1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * NetLabel Unlabeled Support 4 * 5 * This file defines functions for dealing with unlabeled packets for the 6 * NetLabel system. The NetLabel system manages static and dynamic label 7 * mappings for network protocols such as CIPSO and RIPSO. 8 * 9 * Author: Paul Moore <paul@paul-moore.com> 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008 14 */ 15 16 #include <linux/types.h> 17 #include <linux/rcupdate.h> 18 #include <linux/list.h> 19 #include <linux/spinlock.h> 20 #include <linux/socket.h> 21 #include <linux/string.h> 22 #include <linux/skbuff.h> 23 #include <linux/audit.h> 24 #include <linux/in.h> 25 #include <linux/in6.h> 26 #include <linux/ip.h> 27 #include <linux/ipv6.h> 28 #include <linux/notifier.h> 29 #include <linux/netdevice.h> 30 #include <linux/security.h> 31 #include <linux/slab.h> 32 #include <net/sock.h> 33 #include <net/netlink.h> 34 #include <net/genetlink.h> 35 #include <net/ip.h> 36 #include <net/ipv6.h> 37 #include <net/net_namespace.h> 38 #include <net/netlabel.h> 39 #include <asm/bug.h> 40 #include <linux/atomic.h> 41 42 #include "netlabel_user.h" 43 #include "netlabel_addrlist.h" 44 #include "netlabel_domainhash.h" 45 #include "netlabel_unlabeled.h" 46 #include "netlabel_mgmt.h" 47 48 /* NOTE: at present we always use init's network namespace since we don't 49 * presently support different namespaces even though the majority of 50 * the functions in this file are "namespace safe" */ 51 52 /* The unlabeled connection hash table which we use to map network interfaces 53 * and addresses of unlabeled packets to a user specified secid value for the 54 * LSM. The hash table is used to lookup the network interface entry 55 * (struct netlbl_unlhsh_iface) and then the interface entry is used to 56 * lookup an IP address match from an ordered list. If a network interface 57 * match can not be found in the hash table then the default entry 58 * (netlbl_unlhsh_def) is used. The IP address entry list 59 * (struct netlbl_unlhsh_addr) is ordered such that the entries with a 60 * larger netmask come first. 61 */ 62 struct netlbl_unlhsh_tbl { 63 struct list_head *tbl; 64 u32 size; 65 }; 66 #define netlbl_unlhsh_addr4_entry(iter) \ 67 container_of(iter, struct netlbl_unlhsh_addr4, list) 68 struct netlbl_unlhsh_addr4 { 69 u32 secid; 70 71 struct netlbl_af4list list; 72 struct rcu_head rcu; 73 }; 74 #define netlbl_unlhsh_addr6_entry(iter) \ 75 container_of(iter, struct netlbl_unlhsh_addr6, list) 76 struct netlbl_unlhsh_addr6 { 77 u32 secid; 78 79 struct netlbl_af6list list; 80 struct rcu_head rcu; 81 }; 82 struct netlbl_unlhsh_iface { 83 int ifindex; 84 struct list_head addr4_list; 85 struct list_head addr6_list; 86 87 u32 valid; 88 struct list_head list; 89 struct rcu_head rcu; 90 }; 91 92 /* Argument struct for netlbl_unlhsh_walk() */ 93 struct netlbl_unlhsh_walk_arg { 94 struct netlink_callback *nl_cb; 95 struct sk_buff *skb; 96 u32 seq; 97 }; 98 99 /* Unlabeled connection hash table */ 100 /* updates should be so rare that having one spinlock for the entire 101 * hash table should be okay */ 102 static DEFINE_SPINLOCK(netlbl_unlhsh_lock); 103 #define netlbl_unlhsh_rcu_deref(p) \ 104 rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock)) 105 static struct netlbl_unlhsh_tbl __rcu *netlbl_unlhsh; 106 static struct netlbl_unlhsh_iface __rcu *netlbl_unlhsh_def; 107 108 /* Accept unlabeled packets flag */ 109 static u8 netlabel_unlabel_acceptflg; 110 111 /* NetLabel Generic NETLINK unlabeled family */ 112 static struct genl_family netlbl_unlabel_gnl_family; 113 114 /* NetLabel Netlink attribute policy */ 115 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { 116 [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, 117 [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY, 118 .len = sizeof(struct in6_addr) }, 119 [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY, 120 .len = sizeof(struct in6_addr) }, 121 [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY, 122 .len = sizeof(struct in_addr) }, 123 [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY, 124 .len = sizeof(struct in_addr) }, 125 [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING, 126 .len = IFNAMSIZ - 1 }, 127 [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY } 128 }; 129 130 /* 131 * Unlabeled Connection Hash Table Functions 132 */ 133 134 /** 135 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table 136 * @entry: the entry's RCU field 137 * 138 * Description: 139 * This function is designed to be used as a callback to the call_rcu() 140 * function so that memory allocated to a hash table interface entry can be 141 * released safely. It is important to note that this function does not free 142 * the IPv4 and IPv6 address lists contained as part of an interface entry. It 143 * is up to the rest of the code to make sure an interface entry is only freed 144 * once it's address lists are empty. 145 * 146 */ 147 static void netlbl_unlhsh_free_iface(struct rcu_head *entry) 148 { 149 struct netlbl_unlhsh_iface *iface; 150 struct netlbl_af4list *iter4; 151 struct netlbl_af4list *tmp4; 152 #if IS_ENABLED(CONFIG_IPV6) 153 struct netlbl_af6list *iter6; 154 struct netlbl_af6list *tmp6; 155 #endif /* IPv6 */ 156 157 iface = container_of(entry, struct netlbl_unlhsh_iface, rcu); 158 159 /* no need for locks here since we are the only one with access to this 160 * structure */ 161 162 netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) { 163 netlbl_af4list_remove_entry(iter4); 164 kfree(netlbl_unlhsh_addr4_entry(iter4)); 165 } 166 #if IS_ENABLED(CONFIG_IPV6) 167 netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) { 168 netlbl_af6list_remove_entry(iter6); 169 kfree(netlbl_unlhsh_addr6_entry(iter6)); 170 } 171 #endif /* IPv6 */ 172 kfree(iface); 173 } 174 175 /** 176 * netlbl_unlhsh_hash - Hashing function for the hash table 177 * @ifindex: the network interface/device to hash 178 * 179 * Description: 180 * This is the hashing function for the unlabeled hash table, it returns the 181 * bucket number for the given device/interface. The caller is responsible for 182 * ensuring that the hash table is protected with either a RCU read lock or 183 * the hash table lock. 184 * 185 */ 186 static u32 netlbl_unlhsh_hash(int ifindex) 187 { 188 return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1); 189 } 190 191 /** 192 * netlbl_unlhsh_search_iface - Search for a matching interface entry 193 * @ifindex: the network interface 194 * 195 * Description: 196 * Searches the unlabeled connection hash table and returns a pointer to the 197 * interface entry which matches @ifindex, otherwise NULL is returned. The 198 * caller is responsible for ensuring that the hash table is protected with 199 * either a RCU read lock or the hash table lock. 200 * 201 */ 202 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex) 203 { 204 u32 bkt; 205 struct list_head *bkt_list; 206 struct netlbl_unlhsh_iface *iter; 207 208 bkt = netlbl_unlhsh_hash(ifindex); 209 bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]; 210 list_for_each_entry_rcu(iter, bkt_list, list, 211 lockdep_is_held(&netlbl_unlhsh_lock)) 212 if (iter->valid && iter->ifindex == ifindex) 213 return iter; 214 215 return NULL; 216 } 217 218 /** 219 * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table 220 * @iface: the associated interface entry 221 * @addr: IPv4 address in network byte order 222 * @mask: IPv4 address mask in network byte order 223 * @secid: LSM secid value for entry 224 * 225 * Description: 226 * Add a new address entry into the unlabeled connection hash table using the 227 * interface entry specified by @iface. On success zero is returned, otherwise 228 * a negative value is returned. 229 * 230 */ 231 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface, 232 const struct in_addr *addr, 233 const struct in_addr *mask, 234 u32 secid) 235 { 236 int ret_val; 237 struct netlbl_unlhsh_addr4 *entry; 238 239 entry = kzalloc(sizeof(*entry), GFP_ATOMIC); 240 if (entry == NULL) 241 return -ENOMEM; 242 243 entry->list.addr = addr->s_addr & mask->s_addr; 244 entry->list.mask = mask->s_addr; 245 entry->list.valid = 1; 246 entry->secid = secid; 247 248 spin_lock(&netlbl_unlhsh_lock); 249 ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list); 250 spin_unlock(&netlbl_unlhsh_lock); 251 252 if (ret_val != 0) 253 kfree(entry); 254 return ret_val; 255 } 256 257 #if IS_ENABLED(CONFIG_IPV6) 258 /** 259 * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table 260 * @iface: the associated interface entry 261 * @addr: IPv6 address in network byte order 262 * @mask: IPv6 address mask in network byte order 263 * @secid: LSM secid value for entry 264 * 265 * Description: 266 * Add a new address entry into the unlabeled connection hash table using the 267 * interface entry specified by @iface. On success zero is returned, otherwise 268 * a negative value is returned. 269 * 270 */ 271 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface, 272 const struct in6_addr *addr, 273 const struct in6_addr *mask, 274 u32 secid) 275 { 276 int ret_val; 277 struct netlbl_unlhsh_addr6 *entry; 278 279 entry = kzalloc(sizeof(*entry), GFP_ATOMIC); 280 if (entry == NULL) 281 return -ENOMEM; 282 283 entry->list.addr = *addr; 284 entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; 285 entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; 286 entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2]; 287 entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3]; 288 entry->list.mask = *mask; 289 entry->list.valid = 1; 290 entry->secid = secid; 291 292 spin_lock(&netlbl_unlhsh_lock); 293 ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list); 294 spin_unlock(&netlbl_unlhsh_lock); 295 296 if (ret_val != 0) 297 kfree(entry); 298 return 0; 299 } 300 #endif /* IPv6 */ 301 302 /** 303 * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table 304 * @ifindex: network interface 305 * 306 * Description: 307 * Add a new, empty, interface entry into the unlabeled connection hash table. 308 * On success a pointer to the new interface entry is returned, on failure NULL 309 * is returned. 310 * 311 */ 312 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex) 313 { 314 u32 bkt; 315 struct netlbl_unlhsh_iface *iface; 316 317 iface = kzalloc(sizeof(*iface), GFP_ATOMIC); 318 if (iface == NULL) 319 return NULL; 320 321 iface->ifindex = ifindex; 322 INIT_LIST_HEAD(&iface->addr4_list); 323 INIT_LIST_HEAD(&iface->addr6_list); 324 iface->valid = 1; 325 326 spin_lock(&netlbl_unlhsh_lock); 327 if (ifindex > 0) { 328 bkt = netlbl_unlhsh_hash(ifindex); 329 if (netlbl_unlhsh_search_iface(ifindex) != NULL) 330 goto add_iface_failure; 331 list_add_tail_rcu(&iface->list, 332 &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]); 333 } else { 334 INIT_LIST_HEAD(&iface->list); 335 if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL) 336 goto add_iface_failure; 337 rcu_assign_pointer(netlbl_unlhsh_def, iface); 338 } 339 spin_unlock(&netlbl_unlhsh_lock); 340 341 return iface; 342 343 add_iface_failure: 344 spin_unlock(&netlbl_unlhsh_lock); 345 kfree(iface); 346 return NULL; 347 } 348 349 /** 350 * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table 351 * @net: network namespace 352 * @dev_name: interface name 353 * @addr: IP address in network byte order 354 * @mask: address mask in network byte order 355 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) 356 * @secid: LSM secid value for the entry 357 * @audit_info: NetLabel audit information 358 * 359 * Description: 360 * Adds a new entry to the unlabeled connection hash table. Returns zero on 361 * success, negative values on failure. 362 * 363 */ 364 int netlbl_unlhsh_add(struct net *net, 365 const char *dev_name, 366 const void *addr, 367 const void *mask, 368 u32 addr_len, 369 u32 secid, 370 struct netlbl_audit *audit_info) 371 { 372 int ret_val; 373 int ifindex; 374 struct net_device *dev; 375 struct netlbl_unlhsh_iface *iface; 376 struct audit_buffer *audit_buf = NULL; 377 char *secctx = NULL; 378 u32 secctx_len; 379 380 if (addr_len != sizeof(struct in_addr) && 381 addr_len != sizeof(struct in6_addr)) 382 return -EINVAL; 383 384 rcu_read_lock(); 385 if (dev_name != NULL) { 386 dev = dev_get_by_name_rcu(net, dev_name); 387 if (dev == NULL) { 388 ret_val = -ENODEV; 389 goto unlhsh_add_return; 390 } 391 ifindex = dev->ifindex; 392 iface = netlbl_unlhsh_search_iface(ifindex); 393 } else { 394 ifindex = 0; 395 iface = rcu_dereference(netlbl_unlhsh_def); 396 } 397 if (iface == NULL) { 398 iface = netlbl_unlhsh_add_iface(ifindex); 399 if (iface == NULL) { 400 ret_val = -ENOMEM; 401 goto unlhsh_add_return; 402 } 403 } 404 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD, 405 audit_info); 406 switch (addr_len) { 407 case sizeof(struct in_addr): { 408 const struct in_addr *addr4 = addr; 409 const struct in_addr *mask4 = mask; 410 411 ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid); 412 if (audit_buf != NULL) 413 netlbl_af4list_audit_addr(audit_buf, 1, 414 dev_name, 415 addr4->s_addr, 416 mask4->s_addr); 417 break; 418 } 419 #if IS_ENABLED(CONFIG_IPV6) 420 case sizeof(struct in6_addr): { 421 const struct in6_addr *addr6 = addr; 422 const struct in6_addr *mask6 = mask; 423 424 ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid); 425 if (audit_buf != NULL) 426 netlbl_af6list_audit_addr(audit_buf, 1, 427 dev_name, 428 addr6, mask6); 429 break; 430 } 431 #endif /* IPv6 */ 432 default: 433 ret_val = -EINVAL; 434 } 435 if (ret_val == 0) 436 atomic_inc(&netlabel_mgmt_protocount); 437 438 unlhsh_add_return: 439 rcu_read_unlock(); 440 if (audit_buf != NULL) { 441 if (security_secid_to_secctx(secid, 442 &secctx, 443 &secctx_len) == 0) { 444 audit_log_format(audit_buf, " sec_obj=%s", secctx); 445 security_release_secctx(secctx, secctx_len); 446 } 447 audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0); 448 audit_log_end(audit_buf); 449 } 450 return ret_val; 451 } 452 453 /** 454 * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry 455 * @net: network namespace 456 * @iface: interface entry 457 * @addr: IP address 458 * @mask: IP address mask 459 * @audit_info: NetLabel audit information 460 * 461 * Description: 462 * Remove an IP address entry from the unlabeled connection hash table. 463 * Returns zero on success, negative values on failure. 464 * 465 */ 466 static int netlbl_unlhsh_remove_addr4(struct net *net, 467 struct netlbl_unlhsh_iface *iface, 468 const struct in_addr *addr, 469 const struct in_addr *mask, 470 struct netlbl_audit *audit_info) 471 { 472 struct netlbl_af4list *list_entry; 473 struct netlbl_unlhsh_addr4 *entry; 474 struct audit_buffer *audit_buf; 475 struct net_device *dev; 476 char *secctx; 477 u32 secctx_len; 478 479 spin_lock(&netlbl_unlhsh_lock); 480 list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr, 481 &iface->addr4_list); 482 spin_unlock(&netlbl_unlhsh_lock); 483 if (list_entry != NULL) 484 entry = netlbl_unlhsh_addr4_entry(list_entry); 485 else 486 entry = NULL; 487 488 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, 489 audit_info); 490 if (audit_buf != NULL) { 491 dev = dev_get_by_index(net, iface->ifindex); 492 netlbl_af4list_audit_addr(audit_buf, 1, 493 (dev != NULL ? dev->name : NULL), 494 addr->s_addr, mask->s_addr); 495 if (dev != NULL) 496 dev_put(dev); 497 if (entry != NULL && 498 security_secid_to_secctx(entry->secid, 499 &secctx, &secctx_len) == 0) { 500 audit_log_format(audit_buf, " sec_obj=%s", secctx); 501 security_release_secctx(secctx, secctx_len); 502 } 503 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); 504 audit_log_end(audit_buf); 505 } 506 507 if (entry == NULL) 508 return -ENOENT; 509 510 kfree_rcu(entry, rcu); 511 return 0; 512 } 513 514 #if IS_ENABLED(CONFIG_IPV6) 515 /** 516 * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry 517 * @net: network namespace 518 * @iface: interface entry 519 * @addr: IP address 520 * @mask: IP address mask 521 * @audit_info: NetLabel audit information 522 * 523 * Description: 524 * Remove an IP address entry from the unlabeled connection hash table. 525 * Returns zero on success, negative values on failure. 526 * 527 */ 528 static int netlbl_unlhsh_remove_addr6(struct net *net, 529 struct netlbl_unlhsh_iface *iface, 530 const struct in6_addr *addr, 531 const struct in6_addr *mask, 532 struct netlbl_audit *audit_info) 533 { 534 struct netlbl_af6list *list_entry; 535 struct netlbl_unlhsh_addr6 *entry; 536 struct audit_buffer *audit_buf; 537 struct net_device *dev; 538 char *secctx; 539 u32 secctx_len; 540 541 spin_lock(&netlbl_unlhsh_lock); 542 list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list); 543 spin_unlock(&netlbl_unlhsh_lock); 544 if (list_entry != NULL) 545 entry = netlbl_unlhsh_addr6_entry(list_entry); 546 else 547 entry = NULL; 548 549 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL, 550 audit_info); 551 if (audit_buf != NULL) { 552 dev = dev_get_by_index(net, iface->ifindex); 553 netlbl_af6list_audit_addr(audit_buf, 1, 554 (dev != NULL ? dev->name : NULL), 555 addr, mask); 556 if (dev != NULL) 557 dev_put(dev); 558 if (entry != NULL && 559 security_secid_to_secctx(entry->secid, 560 &secctx, &secctx_len) == 0) { 561 audit_log_format(audit_buf, " sec_obj=%s", secctx); 562 security_release_secctx(secctx, secctx_len); 563 } 564 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); 565 audit_log_end(audit_buf); 566 } 567 568 if (entry == NULL) 569 return -ENOENT; 570 571 kfree_rcu(entry, rcu); 572 return 0; 573 } 574 #endif /* IPv6 */ 575 576 /** 577 * netlbl_unlhsh_condremove_iface - Remove an interface entry 578 * @iface: the interface entry 579 * 580 * Description: 581 * Remove an interface entry from the unlabeled connection hash table if it is 582 * empty. An interface entry is considered to be empty if there are no 583 * address entries assigned to it. 584 * 585 */ 586 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface) 587 { 588 struct netlbl_af4list *iter4; 589 #if IS_ENABLED(CONFIG_IPV6) 590 struct netlbl_af6list *iter6; 591 #endif /* IPv6 */ 592 593 spin_lock(&netlbl_unlhsh_lock); 594 netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list) 595 goto unlhsh_condremove_failure; 596 #if IS_ENABLED(CONFIG_IPV6) 597 netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list) 598 goto unlhsh_condremove_failure; 599 #endif /* IPv6 */ 600 iface->valid = 0; 601 if (iface->ifindex > 0) 602 list_del_rcu(&iface->list); 603 else 604 RCU_INIT_POINTER(netlbl_unlhsh_def, NULL); 605 spin_unlock(&netlbl_unlhsh_lock); 606 607 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); 608 return; 609 610 unlhsh_condremove_failure: 611 spin_unlock(&netlbl_unlhsh_lock); 612 } 613 614 /** 615 * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table 616 * @net: network namespace 617 * @dev_name: interface name 618 * @addr: IP address in network byte order 619 * @mask: address mask in network byte order 620 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6) 621 * @audit_info: NetLabel audit information 622 * 623 * Description: 624 * Removes and existing entry from the unlabeled connection hash table. 625 * Returns zero on success, negative values on failure. 626 * 627 */ 628 int netlbl_unlhsh_remove(struct net *net, 629 const char *dev_name, 630 const void *addr, 631 const void *mask, 632 u32 addr_len, 633 struct netlbl_audit *audit_info) 634 { 635 int ret_val; 636 struct net_device *dev; 637 struct netlbl_unlhsh_iface *iface; 638 639 if (addr_len != sizeof(struct in_addr) && 640 addr_len != sizeof(struct in6_addr)) 641 return -EINVAL; 642 643 rcu_read_lock(); 644 if (dev_name != NULL) { 645 dev = dev_get_by_name_rcu(net, dev_name); 646 if (dev == NULL) { 647 ret_val = -ENODEV; 648 goto unlhsh_remove_return; 649 } 650 iface = netlbl_unlhsh_search_iface(dev->ifindex); 651 } else 652 iface = rcu_dereference(netlbl_unlhsh_def); 653 if (iface == NULL) { 654 ret_val = -ENOENT; 655 goto unlhsh_remove_return; 656 } 657 switch (addr_len) { 658 case sizeof(struct in_addr): 659 ret_val = netlbl_unlhsh_remove_addr4(net, 660 iface, addr, mask, 661 audit_info); 662 break; 663 #if IS_ENABLED(CONFIG_IPV6) 664 case sizeof(struct in6_addr): 665 ret_val = netlbl_unlhsh_remove_addr6(net, 666 iface, addr, mask, 667 audit_info); 668 break; 669 #endif /* IPv6 */ 670 default: 671 ret_val = -EINVAL; 672 } 673 if (ret_val == 0) { 674 netlbl_unlhsh_condremove_iface(iface); 675 atomic_dec(&netlabel_mgmt_protocount); 676 } 677 678 unlhsh_remove_return: 679 rcu_read_unlock(); 680 return ret_val; 681 } 682 683 /* 684 * General Helper Functions 685 */ 686 687 /** 688 * netlbl_unlhsh_netdev_handler - Network device notification handler 689 * @this: notifier block 690 * @event: the event 691 * @ptr: the netdevice notifier info (cast to void) 692 * 693 * Description: 694 * Handle network device events, although at present all we care about is a 695 * network device going away. In the case of a device going away we clear any 696 * related entries from the unlabeled connection hash table. 697 * 698 */ 699 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this, 700 unsigned long event, void *ptr) 701 { 702 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 703 struct netlbl_unlhsh_iface *iface = NULL; 704 705 if (!net_eq(dev_net(dev), &init_net)) 706 return NOTIFY_DONE; 707 708 /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */ 709 if (event == NETDEV_DOWN) { 710 spin_lock(&netlbl_unlhsh_lock); 711 iface = netlbl_unlhsh_search_iface(dev->ifindex); 712 if (iface != NULL && iface->valid) { 713 iface->valid = 0; 714 list_del_rcu(&iface->list); 715 } else 716 iface = NULL; 717 spin_unlock(&netlbl_unlhsh_lock); 718 } 719 720 if (iface != NULL) 721 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface); 722 723 return NOTIFY_DONE; 724 } 725 726 /** 727 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag 728 * @value: desired value 729 * @audit_info: NetLabel audit information 730 * 731 * Description: 732 * Set the value of the unlabeled accept flag to @value. 733 * 734 */ 735 static void netlbl_unlabel_acceptflg_set(u8 value, 736 struct netlbl_audit *audit_info) 737 { 738 struct audit_buffer *audit_buf; 739 u8 old_val; 740 741 old_val = netlabel_unlabel_acceptflg; 742 netlabel_unlabel_acceptflg = value; 743 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW, 744 audit_info); 745 if (audit_buf != NULL) { 746 audit_log_format(audit_buf, 747 " unlbl_accept=%u old=%u", value, old_val); 748 audit_log_end(audit_buf); 749 } 750 } 751 752 /** 753 * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information 754 * @info: the Generic NETLINK info block 755 * @addr: the IP address 756 * @mask: the IP address mask 757 * @len: the address length 758 * 759 * Description: 760 * Examine the Generic NETLINK message and extract the IP address information. 761 * Returns zero on success, negative values on failure. 762 * 763 */ 764 static int netlbl_unlabel_addrinfo_get(struct genl_info *info, 765 void **addr, 766 void **mask, 767 u32 *len) 768 { 769 u32 addr_len; 770 771 if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] && 772 info->attrs[NLBL_UNLABEL_A_IPV4MASK]) { 773 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); 774 if (addr_len != sizeof(struct in_addr) && 775 addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK])) 776 return -EINVAL; 777 *len = addr_len; 778 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]); 779 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]); 780 return 0; 781 } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) { 782 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); 783 if (addr_len != sizeof(struct in6_addr) && 784 addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK])) 785 return -EINVAL; 786 *len = addr_len; 787 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]); 788 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]); 789 return 0; 790 } 791 792 return -EINVAL; 793 } 794 795 /* 796 * NetLabel Command Handlers 797 */ 798 799 /** 800 * netlbl_unlabel_accept - Handle an ACCEPT message 801 * @skb: the NETLINK buffer 802 * @info: the Generic NETLINK info block 803 * 804 * Description: 805 * Process a user generated ACCEPT message and set the accept flag accordingly. 806 * Returns zero on success, negative values on failure. 807 * 808 */ 809 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info) 810 { 811 u8 value; 812 struct netlbl_audit audit_info; 813 814 if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) { 815 value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]); 816 if (value == 1 || value == 0) { 817 netlbl_netlink_auditinfo(skb, &audit_info); 818 netlbl_unlabel_acceptflg_set(value, &audit_info); 819 return 0; 820 } 821 } 822 823 return -EINVAL; 824 } 825 826 /** 827 * netlbl_unlabel_list - Handle a LIST message 828 * @skb: the NETLINK buffer 829 * @info: the Generic NETLINK info block 830 * 831 * Description: 832 * Process a user generated LIST message and respond with the current status. 833 * Returns zero on success, negative values on failure. 834 * 835 */ 836 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info) 837 { 838 int ret_val = -EINVAL; 839 struct sk_buff *ans_skb; 840 void *data; 841 842 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 843 if (ans_skb == NULL) 844 goto list_failure; 845 data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family, 846 0, NLBL_UNLABEL_C_LIST); 847 if (data == NULL) { 848 ret_val = -ENOMEM; 849 goto list_failure; 850 } 851 852 ret_val = nla_put_u8(ans_skb, 853 NLBL_UNLABEL_A_ACPTFLG, 854 netlabel_unlabel_acceptflg); 855 if (ret_val != 0) 856 goto list_failure; 857 858 genlmsg_end(ans_skb, data); 859 return genlmsg_reply(ans_skb, info); 860 861 list_failure: 862 kfree_skb(ans_skb); 863 return ret_val; 864 } 865 866 /** 867 * netlbl_unlabel_staticadd - Handle a STATICADD message 868 * @skb: the NETLINK buffer 869 * @info: the Generic NETLINK info block 870 * 871 * Description: 872 * Process a user generated STATICADD message and add a new unlabeled 873 * connection entry to the hash table. Returns zero on success, negative 874 * values on failure. 875 * 876 */ 877 static int netlbl_unlabel_staticadd(struct sk_buff *skb, 878 struct genl_info *info) 879 { 880 int ret_val; 881 char *dev_name; 882 void *addr; 883 void *mask; 884 u32 addr_len; 885 u32 secid; 886 struct netlbl_audit audit_info; 887 888 /* Don't allow users to add both IPv4 and IPv6 addresses for a 889 * single entry. However, allow users to create two entries, one each 890 * for IPv4 and IPv4, with the same LSM security context which should 891 * achieve the same result. */ 892 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || 893 !info->attrs[NLBL_UNLABEL_A_IFACE] || 894 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 895 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 896 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 897 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 898 return -EINVAL; 899 900 netlbl_netlink_auditinfo(skb, &audit_info); 901 902 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 903 if (ret_val != 0) 904 return ret_val; 905 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); 906 ret_val = security_secctx_to_secid( 907 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), 908 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), 909 &secid); 910 if (ret_val != 0) 911 return ret_val; 912 913 return netlbl_unlhsh_add(&init_net, 914 dev_name, addr, mask, addr_len, secid, 915 &audit_info); 916 } 917 918 /** 919 * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message 920 * @skb: the NETLINK buffer 921 * @info: the Generic NETLINK info block 922 * 923 * Description: 924 * Process a user generated STATICADDDEF message and add a new default 925 * unlabeled connection entry. Returns zero on success, negative values on 926 * failure. 927 * 928 */ 929 static int netlbl_unlabel_staticadddef(struct sk_buff *skb, 930 struct genl_info *info) 931 { 932 int ret_val; 933 void *addr; 934 void *mask; 935 u32 addr_len; 936 u32 secid; 937 struct netlbl_audit audit_info; 938 939 /* Don't allow users to add both IPv4 and IPv6 addresses for a 940 * single entry. However, allow users to create two entries, one each 941 * for IPv4 and IPv6, with the same LSM security context which should 942 * achieve the same result. */ 943 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] || 944 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 945 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 946 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 947 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 948 return -EINVAL; 949 950 netlbl_netlink_auditinfo(skb, &audit_info); 951 952 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 953 if (ret_val != 0) 954 return ret_val; 955 ret_val = security_secctx_to_secid( 956 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), 957 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), 958 &secid); 959 if (ret_val != 0) 960 return ret_val; 961 962 return netlbl_unlhsh_add(&init_net, 963 NULL, addr, mask, addr_len, secid, 964 &audit_info); 965 } 966 967 /** 968 * netlbl_unlabel_staticremove - Handle a STATICREMOVE message 969 * @skb: the NETLINK buffer 970 * @info: the Generic NETLINK info block 971 * 972 * Description: 973 * Process a user generated STATICREMOVE message and remove the specified 974 * unlabeled connection entry. Returns zero on success, negative values on 975 * failure. 976 * 977 */ 978 static int netlbl_unlabel_staticremove(struct sk_buff *skb, 979 struct genl_info *info) 980 { 981 int ret_val; 982 char *dev_name; 983 void *addr; 984 void *mask; 985 u32 addr_len; 986 struct netlbl_audit audit_info; 987 988 /* See the note in netlbl_unlabel_staticadd() about not allowing both 989 * IPv4 and IPv6 in the same entry. */ 990 if (!info->attrs[NLBL_UNLABEL_A_IFACE] || 991 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 992 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 993 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 994 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 995 return -EINVAL; 996 997 netlbl_netlink_auditinfo(skb, &audit_info); 998 999 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 1000 if (ret_val != 0) 1001 return ret_val; 1002 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]); 1003 1004 return netlbl_unlhsh_remove(&init_net, 1005 dev_name, addr, mask, addr_len, 1006 &audit_info); 1007 } 1008 1009 /** 1010 * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message 1011 * @skb: the NETLINK buffer 1012 * @info: the Generic NETLINK info block 1013 * 1014 * Description: 1015 * Process a user generated STATICREMOVEDEF message and remove the default 1016 * unlabeled connection entry. Returns zero on success, negative values on 1017 * failure. 1018 * 1019 */ 1020 static int netlbl_unlabel_staticremovedef(struct sk_buff *skb, 1021 struct genl_info *info) 1022 { 1023 int ret_val; 1024 void *addr; 1025 void *mask; 1026 u32 addr_len; 1027 struct netlbl_audit audit_info; 1028 1029 /* See the note in netlbl_unlabel_staticadd() about not allowing both 1030 * IPv4 and IPv6 in the same entry. */ 1031 if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] || 1032 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^ 1033 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] || 1034 !info->attrs[NLBL_UNLABEL_A_IPV6MASK]))) 1035 return -EINVAL; 1036 1037 netlbl_netlink_auditinfo(skb, &audit_info); 1038 1039 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len); 1040 if (ret_val != 0) 1041 return ret_val; 1042 1043 return netlbl_unlhsh_remove(&init_net, 1044 NULL, addr, mask, addr_len, 1045 &audit_info); 1046 } 1047 1048 1049 /** 1050 * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF] 1051 * @cmd: command/message 1052 * @iface: the interface entry 1053 * @addr4: the IPv4 address entry 1054 * @addr6: the IPv6 address entry 1055 * @arg: the netlbl_unlhsh_walk_arg structure 1056 * 1057 * Description: 1058 * This function is designed to be used to generate a response for a 1059 * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6 1060 * can be specified, not both, the other unspecified entry should be set to 1061 * NULL by the caller. Returns the size of the message on success, negative 1062 * values on failure. 1063 * 1064 */ 1065 static int netlbl_unlabel_staticlist_gen(u32 cmd, 1066 const struct netlbl_unlhsh_iface *iface, 1067 const struct netlbl_unlhsh_addr4 *addr4, 1068 const struct netlbl_unlhsh_addr6 *addr6, 1069 void *arg) 1070 { 1071 int ret_val = -ENOMEM; 1072 struct netlbl_unlhsh_walk_arg *cb_arg = arg; 1073 struct net_device *dev; 1074 void *data; 1075 u32 secid; 1076 char *secctx; 1077 u32 secctx_len; 1078 1079 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, 1080 cb_arg->seq, &netlbl_unlabel_gnl_family, 1081 NLM_F_MULTI, cmd); 1082 if (data == NULL) 1083 goto list_cb_failure; 1084 1085 if (iface->ifindex > 0) { 1086 dev = dev_get_by_index(&init_net, iface->ifindex); 1087 if (!dev) { 1088 ret_val = -ENODEV; 1089 goto list_cb_failure; 1090 } 1091 ret_val = nla_put_string(cb_arg->skb, 1092 NLBL_UNLABEL_A_IFACE, dev->name); 1093 dev_put(dev); 1094 if (ret_val != 0) 1095 goto list_cb_failure; 1096 } 1097 1098 if (addr4) { 1099 struct in_addr addr_struct; 1100 1101 addr_struct.s_addr = addr4->list.addr; 1102 ret_val = nla_put_in_addr(cb_arg->skb, 1103 NLBL_UNLABEL_A_IPV4ADDR, 1104 addr_struct.s_addr); 1105 if (ret_val != 0) 1106 goto list_cb_failure; 1107 1108 addr_struct.s_addr = addr4->list.mask; 1109 ret_val = nla_put_in_addr(cb_arg->skb, 1110 NLBL_UNLABEL_A_IPV4MASK, 1111 addr_struct.s_addr); 1112 if (ret_val != 0) 1113 goto list_cb_failure; 1114 1115 secid = addr4->secid; 1116 } else { 1117 ret_val = nla_put_in6_addr(cb_arg->skb, 1118 NLBL_UNLABEL_A_IPV6ADDR, 1119 &addr6->list.addr); 1120 if (ret_val != 0) 1121 goto list_cb_failure; 1122 1123 ret_val = nla_put_in6_addr(cb_arg->skb, 1124 NLBL_UNLABEL_A_IPV6MASK, 1125 &addr6->list.mask); 1126 if (ret_val != 0) 1127 goto list_cb_failure; 1128 1129 secid = addr6->secid; 1130 } 1131 1132 ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len); 1133 if (ret_val != 0) 1134 goto list_cb_failure; 1135 ret_val = nla_put(cb_arg->skb, 1136 NLBL_UNLABEL_A_SECCTX, 1137 secctx_len, 1138 secctx); 1139 security_release_secctx(secctx, secctx_len); 1140 if (ret_val != 0) 1141 goto list_cb_failure; 1142 1143 cb_arg->seq++; 1144 genlmsg_end(cb_arg->skb, data); 1145 return 0; 1146 1147 list_cb_failure: 1148 genlmsg_cancel(cb_arg->skb, data); 1149 return ret_val; 1150 } 1151 1152 /** 1153 * netlbl_unlabel_staticlist - Handle a STATICLIST message 1154 * @skb: the NETLINK buffer 1155 * @cb: the NETLINK callback 1156 * 1157 * Description: 1158 * Process a user generated STATICLIST message and dump the unlabeled 1159 * connection hash table in a form suitable for use in a kernel generated 1160 * STATICLIST message. Returns the length of @skb. 1161 * 1162 */ 1163 static int netlbl_unlabel_staticlist(struct sk_buff *skb, 1164 struct netlink_callback *cb) 1165 { 1166 struct netlbl_unlhsh_walk_arg cb_arg; 1167 u32 skip_bkt = cb->args[0]; 1168 u32 skip_chain = cb->args[1]; 1169 u32 iter_bkt; 1170 u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0; 1171 struct netlbl_unlhsh_iface *iface; 1172 struct list_head *iter_list; 1173 struct netlbl_af4list *addr4; 1174 #if IS_ENABLED(CONFIG_IPV6) 1175 struct netlbl_af6list *addr6; 1176 #endif 1177 1178 cb_arg.nl_cb = cb; 1179 cb_arg.skb = skb; 1180 cb_arg.seq = cb->nlh->nlmsg_seq; 1181 1182 rcu_read_lock(); 1183 for (iter_bkt = skip_bkt; 1184 iter_bkt < rcu_dereference(netlbl_unlhsh)->size; 1185 iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) { 1186 iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt]; 1187 list_for_each_entry_rcu(iface, iter_list, list) { 1188 if (!iface->valid || 1189 iter_chain++ < skip_chain) 1190 continue; 1191 netlbl_af4list_foreach_rcu(addr4, 1192 &iface->addr4_list) { 1193 if (iter_addr4++ < cb->args[2]) 1194 continue; 1195 if (netlbl_unlabel_staticlist_gen( 1196 NLBL_UNLABEL_C_STATICLIST, 1197 iface, 1198 netlbl_unlhsh_addr4_entry(addr4), 1199 NULL, 1200 &cb_arg) < 0) { 1201 iter_addr4--; 1202 iter_chain--; 1203 goto unlabel_staticlist_return; 1204 } 1205 } 1206 #if IS_ENABLED(CONFIG_IPV6) 1207 netlbl_af6list_foreach_rcu(addr6, 1208 &iface->addr6_list) { 1209 if (iter_addr6++ < cb->args[3]) 1210 continue; 1211 if (netlbl_unlabel_staticlist_gen( 1212 NLBL_UNLABEL_C_STATICLIST, 1213 iface, 1214 NULL, 1215 netlbl_unlhsh_addr6_entry(addr6), 1216 &cb_arg) < 0) { 1217 iter_addr6--; 1218 iter_chain--; 1219 goto unlabel_staticlist_return; 1220 } 1221 } 1222 #endif /* IPv6 */ 1223 } 1224 } 1225 1226 unlabel_staticlist_return: 1227 rcu_read_unlock(); 1228 cb->args[0] = iter_bkt; 1229 cb->args[1] = iter_chain; 1230 cb->args[2] = iter_addr4; 1231 cb->args[3] = iter_addr6; 1232 return skb->len; 1233 } 1234 1235 /** 1236 * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message 1237 * @skb: the NETLINK buffer 1238 * @cb: the NETLINK callback 1239 * 1240 * Description: 1241 * Process a user generated STATICLISTDEF message and dump the default 1242 * unlabeled connection entry in a form suitable for use in a kernel generated 1243 * STATICLISTDEF message. Returns the length of @skb. 1244 * 1245 */ 1246 static int netlbl_unlabel_staticlistdef(struct sk_buff *skb, 1247 struct netlink_callback *cb) 1248 { 1249 struct netlbl_unlhsh_walk_arg cb_arg; 1250 struct netlbl_unlhsh_iface *iface; 1251 u32 iter_addr4 = 0, iter_addr6 = 0; 1252 struct netlbl_af4list *addr4; 1253 #if IS_ENABLED(CONFIG_IPV6) 1254 struct netlbl_af6list *addr6; 1255 #endif 1256 1257 cb_arg.nl_cb = cb; 1258 cb_arg.skb = skb; 1259 cb_arg.seq = cb->nlh->nlmsg_seq; 1260 1261 rcu_read_lock(); 1262 iface = rcu_dereference(netlbl_unlhsh_def); 1263 if (iface == NULL || !iface->valid) 1264 goto unlabel_staticlistdef_return; 1265 1266 netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) { 1267 if (iter_addr4++ < cb->args[0]) 1268 continue; 1269 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, 1270 iface, 1271 netlbl_unlhsh_addr4_entry(addr4), 1272 NULL, 1273 &cb_arg) < 0) { 1274 iter_addr4--; 1275 goto unlabel_staticlistdef_return; 1276 } 1277 } 1278 #if IS_ENABLED(CONFIG_IPV6) 1279 netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) { 1280 if (iter_addr6++ < cb->args[1]) 1281 continue; 1282 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF, 1283 iface, 1284 NULL, 1285 netlbl_unlhsh_addr6_entry(addr6), 1286 &cb_arg) < 0) { 1287 iter_addr6--; 1288 goto unlabel_staticlistdef_return; 1289 } 1290 } 1291 #endif /* IPv6 */ 1292 1293 unlabel_staticlistdef_return: 1294 rcu_read_unlock(); 1295 cb->args[0] = iter_addr4; 1296 cb->args[1] = iter_addr6; 1297 return skb->len; 1298 } 1299 1300 /* 1301 * NetLabel Generic NETLINK Command Definitions 1302 */ 1303 1304 static const struct genl_ops netlbl_unlabel_genl_ops[] = { 1305 { 1306 .cmd = NLBL_UNLABEL_C_STATICADD, 1307 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1308 .flags = GENL_ADMIN_PERM, 1309 .doit = netlbl_unlabel_staticadd, 1310 .dumpit = NULL, 1311 }, 1312 { 1313 .cmd = NLBL_UNLABEL_C_STATICREMOVE, 1314 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1315 .flags = GENL_ADMIN_PERM, 1316 .doit = netlbl_unlabel_staticremove, 1317 .dumpit = NULL, 1318 }, 1319 { 1320 .cmd = NLBL_UNLABEL_C_STATICLIST, 1321 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1322 .flags = 0, 1323 .doit = NULL, 1324 .dumpit = netlbl_unlabel_staticlist, 1325 }, 1326 { 1327 .cmd = NLBL_UNLABEL_C_STATICADDDEF, 1328 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1329 .flags = GENL_ADMIN_PERM, 1330 .doit = netlbl_unlabel_staticadddef, 1331 .dumpit = NULL, 1332 }, 1333 { 1334 .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF, 1335 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1336 .flags = GENL_ADMIN_PERM, 1337 .doit = netlbl_unlabel_staticremovedef, 1338 .dumpit = NULL, 1339 }, 1340 { 1341 .cmd = NLBL_UNLABEL_C_STATICLISTDEF, 1342 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1343 .flags = 0, 1344 .doit = NULL, 1345 .dumpit = netlbl_unlabel_staticlistdef, 1346 }, 1347 { 1348 .cmd = NLBL_UNLABEL_C_ACCEPT, 1349 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1350 .flags = GENL_ADMIN_PERM, 1351 .doit = netlbl_unlabel_accept, 1352 .dumpit = NULL, 1353 }, 1354 { 1355 .cmd = NLBL_UNLABEL_C_LIST, 1356 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 1357 .flags = 0, 1358 .doit = netlbl_unlabel_list, 1359 .dumpit = NULL, 1360 }, 1361 }; 1362 1363 static struct genl_family netlbl_unlabel_gnl_family __ro_after_init = { 1364 .hdrsize = 0, 1365 .name = NETLBL_NLTYPE_UNLABELED_NAME, 1366 .version = NETLBL_PROTO_VERSION, 1367 .maxattr = NLBL_UNLABEL_A_MAX, 1368 .policy = netlbl_unlabel_genl_policy, 1369 .module = THIS_MODULE, 1370 .ops = netlbl_unlabel_genl_ops, 1371 .n_ops = ARRAY_SIZE(netlbl_unlabel_genl_ops), 1372 }; 1373 1374 /* 1375 * NetLabel Generic NETLINK Protocol Functions 1376 */ 1377 1378 /** 1379 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component 1380 * 1381 * Description: 1382 * Register the unlabeled packet NetLabel component with the Generic NETLINK 1383 * mechanism. Returns zero on success, negative values on failure. 1384 * 1385 */ 1386 int __init netlbl_unlabel_genl_init(void) 1387 { 1388 return genl_register_family(&netlbl_unlabel_gnl_family); 1389 } 1390 1391 /* 1392 * NetLabel KAPI Hooks 1393 */ 1394 1395 static struct notifier_block netlbl_unlhsh_netdev_notifier = { 1396 .notifier_call = netlbl_unlhsh_netdev_handler, 1397 }; 1398 1399 /** 1400 * netlbl_unlabel_init - Initialize the unlabeled connection hash table 1401 * @size: the number of bits to use for the hash buckets 1402 * 1403 * Description: 1404 * Initializes the unlabeled connection hash table and registers a network 1405 * device notification handler. This function should only be called by the 1406 * NetLabel subsystem itself during initialization. Returns zero on success, 1407 * non-zero values on error. 1408 * 1409 */ 1410 int __init netlbl_unlabel_init(u32 size) 1411 { 1412 u32 iter; 1413 struct netlbl_unlhsh_tbl *hsh_tbl; 1414 1415 if (size == 0) 1416 return -EINVAL; 1417 1418 hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL); 1419 if (hsh_tbl == NULL) 1420 return -ENOMEM; 1421 hsh_tbl->size = 1 << size; 1422 hsh_tbl->tbl = kcalloc(hsh_tbl->size, 1423 sizeof(struct list_head), 1424 GFP_KERNEL); 1425 if (hsh_tbl->tbl == NULL) { 1426 kfree(hsh_tbl); 1427 return -ENOMEM; 1428 } 1429 for (iter = 0; iter < hsh_tbl->size; iter++) 1430 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]); 1431 1432 spin_lock(&netlbl_unlhsh_lock); 1433 rcu_assign_pointer(netlbl_unlhsh, hsh_tbl); 1434 spin_unlock(&netlbl_unlhsh_lock); 1435 1436 register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier); 1437 1438 return 0; 1439 } 1440 1441 /** 1442 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet 1443 * @skb: the packet 1444 * @family: protocol family 1445 * @secattr: the security attributes 1446 * 1447 * Description: 1448 * Determine the security attributes, if any, for an unlabled packet and return 1449 * them in @secattr. Returns zero on success and negative values on failure. 1450 * 1451 */ 1452 int netlbl_unlabel_getattr(const struct sk_buff *skb, 1453 u16 family, 1454 struct netlbl_lsm_secattr *secattr) 1455 { 1456 struct netlbl_unlhsh_iface *iface; 1457 1458 rcu_read_lock(); 1459 iface = netlbl_unlhsh_search_iface(skb->skb_iif); 1460 if (iface == NULL) 1461 iface = rcu_dereference(netlbl_unlhsh_def); 1462 if (iface == NULL || !iface->valid) 1463 goto unlabel_getattr_nolabel; 1464 1465 #if IS_ENABLED(CONFIG_IPV6) 1466 /* When resolving a fallback label, check the sk_buff version as 1467 * it is possible (e.g. SCTP) to have family = PF_INET6 while 1468 * receiving ip_hdr(skb)->version = 4. 1469 */ 1470 if (family == PF_INET6 && ip_hdr(skb)->version == 4) 1471 family = PF_INET; 1472 #endif /* IPv6 */ 1473 1474 switch (family) { 1475 case PF_INET: { 1476 struct iphdr *hdr4; 1477 struct netlbl_af4list *addr4; 1478 1479 hdr4 = ip_hdr(skb); 1480 addr4 = netlbl_af4list_search(hdr4->saddr, 1481 &iface->addr4_list); 1482 if (addr4 == NULL) 1483 goto unlabel_getattr_nolabel; 1484 secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid; 1485 break; 1486 } 1487 #if IS_ENABLED(CONFIG_IPV6) 1488 case PF_INET6: { 1489 struct ipv6hdr *hdr6; 1490 struct netlbl_af6list *addr6; 1491 1492 hdr6 = ipv6_hdr(skb); 1493 addr6 = netlbl_af6list_search(&hdr6->saddr, 1494 &iface->addr6_list); 1495 if (addr6 == NULL) 1496 goto unlabel_getattr_nolabel; 1497 secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid; 1498 break; 1499 } 1500 #endif /* IPv6 */ 1501 default: 1502 goto unlabel_getattr_nolabel; 1503 } 1504 rcu_read_unlock(); 1505 1506 secattr->flags |= NETLBL_SECATTR_SECID; 1507 secattr->type = NETLBL_NLTYPE_UNLABELED; 1508 return 0; 1509 1510 unlabel_getattr_nolabel: 1511 rcu_read_unlock(); 1512 if (netlabel_unlabel_acceptflg == 0) 1513 return -ENOMSG; 1514 secattr->type = NETLBL_NLTYPE_UNLABELED; 1515 return 0; 1516 } 1517 1518 /** 1519 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets 1520 * 1521 * Description: 1522 * Set the default NetLabel configuration to allow incoming unlabeled packets 1523 * and to send unlabeled network traffic by default. 1524 * 1525 */ 1526 int __init netlbl_unlabel_defconf(void) 1527 { 1528 int ret_val; 1529 struct netlbl_dom_map *entry; 1530 struct netlbl_audit audit_info; 1531 1532 /* Only the kernel is allowed to call this function and the only time 1533 * it is called is at bootup before the audit subsystem is reporting 1534 * messages so don't worry to much about these values. */ 1535 security_task_getsecid(current, &audit_info.secid); 1536 audit_info.loginuid = GLOBAL_ROOT_UID; 1537 audit_info.sessionid = 0; 1538 1539 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 1540 if (entry == NULL) 1541 return -ENOMEM; 1542 entry->family = AF_UNSPEC; 1543 entry->def.type = NETLBL_NLTYPE_UNLABELED; 1544 ret_val = netlbl_domhsh_add_default(entry, &audit_info); 1545 if (ret_val != 0) 1546 return ret_val; 1547 1548 netlbl_unlabel_acceptflg_set(1, &audit_info); 1549 1550 return 0; 1551 } 1552