1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38#include <linux/init.h>
39#include <linux/types.h>
40#include <linux/rcupdate.h>
41#include <linux/list.h>
42#include <linux/spinlock.h>
43#include <linux/string.h>
44#include <linux/jhash.h>
45#include <linux/audit.h>
46#include <linux/slab.h>
47#include <net/ip.h>
48#include <net/icmp.h>
49#include <net/tcp.h>
50#include <net/netlabel.h>
51#include <net/cipso_ipv4.h>
52#include <linux/atomic.h>
53#include <linux/bug.h>
54#include <asm/unaligned.h>
55
56
57
58
59
60
61static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
62static LIST_HEAD(cipso_v4_doi_list);
63
64
65int cipso_v4_cache_enabled = 1;
66int cipso_v4_cache_bucketsize = 10;
67#define CIPSO_V4_CACHE_BUCKETBITS 7
68#define CIPSO_V4_CACHE_BUCKETS (1 << CIPSO_V4_CACHE_BUCKETBITS)
69#define CIPSO_V4_CACHE_REORDERLIMIT 10
70struct cipso_v4_map_cache_bkt {
71 spinlock_t lock;
72 u32 size;
73 struct list_head list;
74};
75
76struct cipso_v4_map_cache_entry {
77 u32 hash;
78 unsigned char *key;
79 size_t key_len;
80
81 struct netlbl_lsm_cache *lsm_data;
82
83 u32 activity;
84 struct list_head list;
85};
86
87static struct cipso_v4_map_cache_bkt *cipso_v4_cache;
88
89
90int cipso_v4_rbm_optfmt = 0;
91int cipso_v4_rbm_strictvalid = 1;
92
93
94
95
96
97
98
99#define CIPSO_V4_OPT_LEN_MAX 40
100
101
102
103#define CIPSO_V4_HDR_LEN 6
104
105
106#define CIPSO_V4_TAG_RBM_BLEN 4
107
108
109#define CIPSO_V4_TAG_ENUM_BLEN 4
110
111
112#define CIPSO_V4_TAG_RNG_BLEN 4
113
114
115
116
117
118#define CIPSO_V4_TAG_RNG_CAT_MAX 8
119
120
121
122
123
124
125
126
127
128
129
130
131#define CIPSO_V4_TAG_LOC_BLEN 6
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149static int cipso_v4_bitmap_walk(const unsigned char *bitmap,
150 u32 bitmap_len,
151 u32 offset,
152 u8 state)
153{
154 u32 bit_spot;
155 u32 byte_offset;
156 unsigned char bitmask;
157 unsigned char byte;
158
159
160 byte_offset = offset / 8;
161 byte = bitmap[byte_offset];
162 bit_spot = offset;
163 bitmask = 0x80 >> (offset % 8);
164
165 while (bit_spot < bitmap_len) {
166 if ((state && (byte & bitmask) == bitmask) ||
167 (state == 0 && (byte & bitmask) == 0))
168 return bit_spot;
169
170 bit_spot++;
171 bitmask >>= 1;
172 if (bitmask == 0) {
173 byte = bitmap[++byte_offset];
174 bitmask = 0x80;
175 }
176 }
177
178 return -1;
179}
180
181
182
183
184
185
186
187
188
189
190
191static void cipso_v4_bitmap_setbit(unsigned char *bitmap,
192 u32 bit,
193 u8 state)
194{
195 u32 byte_spot;
196 u8 bitmask;
197
198
199 byte_spot = bit / 8;
200 bitmask = 0x80 >> (bit % 8);
201 if (state)
202 bitmap[byte_spot] |= bitmask;
203 else
204 bitmap[byte_spot] &= ~bitmask;
205}
206
207
208
209
210
211
212
213
214
215
216static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
217{
218 if (entry->lsm_data)
219 netlbl_secattr_cache_free(entry->lsm_data);
220 kfree(entry->key);
221 kfree(entry);
222}
223
224
225
226
227
228
229
230
231
232
233static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
234{
235 return jhash(key, key_len, 0);
236}
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251static int __init cipso_v4_cache_init(void)
252{
253 u32 iter;
254
255 cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
256 sizeof(struct cipso_v4_map_cache_bkt),
257 GFP_KERNEL);
258 if (!cipso_v4_cache)
259 return -ENOMEM;
260
261 for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
262 spin_lock_init(&cipso_v4_cache[iter].lock);
263 cipso_v4_cache[iter].size = 0;
264 INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
265 }
266
267 return 0;
268}
269
270
271
272
273
274
275
276
277
278void cipso_v4_cache_invalidate(void)
279{
280 struct cipso_v4_map_cache_entry *entry, *tmp_entry;
281 u32 iter;
282
283 for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
284 spin_lock_bh(&cipso_v4_cache[iter].lock);
285 list_for_each_entry_safe(entry,
286 tmp_entry,
287 &cipso_v4_cache[iter].list, list) {
288 list_del(&entry->list);
289 cipso_v4_cache_entry_free(entry);
290 }
291 cipso_v4_cache[iter].size = 0;
292 spin_unlock_bh(&cipso_v4_cache[iter].lock);
293 }
294}
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318static int cipso_v4_cache_check(const unsigned char *key,
319 u32 key_len,
320 struct netlbl_lsm_secattr *secattr)
321{
322 u32 bkt;
323 struct cipso_v4_map_cache_entry *entry;
324 struct cipso_v4_map_cache_entry *prev_entry = NULL;
325 u32 hash;
326
327 if (!cipso_v4_cache_enabled)
328 return -ENOENT;
329
330 hash = cipso_v4_map_cache_hash(key, key_len);
331 bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
332 spin_lock_bh(&cipso_v4_cache[bkt].lock);
333 list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
334 if (entry->hash == hash &&
335 entry->key_len == key_len &&
336 memcmp(entry->key, key, key_len) == 0) {
337 entry->activity += 1;
338 atomic_inc(&entry->lsm_data->refcount);
339 secattr->cache = entry->lsm_data;
340 secattr->flags |= NETLBL_SECATTR_CACHE;
341 secattr->type = NETLBL_NLTYPE_CIPSOV4;
342 if (!prev_entry) {
343 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
344 return 0;
345 }
346
347 if (prev_entry->activity > 0)
348 prev_entry->activity -= 1;
349 if (entry->activity > prev_entry->activity &&
350 entry->activity - prev_entry->activity >
351 CIPSO_V4_CACHE_REORDERLIMIT) {
352 __list_del(entry->list.prev, entry->list.next);
353 __list_add(&entry->list,
354 prev_entry->list.prev,
355 &prev_entry->list);
356 }
357
358 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
359 return 0;
360 }
361 prev_entry = entry;
362 }
363 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
364
365 return -ENOENT;
366}
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381int cipso_v4_cache_add(const unsigned char *cipso_ptr,
382 const struct netlbl_lsm_secattr *secattr)
383{
384 int ret_val = -EPERM;
385 u32 bkt;
386 struct cipso_v4_map_cache_entry *entry = NULL;
387 struct cipso_v4_map_cache_entry *old_entry = NULL;
388 u32 cipso_ptr_len;
389
390 if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
391 return 0;
392
393 cipso_ptr_len = cipso_ptr[1];
394
395 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
396 if (!entry)
397 return -ENOMEM;
398 entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
399 if (!entry->key) {
400 ret_val = -ENOMEM;
401 goto cache_add_failure;
402 }
403 entry->key_len = cipso_ptr_len;
404 entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
405 atomic_inc(&secattr->cache->refcount);
406 entry->lsm_data = secattr->cache;
407
408 bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
409 spin_lock_bh(&cipso_v4_cache[bkt].lock);
410 if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
411 list_add(&entry->list, &cipso_v4_cache[bkt].list);
412 cipso_v4_cache[bkt].size += 1;
413 } else {
414 old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
415 struct cipso_v4_map_cache_entry, list);
416 list_del(&old_entry->list);
417 list_add(&entry->list, &cipso_v4_cache[bkt].list);
418 cipso_v4_cache_entry_free(old_entry);
419 }
420 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
421
422 return 0;
423
424cache_add_failure:
425 if (entry)
426 cipso_v4_cache_entry_free(entry);
427 return ret_val;
428}
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
444{
445 struct cipso_v4_doi *iter;
446
447 list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
448 if (iter->doi == doi && atomic_read(&iter->refcount))
449 return iter;
450 return NULL;
451}
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
467 struct netlbl_audit *audit_info)
468{
469 int ret_val = -EINVAL;
470 u32 iter;
471 u32 doi;
472 u32 doi_type;
473 struct audit_buffer *audit_buf;
474
475 doi = doi_def->doi;
476 doi_type = doi_def->type;
477
478 if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
479 goto doi_add_return;
480 for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
481 switch (doi_def->tags[iter]) {
482 case CIPSO_V4_TAG_RBITMAP:
483 break;
484 case CIPSO_V4_TAG_RANGE:
485 case CIPSO_V4_TAG_ENUM:
486 if (doi_def->type != CIPSO_V4_MAP_PASS)
487 goto doi_add_return;
488 break;
489 case CIPSO_V4_TAG_LOCAL:
490 if (doi_def->type != CIPSO_V4_MAP_LOCAL)
491 goto doi_add_return;
492 break;
493 case CIPSO_V4_TAG_INVALID:
494 if (iter == 0)
495 goto doi_add_return;
496 break;
497 default:
498 goto doi_add_return;
499 }
500 }
501
502 atomic_set(&doi_def->refcount, 1);
503
504 spin_lock(&cipso_v4_doi_list_lock);
505 if (cipso_v4_doi_search(doi_def->doi)) {
506 spin_unlock(&cipso_v4_doi_list_lock);
507 ret_val = -EEXIST;
508 goto doi_add_return;
509 }
510 list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
511 spin_unlock(&cipso_v4_doi_list_lock);
512 ret_val = 0;
513
514doi_add_return:
515 audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
516 if (audit_buf) {
517 const char *type_str;
518 switch (doi_type) {
519 case CIPSO_V4_MAP_TRANS:
520 type_str = "trans";
521 break;
522 case CIPSO_V4_MAP_PASS:
523 type_str = "pass";
524 break;
525 case CIPSO_V4_MAP_LOCAL:
526 type_str = "local";
527 break;
528 default:
529 type_str = "(unknown)";
530 }
531 audit_log_format(audit_buf,
532 " cipso_doi=%u cipso_type=%s res=%u",
533 doi, type_str, ret_val == 0 ? 1 : 0);
534 audit_log_end(audit_buf);
535 }
536
537 return ret_val;
538}
539
540
541
542
543
544
545
546
547
548void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
549{
550 if (!doi_def)
551 return;
552
553 switch (doi_def->type) {
554 case CIPSO_V4_MAP_TRANS:
555 kfree(doi_def->map.std->lvl.cipso);
556 kfree(doi_def->map.std->lvl.local);
557 kfree(doi_def->map.std->cat.cipso);
558 kfree(doi_def->map.std->cat.local);
559 break;
560 }
561 kfree(doi_def);
562}
563
564
565
566
567
568
569
570
571
572
573
574static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
575{
576 struct cipso_v4_doi *doi_def;
577
578 doi_def = container_of(entry, struct cipso_v4_doi, rcu);
579 cipso_v4_doi_free(doi_def);
580}
581
582
583
584
585
586
587
588
589
590
591
592
593int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
594{
595 int ret_val;
596 struct cipso_v4_doi *doi_def;
597 struct audit_buffer *audit_buf;
598
599 spin_lock(&cipso_v4_doi_list_lock);
600 doi_def = cipso_v4_doi_search(doi);
601 if (!doi_def) {
602 spin_unlock(&cipso_v4_doi_list_lock);
603 ret_val = -ENOENT;
604 goto doi_remove_return;
605 }
606 if (!atomic_dec_and_test(&doi_def->refcount)) {
607 spin_unlock(&cipso_v4_doi_list_lock);
608 ret_val = -EBUSY;
609 goto doi_remove_return;
610 }
611 list_del_rcu(&doi_def->list);
612 spin_unlock(&cipso_v4_doi_list_lock);
613
614 cipso_v4_cache_invalidate();
615 call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
616 ret_val = 0;
617
618doi_remove_return:
619 audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
620 if (audit_buf) {
621 audit_log_format(audit_buf,
622 " cipso_doi=%u res=%u",
623 doi, ret_val == 0 ? 1 : 0);
624 audit_log_end(audit_buf);
625 }
626
627 return ret_val;
628}
629
630
631
632
633
634
635
636
637
638
639
640
641struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
642{
643 struct cipso_v4_doi *doi_def;
644
645 rcu_read_lock();
646 doi_def = cipso_v4_doi_search(doi);
647 if (!doi_def)
648 goto doi_getdef_return;
649 if (!atomic_inc_not_zero(&doi_def->refcount))
650 doi_def = NULL;
651
652doi_getdef_return:
653 rcu_read_unlock();
654 return doi_def;
655}
656
657
658
659
660
661
662
663
664
665void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
666{
667 if (!doi_def)
668 return;
669
670 if (!atomic_dec_and_test(&doi_def->refcount))
671 return;
672 spin_lock(&cipso_v4_doi_list_lock);
673 list_del_rcu(&doi_def->list);
674 spin_unlock(&cipso_v4_doi_list_lock);
675
676 cipso_v4_cache_invalidate();
677 call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
678}
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693int cipso_v4_doi_walk(u32 *skip_cnt,
694 int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
695 void *cb_arg)
696{
697 int ret_val = -ENOENT;
698 u32 doi_cnt = 0;
699 struct cipso_v4_doi *iter_doi;
700
701 rcu_read_lock();
702 list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
703 if (atomic_read(&iter_doi->refcount) > 0) {
704 if (doi_cnt++ < *skip_cnt)
705 continue;
706 ret_val = callback(iter_doi, cb_arg);
707 if (ret_val < 0) {
708 doi_cnt--;
709 goto doi_walk_return;
710 }
711 }
712
713doi_walk_return:
714 rcu_read_unlock();
715 *skip_cnt = doi_cnt;
716 return ret_val;
717}
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
735{
736 switch (doi_def->type) {
737 case CIPSO_V4_MAP_PASS:
738 return 0;
739 case CIPSO_V4_MAP_TRANS:
740 if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
741 return 0;
742 break;
743 }
744
745 return -EFAULT;
746}
747
748
749
750
751
752
753
754
755
756
757
758
759
760static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
761 u32 host_lvl,
762 u32 *net_lvl)
763{
764 switch (doi_def->type) {
765 case CIPSO_V4_MAP_PASS:
766 *net_lvl = host_lvl;
767 return 0;
768 case CIPSO_V4_MAP_TRANS:
769 if (host_lvl < doi_def->map.std->lvl.local_size &&
770 doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
771 *net_lvl = doi_def->map.std->lvl.local[host_lvl];
772 return 0;
773 }
774 return -EPERM;
775 }
776
777 return -EINVAL;
778}
779
780
781
782
783
784
785
786
787
788
789
790
791
792static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
793 u32 net_lvl,
794 u32 *host_lvl)
795{
796 struct cipso_v4_std_map_tbl *map_tbl;
797
798 switch (doi_def->type) {
799 case CIPSO_V4_MAP_PASS:
800 *host_lvl = net_lvl;
801 return 0;
802 case CIPSO_V4_MAP_TRANS:
803 map_tbl = doi_def->map.std;
804 if (net_lvl < map_tbl->lvl.cipso_size &&
805 map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
806 *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
807 return 0;
808 }
809 return -EPERM;
810 }
811
812 return -EINVAL;
813}
814
815
816
817
818
819
820
821
822
823
824
825
826
827static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
828 const unsigned char *bitmap,
829 u32 bitmap_len)
830{
831 int cat = -1;
832 u32 bitmap_len_bits = bitmap_len * 8;
833 u32 cipso_cat_size;
834 u32 *cipso_array;
835
836 switch (doi_def->type) {
837 case CIPSO_V4_MAP_PASS:
838 return 0;
839 case CIPSO_V4_MAP_TRANS:
840 cipso_cat_size = doi_def->map.std->cat.cipso_size;
841 cipso_array = doi_def->map.std->cat.cipso;
842 for (;;) {
843 cat = cipso_v4_bitmap_walk(bitmap,
844 bitmap_len_bits,
845 cat + 1,
846 1);
847 if (cat < 0)
848 break;
849 if (cat >= cipso_cat_size ||
850 cipso_array[cat] >= CIPSO_V4_INV_CAT)
851 return -EFAULT;
852 }
853
854 if (cat == -1)
855 return 0;
856 break;
857 }
858
859 return -EFAULT;
860}
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
876 const struct netlbl_lsm_secattr *secattr,
877 unsigned char *net_cat,
878 u32 net_cat_len)
879{
880 int host_spot = -1;
881 u32 net_spot = CIPSO_V4_INV_CAT;
882 u32 net_spot_max = 0;
883 u32 net_clen_bits = net_cat_len * 8;
884 u32 host_cat_size = 0;
885 u32 *host_cat_array = NULL;
886
887 if (doi_def->type == CIPSO_V4_MAP_TRANS) {
888 host_cat_size = doi_def->map.std->cat.local_size;
889 host_cat_array = doi_def->map.std->cat.local;
890 }
891
892 for (;;) {
893 host_spot = netlbl_catmap_walk(secattr->attr.mls.cat,
894 host_spot + 1);
895 if (host_spot < 0)
896 break;
897
898 switch (doi_def->type) {
899 case CIPSO_V4_MAP_PASS:
900 net_spot = host_spot;
901 break;
902 case CIPSO_V4_MAP_TRANS:
903 if (host_spot >= host_cat_size)
904 return -EPERM;
905 net_spot = host_cat_array[host_spot];
906 if (net_spot >= CIPSO_V4_INV_CAT)
907 return -EPERM;
908 break;
909 }
910 if (net_spot >= net_clen_bits)
911 return -ENOSPC;
912 cipso_v4_bitmap_setbit(net_cat, net_spot, 1);
913
914 if (net_spot > net_spot_max)
915 net_spot_max = net_spot;
916 }
917
918 if (++net_spot_max % 8)
919 return net_spot_max / 8 + 1;
920 return net_spot_max / 8;
921}
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
937 const unsigned char *net_cat,
938 u32 net_cat_len,
939 struct netlbl_lsm_secattr *secattr)
940{
941 int ret_val;
942 int net_spot = -1;
943 u32 host_spot = CIPSO_V4_INV_CAT;
944 u32 net_clen_bits = net_cat_len * 8;
945 u32 net_cat_size = 0;
946 u32 *net_cat_array = NULL;
947
948 if (doi_def->type == CIPSO_V4_MAP_TRANS) {
949 net_cat_size = doi_def->map.std->cat.cipso_size;
950 net_cat_array = doi_def->map.std->cat.cipso;
951 }
952
953 for (;;) {
954 net_spot = cipso_v4_bitmap_walk(net_cat,
955 net_clen_bits,
956 net_spot + 1,
957 1);
958 if (net_spot < 0) {
959 if (net_spot == -2)
960 return -EFAULT;
961 return 0;
962 }
963
964 switch (doi_def->type) {
965 case CIPSO_V4_MAP_PASS:
966 host_spot = net_spot;
967 break;
968 case CIPSO_V4_MAP_TRANS:
969 if (net_spot >= net_cat_size)
970 return -EPERM;
971 host_spot = net_cat_array[net_spot];
972 if (host_spot >= CIPSO_V4_INV_CAT)
973 return -EPERM;
974 break;
975 }
976 ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
977 host_spot,
978 GFP_ATOMIC);
979 if (ret_val != 0)
980 return ret_val;
981 }
982
983 return -EINVAL;
984}
985
986
987
988
989
990
991
992
993
994
995
996
997
998static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
999 const unsigned char *enumcat,
1000 u32 enumcat_len)
1001{
1002 u16 cat;
1003 int cat_prev = -1;
1004 u32 iter;
1005
1006 if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
1007 return -EFAULT;
1008
1009 for (iter = 0; iter < enumcat_len; iter += 2) {
1010 cat = get_unaligned_be16(&enumcat[iter]);
1011 if (cat <= cat_prev)
1012 return -EFAULT;
1013 cat_prev = cat;
1014 }
1015
1016 return 0;
1017}
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
1034 const struct netlbl_lsm_secattr *secattr,
1035 unsigned char *net_cat,
1036 u32 net_cat_len)
1037{
1038 int cat = -1;
1039 u32 cat_iter = 0;
1040
1041 for (;;) {
1042 cat = netlbl_catmap_walk(secattr->attr.mls.cat, cat + 1);
1043 if (cat < 0)
1044 break;
1045 if ((cat_iter + 2) > net_cat_len)
1046 return -ENOSPC;
1047
1048 *((__be16 *)&net_cat[cat_iter]) = htons(cat);
1049 cat_iter += 2;
1050 }
1051
1052 return cat_iter;
1053}
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
1069 const unsigned char *net_cat,
1070 u32 net_cat_len,
1071 struct netlbl_lsm_secattr *secattr)
1072{
1073 int ret_val;
1074 u32 iter;
1075
1076 for (iter = 0; iter < net_cat_len; iter += 2) {
1077 ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
1078 get_unaligned_be16(&net_cat[iter]),
1079 GFP_ATOMIC);
1080 if (ret_val != 0)
1081 return ret_val;
1082 }
1083
1084 return 0;
1085}
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1100 const unsigned char *rngcat,
1101 u32 rngcat_len)
1102{
1103 u16 cat_high;
1104 u16 cat_low;
1105 u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1106 u32 iter;
1107
1108 if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1109 return -EFAULT;
1110
1111 for (iter = 0; iter < rngcat_len; iter += 4) {
1112 cat_high = get_unaligned_be16(&rngcat[iter]);
1113 if ((iter + 4) <= rngcat_len)
1114 cat_low = get_unaligned_be16(&rngcat[iter + 2]);
1115 else
1116 cat_low = 0;
1117
1118 if (cat_high > cat_prev)
1119 return -EFAULT;
1120
1121 cat_prev = cat_low;
1122 }
1123
1124 return 0;
1125}
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1142 const struct netlbl_lsm_secattr *secattr,
1143 unsigned char *net_cat,
1144 u32 net_cat_len)
1145{
1146 int iter = -1;
1147 u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1148 u32 array_cnt = 0;
1149 u32 cat_size = 0;
1150
1151
1152 if (net_cat_len >
1153 (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1154 return -ENOSPC;
1155
1156 for (;;) {
1157 iter = netlbl_catmap_walk(secattr->attr.mls.cat, iter + 1);
1158 if (iter < 0)
1159 break;
1160 cat_size += (iter == 0 ? 0 : sizeof(u16));
1161 if (cat_size > net_cat_len)
1162 return -ENOSPC;
1163 array[array_cnt++] = iter;
1164
1165 iter = netlbl_catmap_walkrng(secattr->attr.mls.cat, iter);
1166 if (iter < 0)
1167 return -EFAULT;
1168 cat_size += sizeof(u16);
1169 if (cat_size > net_cat_len)
1170 return -ENOSPC;
1171 array[array_cnt++] = iter;
1172 }
1173
1174 for (iter = 0; array_cnt > 0;) {
1175 *((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1176 iter += 2;
1177 array_cnt--;
1178 if (array[array_cnt] != 0) {
1179 *((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1180 iter += 2;
1181 }
1182 }
1183
1184 return cat_size;
1185}
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1201 const unsigned char *net_cat,
1202 u32 net_cat_len,
1203 struct netlbl_lsm_secattr *secattr)
1204{
1205 int ret_val;
1206 u32 net_iter;
1207 u16 cat_low;
1208 u16 cat_high;
1209
1210 for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
1211 cat_high = get_unaligned_be16(&net_cat[net_iter]);
1212 if ((net_iter + 4) <= net_cat_len)
1213 cat_low = get_unaligned_be16(&net_cat[net_iter + 2]);
1214 else
1215 cat_low = 0;
1216
1217 ret_val = netlbl_catmap_setrng(&secattr->attr.mls.cat,
1218 cat_low,
1219 cat_high,
1220 GFP_ATOMIC);
1221 if (ret_val != 0)
1222 return ret_val;
1223 }
1224
1225 return 0;
1226}
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1243 unsigned char *buf,
1244 u32 len)
1245{
1246 buf[0] = IPOPT_CIPSO;
1247 buf[1] = CIPSO_V4_HDR_LEN + len;
1248 *(__be32 *)&buf[2] = htonl(doi_def->doi);
1249}
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264
1265static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1266 const struct netlbl_lsm_secattr *secattr,
1267 unsigned char *buffer,
1268 u32 buffer_len)
1269{
1270 int ret_val;
1271 u32 tag_len;
1272 u32 level;
1273
1274 if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1275 return -EPERM;
1276
1277 ret_val = cipso_v4_map_lvl_hton(doi_def,
1278 secattr->attr.mls.lvl,
1279 &level);
1280 if (ret_val != 0)
1281 return ret_val;
1282
1283 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1284 ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
1285 secattr,
1286 &buffer[4],
1287 buffer_len - 4);
1288 if (ret_val < 0)
1289 return ret_val;
1290
1291
1292
1293
1294 if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
1295 tag_len = 14;
1296 else
1297 tag_len = 4 + ret_val;
1298 } else
1299 tag_len = 4;
1300
1301 buffer[0] = CIPSO_V4_TAG_RBITMAP;
1302 buffer[1] = tag_len;
1303 buffer[3] = level;
1304
1305 return tag_len;
1306}
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1321 const unsigned char *tag,
1322 struct netlbl_lsm_secattr *secattr)
1323{
1324 int ret_val;
1325 u8 tag_len = tag[1];
1326 u32 level;
1327
1328 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1329 if (ret_val != 0)
1330 return ret_val;
1331 secattr->attr.mls.lvl = level;
1332 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1333
1334 if (tag_len > 4) {
1335 ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1336 &tag[4],
1337 tag_len - 4,
1338 secattr);
1339 if (ret_val != 0) {
1340 netlbl_catmap_free(secattr->attr.mls.cat);
1341 return ret_val;
1342 }
1343
1344 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1345 }
1346
1347 return 0;
1348}
1349
1350
1351
1352
1353
1354
1355
1356
1357
1358
1359
1360
1361
1362static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1363 const struct netlbl_lsm_secattr *secattr,
1364 unsigned char *buffer,
1365 u32 buffer_len)
1366{
1367 int ret_val;
1368 u32 tag_len;
1369 u32 level;
1370
1371 if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1372 return -EPERM;
1373
1374 ret_val = cipso_v4_map_lvl_hton(doi_def,
1375 secattr->attr.mls.lvl,
1376 &level);
1377 if (ret_val != 0)
1378 return ret_val;
1379
1380 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1381 ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1382 secattr,
1383 &buffer[4],
1384 buffer_len - 4);
1385 if (ret_val < 0)
1386 return ret_val;
1387
1388 tag_len = 4 + ret_val;
1389 } else
1390 tag_len = 4;
1391
1392 buffer[0] = CIPSO_V4_TAG_ENUM;
1393 buffer[1] = tag_len;
1394 buffer[3] = level;
1395
1396 return tag_len;
1397}
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407
1408
1409
1410
1411static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1412 const unsigned char *tag,
1413 struct netlbl_lsm_secattr *secattr)
1414{
1415 int ret_val;
1416 u8 tag_len = tag[1];
1417 u32 level;
1418
1419 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1420 if (ret_val != 0)
1421 return ret_val;
1422 secattr->attr.mls.lvl = level;
1423 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1424
1425 if (tag_len > 4) {
1426 ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1427 &tag[4],
1428 tag_len - 4,
1429 secattr);
1430 if (ret_val != 0) {
1431 netlbl_catmap_free(secattr->attr.mls.cat);
1432 return ret_val;
1433 }
1434
1435 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1436 }
1437
1438 return 0;
1439}
1440
1441
1442
1443
1444
1445
1446
1447
1448
1449
1450
1451
1452
1453static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1454 const struct netlbl_lsm_secattr *secattr,
1455 unsigned char *buffer,
1456 u32 buffer_len)
1457{
1458 int ret_val;
1459 u32 tag_len;
1460 u32 level;
1461
1462 if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1463 return -EPERM;
1464
1465 ret_val = cipso_v4_map_lvl_hton(doi_def,
1466 secattr->attr.mls.lvl,
1467 &level);
1468 if (ret_val != 0)
1469 return ret_val;
1470
1471 if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1472 ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1473 secattr,
1474 &buffer[4],
1475 buffer_len - 4);
1476 if (ret_val < 0)
1477 return ret_val;
1478
1479 tag_len = 4 + ret_val;
1480 } else
1481 tag_len = 4;
1482
1483 buffer[0] = CIPSO_V4_TAG_RANGE;
1484 buffer[1] = tag_len;
1485 buffer[3] = level;
1486
1487 return tag_len;
1488}
1489
1490
1491
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1502 const unsigned char *tag,
1503 struct netlbl_lsm_secattr *secattr)
1504{
1505 int ret_val;
1506 u8 tag_len = tag[1];
1507 u32 level;
1508
1509 ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1510 if (ret_val != 0)
1511 return ret_val;
1512 secattr->attr.mls.lvl = level;
1513 secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1514
1515 if (tag_len > 4) {
1516 ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1517 &tag[4],
1518 tag_len - 4,
1519 secattr);
1520 if (ret_val != 0) {
1521 netlbl_catmap_free(secattr->attr.mls.cat);
1522 return ret_val;
1523 }
1524
1525 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1526 }
1527
1528 return 0;
1529}
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
1544 const struct netlbl_lsm_secattr *secattr,
1545 unsigned char *buffer,
1546 u32 buffer_len)
1547{
1548 if (!(secattr->flags & NETLBL_SECATTR_SECID))
1549 return -EPERM;
1550
1551 buffer[0] = CIPSO_V4_TAG_LOCAL;
1552 buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
1553 *(u32 *)&buffer[2] = secattr->attr.secid;
1554
1555 return CIPSO_V4_TAG_LOC_BLEN;
1556}
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
1570 const unsigned char *tag,
1571 struct netlbl_lsm_secattr *secattr)
1572{
1573 secattr->attr.secid = *(u32 *)&tag[2];
1574 secattr->flags |= NETLBL_SECATTR_SECID;
1575
1576 return 0;
1577}
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
1589{
1590 const struct iphdr *iph = ip_hdr(skb);
1591 unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
1592 int optlen;
1593 int taglen;
1594
1595 for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
1596 if (optptr[0] == IPOPT_CIPSO)
1597 return optptr;
1598 taglen = optptr[1];
1599 optlen -= taglen;
1600 optptr += taglen;
1601 }
1602
1603 return NULL;
1604}
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
1626{
1627 unsigned char *opt = *option;
1628 unsigned char *tag;
1629 unsigned char opt_iter;
1630 unsigned char err_offset = 0;
1631 u8 opt_len;
1632 u8 tag_len;
1633 struct cipso_v4_doi *doi_def = NULL;
1634 u32 tag_iter;
1635
1636
1637 opt_len = opt[1];
1638 if (opt_len < 8) {
1639 err_offset = 1;
1640 goto validate_return;
1641 }
1642
1643 rcu_read_lock();
1644 doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2]));
1645 if (!doi_def) {
1646 err_offset = 2;
1647 goto validate_return_locked;
1648 }
1649
1650 opt_iter = CIPSO_V4_HDR_LEN;
1651 tag = opt + opt_iter;
1652 while (opt_iter < opt_len) {
1653 for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1654 if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1655 ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1656 err_offset = opt_iter;
1657 goto validate_return_locked;
1658 }
1659
1660 tag_len = tag[1];
1661 if (tag_len > (opt_len - opt_iter)) {
1662 err_offset = opt_iter + 1;
1663 goto validate_return_locked;
1664 }
1665
1666 switch (tag[0]) {
1667 case CIPSO_V4_TAG_RBITMAP:
1668 if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
1669 err_offset = opt_iter + 1;
1670 goto validate_return_locked;
1671 }
1672
1673
1674
1675
1676
1677
1678
1679
1680 if (cipso_v4_rbm_strictvalid) {
1681 if (cipso_v4_map_lvl_valid(doi_def,
1682 tag[3]) < 0) {
1683 err_offset = opt_iter + 3;
1684 goto validate_return_locked;
1685 }
1686 if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
1687 cipso_v4_map_cat_rbm_valid(doi_def,
1688 &tag[4],
1689 tag_len - 4) < 0) {
1690 err_offset = opt_iter + 4;
1691 goto validate_return_locked;
1692 }
1693 }
1694 break;
1695 case CIPSO_V4_TAG_ENUM:
1696 if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
1697 err_offset = opt_iter + 1;
1698 goto validate_return_locked;
1699 }
1700
1701 if (cipso_v4_map_lvl_valid(doi_def,
1702 tag[3]) < 0) {
1703 err_offset = opt_iter + 3;
1704 goto validate_return_locked;
1705 }
1706 if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
1707 cipso_v4_map_cat_enum_valid(doi_def,
1708 &tag[4],
1709 tag_len - 4) < 0) {
1710 err_offset = opt_iter + 4;
1711 goto validate_return_locked;
1712 }
1713 break;
1714 case CIPSO_V4_TAG_RANGE:
1715 if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
1716 err_offset = opt_iter + 1;
1717 goto validate_return_locked;
1718 }
1719
1720 if (cipso_v4_map_lvl_valid(doi_def,
1721 tag[3]) < 0) {
1722 err_offset = opt_iter + 3;
1723 goto validate_return_locked;
1724 }
1725 if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
1726 cipso_v4_map_cat_rng_valid(doi_def,
1727 &tag[4],
1728 tag_len - 4) < 0) {
1729 err_offset = opt_iter + 4;
1730 goto validate_return_locked;
1731 }
1732 break;
1733 case CIPSO_V4_TAG_LOCAL:
1734
1735
1736
1737
1738
1739 if (!skb || !(skb->dev->flags & IFF_LOOPBACK)) {
1740 err_offset = opt_iter;
1741 goto validate_return_locked;
1742 }
1743 if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
1744 err_offset = opt_iter + 1;
1745 goto validate_return_locked;
1746 }
1747 break;
1748 default:
1749 err_offset = opt_iter;
1750 goto validate_return_locked;
1751 }
1752
1753 tag += tag_len;
1754 opt_iter += tag_len;
1755 }
1756
1757validate_return_locked:
1758 rcu_read_unlock();
1759validate_return:
1760 *option = opt + err_offset;
1761 return err_offset;
1762}
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1792{
1793 if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
1794 return;
1795
1796 if (gateway)
1797 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
1798 else
1799 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
1800}
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813
1814
1815static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
1816 const struct cipso_v4_doi *doi_def,
1817 const struct netlbl_lsm_secattr *secattr)
1818{
1819 int ret_val;
1820 u32 iter;
1821
1822 if (buf_len <= CIPSO_V4_HDR_LEN)
1823 return -ENOSPC;
1824
1825
1826
1827
1828 iter = 0;
1829 do {
1830 memset(buf, 0, buf_len);
1831 switch (doi_def->tags[iter]) {
1832 case CIPSO_V4_TAG_RBITMAP:
1833 ret_val = cipso_v4_gentag_rbm(doi_def,
1834 secattr,
1835 &buf[CIPSO_V4_HDR_LEN],
1836 buf_len - CIPSO_V4_HDR_LEN);
1837 break;
1838 case CIPSO_V4_TAG_ENUM:
1839 ret_val = cipso_v4_gentag_enum(doi_def,
1840 secattr,
1841 &buf[CIPSO_V4_HDR_LEN],
1842 buf_len - CIPSO_V4_HDR_LEN);
1843 break;
1844 case CIPSO_V4_TAG_RANGE:
1845 ret_val = cipso_v4_gentag_rng(doi_def,
1846 secattr,
1847 &buf[CIPSO_V4_HDR_LEN],
1848 buf_len - CIPSO_V4_HDR_LEN);
1849 break;
1850 case CIPSO_V4_TAG_LOCAL:
1851 ret_val = cipso_v4_gentag_loc(doi_def,
1852 secattr,
1853 &buf[CIPSO_V4_HDR_LEN],
1854 buf_len - CIPSO_V4_HDR_LEN);
1855 break;
1856 default:
1857 return -EPERM;
1858 }
1859
1860 iter++;
1861 } while (ret_val < 0 &&
1862 iter < CIPSO_V4_TAG_MAXCNT &&
1863 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
1864 if (ret_val < 0)
1865 return ret_val;
1866 cipso_v4_gentag_hdr(doi_def, buf, ret_val);
1867 return CIPSO_V4_HDR_LEN + ret_val;
1868}
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882
1883
1884int cipso_v4_sock_setattr(struct sock *sk,
1885 const struct cipso_v4_doi *doi_def,
1886 const struct netlbl_lsm_secattr *secattr)
1887{
1888 int ret_val = -EPERM;
1889 unsigned char *buf = NULL;
1890 u32 buf_len;
1891 u32 opt_len;
1892 struct ip_options_rcu *old, *opt = NULL;
1893 struct inet_sock *sk_inet;
1894 struct inet_connection_sock *sk_conn;
1895
1896
1897
1898
1899
1900 if (!sk)
1901 return 0;
1902
1903
1904
1905
1906 buf_len = CIPSO_V4_OPT_LEN_MAX;
1907 buf = kmalloc(buf_len, GFP_ATOMIC);
1908 if (!buf) {
1909 ret_val = -ENOMEM;
1910 goto socket_setattr_failure;
1911 }
1912
1913 ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1914 if (ret_val < 0)
1915 goto socket_setattr_failure;
1916 buf_len = ret_val;
1917
1918
1919
1920
1921
1922 opt_len = (buf_len + 3) & ~3;
1923 opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1924 if (!opt) {
1925 ret_val = -ENOMEM;
1926 goto socket_setattr_failure;
1927 }
1928 memcpy(opt->opt.__data, buf, buf_len);
1929 opt->opt.optlen = opt_len;
1930 opt->opt.cipso = sizeof(struct iphdr);
1931 kfree(buf);
1932 buf = NULL;
1933
1934 sk_inet = inet_sk(sk);
1935
1936 old = rcu_dereference_protected(sk_inet->inet_opt, sock_owned_by_user(sk));
1937 if (sk_inet->is_icsk) {
1938 sk_conn = inet_csk(sk);
1939 if (old)
1940 sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
1941 sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
1942 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1943 }
1944 rcu_assign_pointer(sk_inet->inet_opt, opt);
1945 if (old)
1946 kfree_rcu(old, rcu);
1947
1948 return 0;
1949
1950socket_setattr_failure:
1951 kfree(buf);
1952 kfree(opt);
1953 return ret_val;
1954}
1955
1956
1957
1958
1959
1960
1961
1962
1963
1964
1965
1966
1967
1968int cipso_v4_req_setattr(struct request_sock *req,
1969 const struct cipso_v4_doi *doi_def,
1970 const struct netlbl_lsm_secattr *secattr)
1971{
1972 int ret_val = -EPERM;
1973 unsigned char *buf = NULL;
1974 u32 buf_len;
1975 u32 opt_len;
1976 struct ip_options_rcu *opt = NULL;
1977 struct inet_request_sock *req_inet;
1978
1979
1980
1981
1982 buf_len = CIPSO_V4_OPT_LEN_MAX;
1983 buf = kmalloc(buf_len, GFP_ATOMIC);
1984 if (!buf) {
1985 ret_val = -ENOMEM;
1986 goto req_setattr_failure;
1987 }
1988
1989 ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1990 if (ret_val < 0)
1991 goto req_setattr_failure;
1992 buf_len = ret_val;
1993
1994
1995
1996
1997
1998 opt_len = (buf_len + 3) & ~3;
1999 opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
2000 if (!opt) {
2001 ret_val = -ENOMEM;
2002 goto req_setattr_failure;
2003 }
2004 memcpy(opt->opt.__data, buf, buf_len);
2005 opt->opt.optlen = opt_len;
2006 opt->opt.cipso = sizeof(struct iphdr);
2007 kfree(buf);
2008 buf = NULL;
2009
2010 req_inet = inet_rsk(req);
2011 opt = xchg(&req_inet->opt, opt);
2012 if (opt)
2013 kfree_rcu(opt, rcu);
2014
2015 return 0;
2016
2017req_setattr_failure:
2018 kfree(buf);
2019 kfree(opt);
2020 return ret_val;
2021}
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
2033static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
2034{
2035 int hdr_delta = 0;
2036 struct ip_options_rcu *opt = *opt_ptr;
2037
2038 if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
2039 u8 cipso_len;
2040 u8 cipso_off;
2041 unsigned char *cipso_ptr;
2042 int iter;
2043 int optlen_new;
2044
2045 cipso_off = opt->opt.cipso - sizeof(struct iphdr);
2046 cipso_ptr = &opt->opt.__data[cipso_off];
2047 cipso_len = cipso_ptr[1];
2048
2049 if (opt->opt.srr > opt->opt.cipso)
2050 opt->opt.srr -= cipso_len;
2051 if (opt->opt.rr > opt->opt.cipso)
2052 opt->opt.rr -= cipso_len;
2053 if (opt->opt.ts > opt->opt.cipso)
2054 opt->opt.ts -= cipso_len;
2055 if (opt->opt.router_alert > opt->opt.cipso)
2056 opt->opt.router_alert -= cipso_len;
2057 opt->opt.cipso = 0;
2058
2059 memmove(cipso_ptr, cipso_ptr + cipso_len,
2060 opt->opt.optlen - cipso_off - cipso_len);
2061
2062
2063
2064
2065
2066
2067 iter = 0;
2068 optlen_new = 0;
2069 while (iter < opt->opt.optlen)
2070 if (opt->opt.__data[iter] != IPOPT_NOP) {
2071 iter += opt->opt.__data[iter + 1];
2072 optlen_new = iter;
2073 } else
2074 iter++;
2075 hdr_delta = opt->opt.optlen;
2076 opt->opt.optlen = (optlen_new + 3) & ~3;
2077 hdr_delta -= opt->opt.optlen;
2078 } else {
2079
2080
2081 *opt_ptr = NULL;
2082 hdr_delta = opt->opt.optlen;
2083 kfree_rcu(opt, rcu);
2084 }
2085
2086 return hdr_delta;
2087}
2088
2089
2090
2091
2092
2093
2094
2095
2096
2097void cipso_v4_sock_delattr(struct sock *sk)
2098{
2099 int hdr_delta;
2100 struct ip_options_rcu *opt;
2101 struct inet_sock *sk_inet;
2102
2103 sk_inet = inet_sk(sk);
2104 opt = rcu_dereference_protected(sk_inet->inet_opt, 1);
2105 if (!opt || opt->opt.cipso == 0)
2106 return;
2107
2108 hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
2109 if (sk_inet->is_icsk && hdr_delta > 0) {
2110 struct inet_connection_sock *sk_conn = inet_csk(sk);
2111 sk_conn->icsk_ext_hdr_len -= hdr_delta;
2112 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
2113 }
2114}
2115
2116
2117
2118
2119
2120
2121
2122
2123
2124void cipso_v4_req_delattr(struct request_sock *req)
2125{
2126 struct ip_options_rcu *opt;
2127 struct inet_request_sock *req_inet;
2128
2129 req_inet = inet_rsk(req);
2130 opt = req_inet->opt;
2131 if (!opt || opt->opt.cipso == 0)
2132 return;
2133
2134 cipso_v4_delopt(&req_inet->opt);
2135}
2136
2137
2138
2139
2140
2141
2142
2143
2144
2145
2146
2147int cipso_v4_getattr(const unsigned char *cipso,
2148 struct netlbl_lsm_secattr *secattr)
2149{
2150 int ret_val = -ENOMSG;
2151 u32 doi;
2152 struct cipso_v4_doi *doi_def;
2153
2154 if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0)
2155 return 0;
2156
2157 doi = get_unaligned_be32(&cipso[2]);
2158 rcu_read_lock();
2159 doi_def = cipso_v4_doi_search(doi);
2160 if (!doi_def)
2161 goto getattr_return;
2162
2163
2164
2165 switch (cipso[6]) {
2166 case CIPSO_V4_TAG_RBITMAP:
2167 ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr);
2168 break;
2169 case CIPSO_V4_TAG_ENUM:
2170 ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr);
2171 break;
2172 case CIPSO_V4_TAG_RANGE:
2173 ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr);
2174 break;
2175 case CIPSO_V4_TAG_LOCAL:
2176 ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr);
2177 break;
2178 }
2179 if (ret_val == 0)
2180 secattr->type = NETLBL_NLTYPE_CIPSOV4;
2181
2182getattr_return:
2183 rcu_read_unlock();
2184 return ret_val;
2185}
2186
2187
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197
2198
2199int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
2200{
2201 struct ip_options_rcu *opt;
2202 int res = -ENOMSG;
2203
2204 rcu_read_lock();
2205 opt = rcu_dereference(inet_sk(sk)->inet_opt);
2206 if (opt && opt->opt.cipso)
2207 res = cipso_v4_getattr(opt->opt.__data +
2208 opt->opt.cipso -
2209 sizeof(struct iphdr),
2210 secattr);
2211 rcu_read_unlock();
2212 return res;
2213}
2214
2215
2216
2217
2218
2219
2220
2221
2222
2223
2224
2225int cipso_v4_skbuff_setattr(struct sk_buff *skb,
2226 const struct cipso_v4_doi *doi_def,
2227 const struct netlbl_lsm_secattr *secattr)
2228{
2229 int ret_val;
2230 struct iphdr *iph;
2231 struct ip_options *opt = &IPCB(skb)->opt;
2232 unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
2233 u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
2234 u32 opt_len;
2235 int len_delta;
2236
2237 ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
2238 if (ret_val < 0)
2239 return ret_val;
2240 buf_len = ret_val;
2241 opt_len = (buf_len + 3) & ~3;
2242
2243
2244
2245
2246
2247
2248
2249 len_delta = opt_len - opt->optlen;
2250
2251
2252
2253 ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
2254 if (ret_val < 0)
2255 return ret_val;
2256
2257 if (len_delta > 0) {
2258
2259
2260 iph = ip_hdr(skb);
2261 skb_push(skb, len_delta);
2262 memmove((char *)iph - len_delta, iph, iph->ihl << 2);
2263 skb_reset_network_header(skb);
2264 iph = ip_hdr(skb);
2265 } else if (len_delta < 0) {
2266 iph = ip_hdr(skb);
2267 memset(iph + 1, IPOPT_NOP, opt->optlen);
2268 } else
2269 iph = ip_hdr(skb);
2270
2271 if (opt->optlen > 0)
2272 memset(opt, 0, sizeof(*opt));
2273 opt->optlen = opt_len;
2274 opt->cipso = sizeof(struct iphdr);
2275 opt->is_changed = 1;
2276
2277
2278
2279
2280
2281
2282 memcpy(iph + 1, buf, buf_len);
2283 if (opt_len > buf_len)
2284 memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
2285 if (len_delta != 0) {
2286 iph->ihl = 5 + (opt_len >> 2);
2287 iph->tot_len = htons(skb->len);
2288 }
2289 ip_send_check(iph);
2290
2291 return 0;
2292}
2293
2294
2295
2296
2297
2298
2299
2300
2301
2302
2303int cipso_v4_skbuff_delattr(struct sk_buff *skb)
2304{
2305 int ret_val;
2306 struct iphdr *iph;
2307 struct ip_options *opt = &IPCB(skb)->opt;
2308 unsigned char *cipso_ptr;
2309
2310 if (opt->cipso == 0)
2311 return 0;
2312
2313
2314 ret_val = skb_cow(skb, skb_headroom(skb));
2315 if (ret_val < 0)
2316 return ret_val;
2317
2318
2319
2320
2321
2322 iph = ip_hdr(skb);
2323 cipso_ptr = (unsigned char *)iph + opt->cipso;
2324 memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
2325 opt->cipso = 0;
2326 opt->is_changed = 1;
2327
2328 ip_send_check(iph);
2329
2330 return 0;
2331}
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344
2345static int __init cipso_v4_init(void)
2346{
2347 int ret_val;
2348
2349 ret_val = cipso_v4_cache_init();
2350 if (ret_val != 0)
2351 panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
2352 ret_val);
2353
2354 return 0;
2355}
2356
2357subsys_initcall(cipso_v4_init);
2358