^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-or-later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * CIPSO - Commercial IP Security Option
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * This is an implementation of the CIPSO 2.2 protocol as specified in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) * FIPS-188. While CIPSO never became a full IETF RFC standard many vendors
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * have chosen to adopt the protocol and over the years it has become a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) * de-facto standard for labeled networking.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) * The CIPSO draft specification can be found in the kernel's Documentation
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * directory as well as the following URL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) * https://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) * The FIPS-188 specification can be found at the following URL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) * https://www.itl.nist.gov/fipspubs/fip188.htm
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) * Author: Paul Moore <paul.moore@hp.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <linux/types.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <linux/rcupdate.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include <linux/list.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <linux/spinlock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #include <linux/string.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <linux/jhash.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #include <linux/audit.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) #include <net/ip.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) #include <net/icmp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) #include <net/tcp.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) #include <net/netlabel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) #include <net/cipso_ipv4.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #include <linux/atomic.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #include <linux/bug.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) #include <asm/unaligned.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) /* List of available DOI definitions */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) /* XXX - This currently assumes a minimal number of different DOIs in use,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) * if in practice there are a lot of different DOIs this list should
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) * probably be turned into a hash table or something similar so we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) * can do quick lookups. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) static LIST_HEAD(cipso_v4_doi_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) /* Label mapping cache */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) int cipso_v4_cache_enabled = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) int cipso_v4_cache_bucketsize = 10;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) #define CIPSO_V4_CACHE_BUCKETBITS 7
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) #define CIPSO_V4_CACHE_BUCKETS (1 << CIPSO_V4_CACHE_BUCKETBITS)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) #define CIPSO_V4_CACHE_REORDERLIMIT 10
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) struct cipso_v4_map_cache_bkt {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) spinlock_t lock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) u32 size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) struct list_head list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) struct cipso_v4_map_cache_entry {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) u32 hash;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) unsigned char *key;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) size_t key_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) struct netlbl_lsm_cache *lsm_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) u32 activity;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) struct list_head list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) static struct cipso_v4_map_cache_bkt *cipso_v4_cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) /* Restricted bitmap (tag #1) flags */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) int cipso_v4_rbm_optfmt = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) int cipso_v4_rbm_strictvalid = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) * Protocol Constants
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) /* Maximum size of the CIPSO IP option, derived from the fact that the maximum
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) #define CIPSO_V4_OPT_LEN_MAX 40
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) /* Length of the base CIPSO option, this includes the option type (1 byte), the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) * option length (1 byte), and the DOI (4 bytes). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) #define CIPSO_V4_HDR_LEN 6
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) /* Base length of the restrictive category bitmap tag (tag #1). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) #define CIPSO_V4_TAG_RBM_BLEN 4
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) /* Base length of the enumerated category tag (tag #2). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) #define CIPSO_V4_TAG_ENUM_BLEN 4
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) /* Base length of the ranged categories bitmap tag (tag #5). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) #define CIPSO_V4_TAG_RNG_BLEN 4
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) /* The maximum number of category ranges permitted in the ranged category tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) * (tag #5). You may note that the IETF draft states that the maximum number
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) * of category ranges is 7, but if the low end of the last category range is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) * zero then it is possible to fit 8 category ranges because the zero should
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) * be omitted. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) #define CIPSO_V4_TAG_RNG_CAT_MAX 8
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) /* Base length of the local tag (non-standard tag).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) * Tag definition (may change between kernel versions)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) * 0 8 16 24 32
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) * +----------+----------+----------+----------+
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) * | 10000000 | 00000110 | 32-bit secid value |
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) * +----------+----------+----------+----------+
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) * | in (host byte order)|
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) * +----------+----------+
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) #define CIPSO_V4_TAG_LOC_BLEN 6
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) * Helper Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) * cipso_v4_cache_entry_free - Frees a cache entry
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) * @entry: the entry to free
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) * This function frees the memory associated with a cache entry including the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) * LSM cache data if there are no longer any users, i.e. reference count == 0.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) if (entry->lsm_data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) netlbl_secattr_cache_free(entry->lsm_data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) kfree(entry->key);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) kfree(entry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) * @key: the hash key
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) * @key_len: the length of the key in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) * The CIPSO tag hashing function. Returns a 32-bit hash value.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) return jhash(key, key_len, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) * Label Mapping Cache Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) * cipso_v4_cache_init - Initialize the CIPSO cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) * Initializes the CIPSO label mapping cache, this function should be called
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) * before any of the other functions defined in this file. Returns zero on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) * success, negative values on error.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) static int __init cipso_v4_cache_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) u32 iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) sizeof(struct cipso_v4_map_cache_bkt),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) if (!cipso_v4_cache)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) spin_lock_init(&cipso_v4_cache[iter].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) cipso_v4_cache[iter].size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) * Invalidates and frees any entries in the CIPSO cache. Returns zero on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) * success and negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) void cipso_v4_cache_invalidate(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) struct cipso_v4_map_cache_entry *entry, *tmp_entry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) u32 iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) spin_lock_bh(&cipso_v4_cache[iter].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) list_for_each_entry_safe(entry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) tmp_entry,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) &cipso_v4_cache[iter].list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) list_del(&entry->list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) cipso_v4_cache_entry_free(entry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) cipso_v4_cache[iter].size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) spin_unlock_bh(&cipso_v4_cache[iter].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) * @key: the buffer to check
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) * @key_len: buffer length in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216) * @secattr: the security attribute struct to use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) * This function checks the cache to see if a label mapping already exists for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) * the given key. If there is a match then the cache is adjusted and the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) * @secattr struct is populated with the correct LSM security attributes. The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) * cache is adjusted in the following manner if the entry is not already the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) * first in the cache bucket:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) * 1. The cache entry's activity counter is incremented
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) * 2. The previous (higher ranking) entry's activity counter is decremented
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) * 3. If the difference between the two activity counters is geater than
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) * CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) * Returns zero on success, -ENOENT for a cache miss, and other negative values
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) * on error.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) static int cipso_v4_cache_check(const unsigned char *key,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) u32 key_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) u32 bkt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) struct cipso_v4_map_cache_entry *entry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) struct cipso_v4_map_cache_entry *prev_entry = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) u32 hash;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) if (!cipso_v4_cache_enabled)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) return -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) hash = cipso_v4_map_cache_hash(key, key_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) spin_lock_bh(&cipso_v4_cache[bkt].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) if (entry->hash == hash &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) entry->key_len == key_len &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) memcmp(entry->key, key, key_len) == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) entry->activity += 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) refcount_inc(&entry->lsm_data->refcount);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) secattr->cache = entry->lsm_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) secattr->flags |= NETLBL_SECATTR_CACHE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) secattr->type = NETLBL_NLTYPE_CIPSOV4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) if (!prev_entry) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) spin_unlock_bh(&cipso_v4_cache[bkt].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) if (prev_entry->activity > 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) prev_entry->activity -= 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) if (entry->activity > prev_entry->activity &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) entry->activity - prev_entry->activity >
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) CIPSO_V4_CACHE_REORDERLIMIT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) __list_del(entry->list.prev, entry->list.next);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) __list_add(&entry->list,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) prev_entry->list.prev,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) &prev_entry->list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) spin_unlock_bh(&cipso_v4_cache[bkt].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) prev_entry = entry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) spin_unlock_bh(&cipso_v4_cache[bkt].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) return -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) * cipso_v4_cache_add - Add an entry to the CIPSO cache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) * @cipso_ptr: pointer to CIPSO IP option
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) * @secattr: the packet's security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) * Add a new entry into the CIPSO label mapping cache. Add the new entry to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) * head of the cache bucket's list, if the cache bucket is out of room remove
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) * the last entry in the list first. It is important to note that there is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) * currently no checking for duplicate keys. Returns zero on success,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) * negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) int cipso_v4_cache_add(const unsigned char *cipso_ptr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) int ret_val = -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) u32 bkt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) struct cipso_v4_map_cache_entry *entry = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) struct cipso_v4_map_cache_entry *old_entry = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) u32 cipso_ptr_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) cipso_ptr_len = cipso_ptr[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) if (!entry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) if (!entry->key) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) ret_val = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) goto cache_add_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) entry->key_len = cipso_ptr_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) refcount_inc(&secattr->cache->refcount);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) entry->lsm_data = secattr->cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) spin_lock_bh(&cipso_v4_cache[bkt].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) list_add(&entry->list, &cipso_v4_cache[bkt].list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) cipso_v4_cache[bkt].size += 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) struct cipso_v4_map_cache_entry, list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) list_del(&old_entry->list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) list_add(&entry->list, &cipso_v4_cache[bkt].list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) cipso_v4_cache_entry_free(old_entry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) spin_unlock_bh(&cipso_v4_cache[bkt].lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) cache_add_failure:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) if (entry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) cipso_v4_cache_entry_free(entry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) * DOI List Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) * cipso_v4_doi_search - Searches for a DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) * @doi: the DOI to search for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) * Search the DOI definition list for a DOI definition with a DOI value that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) * matches @doi. The caller is responsible for calling rcu_read_[un]lock().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) * Returns a pointer to the DOI definition on success and NULL on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) struct cipso_v4_doi *iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) if (iter->doi == doi && refcount_read(&iter->refcount))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) return iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) * @doi_def: the DOI structure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) * @audit_info: NetLabel audit information
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) * The caller defines a new DOI for use by the CIPSO engine and calls this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) * function to add it to the list of acceptable domains. The caller must
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) * ensure that the mapping table specified in @doi_def->map meets all of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) * requirements of the mapping type (see cipso_ipv4.h for details). Returns
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) * zero on success and non-zero on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) struct netlbl_audit *audit_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) int ret_val = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) u32 iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) u32 doi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) u32 doi_type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) doi = doi_def->doi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) doi_type = doi_def->type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) goto doi_add_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) switch (doi_def->tags[iter]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) case CIPSO_V4_TAG_RBITMAP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) case CIPSO_V4_TAG_RANGE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) case CIPSO_V4_TAG_ENUM:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) if (doi_def->type != CIPSO_V4_MAP_PASS)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) goto doi_add_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) case CIPSO_V4_TAG_LOCAL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) if (doi_def->type != CIPSO_V4_MAP_LOCAL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) goto doi_add_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) case CIPSO_V4_TAG_INVALID:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) if (iter == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) goto doi_add_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) goto doi_add_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) refcount_set(&doi_def->refcount, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) spin_lock(&cipso_v4_doi_list_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) if (cipso_v4_doi_search(doi_def->doi)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) spin_unlock(&cipso_v4_doi_list_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) ret_val = -EEXIST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) goto doi_add_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) spin_unlock(&cipso_v4_doi_list_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) ret_val = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) doi_add_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) if (audit_buf) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433) const char *type_str;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) switch (doi_type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) type_str = "trans";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) case CIPSO_V4_MAP_PASS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) type_str = "pass";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) case CIPSO_V4_MAP_LOCAL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) type_str = "local";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) type_str = "(unknown)";
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) audit_log_format(audit_buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) " cipso_doi=%u cipso_type=%s res=%u",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) doi, type_str, ret_val == 0 ? 1 : 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) * cipso_v4_doi_free - Frees a DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) * This function frees all of the memory associated with a DOI definition.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) if (!doi_def)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) switch (doi_def->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) kfree(doi_def->map.std->lvl.cipso);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) kfree(doi_def->map.std->lvl.local);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) kfree(doi_def->map.std->cat.cipso);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) kfree(doi_def->map.std->cat.local);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) kfree(doi_def->map.std);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) kfree(doi_def);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) * cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) * @entry: the entry's RCU field
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) * This function is designed to be used as a callback to the call_rcu()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) * function so that the memory allocated to the DOI definition can be released
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) * safely.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) struct cipso_v4_doi *doi_def;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) doi_def = container_of(entry, struct cipso_v4_doi, rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) cipso_v4_doi_free(doi_def);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) * @doi: the DOI value
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) * @audit_info: NetLabel audit information
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) * Removes a DOI definition from the CIPSO engine. The NetLabel routines will
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) * be called to release their own LSM domain mappings as well as our own
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) * domain list. Returns zero on success and negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) struct cipso_v4_doi *doi_def;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) struct audit_buffer *audit_buf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) spin_lock(&cipso_v4_doi_list_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) doi_def = cipso_v4_doi_search(doi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) if (!doi_def) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) spin_unlock(&cipso_v4_doi_list_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) ret_val = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) goto doi_remove_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523) list_del_rcu(&doi_def->list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) spin_unlock(&cipso_v4_doi_list_lock);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) cipso_v4_doi_putdef(doi_def);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) ret_val = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) doi_remove_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) if (audit_buf) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) audit_log_format(audit_buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) " cipso_doi=%u res=%u",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) doi, ret_val == 0 ? 1 : 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535) audit_log_end(audit_buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) * cipso_v4_doi_getdef - Returns a reference to a valid DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) * @doi: the DOI value
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) * Searches for a valid DOI definition and if one is found it is returned to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) * the caller. Otherwise NULL is returned. The caller must ensure that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) * rcu_read_lock() is held while accessing the returned definition and the DOI
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549) * definition reference count is decremented when the caller is done.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) struct cipso_v4_doi *doi_def;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) doi_def = cipso_v4_doi_search(doi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) if (!doi_def)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) goto doi_getdef_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) if (!refcount_inc_not_zero(&doi_def->refcount))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) doi_def = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563) doi_getdef_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565) return doi_def;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) * cipso_v4_doi_putdef - Releases a reference for the given DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) * Releases a DOI definition reference obtained from cipso_v4_doi_getdef().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578) if (!doi_def)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) if (!refcount_dec_and_test(&doi_def->refcount))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) cipso_v4_cache_invalidate();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) * cipso_v4_doi_walk - Iterate through the DOI definitions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590) * @skip_cnt: skip past this number of DOI definitions, updated
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) * @callback: callback for each DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592) * @cb_arg: argument for the callback function
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595) * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596) * For each entry call @callback, if @callback returns a negative value stop
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) * 'walking' through the list and return. Updates the value in @skip_cnt upon
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) * return. Returns zero on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) int cipso_v4_doi_walk(u32 *skip_cnt,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602) int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603) void *cb_arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) int ret_val = -ENOENT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) u32 doi_cnt = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) struct cipso_v4_doi *iter_doi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610) list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) if (refcount_read(&iter_doi->refcount) > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) if (doi_cnt++ < *skip_cnt)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) ret_val = callback(iter_doi, cb_arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615) if (ret_val < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616) doi_cnt--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) goto doi_walk_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) doi_walk_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) *skip_cnt = doi_cnt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) * Label Mapping Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634) * @level: the level to check
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637) * Checks the given level against the given DOI definition and returns a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638) * negative value if the level does not have a valid mapping and a zero value
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639) * if the level is defined by the DOI.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644) switch (doi_def->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645) case CIPSO_V4_MAP_PASS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648) if ((level < doi_def->map.std->lvl.cipso_size) &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658) * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660) * @host_lvl: the host MLS level
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661) * @net_lvl: the network/CIPSO MLS level
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) * Perform a label mapping to translate a local MLS level to the correct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) * CIPSO level using the given DOI definition. Returns zero on success,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) * negative values otherwise.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670) u32 host_lvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671) u32 *net_lvl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) switch (doi_def->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674) case CIPSO_V4_MAP_PASS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675) *net_lvl = host_lvl;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) if (host_lvl < doi_def->map.std->lvl.local_size &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679) doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) *net_lvl = doi_def->map.std->lvl.local[host_lvl];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690) * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692) * @net_lvl: the network/CIPSO MLS level
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693) * @host_lvl: the host MLS level
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696) * Perform a label mapping to translate a CIPSO level to the correct local MLS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697) * level using the given DOI definition. Returns zero on success, negative
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698) * values otherwise.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701) static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702) u32 net_lvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703) u32 *host_lvl)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) struct cipso_v4_std_map_tbl *map_tbl;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707) switch (doi_def->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708) case CIPSO_V4_MAP_PASS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709) *host_lvl = net_lvl;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) map_tbl = doi_def->map.std;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713) if (net_lvl < map_tbl->lvl.cipso_size &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714) map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715) *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) * @bitmap: category bitmap
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728) * @bitmap_len: bitmap length in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731) * Checks the given category bitmap against the given DOI definition and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) * returns a negative value if any of the categories in the bitmap do not have
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733) * a valid mapping and a zero value if all of the categories are valid.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) const unsigned char *bitmap,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738) u32 bitmap_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740) int cat = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741) u32 bitmap_len_bits = bitmap_len * 8;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742) u32 cipso_cat_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743) u32 *cipso_array;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745) switch (doi_def->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) case CIPSO_V4_MAP_PASS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749) cipso_cat_size = doi_def->map.std->cat.cipso_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750) cipso_array = doi_def->map.std->cat.cipso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) for (;;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) cat = netlbl_bitmap_walk(bitmap,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753) bitmap_len_bits,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754) cat + 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755) 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756) if (cat < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758) if (cat >= cipso_cat_size ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) cipso_array[cat] >= CIPSO_V4_INV_CAT)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) if (cat == -1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775) * @net_cat: the zero'd out category bitmap in network/CIPSO format
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776) * @net_cat_len: the length of the CIPSO bitmap in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) * Perform a label mapping to translate a local MLS category bitmap to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780) * correct CIPSO bitmap using the given DOI definition. Returns the minimum
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) * size in bytes of the network bitmap on success, negative values otherwise.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784) static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785) const struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786) unsigned char *net_cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787) u32 net_cat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789) int host_spot = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790) u32 net_spot = CIPSO_V4_INV_CAT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791) u32 net_spot_max = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) u32 net_clen_bits = net_cat_len * 8;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793) u32 host_cat_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) u32 *host_cat_array = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796) if (doi_def->type == CIPSO_V4_MAP_TRANS) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) host_cat_size = doi_def->map.std->cat.local_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798) host_cat_array = doi_def->map.std->cat.local;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801) for (;;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) host_spot = netlbl_catmap_walk(secattr->attr.mls.cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803) host_spot + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804) if (host_spot < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 806)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 807) switch (doi_def->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 808) case CIPSO_V4_MAP_PASS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 809) net_spot = host_spot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 810) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 811) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 812) if (host_spot >= host_cat_size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 813) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 814) net_spot = host_cat_array[host_spot];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 815) if (net_spot >= CIPSO_V4_INV_CAT)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 816) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 817) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 818) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 819) if (net_spot >= net_clen_bits)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 820) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 821) netlbl_bitmap_setbit(net_cat, net_spot, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 822)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 823) if (net_spot > net_spot_max)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 824) net_spot_max = net_spot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 825) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 826)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 827) if (++net_spot_max % 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 828) return net_spot_max / 8 + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 829) return net_spot_max / 8;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 830) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 831)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 832) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 833) * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 834) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 835) * @net_cat: the category bitmap in network/CIPSO format
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 836) * @net_cat_len: the length of the CIPSO bitmap in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 837) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 838) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 839) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 840) * Perform a label mapping to translate a CIPSO bitmap to the correct local
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 841) * MLS category bitmap using the given DOI definition. Returns zero on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 842) * success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 843) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 844) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 845) static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 846) const unsigned char *net_cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 847) u32 net_cat_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 848) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 849) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 850) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 851) int net_spot = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 852) u32 host_spot = CIPSO_V4_INV_CAT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 853) u32 net_clen_bits = net_cat_len * 8;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 854) u32 net_cat_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 855) u32 *net_cat_array = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 856)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 857) if (doi_def->type == CIPSO_V4_MAP_TRANS) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 858) net_cat_size = doi_def->map.std->cat.cipso_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 859) net_cat_array = doi_def->map.std->cat.cipso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 860) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 861)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 862) for (;;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 863) net_spot = netlbl_bitmap_walk(net_cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 864) net_clen_bits,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 865) net_spot + 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 866) 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 867) if (net_spot < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 868) if (net_spot == -2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 869) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 870) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 871) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 872)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 873) switch (doi_def->type) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 874) case CIPSO_V4_MAP_PASS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 875) host_spot = net_spot;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 876) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 877) case CIPSO_V4_MAP_TRANS:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 878) if (net_spot >= net_cat_size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 879) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 880) host_spot = net_cat_array[net_spot];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 881) if (host_spot >= CIPSO_V4_INV_CAT)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 882) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 883) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 884) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 885) ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 886) host_spot,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 887) GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 888) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 889) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 890) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 891)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 892) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 893) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 894)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 895) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 896) * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 897) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 898) * @enumcat: category list
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 899) * @enumcat_len: length of the category list in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 900) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 901) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 902) * Checks the given categories against the given DOI definition and returns a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 903) * negative value if any of the categories do not have a valid mapping and a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 904) * zero value if all of the categories are valid.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 905) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 906) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 907) static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 908) const unsigned char *enumcat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 909) u32 enumcat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 910) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 911) u16 cat;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 912) int cat_prev = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 913) u32 iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 914)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 915) if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 916) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 917)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 918) for (iter = 0; iter < enumcat_len; iter += 2) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 919) cat = get_unaligned_be16(&enumcat[iter]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 920) if (cat <= cat_prev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 921) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 922) cat_prev = cat;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 923) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 924)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 925) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 926) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 927)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 928) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 929) * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 930) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 931) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 932) * @net_cat: the zero'd out category list in network/CIPSO format
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 933) * @net_cat_len: the length of the CIPSO category list in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 934) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 935) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 936) * Perform a label mapping to translate a local MLS category bitmap to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 937) * correct CIPSO category list using the given DOI definition. Returns the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 938) * size in bytes of the network category bitmap on success, negative values
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 939) * otherwise.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 940) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 941) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 942) static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 943) const struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 944) unsigned char *net_cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 945) u32 net_cat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 946) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 947) int cat = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 948) u32 cat_iter = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 949)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 950) for (;;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 951) cat = netlbl_catmap_walk(secattr->attr.mls.cat, cat + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 952) if (cat < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 953) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 954) if ((cat_iter + 2) > net_cat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 955) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 956)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 957) *((__be16 *)&net_cat[cat_iter]) = htons(cat);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 958) cat_iter += 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 959) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 960)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 961) return cat_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 962) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 963)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 964) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 965) * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 966) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 967) * @net_cat: the category list in network/CIPSO format
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 968) * @net_cat_len: the length of the CIPSO bitmap in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 969) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 970) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 971) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 972) * Perform a label mapping to translate a CIPSO category list to the correct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 973) * local MLS category bitmap using the given DOI definition. Returns zero on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 974) * success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 975) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 976) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 977) static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 978) const unsigned char *net_cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 979) u32 net_cat_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 980) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 981) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 982) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 983) u32 iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 984)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 985) for (iter = 0; iter < net_cat_len; iter += 2) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 986) ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 987) get_unaligned_be16(&net_cat[iter]),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 988) GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 989) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 990) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 991) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 992)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 993) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 994) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 995)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 996) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 997) * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 998) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 999) * @rngcat: category list
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1000) * @rngcat_len: length of the category list in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1001) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1002) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1003) * Checks the given categories against the given DOI definition and returns a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1004) * negative value if any of the categories do not have a valid mapping and a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1005) * zero value if all of the categories are valid.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1006) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1007) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1008) static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1009) const unsigned char *rngcat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1010) u32 rngcat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1011) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1012) u16 cat_high;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1013) u16 cat_low;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1014) u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1015) u32 iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1016)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1017) if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1018) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1019)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1020) for (iter = 0; iter < rngcat_len; iter += 4) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1021) cat_high = get_unaligned_be16(&rngcat[iter]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1022) if ((iter + 4) <= rngcat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1023) cat_low = get_unaligned_be16(&rngcat[iter + 2]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1024) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1025) cat_low = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1026)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1027) if (cat_high > cat_prev)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1028) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1029)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1030) cat_prev = cat_low;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1031) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1032)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1033) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1034) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1035)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1036) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1037) * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1038) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1039) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1040) * @net_cat: the zero'd out category list in network/CIPSO format
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1041) * @net_cat_len: the length of the CIPSO category list in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1042) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1043) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1044) * Perform a label mapping to translate a local MLS category bitmap to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1045) * correct CIPSO category list using the given DOI definition. Returns the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1046) * size in bytes of the network category bitmap on success, negative values
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1047) * otherwise.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1048) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1049) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1050) static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1051) const struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1052) unsigned char *net_cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1053) u32 net_cat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1054) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1055) int iter = -1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1056) u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1057) u32 array_cnt = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1058) u32 cat_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1059)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1060) /* make sure we don't overflow the 'array[]' variable */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1061) if (net_cat_len >
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1062) (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1063) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1064)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1065) for (;;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1066) iter = netlbl_catmap_walk(secattr->attr.mls.cat, iter + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1067) if (iter < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1068) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1069) cat_size += (iter == 0 ? 0 : sizeof(u16));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1070) if (cat_size > net_cat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1071) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1072) array[array_cnt++] = iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1073)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1074) iter = netlbl_catmap_walkrng(secattr->attr.mls.cat, iter);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1075) if (iter < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1076) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1077) cat_size += sizeof(u16);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1078) if (cat_size > net_cat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1079) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1080) array[array_cnt++] = iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1081) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1082)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1083) for (iter = 0; array_cnt > 0;) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1084) *((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1085) iter += 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1086) array_cnt--;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1087) if (array[array_cnt] != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1088) *((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1089) iter += 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1090) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1091) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1092)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1093) return cat_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1094) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1095)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1096) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1097) * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1098) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1099) * @net_cat: the category list in network/CIPSO format
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1100) * @net_cat_len: the length of the CIPSO bitmap in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1101) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1102) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1103) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1104) * Perform a label mapping to translate a CIPSO category list to the correct
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1105) * local MLS category bitmap using the given DOI definition. Returns zero on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1106) * success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1107) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1108) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1109) static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1110) const unsigned char *net_cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1111) u32 net_cat_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1112) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1113) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1114) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1115) u32 net_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1116) u16 cat_low;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1117) u16 cat_high;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1119) for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1120) cat_high = get_unaligned_be16(&net_cat[net_iter]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1121) if ((net_iter + 4) <= net_cat_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1122) cat_low = get_unaligned_be16(&net_cat[net_iter + 2]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1123) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1124) cat_low = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1126) ret_val = netlbl_catmap_setrng(&secattr->attr.mls.cat,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1127) cat_low,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1128) cat_high,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1129) GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1130) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1131) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1132) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1133)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1134) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1135) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1136)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1137) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1138) * Protocol Handling Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1139) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1140)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1141) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1142) * cipso_v4_gentag_hdr - Generate a CIPSO option header
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1143) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1144) * @len: the total tag length in bytes, not including this header
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1145) * @buf: the CIPSO option buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1146) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1147) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1148) * Write a CIPSO header into the beginning of @buffer.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1149) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1150) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1151) static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1152) unsigned char *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1153) u32 len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1154) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1155) buf[0] = IPOPT_CIPSO;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1156) buf[1] = CIPSO_V4_HDR_LEN + len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1157) *(__be32 *)&buf[2] = htonl(doi_def->doi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1158) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1159)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1160) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1161) * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1162) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1163) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1164) * @buffer: the option buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1165) * @buffer_len: length of buffer in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1166) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1167) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1168) * Generate a CIPSO option using the restricted bitmap tag, tag type #1. The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1169) * actual buffer length may be larger than the indicated size due to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1170) * translation between host and network category bitmaps. Returns the size of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1171) * the tag on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1172) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1173) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1174) static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1175) const struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1176) unsigned char *buffer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1177) u32 buffer_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1178) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1179) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1180) u32 tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1181) u32 level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1182)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1183) if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1184) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1186) ret_val = cipso_v4_map_lvl_hton(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1187) secattr->attr.mls.lvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1188) &level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1189) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1190) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1191)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1192) if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1193) ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1194) secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1195) &buffer[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1196) buffer_len - 4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1197) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1198) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1199)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1200) /* This will send packets using the "optimized" format when
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1201) * possible as specified in section 3.4.2.6 of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1202) * CIPSO draft. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1203) if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1204) tag_len = 14;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1205) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1206) tag_len = 4 + ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1207) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1208) tag_len = 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1209)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1210) buffer[0] = CIPSO_V4_TAG_RBITMAP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1211) buffer[1] = tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1212) buffer[3] = level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1214) return tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1215) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1216)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1217) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1218) * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1219) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1220) * @tag: the CIPSO tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1221) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1222) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1223) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1224) * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1225) * attributes in @secattr. Return zero on success, negatives values on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1226) * failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1227) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1228) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1229) static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1230) const unsigned char *tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1231) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1232) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1233) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1234) u8 tag_len = tag[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1235) u32 level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1236)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1237) ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1238) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1239) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1240) secattr->attr.mls.lvl = level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1241) secattr->flags |= NETLBL_SECATTR_MLS_LVL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1242)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1243) if (tag_len > 4) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1244) ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1245) &tag[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1246) tag_len - 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1247) secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1248) if (ret_val != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1249) netlbl_catmap_free(secattr->attr.mls.cat);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1250) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1251) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1252)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1253) if (secattr->attr.mls.cat)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1254) secattr->flags |= NETLBL_SECATTR_MLS_CAT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1255) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1256)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1257) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1258) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1259)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1260) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1261) * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1262) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1263) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1264) * @buffer: the option buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1265) * @buffer_len: length of buffer in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1266) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1267) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1268) * Generate a CIPSO option using the enumerated tag, tag type #2. Returns the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1269) * size of the tag on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1270) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1271) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1272) static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1273) const struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1274) unsigned char *buffer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1275) u32 buffer_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1276) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1277) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1278) u32 tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1279) u32 level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1280)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1281) if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1282) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1284) ret_val = cipso_v4_map_lvl_hton(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1285) secattr->attr.mls.lvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1286) &level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1287) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1288) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1289)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1290) if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1291) ret_val = cipso_v4_map_cat_enum_hton(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1292) secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1293) &buffer[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1294) buffer_len - 4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1295) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1296) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1297)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1298) tag_len = 4 + ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1299) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1300) tag_len = 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1301)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1302) buffer[0] = CIPSO_V4_TAG_ENUM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1303) buffer[1] = tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1304) buffer[3] = level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1305)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1306) return tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1307) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1308)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1309) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1310) * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1311) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1312) * @tag: the CIPSO tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1313) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1314) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1315) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1316) * Parse a CIPSO enumerated tag (tag type #2) and return the security
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1317) * attributes in @secattr. Return zero on success, negatives values on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1318) * failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1319) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1320) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1321) static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1322) const unsigned char *tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1323) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1324) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1325) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1326) u8 tag_len = tag[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1327) u32 level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1328)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1329) ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1330) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1331) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1332) secattr->attr.mls.lvl = level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1333) secattr->flags |= NETLBL_SECATTR_MLS_LVL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1334)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1335) if (tag_len > 4) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1336) ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1337) &tag[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1338) tag_len - 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1339) secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1340) if (ret_val != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1341) netlbl_catmap_free(secattr->attr.mls.cat);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1342) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1343) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1344)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1345) secattr->flags |= NETLBL_SECATTR_MLS_CAT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1346) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1347)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1348) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1349) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1350)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1351) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1352) * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1353) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1354) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1355) * @buffer: the option buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1356) * @buffer_len: length of buffer in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1357) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1358) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1359) * Generate a CIPSO option using the ranged tag, tag type #5. Returns the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1360) * size of the tag on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1361) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1362) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1363) static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1364) const struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1365) unsigned char *buffer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1366) u32 buffer_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1367) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1368) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1369) u32 tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1370) u32 level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1371)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1372) if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1373) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1374)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1375) ret_val = cipso_v4_map_lvl_hton(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1376) secattr->attr.mls.lvl,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1377) &level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1378) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1379) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1381) if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1382) ret_val = cipso_v4_map_cat_rng_hton(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1383) secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1384) &buffer[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1385) buffer_len - 4);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1386) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1387) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1388)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1389) tag_len = 4 + ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1390) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1391) tag_len = 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1392)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1393) buffer[0] = CIPSO_V4_TAG_RANGE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1394) buffer[1] = tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1395) buffer[3] = level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1396)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1397) return tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1398) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1399)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1400) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1401) * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1402) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1403) * @tag: the CIPSO tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1404) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1405) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1406) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1407) * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1408) * in @secattr. Return zero on success, negatives values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1409) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1410) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1411) static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1412) const unsigned char *tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1413) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1414) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1415) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1416) u8 tag_len = tag[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1417) u32 level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1418)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1419) ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1420) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1421) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1422) secattr->attr.mls.lvl = level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1423) secattr->flags |= NETLBL_SECATTR_MLS_LVL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1424)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1425) if (tag_len > 4) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1426) ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1427) &tag[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1428) tag_len - 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1429) secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1430) if (ret_val != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1431) netlbl_catmap_free(secattr->attr.mls.cat);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1432) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1433) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1434)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1435) if (secattr->attr.mls.cat)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1436) secattr->flags |= NETLBL_SECATTR_MLS_CAT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1437) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1438)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1439) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1440) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1441)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1442) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1443) * cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1444) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1445) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1446) * @buffer: the option buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1447) * @buffer_len: length of buffer in bytes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1448) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1449) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1450) * Generate a CIPSO option using the local tag. Returns the size of the tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1451) * on success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1452) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1453) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1454) static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1455) const struct netlbl_lsm_secattr *secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1456) unsigned char *buffer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1457) u32 buffer_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1458) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1459) if (!(secattr->flags & NETLBL_SECATTR_SECID))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1460) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1461)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1462) buffer[0] = CIPSO_V4_TAG_LOCAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1463) buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1464) *(u32 *)&buffer[2] = secattr->attr.secid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1465)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1466) return CIPSO_V4_TAG_LOC_BLEN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1467) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1468)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1469) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1470) * cipso_v4_parsetag_loc - Parse a CIPSO local tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1471) * @doi_def: the DOI definition
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1472) * @tag: the CIPSO tag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1473) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1474) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1475) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1476) * Parse a CIPSO local tag and return the security attributes in @secattr.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1477) * Return zero on success, negatives values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1478) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1479) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1480) static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1481) const unsigned char *tag,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1482) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1483) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1484) secattr->attr.secid = *(u32 *)&tag[2];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1485) secattr->flags |= NETLBL_SECATTR_SECID;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1486)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1487) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1488) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1489)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1490) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1491) * cipso_v4_optptr - Find the CIPSO option in the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1492) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1493) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1494) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1495) * Parse the packet's IP header looking for a CIPSO option. Returns a pointer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1496) * to the start of the CIPSO option on success, NULL if one is not found.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1497) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1498) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1499) unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1500) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1501) const struct iphdr *iph = ip_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1502) unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1503) int optlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1504) int taglen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1505)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1506) for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1507) switch (optptr[0]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1508) case IPOPT_END:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1509) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1510) case IPOPT_NOOP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1511) taglen = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1512) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1513) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1514) taglen = optptr[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1515) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1516) if (!taglen || taglen > optlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1517) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1518) if (optptr[0] == IPOPT_CIPSO)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1519) return optptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1520)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1521) optlen -= taglen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1522) optptr += taglen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1523) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1524)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1525) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1526) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1527)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1528) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1529) * cipso_v4_validate - Validate a CIPSO option
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1530) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1531) * @option: the start of the option, on error it is set to point to the error
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1532) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1533) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1534) * This routine is called to validate a CIPSO option, it checks all of the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1535) * fields to ensure that they are at least valid, see the draft snippet below
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1536) * for details. If the option is valid then a zero value is returned and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1537) * the value of @option is unchanged. If the option is invalid then a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1538) * non-zero value is returned and @option is adjusted to point to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1539) * offending portion of the option. From the IETF draft ...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1540) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1541) * "If any field within the CIPSO options, such as the DOI identifier, is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1542) * recognized the IP datagram is discarded and an ICMP 'parameter problem'
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1543) * (type 12) is generated and returned. The ICMP code field is set to 'bad
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1544) * parameter' (code 0) and the pointer is set to the start of the CIPSO field
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1545) * that is unrecognized."
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1546) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1547) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1548) int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1549) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1550) unsigned char *opt = *option;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1551) unsigned char *tag;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1552) unsigned char opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1553) unsigned char err_offset = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1554) u8 opt_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1555) u8 tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1556) struct cipso_v4_doi *doi_def = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1557) u32 tag_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1558)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1559) /* caller already checks for length values that are too large */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1560) opt_len = opt[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1561) if (opt_len < 8) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1562) err_offset = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1563) goto validate_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1564) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1565)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1566) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1567) doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2]));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1568) if (!doi_def) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1569) err_offset = 2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1570) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1571) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1572)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1573) opt_iter = CIPSO_V4_HDR_LEN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1574) tag = opt + opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1575) while (opt_iter < opt_len) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1576) for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1577) if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1578) ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1579) err_offset = opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1580) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1581) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1582)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1583) if (opt_iter + 1 == opt_len) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1584) err_offset = opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1585) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1586) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1587) tag_len = tag[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1588) if (tag_len > (opt_len - opt_iter)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1589) err_offset = opt_iter + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1590) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1591) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1592)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1593) switch (tag[0]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1594) case CIPSO_V4_TAG_RBITMAP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1595) if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1596) err_offset = opt_iter + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1597) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1598) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1599)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1600) /* We are already going to do all the verification
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1601) * necessary at the socket layer so from our point of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1602) * view it is safe to turn these checks off (and less
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1603) * work), however, the CIPSO draft says we should do
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1604) * all the CIPSO validations here but it doesn't
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1605) * really specify _exactly_ what we need to validate
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1606) * ... so, just make it a sysctl tunable. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1607) if (cipso_v4_rbm_strictvalid) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1608) if (cipso_v4_map_lvl_valid(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1609) tag[3]) < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1610) err_offset = opt_iter + 3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1611) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1612) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1613) if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1614) cipso_v4_map_cat_rbm_valid(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1615) &tag[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1616) tag_len - 4) < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1617) err_offset = opt_iter + 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1618) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1619) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1620) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1621) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1622) case CIPSO_V4_TAG_ENUM:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1623) if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1624) err_offset = opt_iter + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1625) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1626) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1627)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1628) if (cipso_v4_map_lvl_valid(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1629) tag[3]) < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1630) err_offset = opt_iter + 3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1631) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1632) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1633) if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1634) cipso_v4_map_cat_enum_valid(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1635) &tag[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1636) tag_len - 4) < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1637) err_offset = opt_iter + 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1638) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1639) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1640) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1641) case CIPSO_V4_TAG_RANGE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1642) if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1643) err_offset = opt_iter + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1644) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1645) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1646)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1647) if (cipso_v4_map_lvl_valid(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1648) tag[3]) < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1649) err_offset = opt_iter + 3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1650) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1651) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1652) if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1653) cipso_v4_map_cat_rng_valid(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1654) &tag[4],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1655) tag_len - 4) < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1656) err_offset = opt_iter + 4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1657) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1658) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1659) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1660) case CIPSO_V4_TAG_LOCAL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1661) /* This is a non-standard tag that we only allow for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1662) * local connections, so if the incoming interface is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1663) * not the loopback device drop the packet. Further,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1664) * there is no legitimate reason for setting this from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1665) * userspace so reject it if skb is NULL. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1666) if (!skb || !(skb->dev->flags & IFF_LOOPBACK)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1667) err_offset = opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1668) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1669) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1670) if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1671) err_offset = opt_iter + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1672) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1673) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1674) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1675) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1676) err_offset = opt_iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1677) goto validate_return_locked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1678) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1679)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1680) tag += tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1681) opt_iter += tag_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1682) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1683)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1684) validate_return_locked:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1685) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1686) validate_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1687) *option = opt + err_offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1688) return err_offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1689) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1690)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1691) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1692) * cipso_v4_error - Send the correct response for a bad packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1693) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1694) * @error: the error code
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1695) * @gateway: CIPSO gateway flag
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1696) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1697) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1698) * Based on the error code given in @error, send an ICMP error message back to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1699) * the originating host. From the IETF draft ...
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1700) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1701) * "If the contents of the CIPSO [option] are valid but the security label is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1702) * outside of the configured host or port label range, the datagram is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1703) * discarded and an ICMP 'destination unreachable' (type 3) is generated and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1704) * returned. The code field of the ICMP is set to 'communication with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1705) * destination network administratively prohibited' (code 9) or to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1706) * 'communication with destination host administratively prohibited'
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1707) * (code 10). The value of the code is dependent on whether the originator
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1708) * of the ICMP message is acting as a CIPSO host or a CIPSO gateway. The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1709) * recipient of the ICMP message MUST be able to handle either value. The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1710) * same procedure is performed if a CIPSO [option] can not be added to an
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1711) * IP packet because it is too large to fit in the IP options area."
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1712) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1713) * "If the error is triggered by receipt of an ICMP message, the message is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1714) * discarded and no response is permitted (consistent with general ICMP
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1715) * processing rules)."
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1716) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1717) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1718) void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1719) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1720) unsigned char optbuf[sizeof(struct ip_options) + 40];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1721) struct ip_options *opt = (struct ip_options *)optbuf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1722) int res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1723)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1724) if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1725) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1726)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1727) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1728) * We might be called above the IP layer,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1729) * so we can not use icmp_send and IPCB here.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1730) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1731)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1732) memset(opt, 0, sizeof(struct ip_options));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1733) opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1734) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1735) res = __ip_options_compile(dev_net(skb->dev), opt, skb, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1736) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1737)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1738) if (res)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1739) return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1740)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1741) if (gateway)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1742) __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0, opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1743) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1744) __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0, opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1745) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1746)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1747) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1748) * cipso_v4_genopt - Generate a CIPSO option
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1749) * @buf: the option buffer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1750) * @buf_len: the size of opt_buf
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1751) * @doi_def: the CIPSO DOI to use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1752) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1753) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1754) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1755) * Generate a CIPSO option using the DOI definition and security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1756) * passed to the function. Returns the length of the option on success and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1757) * negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1758) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1759) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1760) static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1761) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1762) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1763) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1764) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1765) u32 iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1766)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1767) if (buf_len <= CIPSO_V4_HDR_LEN)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1768) return -ENOSPC;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1769)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1770) /* XXX - This code assumes only one tag per CIPSO option which isn't
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1771) * really a good assumption to make but since we only support the MAC
