED(CONFIG_IPV6)
 534/**
 535 * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
 536 * @net: network namespace
 537 * @iface: interface entry
 538 * @addr: IP address
 539 * @mask: IP address mask
 540 * @audit_info: NetLabel audit information
 541 *
 542 * Description:
 543 * Remove an IP address entry from the unlabeled connection hash table.
 544 * Returns zero on success, negative values on failure.
 545 *
 546 */
 547static int netlbl_unlhsh_remove_addr6(struct net *net,
 548                                      struct netlbl_unlhsh_iface *iface,
 549                                      const struct in6_addr *addr,
 550                                      const struct in6_addr *mask,
 551                                      struct netlbl_audit *audit_info)
 552{
 553        struct netlbl_af6list *list_entry;
 554        struct netlbl_unlhsh_addr6 *entry;
 555        struct audit_buffer *audit_buf;
 556        struct net_device *dev;
 557        char *secctx;
 558        u32 secctx_len;
 559
 560        spin_lock(&netlbl_unlhsh_lock);
 561        list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
 562        spin_unlock(&netlbl_unlhsh_lock);
 563        if (list_entry != NULL)
 564                entry = netlbl_unlhsh_addr6_entry(list_entry);
 565        else
 566                entry = NULL;
 567
 568        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
 569                                              audit_info);
 570        if (audit_buf != NULL) {
 571                dev = dev_get_by_index(net, iface->ifindex);
 572                netlbl_af6list_audit_addr(audit_buf, 1,
 573                                          (dev != NULL ? dev->name : NULL),
 574                                          addr, mask);
 575                if (dev != NULL)
 576                        dev_put(dev);
 577                if (entry != NULL &&
 578                    security_secid_to_secctx(entry->secid,
 579                                             &secctx, &secctx_len) == 0) {
 580                        audit_log_format(audit_buf, " sec_obj=%s", secctx);
 581                        security_release_secctx(secctx, secctx_len);
 582                }
 583                audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
 584                audit_log_end(audit_buf);
 585        }
 586
 587        if (entry == NULL)
 588                return -ENOENT;
 589
 590        kfree_rcu(entry, rcu);
 591        return 0;
 592}
 593#endif /* IPv6 */
 594
 595/**
 596 * netlbl_unlhsh_condremove_iface - Remove an interface entry
 597 * @iface: the interface entry
 598 *
 599 * Description:
 600 * Remove an interface entry from the unlabeled connection hash table if it is
 601 * empty.  An interface entry is considered to be empty if there are no
 602 * address entries assigned to it.
 603 *
 604 */
 605static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
 606{
 607        struct netlbl_af4list *iter4;
 608#if IS_ENABLED(CONFIG_IPV6)
 609        struct netlbl_af6list *iter6;
 610#endif /* IPv6 */
 611
 612        spin_lock(&netlbl_unlhsh_lock);
 613        netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
 614                goto unlhsh_condremove_failure;
 615#if IS_ENABLED(CONFIG_IPV6)
 616        netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
 617                goto unlhsh_condremove_failure;
 618#endif /* IPv6 */
 619        iface->valid = 0;
 620        if (iface->ifindex > 0)
 621                list_del_rcu(&iface->list);
 622        else
 623                RCU_INIT_POINTER(netlbl_unlhsh_def, NULL);
 624        spin_unlock(&netlbl_unlhsh_lock);
 625
 626        call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
 627        return;
 628
 629unlhsh_condremove_failure:
 630        spin_unlock(&netlbl_unlhsh_lock);
 631}
 632
 633/**
 634 * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
 635 * @net: network namespace
 636 * @dev_name: interface name
 637 * @addr: IP address in network byte order
 638 * @mask: address mask in network byte order
 639 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
 640 * @audit_info: NetLabel audit information
 641 *
 642 * Description:
 643 * Removes and existing entry from the unlabeled connection hash table.
 644 * Returns zero on success, negative values on failure.
 645 *
 646 */
 647int netlbl_unlhsh_remove(struct net *net,
 648                         const char *dev_name,
 649                         const void *addr,
 650                         const void *mask,
 651                         u32 addr_len,
 652                         struct netlbl_audit *audit_info)
 653{
 654        int ret_val;
 655        struct net_device *dev;
 656        struct netlbl_unlhsh_iface *iface;
 657
 658        if (addr_len != sizeof(struct in_addr) &&
 659            addr_len != sizeof(struct in6_addr))
 660                return -EINVAL;
 661
 662        rcu_read_lock();
 663        if (dev_name != NULL) {
 664                dev = dev_get_by_name_rcu(net, dev_name);
 665                if (dev == NULL) {
 666                        ret_val = -ENODEV;
 667                        goto unlhsh_remove_return;
 668                }
 669                iface = netlbl_unlhsh_search_iface(dev->ifindex);
 670        } else
 671                iface = rcu_dereference(netlbl_unlhsh_def);
 672        if (iface == NULL) {
 673                ret_val = -ENOENT;
 674                goto unlhsh_remove_return;
 675        }
 676        switch (addr_len) {
 677        case sizeof(struct in_addr):
 678                ret_val = netlbl_unlhsh_remove_addr4(net,
 679                                                     iface, addr, mask,
 680                                                     audit_info);
 681                break;
 682#if IS_ENABLED(CONFIG_IPV6)
 683        case sizeof(struct in6_addr):
 684                ret_val = netlbl_unlhsh_remove_addr6(net,
 685                                                     iface, addr, mask,
 686                                                     audit_info);
 687                break;
 688#endif /* IPv6 */
 689        default:
 690                ret_val = -EINVAL;
 691        }
 692        if (ret_val == 0) {
 693                netlbl_unlhsh_condremove_iface(iface);
 694                atomic_dec(&netlabel_mgmt_protocount);
 695        }
 696
 697unlhsh_remove_return:
 698        rcu_read_unlock();
 699        return ret_val;
 700}
 701
 702/*
 703 * General Helper Functions
 704 */
 705
 706/**
 707 * netlbl_unlhsh_netdev_handler - Network device notification handler
 708 * @this: notifier block
 709 * @event: the event
 710 * @ptr: the netdevice notifier info (cast to void)
 711 *
 712 * Description:
 713 * Handle network device events, although at present all we care about is a
 714 * network device going away.  In the case of a device going away we clear any
 715 * related entries from the unlabeled connection hash table.
 716 *
 717 */
 718static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
 719                                        unsigned long event, void *ptr)
 720{
 721        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 722        struct netlbl_unlhsh_iface *iface = NULL;
 723
 724        if (!net_eq(dev_net(dev), &init_net))
 725                return NOTIFY_DONE;
 726
 727        /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
 728        if (event == NETDEV_DOWN) {
 729                spin_lock(&netlbl_unlhsh_lock);
 730                iface = netlbl_unlhsh_search_iface(dev->ifindex);
 731                if (iface != NULL && iface->valid) {
 732                        iface->valid = 0;
 733                        list_del_rcu(&iface->list);
 734                } else
 735                        iface = NULL;
 736                spin_unlock(&netlbl_unlhsh_lock);
 737        }
 738
 739        if (iface != NULL)
 740                call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
 741
 742        return NOTIFY_DONE;
 743}
 744
 745/**
 746 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
 747 * @value: desired value
 748 * @audit_info: NetLabel audit information
 749 *
 750 * Description:
 751 * Set the value of the unlabeled accept flag to @value.
 752 *
 753 */
 754static void netlbl_unlabel_acceptflg_set(u8 value,
 755                                         struct netlbl_audit *audit_info)
 756{
 757        struct audit_buffer *audit_buf;
 758        u8 old_val;
 759
 760        old_val = netlabel_unlabel_acceptflg;
 761        netlabel_unlabel_acceptflg = value;
 762        audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
 763                                              audit_info);
 764        if (audit_buf != NULL) {
 765                audit_log_format(audit_buf,
 766                                 " unlbl_accept=%u old=%u", value, old_val);
 767                audit_log_end(audit_buf);
 768        }
 769}
 770
 771/**
 772 * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
 773 * @info: the Generic NETLINK info block
 774 * @addr: the IP address
 775 * @mask: the IP address mask
 776 * @len: the address length
 777 *
 778 * Description:
 779 * Examine the Generic NETLINK message and extract the IP address information.
 780 * Returns zero on success, negative values on failure.
 781 *
 782 */
 783static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
 784                                       void **addr,
 785                                       void **mask,
 786                                       u32 *len)
 787{
 788        u32 addr_len;
 789
 790        if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR]) {
 791                addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
 792                if (addr_len != sizeof(struct in_addr) &&
 793                    addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
 794                        return -EINVAL;
 795                *len = addr_len;
 796                *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
 797                *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
 798                return 0;
 799        } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
 800                addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
 801                if (addr_len != sizeof(struct in6_addr) &&
 802                    addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
 803                        return -EINVAL;
 804                *len = addr_len;
 805                *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
 806                *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
 807                return 0;
 808        }
 809
 810        return -EINVAL;
 811}
 812
 813/*
 814 * NetLabel Command Handlers
 815 */
 816
 817/**
 818 * netlbl_unlabel_accept - Handle an ACCEPT message
 819 * @skb: the NETLINK buffer
 820 * @info: the Generic NETLINK info block
 821 *
 822 * Description:
 823 * Process a user generated ACCEPT message and set the accept flag accordingly.
 824 * Returns zero on success, negative values on failure.
 825 *
 826 */
 827static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
 828{
 829        u8 value;
 830        struct netlbl_audit audit_info;
 831
 832        if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
 833                value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
 834                if (value == 1 || value == 0) {
 835                        netlbl_netlink_auditinfo(skb, &audit_info);
 836                        netlbl_unlabel_acceptflg_set(value, &audit_info);
 837                        return 0;
 838                }
 839        }
 840
 841        return -EINVAL;
 842}
 843
 844/**
 845 * netlbl_unlabel_list - Handle a LIST message
 846 * @skb: the NETLINK buffer
 847 * @info: the Generic NETLINK info block
 848 *
 849 * Description:
 850 * Process a user generated LIST message and respond with the current status.
 851 * Returns zero on success, negative values on failure.
 852 *
 853 */
 854static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
 855{
 856        int ret_val = -EINVAL;
 857        struct sk_buff *ans_skb;
 858        void *data;
 859
 860        ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 861        if (ans_skb == NULL)
 862                goto list_failure;
 863        data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
 864                                 0, NLBL_UNLABEL_C_LIST);
 865        if (data == NULL) {
 866                ret_val = -ENOMEM;
 867                goto list_failure;
 868        }
 869
 870        ret_val = nla_put_u8(ans_skb,
 871                             NLBL_UNLABEL_A_ACPTFLG,
 872                             netlabel_unlabel_acceptflg);
 873        if (ret_val != 0)
 874                goto list_failure;
 875
 876        genlmsg_end(ans_skb, data);
 877        return genlmsg_reply(ans_skb, info);
 878
 879list_failure:
 880        kfree_skb(ans_skb);
 881        return ret_val;
 882}
 883
 884/**
 885 * netlbl_unlabel_staticadd - Handle a STATICADD message
 886 * @skb: the NETLINK buffer
 887 * @info: the Generic NETLINK info block
 888 *
 889 * Description:
 890 * Process a user generated STATICADD message and add a new unlabeled
 891 * connection entry to the hash table.  Returns zero on success, negative
 892 * values on failure.
 893 *
 894 */
 895static int netlbl_unlabel_staticadd(struct sk_buff *skb,
 896                                    struct genl_info *info)
 897{
 898        int ret_val;
 899        char *dev_name;
 900        void *addr;
 901        void *mask;
 902        u32 addr_len;
 903        u32 secid;
 904        struct netlbl_audit audit_info;
 905
 906        /* Don't allow users to add both IPv4 and IPv6 addresses for a
 907         * single entry.  However, allow users to create two entries, one each
 908         * for IPv4 and IPv4, with the same LSM security context which should
 909         * achieve the same result. */
 910        if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
 911            !info->attrs[NLBL_UNLABEL_A_IFACE] ||
 912            !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
 913               !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
 914              (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
 915               !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 916                return -EINVAL;
 917
 918        netlbl_netlink_auditinfo(skb, &audit_info);
 919
 920        ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 921        if (ret_val != 0)
 922                return ret_val;
 923        dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
 924        ret_val = security_secctx_to_secid(
 925                                  nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 926                                  nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 927                                  &secid);
 928        if (ret_val != 0)
 929                return ret_val;
 930
 931        return netlbl_unlhsh_add(&init_net,
 932                                 dev_name, addr, mask, addr_len, secid,
 933                                 &audit_info);
 934}
 935
 936/**
 937 * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
 938 * @skb: the NETLINK buffer
 939 * @info: the Generic NETLINK info block
 940 *
 941 * Description:
 942 * Process a user generated STATICADDDEF message and add a new default
 943 * unlabeled connection entry.  Returns zero on success, negative values on
 944 * failure.
 945 *
 946 */
 947static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
 948                                       struct genl_info *info)
 949{
 950        int ret_val;
 951        void *addr;
 952        void *mask;
 953        u32 addr_len;
 954        u32 secid;
 955        struct netlbl_audit audit_info;
 956
 957        /* Don't allow users to add both IPv4 and IPv6 addresses for a
 958         * single entry.  However, allow users to create two entries, one each
 959         * for IPv4 and IPv6, with the same LSM security context which should
 960         * achieve the same result. */
 961        if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
 962            !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
 963               !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
 964              (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
 965               !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 966                return -EINVAL;
 967
 968        netlbl_netlink_auditinfo(skb, &audit_info);
 969
 970        ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 971        if (ret_val != 0)
 972                return ret_val;
 973        ret_val = security_secctx_to_secid(
 974                                  nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 975                                  nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 976                                  &secid);
 977        if (ret_val != 0)
 978                return ret_val;
 979
 980        return netlbl_unlhsh_add(&init_net,
 981                                 NULL, addr, mask, addr_len, secid,
 982                                 &audit_info);
 983}
 984
 985/**
 986 * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
 987 * @skb: the NETLINK buffer
 988 * @info: the Generic NETLINK info block
 989 *
 990 * Description:
 991 * Process a user generated STATICREMOVE message and remove the specified
 992 * unlabeled connection entry.  Returns zero on success, negative values on
 993 * failure.
 994 *
 995 */
 996static int netlbl_unlabel_staticremove(struct sk_buff *skb,
 997                                       struct genl_info *info)
 998{
 999        int ret_val;
1000        char *dev_name;
1001        void *addr;
1002        void *mask;
1003        u32 addr_len;
1004        struct netlbl_audit audit_info;
1005
1006        /* See the note in netlbl_unlabel_staticadd() about not allowing both
1007         * IPv4 and IPv6 in the same entry. */
1008        if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
1009            !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1010               !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1011              (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1012               !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1013                return -EINVAL;
1014
1015        netlbl_netlink_auditinfo(skb, &audit_info);
1016
1017        ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1018        if (ret_val != 0)
1019                return ret_val;
1020        dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
1021
1022        return netlbl_unlhsh_remove(&init_net,
1023                                    dev_name, addr, mask, addr_len,
1024                                    &audit_info);
1025}
1026
1027/**
1028 * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1029 * @skb: the NETLINK buffer
1030 * @info: the Generic NETLINK info block
1031 *
1032 * Description:
1033 * Process a user generated STATICREMOVEDEF message and remove the default
1034 * unlabeled connection entry.  Returns zero on success, negative values on
1035 * failure.
1036 *
1037 */
1038static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
1039                                          struct genl_info *info)
1040{
1041        int ret_val;
1042        void *addr;
1043        void *mask;
1044        u32 addr_len;
1045        struct netlbl_audit audit_info;
1046
1047        /* See the note in netlbl_unlabel_staticadd() about not allowing both
1048         * IPv4 and IPv6 in the same entry. */
1049        if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1050               !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1051              (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1052               !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1053                return -EINVAL;
1054
1055        netlbl_netlink_auditinfo(skb, &audit_info);
1056
1057        ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1058        if (ret_val != 0)
1059                return ret_val;
1060
1061        return netlbl_unlhsh_remove(&init_net,
1062                                    NULL, addr, mask, addr_len,
1063                                    &audit_info);
1064}
1065
1066
1067/**
1068 * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1069 * @cmd: command/message
1070 * @iface: the interface entry
1071 * @addr4: the IPv4 address entry
1072 * @addr6: the IPv6 address entry
1073 * @arg: the netlbl_unlhsh_walk_arg structure
1074 *
1075 * Description:
1076 * This function is designed to be used to generate a response for a
1077 * STATICLIST or STATICLISTDEF message.  When called either @addr4 or @addr6
1078 * can be specified, not both, the other unspecified entry should be set to
1079 * NULL by the caller.  Returns the size of the message on success, negative
1080 * values on failure.
1081 *
1082 */
1083static int netlbl_unlabel_staticlist_gen(u32 cmd,
1084                                       const struct netlbl_unlhsh_iface *iface,
1085                                       const struct netlbl_unlhsh_addr4 *addr4,
1086                                       const struct netlbl_unlhsh_addr6 *addr6,
1087                                       void *arg)
1088{
1089        int ret_val = -ENOMEM;
1090        struct netlbl_unlhsh_walk_arg *cb_arg = arg;
1091        struct net_device *dev;
1092        void *data;
1093        u32 secid;
1094        char *secctx;
1095        u32 secctx_len;
1096
1097        data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
1098                           cb_arg->seq, &netlbl_unlabel_gnl_family,
1099                           NLM_F_MULTI, cmd);
1100        if (data == NULL)
1101                goto list_cb_failure;
1102
1103        if (iface->ifindex > 0) {
1104                dev = dev_get_by_index(&init_net, iface->ifindex);
1105                if (!dev) {
1106                        ret_val = -ENODEV;
1107                        goto list_cb_failure;
1108                }
1109                ret_val = nla_put_string(cb_arg->skb,
1110                                         NLBL_UNLABEL_A_IFACE, dev->name);
1111                dev_put(dev);
1112                if (ret_val != 0)
1113                        goto list_cb_failure;
1114        }
1115
1116        if (addr4) {
1117                struct in_addr addr_struct;
1118
1119                addr_struct.s_addr = addr4->list.addr;
1120                ret_val = nla_put_in_addr(cb_arg->skb,
1121                                          NLBL_UNLABEL_A_IPV4ADDR,
1122                                          addr_struct.s_addr);
1123                if (ret_val != 0)
1124                        goto list_cb_failure;
1125
1126                addr_struct.s_addr = addr4->list.mask;
1127                ret_val = nla_put_in_addr(cb_arg->skb,
1128                                          NLBL_UNLABEL_A_IPV4MASK,
1129                                          addr_struct.s_addr);
1130                if (ret_val != 0)
1131                        goto list_cb_failure;
1132
1133                secid = addr4->secid;
1134        } else {
1135                ret_val = nla_put_in6_addr(cb_arg->skb,
1136                                           NLBL_UNLABEL_A_IPV6ADDR,
1137                                           &addr6->list.addr);
1138                if (ret_val != 0)
1139                        goto list_cb_failure;
1140
1141                ret_val = nla_put_in6_addr(cb_arg->skb,
1142                                           NLBL_UNLABEL_A_IPV6MASK,
1143                                           &addr6->list.mask);
1144                if (ret_val != 0)
1145                        goto list_cb_failure;
1146
1147                secid = addr6->secid;
1148        }
1149
1150        ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
1151        if (ret_val != 0)
1152                goto list_cb_failure;
1153        ret_val = nla_put(cb_arg->skb,
1154                          NLBL_UNLABEL_A_SECCTX,
1155                          secctx_len,
1156                          secctx);
1157        security_release_secctx(secctx, secctx_len);
1158        if (ret_val != 0)
1159                goto list_cb_failure;
1160
1161        cb_arg->seq++;
1162        genlmsg_end(cb_arg->skb, data);
1163        return 0;
1164
1165list_cb_failure:
1166        genlmsg_cancel(cb_arg->skb, data);
1167        return ret_val;
1168}
1169
1170/**
1171 * netlbl_unlabel_staticlist - Handle a STATICLIST message
1172 * @skb: the NETLINK buffer
1173 * @cb: the NETLINK callback
1174 *
1175 * Description:
1176 * Process a user generated STATICLIST message and dump the unlabeled
1177 * connection hash table in a form suitable for use in a kernel generated
1178 * STATICLIST message.  Returns the length of @skb.
1179 *
1180 */
1181static int netlbl_unlabel_staticlist(struct sk_buff *skb,
1182                                     struct netlink_callback *cb)
1183{
1184        struct netlbl_unlhsh_walk_arg cb_arg;
1185        u32 skip_bkt = cb->args[0];
1186        u32 skip_chain = cb->args[1];
1187        u32 iter_bkt;
1188        u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
1189        struct netlbl_unlhsh_iface *iface;
1190        struct list_head *iter_list;
1191        struct netlbl_af4list *addr4;
1192#if IS_ENABLED(CONFIG_IPV6)
1193        struct netlbl_af6list *addr6;
1194#endif
1195
1196        cb_arg.nl_cb = cb;
1197        cb_arg.skb = skb;
1198        cb_arg.seq = cb->nlh->nlmsg_seq;
1199
1200        rcu_read_lock();
1201        for (iter_bkt = skip_bkt;
1202             iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
1203             iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
1204                iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
1205                list_for_each_entry_rcu(iface, iter_list, list) {
1206                        if (!iface->valid ||
1207                            iter_chain++ < skip_chain)
1208                                continue;
1209                        netlbl_af4list_foreach_rcu(addr4,
1210                                                   &iface->addr4_list) {
1211                                if (iter_addr4++ < cb->args[2])
1212                                        continue;
1213                                if (netlbl_unlabel_staticlist_gen(
1214                                              NLBL_UNLABEL_C_STATICLIST,
1215                                              iface,
1216                                              netlbl_unlhsh_addr4_entry(addr4),
1217                                              NULL,
1218                                              &cb_arg) < 0) {
1219                                        iter_addr4--;
1220                                        iter_chain--;
1221                                        goto unlabel_staticlist_return;
1222                                }
1223                        }
1224#if IS_ENABLED(CONFIG_IPV6)
1225                        netlbl_af6list_foreach_rcu(addr6,
1226                                                   &iface->addr6_list) {
1227                                if (iter_addr6++ < cb->args[3])
1228                                        continue;
1229                                if (netlbl_unlabel_staticlist_gen(
1230                                              NLBL_UNLABEL_C_STATICLIST,
1231                                              iface,
1232                                              NULL,
1233                                              netlbl_unlhsh_addr6_entry(addr6),
1234                                              &cb_arg) < 0) {
1235                                        iter_addr6--;
1236                                        iter_chain--;
1237                                        goto unlabel_staticlist_return;
1238                                }
1239                        }
1240#endif /* IPv6 */
1241                }
1242        }
1243
1244unlabel_staticlist_return:
1245        rcu_read_unlock();
1246        cb->args[0] = iter_bkt;
1247        cb->args[1] = iter_chain;
1248        cb->args[2] = iter_addr4;
1249        cb->args[3] = iter_addr6;
1250        return skb->len;
1251}
1252
1253/**
1254 * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1255 * @skb: the NETLINK buffer
1256 * @cb: the NETLINK callback
1257 *
1258 * Description:
1259 * Process a user generated STATICLISTDEF message and dump the default
1260 * unlabeled connection entry in a form suitable for use in a kernel generated
1261 * STATICLISTDEF message.  Returns the length of @skb.
1262 *
1263 */
1264static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
1265                                        struct netlink_callback *cb)
1266{
1267        struct netlbl_unlhsh_walk_arg cb_arg;
1268        struct netlbl_unlhsh_iface *iface;
1269        u32 iter_addr4 = 0, iter_addr6 = 0;
1270        struct netlbl_af4list *addr4;
1271#if IS_ENABLED(CONFIG_IPV6)
1272        struct netlbl_af6list *addr6;
1273#endif
1274
1275        cb_arg.nl_cb = cb;
1276        cb_arg.skb = skb;
1277        cb_arg.seq = cb->nlh->nlmsg_seq;
1278
1279        rcu_read_lock();
1280        iface = rcu_dereference(netlbl_unlhsh_def);
1281        if (iface == NULL || !iface->valid)
1282                goto unlabel_staticlistdef_return;
1283
1284        netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
1285                if (iter_addr4++ < cb->args[0])
1286                        continue;
1287                if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1288                                              iface,
1289                                              netlbl_unlhsh_addr4_entry(addr4),
1290                                              NULL,
1291                                              &cb_arg) < 0) {
1292                        iter_addr4--;
1293                        goto unlabel_staticlistdef_return;
1294                }
1295        }
1296#if IS_ENABLED(CONFIG_IPV6)
1297        netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
1298                if (iter_addr6++ < cb->args[1])
1299                        continue;
1300                if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1301                                              iface,
1302                                              NULL,
1303                                              netlbl_unlhsh_addr6_entry(addr6),
1304                                              &cb_arg) < 0) {
1305                        iter_addr6--;
1306                        goto unlabel_staticlistdef_return;
1307                }
1308        }
1309#endif /* IPv6 */
1310
1311unlabel_staticlistdef_return:
1312        rcu_read_unlock();
1313        cb->args[0] = iter_addr4;
1314        cb->args[1] = iter_addr6;
1315        return skb->len;
1316}
1317
1318/*
1319 * NetLabel Generic NETLINK Command Definitions
1320 */
1321
1322static const struct genl_ops netlbl_unlabel_genl_ops[] = {
1323        {
1324        .cmd = NLBL_UNLABEL_C_STATICADD,
1325        .flags = GENL_ADMIN_PERM,
1326        .policy = netlbl_unlabel_genl_policy,
1327        .doit = netlbl_unlabel_staticadd,
1328        .dumpit = NULL,
1329        },
1330        {
1331        .cmd = NLBL_UNLABEL_C_STATICREMOVE,
1332        .flags = GENL_ADMIN_PERM,
1333        .policy = netlbl_unlabel_genl_policy,
1334        .doit = netlbl_unlabel_staticremove,
1335        .dumpit = NULL,
1336        },
1337        {
1338        .cmd = NLBL_UNLABEL_C_STATICLIST,
1339        .flags = 0,
1340        .policy = netlbl_unlabel_genl_policy,
1341        .doit = NULL,
1342        .dumpit = netlbl_unlabel_staticlist,
1343        },
1344        {
1345        .cmd = NLBL_UNLABEL_C_STATICADDDEF,
1346        .flags = GENL_ADMIN_PERM,
1347        .policy = netlbl_unlabel_genl_policy,
1348        .doit = netlbl_unlabel_staticadddef,
1349        .dumpit = NULL,
1350        },
1351        {
1352        .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
1353        .flags = GENL_ADMIN_PERM,
1354        .policy = netlbl_unlabel_genl_policy,
1355        .doit = netlbl_unlabel_staticremovedef,
1356        .dumpit = NULL,
1357        },
1358        {
1359        .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
1360        .flags = 0,
1361        .policy = netlbl_unlabel_genl_policy,
1362        .doit = NULL,
1363        .dumpit = netlbl_unlabel_staticlistdef,
1364        },
1365        {
1366        .cmd = NLBL_UNLABEL_C_ACCEPT,
1367        .flags = GENL_ADMIN_PERM,
1368        .policy = netlbl_unlabel_genl_policy,
1369        .doit = netlbl_unlabel_accept,
1370        .dumpit = NULL,
1371        },
1372        {
1373        .cmd = NLBL_UNLABEL_C_LIST,
1374        .flags = 0,
1375        .policy = netlbl_unlabel_genl_policy,
1376        .doit = netlbl_unlabel_list,
1377        .dumpit = NULL,
1378        },
1379};
1380
1381/*
1382 * NetLabel Generic NETLINK Protocol Functions
1383 */
1384
1385/**
1386 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1387 *
1388 * Description:
1389 * Register the unlabeled packet NetLabel component with the Generic NETLINK
1390 * mechanism.  Returns zero on success, negative values on failure.
1391 *
1392 */
1393int __init netlbl_unlabel_genl_init(void)
1394{
1395        return genl_register_family_with_ops(&netlbl_unlabel_gnl_family,
1396                                             netlbl_unlabel_genl_ops);
1397}
1398
1399/*
1400 * NetLabel KAPI Hooks
1401 */
1402
1403static struct notifier_block netlbl_unlhsh_netdev_notifier = {
1404        .notifier_call = netlbl_unlhsh_netdev_handler,
1405};
1406
1407/**
1408 * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1409 * @size: the number of bits to use for the hash buckets
1410 *
1411 * Description:
1412 * Initializes the unlabeled connection hash table and registers a network
1413 * device notification handler.  This function should only be called by the
1414 * NetLabel subsystem itself during initialization.  Returns zero on success,
1415 * non-zero values on error.
1416 *
1417 */
1418int __init netlbl_unlabel_init(u32 size)
1419{
1420        u32 iter;
1421        struct netlbl_unlhsh_tbl *hsh_tbl;
1422
1423        if (size == 0)
1424                return -EINVAL;
1425
1426        hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
1427        if (hsh_tbl == NULL)
1428                return -ENOMEM;
1429        hsh_tbl->size = 1 << size;
1430        hsh_tbl->tbl = kcalloc(hsh_tbl->size,
1431                               sizeof(struct list_head),
1432                               GFP_KERNEL);
1433        if (hsh_tbl->tbl == NULL) {
1434                kfree(hsh_tbl);
1435                return -ENOMEM;
1436        }
1437        for (iter = 0; iter < hsh_tbl->size; iter++)
1438                INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
1439
1440        spin_lock(&netlbl_unlhsh_lock);
1441        rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
1442        spin_unlock(&netlbl_unlhsh_lock);
1443
1444        register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
1445
1446        return 0;
1447}
1448
1449/**
1450 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1451 * @skb: the packet
1452 * @family: protocol family
1453 * @secattr: the security attributes
1454 *
1455 * Description:
1456 * Determine the security attributes, if any, for an unlabled packet and return
1457 * them in @secattr.  Returns zero on success and negative values on failure.
1458 *
1459 */
1460int netlbl_unlabel_getattr(const struct sk_buff *skb,
1461                           u16 family,
1462                           struct netlbl_lsm_secattr *secattr)
1463{
1464        struct netlbl_unlhsh_iface *iface;
1465
1466        rcu_read_lock();
1467        iface = netlbl_unlhsh_search_iface(skb->skb_iif);
1468        if (iface == NULL)
1469                iface = rcu_dereference(netlbl_unlhsh_def);
1470        if (iface == NULL || !iface->valid)
1471                goto unlabel_getattr_nolabel;
1472        switch (family) {
1473        case PF_INET: {
1474                struct iphdr *hdr4;
1475                struct netlbl_af4list *addr4;
1476
1477                hdr4 = ip_hdr(skb);
1478                addr4 = netlbl_af4list_search(hdr4->saddr,
1479                                              &iface->addr4_list);
1480                if (addr4 == NULL)
1481                        goto unlabel_getattr_nolabel;
1482                secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
1483                break;
1484        }
1485#if IS_ENABLED(CONFIG_IPV6)
1486        case PF_INET6: {
1487                struct ipv6hdr *hdr6;
1488                struct netlbl_af6list *addr6;
1489
1490                hdr6 = ipv6_hdr(skb);
1491                addr6 = netlbl_af6list_search(&hdr6->saddr,
1492                                              &iface->addr6_list);
1493                if (addr6 == NULL)
1494                        goto unlabel_getattr_nolabel;
1495                secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
1496                break;
1497        }
1498#endif /* IPv6 */
1499        default:
1500                goto unlabel_getattr_nolabel;
1501        }
1502        rcu_read_unlock();
1503
1504        secattr->flags |= NETLBL_SECATTR_SECID;
1505        secattr->type = NETLBL_NLTYPE_UNLABELED;
1506        return 0;
1507
1508unlabel_getattr_nolabel:
1509        rcu_read_unlock();
1510        if (netlabel_unlabel_acceptflg == 0)
1511                return -ENOMSG;
1512        secattr->type = NETLBL_NLTYPE_UNLABELED;
1513        return 0;
1514}
1515
1516/**
1517 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1518 *
1519 * Description:
1520 * Set the default NetLabel configuration to allow incoming unlabeled packets
1521 * and to send unlabeled network traffic by default.
1522 *
1523 */
1524int __init netlbl_unlabel_defconf(void)
1525{
1526        int ret_val;
1527        struct netlbl_dom_map *entry;
1528        struct netlbl_audit audit_info;
1529
1530        /* Only the kernel is allowed to call this function and the only time
1531         * it is called is at bootup before the audit subsystem is reporting
1532         * messages so don't worry to much about these values. */
1533        security_task_getsecid(current, &audit_info.secid);
1534        audit_info.loginuid = GLOBAL_ROOT_UID;
1535        audit_info.sessionid = 0;
1536
1537        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1538        if (entry == NULL)
1539                return -ENOMEM;
1540        entry->def.type = NETLBL_NLTYPE_UNLABELED;
1541        ret_val = netlbl_domhsh_add_default(entry, &audit_info);
1542        if (ret_val != 0)
1543                return ret_val;
1544
1545        netlbl_unlabel_acceptflg_set(1, &audit_info);
1546
1547        return 0;
1548}
1549