1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31#include <linux/types.h>
32#include <linux/rcupdate.h>
33#include <linux/list.h>
34#include <linux/spinlock.h>
35#include <linux/in.h>
36#include <linux/in6.h>
37#include <linux/ip.h>
38#include <linux/ipv6.h>
39#include <net/ip.h>
40#include <net/ipv6.h>
41#include <linux/audit.h>
42
43#include "netlabel_addrlist.h"
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60struct netlbl_af4list *netlbl_af4list_search(__be32 addr,
61 struct list_head *head)
62{
63 struct netlbl_af4list *iter;
64
65 list_for_each_entry_rcu(iter, head, list)
66 if (iter->valid && (addr & iter->mask) == iter->addr)
67 return iter;
68
69 return NULL;
70}
71
72
73
74
75
76
77
78
79
80
81
82
83
84struct netlbl_af4list *netlbl_af4list_search_exact(__be32 addr,
85 __be32 mask,
86 struct list_head *head)
87{
88 struct netlbl_af4list *iter;
89
90 list_for_each_entry_rcu(iter, head, list)
91 if (iter->valid && iter->addr == addr && iter->mask == mask)
92 return iter;
93
94 return NULL;
95}
96
97
98#if IS_ENABLED(CONFIG_IPV6)
99
100
101
102
103
104
105
106
107
108
109
110struct netlbl_af6list *netlbl_af6list_search(const struct in6_addr *addr,
111 struct list_head *head)
112{
113 struct netlbl_af6list *iter;
114
115 list_for_each_entry_rcu(iter, head, list)
116 if (iter->valid &&
117 ipv6_masked_addr_cmp(&iter->addr, &iter->mask, addr) == 0)
118 return iter;
119
120 return NULL;
121}
122
123
124
125
126
127
128
129
130
131
132
133
134
135struct netlbl_af6list *netlbl_af6list_search_exact(const struct in6_addr *addr,
136 const struct in6_addr *mask,
137 struct list_head *head)
138{
139 struct netlbl_af6list *iter;
140
141 list_for_each_entry_rcu(iter, head, list)
142 if (iter->valid &&
143 ipv6_addr_equal(&iter->addr, addr) &&
144 ipv6_addr_equal(&iter->mask, mask))
145 return iter;
146
147 return NULL;
148}
149#endif
150
151
152
153
154
155
156
157
158
159
160
161
162int netlbl_af4list_add(struct netlbl_af4list *entry, struct list_head *head)
163{
164 struct netlbl_af4list *iter;
165
166 iter = netlbl_af4list_search(entry->addr, head);
167 if (iter != NULL &&
168 iter->addr == entry->addr && iter->mask == entry->mask)
169 return -EEXIST;
170
171
172
173
174
175 list_for_each_entry_rcu(iter, head, list)
176 if (iter->valid &&
177 ntohl(entry->mask) > ntohl(iter->mask)) {
178 __list_add_rcu(&entry->list,
179 iter->list.prev,
180 &iter->list);
181 return 0;
182 }
183 list_add_tail_rcu(&entry->list, head);
184 return 0;
185}
186
187#if IS_ENABLED(CONFIG_IPV6)
188
189
190
191
192
193
194
195
196
197
198
199int netlbl_af6list_add(struct netlbl_af6list *entry, struct list_head *head)
200{
201 struct netlbl_af6list *iter;
202
203 iter = netlbl_af6list_search(&entry->addr, head);
204 if (iter != NULL &&
205 ipv6_addr_equal(&iter->addr, &entry->addr) &&
206 ipv6_addr_equal(&iter->mask, &entry->mask))
207 return -EEXIST;
208
209
210
211
212
213 list_for_each_entry_rcu(iter, head, list)
214 if (iter->valid &&
215 ipv6_addr_cmp(&entry->mask, &iter->mask) > 0) {
216 __list_add_rcu(&entry->list,
217 iter->list.prev,
218 &iter->list);
219 return 0;
220 }
221 list_add_tail_rcu(&entry->list, head);
222 return 0;
223}
224#endif
225
226
227
228
229
230
231
232
233
234
235void netlbl_af4list_remove_entry(struct netlbl_af4list *entry)
236{
237 entry->valid = 0;
238 list_del_rcu(&entry->list);
239}
240
241
242
243
244
245
246
247
248
249
250
251
252
253struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,
254 struct list_head *head)
255{
256 struct netlbl_af4list *entry;
257
258 entry = netlbl_af4list_search_exact(addr, mask, head);
259 if (entry == NULL)
260 return NULL;
261 netlbl_af4list_remove_entry(entry);
262 return entry;
263}
264
265#if IS_ENABLED(CONFIG_IPV6)
266
267
268
269
270
271
272
273
274
275void netlbl_af6list_remove_entry(struct netlbl_af6list *entry)
276{
277 entry->valid = 0;
278 list_del_rcu(&entry->list);
279}
280
281
282
283
284
285
286
287
288
289
290
291
292
293struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,
294 const struct in6_addr *mask,
295 struct list_head *head)
296{
297 struct netlbl_af6list *entry;
298
299 entry = netlbl_af6list_search_exact(addr, mask, head);
300 if (entry == NULL)
301 return NULL;
302 netlbl_af6list_remove_entry(entry);
303 return entry;
304}
305#endif
306
307
308
309
310
311#ifdef CONFIG_AUDIT
312
313
314
315
316
317
318
319
320
321
322
323
324void netlbl_af4list_audit_addr(struct audit_buffer *audit_buf,
325 int src, const char *dev,
326 __be32 addr, __be32 mask)
327{
328 u32 mask_val = ntohl(mask);
329 char *dir = (src ? "src" : "dst");
330
331 if (dev != NULL)
332 audit_log_format(audit_buf, " netif=%s", dev);
333 audit_log_format(audit_buf, " %s=%pI4", dir, &addr);
334 if (mask_val != 0xffffffff) {
335 u32 mask_len = 0;
336 while (mask_val > 0) {
337 mask_val <<= 1;
338 mask_len++;
339 }
340 audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
341 }
342}
343
344#if IS_ENABLED(CONFIG_IPV6)
345
346
347
348
349
350
351
352
353
354
355
356
357void netlbl_af6list_audit_addr(struct audit_buffer *audit_buf,
358 int src,
359 const char *dev,
360 const struct in6_addr *addr,
361 const struct in6_addr *mask)
362{
363 char *dir = (src ? "src" : "dst");
364
365 if (dev != NULL)
366 audit_log_format(audit_buf, " netif=%s", dev);
367 audit_log_format(audit_buf, " %s=%pI6", dir, addr);
368 if (ntohl(mask->s6_addr32[3]) != 0xffffffff) {
369 u32 mask_len = 0;
370 u32 mask_val;
371 int iter = -1;
372 while (ntohl(mask->s6_addr32[++iter]) == 0xffffffff)
373 mask_len += 32;
374 mask_val = ntohl(mask->s6_addr32[iter]);
375 while (mask_val > 0) {
376 mask_val <<= 1;
377 mask_len++;
378 }
379 audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
380 }
381}
382#endif
383#endif
384