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1772) * tags right now it is a safe assumption. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1773) iter = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1774) do {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1775) memset(buf, 0, buf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1776) switch (doi_def->tags[iter]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1777) case CIPSO_V4_TAG_RBITMAP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1778) ret_val = cipso_v4_gentag_rbm(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1779) secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1780) &buf[CIPSO_V4_HDR_LEN],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1781) buf_len - CIPSO_V4_HDR_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1782) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1783) case CIPSO_V4_TAG_ENUM:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1784) ret_val = cipso_v4_gentag_enum(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1785) secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1786) &buf[CIPSO_V4_HDR_LEN],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1787) buf_len - CIPSO_V4_HDR_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1788) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1789) case CIPSO_V4_TAG_RANGE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1790) ret_val = cipso_v4_gentag_rng(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1791) secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1792) &buf[CIPSO_V4_HDR_LEN],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1793) buf_len - CIPSO_V4_HDR_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1794) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1795) case CIPSO_V4_TAG_LOCAL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1796) ret_val = cipso_v4_gentag_loc(doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1797) secattr,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1798) &buf[CIPSO_V4_HDR_LEN],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1799) buf_len - CIPSO_V4_HDR_LEN);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1800) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1801) default:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1802) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1803) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1804)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1805) iter++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1806) } while (ret_val < 0 &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1807) iter < CIPSO_V4_TAG_MAXCNT &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1808) doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1809) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1810) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1811) cipso_v4_gentag_hdr(doi_def, buf, ret_val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1812) return CIPSO_V4_HDR_LEN + ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1813) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1814)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1815) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1816) * cipso_v4_sock_setattr - Add a CIPSO option to a socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1817) * @sk: the socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1818) * @doi_def: the CIPSO DOI to use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1819) * @secattr: the specific security attributes of the socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1820) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1821) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1822) * Set the CIPSO option on the given socket using the DOI definition and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1823) * security attributes passed to the function. This function requires
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1824) * exclusive access to @sk, which means it either needs to be in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1825) * process of being created or locked. Returns zero on success and negative
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1826) * values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1827) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1828) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1829) int cipso_v4_sock_setattr(struct sock *sk,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1830) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1831) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1832) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1833) int ret_val = -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1834) unsigned char *buf = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1835) u32 buf_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1836) u32 opt_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1837) struct ip_options_rcu *old, *opt = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1838) struct inet_sock *sk_inet;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1839) struct inet_connection_sock *sk_conn;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1840)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1841) /* In the case of sock_create_lite(), the sock->sk field is not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1842) * defined yet but it is not a problem as the only users of these
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1843) * "lite" PF_INET sockets are functions which do an accept() call
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1844) * afterwards so we will label the socket as part of the accept(). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1845) if (!sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1846) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1847)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1848) /* We allocate the maximum CIPSO option size here so we are probably
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1849) * being a little wasteful, but it makes our life _much_ easier later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1850) * on and after all we are only talking about 40 bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1851) buf_len = CIPSO_V4_OPT_LEN_MAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1852) buf = kmalloc(buf_len, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1853) if (!buf) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1854) ret_val = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1855) goto socket_setattr_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1856) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1857)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1858) ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1859) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1860) goto socket_setattr_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1861) buf_len = ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1862)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1863) /* We can't use ip_options_get() directly because it makes a call to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1864) * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1865) * we won't always have CAP_NET_RAW even though we _always_ want to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1866) * set the IPOPT_CIPSO option. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1867) opt_len = (buf_len + 3) & ~3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1868) opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1869) if (!opt) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1870) ret_val = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1871) goto socket_setattr_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1872) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1873) memcpy(opt->opt.__data, buf, buf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1874) opt->opt.optlen = opt_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1875) opt->opt.cipso = sizeof(struct iphdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1876) kfree(buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1877) buf = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1878)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1879) sk_inet = inet_sk(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1880)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1881) old = rcu_dereference_protected(sk_inet->inet_opt,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1882) lockdep_sock_is_held(sk));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1883) if (sk_inet->is_icsk) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1884) sk_conn = inet_csk(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1885) if (old)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1886) sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1887) sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1888) sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1889) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1890) rcu_assign_pointer(sk_inet->inet_opt, opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1891) if (old)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1892) kfree_rcu(old, rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1893)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1894) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1895)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1896) socket_setattr_failure:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1897) kfree(buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1898) kfree(opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1899) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1900) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1901)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1902) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1903) * cipso_v4_req_setattr - Add a CIPSO option to a connection request socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1904) * @req: the connection request socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1905) * @doi_def: the CIPSO DOI to use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1906) * @secattr: the specific security attributes of the socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1907) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1908) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1909) * Set the CIPSO option on the given socket using the DOI definition and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1910) * security attributes passed to the function. Returns zero on success and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1911) * negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1912) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1913) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1914) int cipso_v4_req_setattr(struct request_sock *req,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1915) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1916) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1917) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1918) int ret_val = -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1919) unsigned char *buf = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1920) u32 buf_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1921) u32 opt_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1922) struct ip_options_rcu *opt = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1923) struct inet_request_sock *req_inet;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1924)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1925) /* We allocate the maximum CIPSO option size here so we are probably
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1926) * being a little wasteful, but it makes our life _much_ easier later
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1927) * on and after all we are only talking about 40 bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1928) buf_len = CIPSO_V4_OPT_LEN_MAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1929) buf = kmalloc(buf_len, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1930) if (!buf) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1931) ret_val = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1932) goto req_setattr_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1933) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1934)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1935) ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1936) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1937) goto req_setattr_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1938) buf_len = ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1939)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1940) /* We can't use ip_options_get() directly because it makes a call to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1941) * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1942) * we won't always have CAP_NET_RAW even though we _always_ want to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1943) * set the IPOPT_CIPSO option. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1944) opt_len = (buf_len + 3) & ~3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1945) opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1946) if (!opt) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1947) ret_val = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1948) goto req_setattr_failure;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1949) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1950) memcpy(opt->opt.__data, buf, buf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1951) opt->opt.optlen = opt_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1952) opt->opt.cipso = sizeof(struct iphdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1953) kfree(buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1954) buf = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1955)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1956) req_inet = inet_rsk(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1957) opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1958) if (opt)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1959) kfree_rcu(opt, rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1960)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1961) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1962)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1963) req_setattr_failure:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1964) kfree(buf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1965) kfree(opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1966) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1967) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1968)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1969) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1970) * cipso_v4_delopt - Delete the CIPSO option from a set of IP options
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1971) * @opt_ptr: IP option pointer
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1972) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1973) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1974) * Deletes the CIPSO IP option from a set of IP options and makes the necessary
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1975) * adjustments to the IP option structure. Returns zero on success, negative
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1976) * values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1977) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1978) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1979) static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1980) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1981) struct ip_options_rcu *opt = rcu_dereference_protected(*opt_ptr, 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1982) int hdr_delta = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1983)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1984) if (!opt || opt->opt.cipso == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1985) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1986) if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1987) u8 cipso_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1988) u8 cipso_off;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1989) unsigned char *cipso_ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1990) int iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1991) int optlen_new;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1992)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1993) cipso_off = opt->opt.cipso - sizeof(struct iphdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1994) cipso_ptr = &opt->opt.__data[cipso_off];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1995) cipso_len = cipso_ptr[1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1996)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1997) if (opt->opt.srr > opt->opt.cipso)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1998) opt->opt.srr -= cipso_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1999) if (opt->opt.rr > opt->opt.cipso)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2000) opt->opt.rr -= cipso_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2001) if (opt->opt.ts > opt->opt.cipso)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2002) opt->opt.ts -= cipso_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2003) if (opt->opt.router_alert > opt->opt.cipso)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2004) opt->opt.router_alert -= cipso_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2005) opt->opt.cipso = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2006)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2007) memmove(cipso_ptr, cipso_ptr + cipso_len,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2008) opt->opt.optlen - cipso_off - cipso_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2009)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2010) /* determining the new total option length is tricky because of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2011) * the padding necessary, the only thing i can think to do at
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2012) * this point is walk the options one-by-one, skipping the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2013) * padding at the end to determine the actual option size and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2014) * from there we can determine the new total option length */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2015) iter = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2016) optlen_new = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2017) while (iter < opt->opt.optlen)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2018) if (opt->opt.__data[iter] != IPOPT_NOP) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2019) iter += opt->opt.__data[iter + 1];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2020) optlen_new = iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2021) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2022) iter++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2023) hdr_delta = opt->opt.optlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2024) opt->opt.optlen = (optlen_new + 3) & ~3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2025) hdr_delta -= opt->opt.optlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2026) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2027) /* only the cipso option was present on the socket so we can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2028) * remove the entire option struct */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2029) *opt_ptr = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2030) hdr_delta = opt->opt.optlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2031) kfree_rcu(opt, rcu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2032) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2033)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2034) return hdr_delta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2035) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2036)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2037) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2038) * cipso_v4_sock_delattr - Delete the CIPSO option from a socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2039) * @sk: the socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2040) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2041) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2042) * Removes the CIPSO option from a socket, if present.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2043) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2044) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2045) void cipso_v4_sock_delattr(struct sock *sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2046) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2047) struct inet_sock *sk_inet;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2048) int hdr_delta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2049)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2050) sk_inet = inet_sk(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2051)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2052) hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2053) if (sk_inet->is_icsk && hdr_delta > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2054) struct inet_connection_sock *sk_conn = inet_csk(sk);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2055) sk_conn->icsk_ext_hdr_len -= hdr_delta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2056) sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2057) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2058) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2059)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2060) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2061) * cipso_v4_req_delattr - Delete the CIPSO option from a request socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2062) * @req: the request socket
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2063) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2064) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2065) * Removes the CIPSO option from a request socket, if present.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2066) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2067) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2068) void cipso_v4_req_delattr(struct request_sock *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2069) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2070) cipso_v4_delopt(&inet_rsk(req)->ireq_opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2071) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2072)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2073) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2074) * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2075) * @cipso: the CIPSO v4 option
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2076) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2077) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2078) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2079) * Inspect @cipso and return the security attributes in @secattr. Returns zero
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2080) * on success and negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2081) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2082) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2083) int cipso_v4_getattr(const unsigned char *cipso,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2084) struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2085) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2086) int ret_val = -ENOMSG;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2087) u32 doi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2088) struct cipso_v4_doi *doi_def;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2089)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2090) if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2091) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2092)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2093) doi = get_unaligned_be32(&cipso[2]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2094) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2095) doi_def = cipso_v4_doi_search(doi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2096) if (!doi_def)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2097) goto getattr_return;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2098) /* XXX - This code assumes only one tag per CIPSO option which isn't
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2099) * really a good assumption to make but since we only support the MAC
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2100) * tags right now it is a safe assumption. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2101) switch (cipso[6]) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2102) case CIPSO_V4_TAG_RBITMAP:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2103) ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2104) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2105) case CIPSO_V4_TAG_ENUM:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2106) ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2107) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2108) case CIPSO_V4_TAG_RANGE:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2109) ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2110) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2111) case CIPSO_V4_TAG_LOCAL:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2112) ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2113) break;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2114) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2115) if (ret_val == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2116) secattr->type = NETLBL_NLTYPE_CIPSOV4;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2117)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2118) getattr_return:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2119) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2120) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2121) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2122)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2123) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2124) * cipso_v4_sock_getattr - Get the security attributes from a sock
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2125) * @sk: the sock
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2126) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2127) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2128) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2129) * Query @sk to see if there is a CIPSO option attached to the sock and if
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2130) * there is return the CIPSO security attributes in @secattr. This function
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2131) * requires that @sk be locked, or privately held, but it does not do any
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2132) * locking itself. Returns zero on success and negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2133) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2134) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2135) int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2136) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2137) struct ip_options_rcu *opt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2138) int res = -ENOMSG;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2140) rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2141) opt = rcu_dereference(inet_sk(sk)->inet_opt);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2142) if (opt && opt->opt.cipso)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2143) res = cipso_v4_getattr(opt->opt.__data +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2144) opt->opt.cipso -
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2145) sizeof(struct iphdr),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2146) secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2147) rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2148) return res;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2149) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2150)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2151) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2152) * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2153) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2154) * @doi_def: the DOI structure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2155) * @secattr: the security attributes
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2156) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2157) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2158) * Set the CIPSO option on the given packet based on the security attributes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2159) * Returns a pointer to the IP header on success and NULL on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2160) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2161) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2162) int cipso_v4_skbuff_setattr(struct sk_buff *skb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2163) const struct cipso_v4_doi *doi_def,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2164) const struct netlbl_lsm_secattr *secattr)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2165) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2166) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2167) struct iphdr *iph;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2168) struct ip_options *opt = &IPCB(skb)->opt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2169) unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2170) u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2171) u32 opt_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2172) int len_delta;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2173)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2174) ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2175) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2176) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2177) buf_len = ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2178) opt_len = (buf_len + 3) & ~3;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2179)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2180) /* we overwrite any existing options to ensure that we have enough
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2181) * room for the CIPSO option, the reason is that we _need_ to guarantee
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2182) * that the security label is applied to the packet - we do the same
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2183) * thing when using the socket options and it hasn't caused a problem,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2184) * if we need to we can always revisit this choice later */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2186) len_delta = opt_len - opt->optlen;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2187) /* if we don't ensure enough headroom we could panic on the skb_push()
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2188) * call below so make sure we have enough, we are also "mangling" the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2189) * packet so we should probably do a copy-on-write call anyway */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2190) ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2191) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2192) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2193)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2194) if (len_delta > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2195) /* we assume that the header + opt->optlen have already been
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2196) * "pushed" in ip_options_build() or similar */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2197) iph = ip_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2198) skb_push(skb, len_delta);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2199) memmove((char *)iph - len_delta, iph, iph->ihl << 2);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2200) skb_reset_network_header(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2201) iph = ip_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2202) } else if (len_delta < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2203) iph = ip_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2204) memset(iph + 1, IPOPT_NOP, opt->optlen);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2205) } else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2206) iph = ip_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2208) if (opt->optlen > 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2209) memset(opt, 0, sizeof(*opt));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2210) opt->optlen = opt_len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2211) opt->cipso = sizeof(struct iphdr);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2212) opt->is_changed = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2214) /* we have to do the following because we are being called from a
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2215) * netfilter hook which means the packet already has had the header
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2216) * fields populated and the checksum calculated - yes this means we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2217) * are doing more work than needed but we do it to keep the core
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2218) * stack clean and tidy */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2219) memcpy(iph + 1, buf, buf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2220) if (opt_len > buf_len)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2221) memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2222) if (len_delta != 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2223) iph->ihl = 5 + (opt_len >> 2);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2224) iph->tot_len = htons(skb->len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2225) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2226) ip_send_check(iph);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2227)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2228) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2229) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2230)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2231) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2232) * cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2233) * @skb: the packet
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2234) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2235) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2236) * Removes any and all CIPSO options from the given packet. Returns zero on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2237) * success, negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2238) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2239) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2240) int cipso_v4_skbuff_delattr(struct sk_buff *skb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2241) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2242) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2243) struct iphdr *iph;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2244) struct ip_options *opt = &IPCB(skb)->opt;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2245) unsigned char *cipso_ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2246)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2247) if (opt->cipso == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2248) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2249)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2250) /* since we are changing the packet we should make a copy */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2251) ret_val = skb_cow(skb, skb_headroom(skb));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2252) if (ret_val < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2253) return ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2254)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2255) /* the easiest thing to do is just replace the cipso option with noop
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2256) * options since we don't change the size of the packet, although we
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2257) * still need to recalculate the checksum */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2258)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2259) iph = ip_hdr(skb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2260) cipso_ptr = (unsigned char *)iph + opt->cipso;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2261) memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2262) opt->cipso = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2263) opt->is_changed = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2264)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2265) ip_send_check(iph);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2266)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2267) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2268) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2269)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2270) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2271) * Setup Functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2272) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2273)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2274) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2275) * cipso_v4_init - Initialize the CIPSO module
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2276) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2277) * Description:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2278) * Initialize the CIPSO module and prepare it for use. Returns zero on success
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2279) * and negative values on failure.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2280) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2281) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2282) static int __init cipso_v4_init(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2283) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2284) int ret_val;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2285)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2286) ret_val = cipso_v4_cache_init();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2287) if (ret_val != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2288) panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2289) ret_val);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2290)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2291) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2292) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2293)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2294) subsys_initcall(cipso_v4_init);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags