^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) /* SPDX-License-Identifier: GPL-2.0-or-later */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * CIPSO - Commercial IP Security Option
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * This is an implementation of the CIPSO 2.2 protocol as specified in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * FIPS-188, copies of both documents can be found in the Documentation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * directory. While CIPSO never became a full IETF RFC standard many vendors
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * have chosen to adopt the protocol and over the years it has become a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * de-facto standard for labeled networking.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * Author: Paul Moore <paul@paul-moore.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #ifndef _CIPSO_IPV4_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #define _CIPSO_IPV4_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <linux/types.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <linux/rcupdate.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <linux/list.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <linux/net.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <linux/skbuff.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include <net/netlabel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <net/request_sock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #include <linux/atomic.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <linux/refcount.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #include <asm/unaligned.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) /* known doi values */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) #define CIPSO_V4_DOI_UNKNOWN 0x00000000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) /* standard tag types */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) #define CIPSO_V4_TAG_INVALID 0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #define CIPSO_V4_TAG_RBITMAP 1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #define CIPSO_V4_TAG_ENUM 2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) #define CIPSO_V4_TAG_RANGE 5
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) #define CIPSO_V4_TAG_PBITMAP 6
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) #define CIPSO_V4_TAG_FREEFORM 7
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) /* non-standard tag types (tags > 127) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) #define CIPSO_V4_TAG_LOCAL 128
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) /* doi mapping types */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) #define CIPSO_V4_MAP_UNKNOWN 0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) #define CIPSO_V4_MAP_TRANS 1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) #define CIPSO_V4_MAP_PASS 2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) #define CIPSO_V4_MAP_LOCAL 3
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) /* limits */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) #define CIPSO_V4_MAX_REM_LVLS 255
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) #define CIPSO_V4_INV_LVL 0x80000000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) #define CIPSO_V4_MAX_LOC_LVLS (CIPSO_V4_INV_LVL - 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) #define CIPSO_V4_MAX_REM_CATS 65534
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) #define CIPSO_V4_INV_CAT 0x80000000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) #define CIPSO_V4_MAX_LOC_CATS (CIPSO_V4_INV_CAT - 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * CIPSO DOI definitions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) /* DOI definition struct */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) #define CIPSO_V4_TAG_MAXCNT 5
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) struct cipso_v4_doi {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) u32 doi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) u32 type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) union {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) struct cipso_v4_std_map_tbl *std;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) } map;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) u8 tags[CIPSO_V4_TAG_MAXCNT];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) refcount_t refcount;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) struct list_head list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) struct rcu_head rcu;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) /* Standard CIPSO mapping table */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) /* NOTE: the highest order bit (i.e. 0x80000000) is an 'invalid' flag, if the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) * bit is set then consider that value as unspecified, meaning the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) * mapping for that particular level/category is invalid */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) struct cipso_v4_std_map_tbl {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) u32 *cipso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) u32 *local;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) u32 cipso_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) u32 local_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) } lvl;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) u32 *cipso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) u32 *local;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) u32 cipso_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) u32 local_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) } cat;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) * Sysctl Variables
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) #ifdef CONFIG_NETLABEL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) extern int cipso_v4_cache_enabled;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) extern int cipso_v4_cache_bucketsize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) extern int cipso_v4_rbm_optfmt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) extern int cipso_v4_rbm_strictvalid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) * DOI List Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) #ifdef CONFIG_NETLABEL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) struct netlbl_audit *audit_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) void cipso_v4_doi_free(struct cipso_v4_doi *doi_def);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) int cipso_v4_doi_walk(u32 *skip_cnt,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) void *cb_arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) struct netlbl_audit *audit_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) static inline void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) static inline int cipso_v4_doi_remove(u32 doi,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) struct netlbl_audit *audit_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) static inline struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) static inline int cipso_v4_doi_walk(u32 *skip_cnt,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) void *cb_arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) #endif /* CONFIG_NETLABEL */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) * Label Mapping Cache Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) #ifdef CONFIG_NETLABEL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) void cipso_v4_cache_invalidate(void);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) int cipso_v4_cache_add(const unsigned char *cipso_ptr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) const struct netlbl_lsm_secattr *secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) static inline void cipso_v4_cache_invalidate(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) #endif /* CONFIG_NETLABEL */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) * Protocol Handling Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) #ifdef CONFIG_NETLABEL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) int cipso_v4_getattr(const unsigned char *cipso,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) struct netlbl_lsm_secattr *secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) int cipso_v4_sock_setattr(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) const struct netlbl_lsm_secattr *secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) void cipso_v4_sock_delattr(struct sock *sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) int cipso_v4_req_setattr(struct request_sock *req,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) const struct netlbl_lsm_secattr *secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) void cipso_v4_req_delattr(struct request_sock *req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) int cipso_v4_skbuff_setattr(struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) const struct netlbl_lsm_secattr *secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) int cipso_v4_skbuff_delattr(struct sk_buff *skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) struct netlbl_lsm_secattr *secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) unsigned char *cipso_v4_optptr(const struct sk_buff *skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) static inline void cipso_v4_error(struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) int error,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) u32 gateway)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) static inline int cipso_v4_getattr(const unsigned char *cipso,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) static inline int cipso_v4_sock_setattr(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) static inline void cipso_v4_sock_delattr(struct sock *sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) static inline int cipso_v4_sock_getattr(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) static inline int cipso_v4_req_setattr(struct request_sock *req,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) static inline void cipso_v4_req_delattr(struct request_sock *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) static inline int cipso_v4_skbuff_setattr(struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) static inline int cipso_v4_skbuff_delattr(struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) return -ENOSYS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) static inline int cipso_v4_validate(const struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) unsigned char **option)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) unsigned char *opt = *option;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) unsigned char err_offset = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) u8 opt_len = opt[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) u8 opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) u8 tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) if (opt_len < 8) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) err_offset = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) if (get_unaligned_be32(&opt[2]) == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) err_offset = 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) for (opt_iter = 6; opt_iter < opt_len;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) if (opt_iter + 1 == opt_len) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) err_offset = opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) tag_len = opt[opt_iter + 1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) err_offset = opt_iter + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) opt_iter += tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) *option = opt + err_offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) return err_offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) #endif /* CONFIG_NETLABEL */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) #endif /* _CIPSO_IPV4_H */
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags