~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/ipv4/cipso_ipv4.c

Version: ~ [ linux-5.4-rc3 ] ~ [ linux-5.3.6 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.79 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.149 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.196 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.196 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.75 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * CIPSO - Commercial IP Security Option
  3  *
  4  * This is an implementation of the CIPSO 2.2 protocol as specified in
  5  * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
  6  * FIPS-188.  While CIPSO never became a full IETF RFC standard many vendors
  7  * have chosen to adopt the protocol and over the years it has become a
  8  * de-facto standard for labeled networking.
  9  *
 10  * The CIPSO draft specification can be found in the kernel's Documentation
 11  * directory as well as the following URL:
 12  *   http://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
 13  * The FIPS-188 specification can be found at the following URL:
 14  *   http://www.itl.nist.gov/fipspubs/fip188.htm
 15  *
 16  * Author: Paul Moore <paul.moore@hp.com>
 17  *
 18  */
 19 
 20 /*
 21  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
 22  *
 23  * This program is free software;  you can redistribute it and/or modify
 24  * it under the terms of the GNU General Public License as published by
 25  * the Free Software Foundation; either version 2 of the License, or
 26  * (at your option) any later version.
 27  *
 28  * This program is distributed in the hope that it will be useful,
 29  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 30  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 31  * the GNU General Public License for more details.
 32  *
 33  * You should have received a copy of the GNU General Public License
 34  * along with this program;  if not, see <http://www.gnu.org/licenses/>.
 35  *
 36  */
 37 
 38 #include <linux/init.h>
 39 #include <linux/types.h>
 40 #include <linux/rcupdate.h>
 41 #include <linux/list.h>
 42 #include <linux/spinlock.h>
 43 #include <linux/string.h>
 44 #include <linux/jhash.h>
 45 #include <linux/audit.h>
 46 #include <linux/slab.h>
 47 #include <net/ip.h>
 48 #include <net/icmp.h>
 49 #include <net/tcp.h>
 50 #include <net/netlabel.h>
 51 #include <net/cipso_ipv4.h>
 52 #include <linux/atomic.h>
 53 #include <linux/bug.h>
 54 #include <asm/unaligned.h>
 55 
 56 /* List of available DOI definitions */
 57 /* XXX - This currently assumes a minimal number of different DOIs in use,
 58  * if in practice there are a lot of different DOIs this list should
 59  * probably be turned into a hash table or something similar so we
 60  * can do quick lookups. */
 61 static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
 62 static LIST_HEAD(cipso_v4_doi_list);
 63 
 64 /* Label mapping cache */
 65 int cipso_v4_cache_enabled = 1;
 66 int cipso_v4_cache_bucketsize = 10;
 67 #define CIPSO_V4_CACHE_BUCKETBITS     7
 68 #define CIPSO_V4_CACHE_BUCKETS        (1 << CIPSO_V4_CACHE_BUCKETBITS)
 69 #define CIPSO_V4_CACHE_REORDERLIMIT   10
 70 struct cipso_v4_map_cache_bkt {
 71         spinlock_t lock;
 72         u32 size;
 73         struct list_head list;
 74 };
 75 
 76 struct cipso_v4_map_cache_entry {
 77         u32 hash;
 78         unsigned char *key;
 79         size_t key_len;
 80 
 81         struct netlbl_lsm_cache *lsm_data;
 82 
 83         u32 activity;
 84         struct list_head list;
 85 };
 86 
 87 static struct cipso_v4_map_cache_bkt *cipso_v4_cache;
 88 
 89 /* Restricted bitmap (tag #1) flags */
 90 int cipso_v4_rbm_optfmt = 0;
 91 int cipso_v4_rbm_strictvalid = 1;
 92 
 93 /*
 94  * Protocol Constants
 95  */
 96 
 97 /* Maximum size of the CIPSO IP option, derived from the fact that the maximum
 98  * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
 99 #define CIPSO_V4_OPT_LEN_MAX          40
100 
101 /* Length of the base CIPSO option, this includes the option type (1 byte), the
102  * option length (1 byte), and the DOI (4 bytes). */
103 #define CIPSO_V4_HDR_LEN              6
104 
105 /* Base length of the restrictive category bitmap tag (tag #1). */
106 #define CIPSO_V4_TAG_RBM_BLEN         4
107 
108 /* Base length of the enumerated category tag (tag #2). */
109 #define CIPSO_V4_TAG_ENUM_BLEN        4
110 
111 /* Base length of the ranged categories bitmap tag (tag #5). */
112 #define CIPSO_V4_TAG_RNG_BLEN         4
113 /* The maximum number of category ranges permitted in the ranged category tag
114  * (tag #5).  You may note that the IETF draft states that the maximum number
115  * of category ranges is 7, but if the low end of the last category range is
116  * zero then it is possible to fit 8 category ranges because the zero should
117  * be omitted. */
118 #define CIPSO_V4_TAG_RNG_CAT_MAX      8
119 
120 /* Base length of the local tag (non-standard tag).
121  *  Tag definition (may change between kernel versions)
122  *
123  * 0          8          16         24         32
124  * +----------+----------+----------+----------+
125  * | 10000000 | 00000110 | 32-bit secid value  |
126  * +----------+----------+----------+----------+
127  * | in (host byte order)|
128  * +----------+----------+
129  *
130  */
131 #define CIPSO_V4_TAG_LOC_BLEN         6
132 
133 /*
134  * Helper Functions
135  */
136 
137 /**
138  * cipso_v4_cache_entry_free - Frees a cache entry
139  * @entry: the entry to free
140  *
141  * Description:
142  * This function frees the memory associated with a cache entry including the
143  * LSM cache data if there are no longer any users, i.e. reference count == 0.
144  *
145  */
146 static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
147 {
148         if (entry->lsm_data)
149                 netlbl_secattr_cache_free(entry->lsm_data);
150         kfree(entry->key);
151         kfree(entry);
152 }
153 
154 /**
155  * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
156  * @key: the hash key
157  * @key_len: the length of the key in bytes
158  *
159  * Description:
160  * The CIPSO tag hashing function.  Returns a 32-bit hash value.
161  *
162  */
163 static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
164 {
165         return jhash(key, key_len, 0);
166 }
167 
168 /*
169  * Label Mapping Cache Functions
170  */
171 
172 /**
173  * cipso_v4_cache_init - Initialize the CIPSO cache
174  *
175  * Description:
176  * Initializes the CIPSO label mapping cache, this function should be called
177  * before any of the other functions defined in this file.  Returns zero on
178  * success, negative values on error.
179  *
180  */
181 static int __init cipso_v4_cache_init(void)
182 {
183         u32 iter;
184 
185         cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
186                                  sizeof(struct cipso_v4_map_cache_bkt),
187                                  GFP_KERNEL);
188         if (!cipso_v4_cache)
189                 return -ENOMEM;
190 
191         for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
192                 spin_lock_init(&cipso_v4_cache[iter].lock);
193                 cipso_v4_cache[iter].size = 0;
194                 INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
195         }
196 
197         return 0;
198 }
199 
200 /**
201  * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
202  *
203  * Description:
204  * Invalidates and frees any entries in the CIPSO cache.  Returns zero on
205  * success and negative values on failure.
206  *
207  */
208 void cipso_v4_cache_invalidate(void)
209 {
210         struct cipso_v4_map_cache_entry *entry, *tmp_entry;
211         u32 iter;
212 
213         for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
214                 spin_lock_bh(&cipso_v4_cache[iter].lock);
215                 list_for_each_entry_safe(entry,
216                                          tmp_entry,
217                                          &cipso_v4_cache[iter].list, list) {
218                         list_del(&entry->list);
219                         cipso_v4_cache_entry_free(entry);
220                 }
221                 cipso_v4_cache[iter].size = 0;
222                 spin_unlock_bh(&cipso_v4_cache[iter].lock);
223         }
224 }
225 
226 /**
227  * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
228  * @key: the buffer to check
229  * @key_len: buffer length in bytes
230  * @secattr: the security attribute struct to use
231  *
232  * Description:
233  * This function checks the cache to see if a label mapping already exists for
234  * the given key.  If there is a match then the cache is adjusted and the
235  * @secattr struct is populated with the correct LSM security attributes.  The
236  * cache is adjusted in the following manner if the entry is not already the
237  * first in the cache bucket:
238  *
239  *  1. The cache entry's activity counter is incremented
240  *  2. The previous (higher ranking) entry's activity counter is decremented
241  *  3. If the difference between the two activity counters is geater than
242  *     CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
243  *
244  * Returns zero on success, -ENOENT for a cache miss, and other negative values
245  * on error.
246  *
247  */
248 static int cipso_v4_cache_check(const unsigned char *key,
249                                 u32 key_len,
250                                 struct netlbl_lsm_secattr *secattr)
251 {
252         u32 bkt;
253         struct cipso_v4_map_cache_entry *entry;
254         struct cipso_v4_map_cache_entry *prev_entry = NULL;
255         u32 hash;
256 
257         if (!cipso_v4_cache_enabled)
258                 return -ENOENT;
259 
260         hash = cipso_v4_map_cache_hash(key, key_len);
261         bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
262         spin_lock_bh(&cipso_v4_cache[bkt].lock);
263         list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
264                 if (entry->hash == hash &&
265                     entry->key_len == key_len &&
266                     memcmp(entry->key, key, key_len) == 0) {
267                         entry->activity += 1;
268                         atomic_inc(&entry->lsm_data->refcount);
269                         secattr->cache = entry->lsm_data;
270                         secattr->flags |= NETLBL_SECATTR_CACHE;
271                         secattr->type = NETLBL_NLTYPE_CIPSOV4;
272                         if (!prev_entry) {
273                                 spin_unlock_bh(&cipso_v4_cache[bkt].lock);
274                                 return 0;
275                         }
276 
277                         if (prev_entry->activity > 0)
278                                 prev_entry->activity -= 1;
279                         if (entry->activity > prev_entry->activity &&
280                             entry->activity - prev_entry->activity >
281                             CIPSO_V4_CACHE_REORDERLIMIT) {
282                                 __list_del(entry->list.prev, entry->list.next);
283                                 __list_add(&entry->list,
284                                            prev_entry->list.prev,
285                                            &prev_entry->list);
286                         }
287 
288                         spin_unlock_bh(&cipso_v4_cache[bkt].lock);
289                         return 0;
290                 }
291                 prev_entry = entry;
292         }
293         spin_unlock_bh(&cipso_v4_cache[bkt].lock);
294 
295         return -ENOENT;
296 }
297 
298 /**
299  * cipso_v4_cache_add - Add an entry to the CIPSO cache
300  * @skb: the packet
301  * @secattr: the packet's security attributes
302  *
303  * Description:
304  * Add a new entry into the CIPSO label mapping cache.  Add the new entry to
305  * head of the cache bucket's list, if the cache bucket is out of room remove
306  * the last entry in the list first.  It is important to note that there is
307  * currently no checking for duplicate keys.  Returns zero on success,
308  * negative values on failure.
309  *
310  */
311 int cipso_v4_cache_add(const unsigned char *cipso_ptr,
312                        const struct netlbl_lsm_secattr *secattr)
313 {
314         int ret_val = -EPERM;
315         u32 bkt;
316         struct cipso_v4_map_cache_entry *entry = NULL;
317         struct cipso_v4_map_cache_entry *old_entry = NULL;
318         u32 cipso_ptr_len;
319 
320         if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
321                 return 0;
322 
323         cipso_ptr_len = cipso_ptr[1];
324 
325         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
326         if (!entry)
327                 return -ENOMEM;
328         entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
329         if (!entry->key) {
330                 ret_val = -ENOMEM;
331                 goto cache_add_failure;
332         }
333         entry->key_len = cipso_ptr_len;
334         entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
335         atomic_inc(&secattr->cache->refcount);
336         entry->lsm_data = secattr->cache;
337 
338         bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
339         spin_lock_bh(&cipso_v4_cache[bkt].lock);
340         if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
341                 list_add(&entry->list, &cipso_v4_cache[bkt].list);
342                 cipso_v4_cache[bkt].size += 1;
343         } else {
344                 old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
345                                        struct cipso_v4_map_cache_entry, list);
346                 list_del(&old_entry->list);
347                 list_add(&entry->list, &cipso_v4_cache[bkt].list);
348                 cipso_v4_cache_entry_free(old_entry);
349         }
350         spin_unlock_bh(&cipso_v4_cache[bkt].lock);
351 
352         return 0;
353 
354 cache_add_failure:
355         if (entry)
356                 cipso_v4_cache_entry_free(entry);
357         return ret_val;
358 }
359 
360 /*
361  * DOI List Functions
362  */
363 
364 /**
365  * cipso_v4_doi_search - Searches for a DOI definition
366  * @doi: the DOI to search for
367  *
368  * Description:
369  * Search the DOI definition list for a DOI definition with a DOI value that
370  * matches @doi.  The caller is responsible for calling rcu_read_[un]lock().
371  * Returns a pointer to the DOI definition on success and NULL on failure.
372  */
373 static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
374 {
375         struct cipso_v4_doi *iter;
376 
377         list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
378                 if (iter->doi == doi && atomic_read(&iter->refcount))
379                         return iter;
380         return NULL;
381 }
382 
383 /**
384  * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
385  * @doi_def: the DOI structure
386  * @audit_info: NetLabel audit information
387  *
388  * Description:
389  * The caller defines a new DOI for use by the CIPSO engine and calls this
390  * function to add it to the list of acceptable domains.  The caller must
391  * ensure that the mapping table specified in @doi_def->map meets all of the
392  * requirements of the mapping type (see cipso_ipv4.h for details).  Returns
393  * zero on success and non-zero on failure.
394  *
395  */
396 int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
397                      struct netlbl_audit *audit_info)
398 {
399         int ret_val = -EINVAL;
400         u32 iter;
401         u32 doi;
402         u32 doi_type;
403         struct audit_buffer *audit_buf;
404 
405         doi = doi_def->doi;
406         doi_type = doi_def->type;
407 
408         if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
409                 goto doi_add_return;
410         for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
411                 switch (doi_def->tags[iter]) {
412                 case CIPSO_V4_TAG_RBITMAP:
413                         break;
414                 case CIPSO_V4_TAG_RANGE:
415                 case CIPSO_V4_TAG_ENUM:
416                         if (doi_def->type != CIPSO_V4_MAP_PASS)
417                                 goto doi_add_return;
418                         break;
419                 case CIPSO_V4_TAG_LOCAL:
420                         if (doi_def->type != CIPSO_V4_MAP_LOCAL)
421                                 goto doi_add_return;
422                         break;
423                 case CIPSO_V4_TAG_INVALID:
424                         if (iter == 0)
425                                 goto doi_add_return;
426                         break;
427                 default:
428                         goto doi_add_return;
429                 }
430         }
431 
432         atomic_set(&doi_def->refcount, 1);
433 
434         spin_lock(&cipso_v4_doi_list_lock);
435         if (cipso_v4_doi_search(doi_def->doi)) {
436                 spin_unlock(&cipso_v4_doi_list_lock);
437                 ret_val = -EEXIST;
438                 goto doi_add_return;
439         }
440         list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
441         spin_unlock(&cipso_v4_doi_list_lock);
442         ret_val = 0;
443 
444 doi_add_return:
445         audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
446         if (audit_buf) {
447                 const char *type_str;
448                 switch (doi_type) {
449                 case CIPSO_V4_MAP_TRANS:
450                         type_str = "trans";
451                         break;
452                 case CIPSO_V4_MAP_PASS:
453                         type_str = "pass";
454                         break;
455                 case CIPSO_V4_MAP_LOCAL:
456                         type_str = "local";
457                         break;
458                 default:
459                         type_str = "(unknown)";
460                 }
461                 audit_log_format(audit_buf,
462                                  " cipso_doi=%u cipso_type=%s res=%u",
463                                  doi, type_str, ret_val == 0 ? 1 : 0);
464                 audit_log_end(audit_buf);
465         }
466 
467         return ret_val;
468 }
469 
470 /**
471  * cipso_v4_doi_free - Frees a DOI definition
472  * @doi_def: the DOI definition
473  *
474  * Description:
475  * This function frees all of the memory associated with a DOI definition.
476  *
477  */
478 void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
479 {
480         if (!doi_def)
481                 return;
482 
483         switch (doi_def->type) {
484         case CIPSO_V4_MAP_TRANS:
485                 kfree(doi_def->map.std->lvl.cipso);
486                 kfree(doi_def->map.std->lvl.local);
487                 kfree(doi_def->map.std->cat.cipso);
488                 kfree(doi_def->map.std->cat.local);
489                 break;
490         }
491         kfree(doi_def);
492 }
493 
494 /**
495  * cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer
496  * @entry: the entry's RCU field
497  *
498  * Description:
499  * This function is designed to be used as a callback to the call_rcu()
500  * function so that the memory allocated to the DOI definition can be released
501  * safely.
502  *
503  */
504 static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
505 {
506         struct cipso_v4_doi *doi_def;
507 
508         doi_def = container_of(entry, struct cipso_v4_doi, rcu);
509         cipso_v4_doi_free(doi_def);
510 }
511 
512 /**
513  * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
514  * @doi: the DOI value
515  * @audit_secid: the LSM secid to use in the audit message
516  *
517  * Description:
518  * Removes a DOI definition from the CIPSO engine.  The NetLabel routines will
519  * be called to release their own LSM domain mappings as well as our own
520  * domain list.  Returns zero on success and negative values on failure.
521  *
522  */
523 int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
524 {
525         int ret_val;
526         struct cipso_v4_doi *doi_def;
527         struct audit_buffer *audit_buf;
528 
529         spin_lock(&cipso_v4_doi_list_lock);
530         doi_def = cipso_v4_doi_search(doi);
531         if (!doi_def) {
532                 spin_unlock(&cipso_v4_doi_list_lock);
533                 ret_val = -ENOENT;
534                 goto doi_remove_return;
535         }
536         if (!atomic_dec_and_test(&doi_def->refcount)) {
537                 spin_unlock(&cipso_v4_doi_list_lock);
538                 ret_val = -EBUSY;
539                 goto doi_remove_return;
540         }
541         list_del_rcu(&doi_def->list);
542         spin_unlock(&cipso_v4_doi_list_lock);
543 
544         cipso_v4_cache_invalidate();
545         call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
546         ret_val = 0;
547 
548 doi_remove_return:
549         audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
550         if (audit_buf) {
551                 audit_log_format(audit_buf,
552                                  " cipso_doi=%u res=%u",
553                                  doi, ret_val == 0 ? 1 : 0);
554                 audit_log_end(audit_buf);
555         }
556 
557         return ret_val;
558 }
559 
560 /**
561  * cipso_v4_doi_getdef - Returns a reference to a valid DOI definition
562  * @doi: the DOI value
563  *
564  * Description:
565  * Searches for a valid DOI definition and if one is found it is returned to
566  * the caller.  Otherwise NULL is returned.  The caller must ensure that
567  * rcu_read_lock() is held while accessing the returned definition and the DOI
568  * definition reference count is decremented when the caller is done.
569  *
570  */
571 struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
572 {
573         struct cipso_v4_doi *doi_def;
574 
575         rcu_read_lock();
576         doi_def = cipso_v4_doi_search(doi);
577         if (!doi_def)
578                 goto doi_getdef_return;
579         if (!atomic_inc_not_zero(&doi_def->refcount))
580                 doi_def = NULL;
581 
582 doi_getdef_return:
583         rcu_read_unlock();
584         return doi_def;
585 }
586 
587 /**
588  * cipso_v4_doi_putdef - Releases a reference for the given DOI definition
589  * @doi_def: the DOI definition
590  *
591  * Description:
592  * Releases a DOI definition reference obtained from cipso_v4_doi_getdef().
593  *
594  */
595 void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
596 {
597         if (!doi_def)
598                 return;
599 
600         if (!atomic_dec_and_test(&doi_def->refcount))
601                 return;
602         spin_lock(&cipso_v4_doi_list_lock);
603         list_del_rcu(&doi_def->list);
604         spin_unlock(&cipso_v4_doi_list_lock);
605 
606         cipso_v4_cache_invalidate();
607         call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
608 }
609 
610 /**
611  * cipso_v4_doi_walk - Iterate through the DOI definitions
612  * @skip_cnt: skip past this number of DOI definitions, updated
613  * @callback: callback for each DOI definition
614  * @cb_arg: argument for the callback function
615  *
616  * Description:
617  * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
618  * For each entry call @callback, if @callback returns a negative value stop
619  * 'walking' through the list and return.  Updates the value in @skip_cnt upon
620  * return.  Returns zero on success, negative values on failure.
621  *
622  */
623 int cipso_v4_doi_walk(u32 *skip_cnt,
624                      int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
625                      void *cb_arg)
626 {
627         int ret_val = -ENOENT;
628         u32 doi_cnt = 0;
629         struct cipso_v4_doi *iter_doi;
630 
631         rcu_read_lock();
632         list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
633                 if (atomic_read(&iter_doi->refcount) > 0) {
634                         if (doi_cnt++ < *skip_cnt)
635                                 continue;
636                         ret_val = callback(iter_doi, cb_arg);
637                         if (ret_val < 0) {
638                                 doi_cnt--;
639                                 goto doi_walk_return;
640                         }
641                 }
642 
643 doi_walk_return:
644         rcu_read_unlock();
645         *skip_cnt = doi_cnt;
646         return ret_val;
647 }
648 
649 /*
650  * Label Mapping Functions
651  */
652 
653 /**
654  * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
655  * @doi_def: the DOI definition
656  * @level: the level to check
657  *
658  * Description:
659  * Checks the given level against the given DOI definition and returns a
660  * negative value if the level does not have a valid mapping and a zero value
661  * if the level is defined by the DOI.
662  *
663  */
664 static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
665 {
666         switch (doi_def->type) {
667         case CIPSO_V4_MAP_PASS:
668                 return 0;
669         case CIPSO_V4_MAP_TRANS:
670                 if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
671                         return 0;
672                 break;
673         }
674 
675         return -EFAULT;
676 }
677 
678 /**
679  * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
680  * @doi_def: the DOI definition
681  * @host_lvl: the host MLS level
682  * @net_lvl: the network/CIPSO MLS level
683  *
684  * Description:
685  * Perform a label mapping to translate a local MLS level to the correct
686  * CIPSO level using the given DOI definition.  Returns zero on success,
687  * negative values otherwise.
688  *
689  */
690 static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
691                                  u32 host_lvl,
692                                  u32 *net_lvl)
693 {
694         switch (doi_def->type) {
695         case CIPSO_V4_MAP_PASS:
696                 *net_lvl = host_lvl;
697                 return 0;
698         case CIPSO_V4_MAP_TRANS:
699                 if (host_lvl < doi_def->map.std->lvl.local_size &&
700                     doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
701                         *net_lvl = doi_def->map.std->lvl.local[host_lvl];
702                         return 0;
703                 }
704                 return -EPERM;
705         }
706 
707         return -EINVAL;
708 }
709 
710 /**
711  * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
712  * @doi_def: the DOI definition
713  * @net_lvl: the network/CIPSO MLS level
714  * @host_lvl: the host MLS level
715  *
716  * Description:
717  * Perform a label mapping to translate a CIPSO level to the correct local MLS
718  * level using the given DOI definition.  Returns zero on success, negative
719  * values otherwise.
720  *
721  */
722 static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
723                                  u32 net_lvl,
724                                  u32 *host_lvl)
725 {
726         struct cipso_v4_std_map_tbl *map_tbl;
727 
728         switch (doi_def->type) {
729         case CIPSO_V4_MAP_PASS:
730                 *host_lvl = net_lvl;
731                 return 0;
732         case CIPSO_V4_MAP_TRANS:
733                 map_tbl = doi_def->map.std;
734                 if (net_lvl < map_tbl->lvl.cipso_size &&
735                     map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
736                         *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
737                         return 0;
738                 }
739                 return -EPERM;
740         }
741 
742         return -EINVAL;
743 }
744 
745 /**
746  * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
747  * @doi_def: the DOI definition
748  * @bitmap: category bitmap
749  * @bitmap_len: bitmap length in bytes
750  *
751  * Description:
752  * Checks the given category bitmap against the given DOI definition and
753  * returns a negative value if any of the categories in the bitmap do not have
754  * a valid mapping and a zero value if all of the categories are valid.
755  *
756  */
757 static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
758                                       const unsigned char *bitmap,
759                                       u32 bitmap_len)
760 {
761         int cat = -1;
762         u32 bitmap_len_bits = bitmap_len * 8;
763         u32 cipso_cat_size;
764         u32 *cipso_array;
765 
766         switch (doi_def->type) {
767         case CIPSO_V4_MAP_PASS:
768                 return 0;
769         case CIPSO_V4_MAP_TRANS:
770                 cipso_cat_size = doi_def->map.std->cat.cipso_size;
771                 cipso_array = doi_def->map.std->cat.cipso;
772                 for (;;) {
773                         cat = netlbl_bitmap_walk(bitmap,
774                                                  bitmap_len_bits,
775                                                  cat + 1,
776                                                  1);
777                         if (cat < 0)
778                                 break;
779                         if (cat >= cipso_cat_size ||
780                             cipso_array[cat] >= CIPSO_V4_INV_CAT)
781                                 return -EFAULT;
782                 }
783 
784                 if (cat == -1)
785                         return 0;
786                 break;
787         }
788 
789         return -EFAULT;
790 }
791 
792 /**
793  * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
794  * @doi_def: the DOI definition
795  * @secattr: the security attributes
796  * @net_cat: the zero'd out category bitmap in network/CIPSO format
797  * @net_cat_len: the length of the CIPSO bitmap in bytes
798  *
799  * Description:
800  * Perform a label mapping to translate a local MLS category bitmap to the
801  * correct CIPSO bitmap using the given DOI definition.  Returns the minimum
802  * size in bytes of the network bitmap on success, negative values otherwise.
803  *
804  */
805 static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
806                                      const struct netlbl_lsm_secattr *secattr,
807                                      unsigned char *net_cat,
808                                      u32 net_cat_len)
809 {
810         int host_spot = -1;
811         u32 net_spot = CIPSO_V4_INV_CAT;
812         u32 net_spot_max = 0;
813         u32 net_clen_bits = net_cat_len * 8;
814         u32 host_cat_size = 0;
815         u32 *host_cat_array = NULL;
816 
817         if (doi_def->type == CIPSO_V4_MAP_TRANS) {
818                 host_cat_size = doi_def->map.std->cat.local_size;
819                 host_cat_array = doi_def->map.std->cat.local;
820         }
821 
822         for (;;) {
823                 host_spot = netlbl_catmap_walk(secattr->attr.mls.cat,
824                                                host_spot + 1);
825                 if (host_spot < 0)
826                         break;
827 
828                 switch (doi_def->type) {
829                 case CIPSO_V4_MAP_PASS:
830                         net_spot = host_spot;
831                         break;
832                 case CIPSO_V4_MAP_TRANS:
833                         if (host_spot >= host_cat_size)
834                                 return -EPERM;
835                         net_spot = host_cat_array[host_spot];
836                         if (net_spot >= CIPSO_V4_INV_CAT)
837                                 return -EPERM;
838                         break;
839                 }
840                 if (net_spot >= net_clen_bits)
841                         return -ENOSPC;
842                 netlbl_bitmap_setbit(net_cat, net_spot, 1);
843 
844                 if (net_spot > net_spot_max)
845                         net_spot_max = net_spot;
846         }
847 
848         if (++net_spot_max % 8)
849                 return net_spot_max / 8 + 1;
850         return net_spot_max / 8;
851 }
852 
853 /**
854  * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
855  * @doi_def: the DOI definition
856  * @net_cat: the category bitmap in network/CIPSO format
857  * @net_cat_len: the length of the CIPSO bitmap in bytes
858  * @secattr: the security attributes
859  *
860  * Description:
861  * Perform a label mapping to translate a CIPSO bitmap to the correct local
862  * MLS category bitmap using the given DOI definition.  Returns zero on
863  * success, negative values on failure.
864  *
865  */
866 static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
867                                      const unsigned char *net_cat,
868                                      u32 net_cat_len,
869                                      struct netlbl_lsm_secattr *secattr)
870 {
871         int ret_val;
872         int net_spot = -1;
873         u32 host_spot = CIPSO_V4_INV_CAT;
874         u32 net_clen_bits = net_cat_len * 8;
875         u32 net_cat_size = 0;
876         u32 *net_cat_array = NULL;
877 
878         if (doi_def->type == CIPSO_V4_MAP_TRANS) {
879                 net_cat_size = doi_def->map.std->cat.cipso_size;
880                 net_cat_array = doi_def->map.std->cat.cipso;
881         }
882 
883         for (;;) {
884                 net_spot = netlbl_bitmap_walk(net_cat,
885                                               net_clen_bits,
886                                               net_spot + 1,
887                                               1);
888                 if (net_spot < 0) {
889                         if (net_spot == -2)
890                                 return -EFAULT;
891                         return 0;
892                 }
893 
894                 switch (doi_def->type) {
895                 case CIPSO_V4_MAP_PASS:
896                         host_spot = net_spot;
897                         break;
898                 case CIPSO_V4_MAP_TRANS:
899                         if (net_spot >= net_cat_size)
900                                 return -EPERM;
901                         host_spot = net_cat_array[net_spot];
902                         if (host_spot >= CIPSO_V4_INV_CAT)
903                                 return -EPERM;
904                         break;
905                 }
906                 ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
907                                                        host_spot,
908                                                        GFP_ATOMIC);
909                 if (ret_val != 0)
910                         return ret_val;
911         }
912 
913         return -EINVAL;
914 }
915 
916 /**
917  * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
918  * @doi_def: the DOI definition
919  * @enumcat: category list
920  * @enumcat_len: length of the category list in bytes
921  *
922  * Description:
923  * Checks the given categories against the given DOI definition and returns a
924  * negative value if any of the categories do not have a valid mapping and a
925  * zero value if all of the categories are valid.
926  *
927  */
928 static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
929                                        const unsigned char *enumcat,
930                                        u32 enumcat_len)
931 {
932         u16 cat;
933         int cat_prev = -1;
934         u32 iter;
935 
936         if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
937                 return -EFAULT;
938 
939         for (iter = 0; iter < enumcat_len; iter += 2) {
940                 cat = get_unaligned_be16(&enumcat[iter]);
941                 if (cat <= cat_prev)
942                         return -EFAULT;
943                 cat_prev = cat;
944         }
945 
946         return 0;
947 }
948 
949 /**
950  * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
951  * @doi_def: the DOI definition
952  * @secattr: the security attributes
953  * @net_cat: the zero'd out category list in network/CIPSO format
954  * @net_cat_len: the length of the CIPSO category list in bytes
955  *
956  * Description:
957  * Perform a label mapping to translate a local MLS category bitmap to the
958  * correct CIPSO category list using the given DOI definition.   Returns the
959  * size in bytes of the network category bitmap on success, negative values
960  * otherwise.
961  *
962  */
963 static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
964                                       const struct netlbl_lsm_secattr *secattr,
965                                       unsigned char *net_cat,
966                                       u32 net_cat_len)
967 {
968         int cat = -1;
969         u32 cat_iter = 0;
970 
971         for (;;) {
972                 cat = netlbl_catmap_walk(secattr->attr.mls.cat, cat + 1);
973                 if (cat < 0)
974                         break;
975                 if ((cat_iter + 2) > net_cat_len)
976                         return -ENOSPC;
977 
978                 *((__be16 *)&net_cat[cat_iter]) = htons(cat);
979                 cat_iter += 2;
980         }
981 
982         return cat_iter;
983 }
984 
985 /**
986  * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
987  * @doi_def: the DOI definition
988  * @net_cat: the category list in network/CIPSO format
989  * @net_cat_len: the length of the CIPSO bitmap in bytes
990  * @secattr: the security attributes
991  *
992  * Description:
993  * Perform a label mapping to translate a CIPSO category list to the correct
994  * local MLS category bitmap using the given DOI definition.  Returns zero on
995  * success, negative values on failure.
996  *
997  */
998 static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
999                                       const unsigned char *net_cat,
1000                                       u32 net_cat_len,
1001                                       struct netlbl_lsm_secattr *secattr)
1002 {
1003         int ret_val;
1004         u32 iter;
1005 
1006         for (iter = 0; iter < net_cat_len; iter += 2) {
1007                 ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
1008                                              get_unaligned_be16(&net_cat[iter]),
1009                                              GFP_ATOMIC);
1010                 if (ret_val != 0)
1011                         return ret_val;
1012         }
1013 
1014         return 0;
1015 }
1016 
1017 /**
1018  * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
1019  * @doi_def: the DOI definition
1020  * @rngcat: category list
1021  * @rngcat_len: length of the category list in bytes
1022  *
1023  * Description:
1024  * Checks the given categories against the given DOI definition and returns a
1025  * negative value if any of the categories do not have a valid mapping and a
1026  * zero value if all of the categories are valid.
1027  *
1028  */
1029 static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1030                                       const unsigned char *rngcat,
1031                                       u32 rngcat_len)
1032 {
1033         u16 cat_high;
1034         u16 cat_low;
1035         u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1036         u32 iter;
1037 
1038         if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1039                 return -EFAULT;
1040 
1041         for (iter = 0; iter < rngcat_len; iter += 4) {
1042                 cat_high = get_unaligned_be16(&rngcat[iter]);
1043                 if ((iter + 4) <= rngcat_len)
1044                         cat_low = get_unaligned_be16(&rngcat[iter + 2]);
1045                 else
1046                         cat_low = 0;
1047 
1048                 if (cat_high > cat_prev)
1049                         return -EFAULT;
1050 
1051                 cat_prev = cat_low;
1052         }
1053 
1054         return 0;
1055 }
1056 
1057 /**
1058  * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
1059  * @doi_def: the DOI definition
1060  * @secattr: the security attributes
1061  * @net_cat: the zero'd out category list in network/CIPSO format
1062  * @net_cat_len: the length of the CIPSO category list in bytes
1063  *
1064  * Description:
1065  * Perform a label mapping to translate a local MLS category bitmap to the
1066  * correct CIPSO category list using the given DOI definition.   Returns the
1067  * size in bytes of the network category bitmap on success, negative values
1068  * otherwise.
1069  *
1070  */
1071 static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1072                                      const struct netlbl_lsm_secattr *secattr,
1073                                      unsigned char *net_cat,
1074                                      u32 net_cat_len)
1075 {
1076         int iter = -1;
1077         u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1078         u32 array_cnt = 0;
1079         u32 cat_size = 0;
1080 
1081         /* make sure we don't overflow the 'array[]' variable */
1082         if (net_cat_len >
1083             (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1084                 return -ENOSPC;
1085 
1086         for (;;) {
1087                 iter = netlbl_catmap_walk(secattr->attr.mls.cat, iter + 1);
1088                 if (iter < 0)
1089                         break;
1090                 cat_size += (iter == 0 ? 0 : sizeof(u16));
1091                 if (cat_size > net_cat_len)
1092                         return -ENOSPC;
1093                 array[array_cnt++] = iter;
1094 
1095                 iter = netlbl_catmap_walkrng(secattr->attr.mls.cat, iter);
1096                 if (iter < 0)
1097                         return -EFAULT;
1098                 cat_size += sizeof(u16);
1099                 if (cat_size > net_cat_len)
1100                         return -ENOSPC;
1101                 array[array_cnt++] = iter;
1102         }
1103 
1104         for (iter = 0; array_cnt > 0;) {
1105                 *((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1106                 iter += 2;
1107                 array_cnt--;
1108                 if (array[array_cnt] != 0) {
1109                         *((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1110                         iter += 2;
1111                 }
1112         }
1113 
1114         return cat_size;
1115 }
1116 
1117 /**
1118  * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
1119  * @doi_def: the DOI definition
1120  * @net_cat: the category list in network/CIPSO format
1121  * @net_cat_len: the length of the CIPSO bitmap in bytes
1122  * @secattr: the security attributes
1123  *
1124  * Description:
1125  * Perform a label mapping to translate a CIPSO category list to the correct
1126  * local MLS category bitmap using the given DOI definition.  Returns zero on
1127  * success, negative values on failure.
1128  *
1129  */
1130 static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1131                                      const unsigned char *net_cat,
1132                                      u32 net_cat_len,
1133                                      struct netlbl_lsm_secattr *secattr)
1134 {
1135         int ret_val;
1136         u32 net_iter;
1137         u16 cat_low;
1138         u16 cat_high;
1139 
1140         for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
1141                 cat_high = get_unaligned_be16(&net_cat[net_iter]);
1142                 if ((net_iter + 4) <= net_cat_len)
1143                         cat_low = get_unaligned_be16(&net_cat[net_iter + 2]);
1144                 else
1145                         cat_low = 0;
1146 
1147                 ret_val = netlbl_catmap_setrng(&secattr->attr.mls.cat,
1148                                                cat_low,
1149                                                cat_high,
1150                                                GFP_ATOMIC);
1151                 if (ret_val != 0)
1152                         return ret_val;
1153         }
1154 
1155         return 0;
1156 }
1157 
1158 /*
1159  * Protocol Handling Functions
1160  */
1161 
1162 /**
1163  * cipso_v4_gentag_hdr - Generate a CIPSO option header
1164  * @doi_def: the DOI definition
1165  * @len: the total tag length in bytes, not including this header
1166  * @buf: the CIPSO option buffer
1167  *
1168  * Description:
1169  * Write a CIPSO header into the beginning of @buffer.
1170  *
1171  */
1172 static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1173                                 unsigned char *buf,
1174                                 u32 len)
1175 {
1176         buf[0] = IPOPT_CIPSO;
1177         buf[1] = CIPSO_V4_HDR_LEN + len;
1178         *(__be32 *)&buf[2] = htonl(doi_def->doi);
1179 }
1180 
1181 /**
1182  * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
1183  * @doi_def: the DOI definition
1184  * @secattr: the security attributes
1185  * @buffer: the option buffer
1186  * @buffer_len: length of buffer in bytes
1187  *
1188  * Description:
1189  * Generate a CIPSO option using the restricted bitmap tag, tag type #1.  The
1190  * actual buffer length may be larger than the indicated size due to
1191  * translation between host and network category bitmaps.  Returns the size of
1192  * the tag on success, negative values on failure.
1193  *
1194  */
1195 static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1196                                const struct netlbl_lsm_secattr *secattr,
1197                                unsigned char *buffer,
1198                                u32 buffer_len)
1199 {
1200         int ret_val;
1201         u32 tag_len;
1202         u32 level;
1203 
1204         if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1205                 return -EPERM;
1206 
1207         ret_val = cipso_v4_map_lvl_hton(doi_def,
1208                                         secattr->attr.mls.lvl,
1209                                         &level);
1210         if (ret_val != 0)
1211                 return ret_val;
1212 
1213         if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1214                 ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
1215                                                     secattr,
1216                                                     &buffer[4],
1217                                                     buffer_len - 4);
1218                 if (ret_val < 0)
1219                         return ret_val;
1220 
1221                 /* This will send packets using the "optimized" format when
1222                  * possible as specified in  section 3.4.2.6 of the
1223                  * CIPSO draft. */
1224                 if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
1225                         tag_len = 14;
1226                 else
1227                         tag_len = 4 + ret_val;
1228         } else
1229                 tag_len = 4;
1230 
1231         buffer[0] = CIPSO_V4_TAG_RBITMAP;
1232         buffer[1] = tag_len;
1233         buffer[3] = level;
1234 
1235         return tag_len;
1236 }
1237 
1238 /**
1239  * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
1240  * @doi_def: the DOI definition
1241  * @tag: the CIPSO tag
1242  * @secattr: the security attributes
1243  *
1244  * Description:
1245  * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
1246  * attributes in @secattr.  Return zero on success, negatives values on
1247  * failure.
1248  *
1249  */
1250 static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1251                                  const unsigned char *tag,
1252                                  struct netlbl_lsm_secattr *secattr)
1253 {
1254         int ret_val;
1255         u8 tag_len = tag[1];
1256         u32 level;
1257 
1258         ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1259         if (ret_val != 0)
1260                 return ret_val;
1261         secattr->attr.mls.lvl = level;
1262         secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1263 
1264         if (tag_len > 4) {
1265                 ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1266                                                     &tag[4],
1267                                                     tag_len - 4,
1268                                                     secattr);
1269                 if (ret_val != 0) {
1270                         netlbl_catmap_free(secattr->attr.mls.cat);
1271                         return ret_val;
1272                 }
1273 
1274                 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1275         }
1276 
1277         return 0;
1278 }
1279 
1280 /**
1281  * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
1282  * @doi_def: the DOI definition
1283  * @secattr: the security attributes
1284  * @buffer: the option buffer
1285  * @buffer_len: length of buffer in bytes
1286  *
1287  * Description:
1288  * Generate a CIPSO option using the enumerated tag, tag type #2.  Returns the
1289  * size of the tag on success, negative values on failure.
1290  *
1291  */
1292 static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1293                                 const struct netlbl_lsm_secattr *secattr,
1294                                 unsigned char *buffer,
1295                                 u32 buffer_len)
1296 {
1297         int ret_val;
1298         u32 tag_len;
1299         u32 level;
1300 
1301         if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1302                 return -EPERM;
1303 
1304         ret_val = cipso_v4_map_lvl_hton(doi_def,
1305                                         secattr->attr.mls.lvl,
1306                                         &level);
1307         if (ret_val != 0)
1308                 return ret_val;
1309 
1310         if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1311                 ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1312                                                      secattr,
1313                                                      &buffer[4],
1314                                                      buffer_len - 4);
1315                 if (ret_val < 0)
1316                         return ret_val;
1317 
1318                 tag_len = 4 + ret_val;
1319         } else
1320                 tag_len = 4;
1321 
1322         buffer[0] = CIPSO_V4_TAG_ENUM;
1323         buffer[1] = tag_len;
1324         buffer[3] = level;
1325 
1326         return tag_len;
1327 }
1328 
1329 /**
1330  * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
1331  * @doi_def: the DOI definition
1332  * @tag: the CIPSO tag
1333  * @secattr: the security attributes
1334  *
1335  * Description:
1336  * Parse a CIPSO enumerated tag (tag type #2) and return the security
1337  * attributes in @secattr.  Return zero on success, negatives values on
1338  * failure.
1339  *
1340  */
1341 static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1342                                   const unsigned char *tag,
1343                                   struct netlbl_lsm_secattr *secattr)
1344 {
1345         int ret_val;
1346         u8 tag_len = tag[1];
1347         u32 level;
1348 
1349         ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1350         if (ret_val != 0)
1351                 return ret_val;
1352         secattr->attr.mls.lvl = level;
1353         secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1354 
1355         if (tag_len > 4) {
1356                 ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1357                                                      &tag[4],
1358                                                      tag_len - 4,
1359                                                      secattr);
1360                 if (ret_val != 0) {
1361                         netlbl_catmap_free(secattr->attr.mls.cat);
1362                         return ret_val;
1363                 }
1364 
1365                 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1366         }
1367 
1368         return 0;
1369 }
1370 
1371 /**
1372  * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
1373  * @doi_def: the DOI definition
1374  * @secattr: the security attributes
1375  * @buffer: the option buffer
1376  * @buffer_len: length of buffer in bytes
1377  *
1378  * Description:
1379  * Generate a CIPSO option using the ranged tag, tag type #5.  Returns the
1380  * size of the tag on success, negative values on failure.
1381  *
1382  */
1383 static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1384                                const struct netlbl_lsm_secattr *secattr,
1385                                unsigned char *buffer,
1386                                u32 buffer_len)
1387 {
1388         int ret_val;
1389         u32 tag_len;
1390         u32 level;
1391 
1392         if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1393                 return -EPERM;
1394 
1395         ret_val = cipso_v4_map_lvl_hton(doi_def,
1396                                         secattr->attr.mls.lvl,
1397                                         &level);
1398         if (ret_val != 0)
1399                 return ret_val;
1400 
1401         if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1402                 ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1403                                                     secattr,
1404                                                     &buffer[4],
1405                                                     buffer_len - 4);
1406                 if (ret_val < 0)
1407                         return ret_val;
1408 
1409                 tag_len = 4 + ret_val;
1410         } else
1411                 tag_len = 4;
1412 
1413         buffer[0] = CIPSO_V4_TAG_RANGE;
1414         buffer[1] = tag_len;
1415         buffer[3] = level;
1416 
1417         return tag_len;
1418 }
1419 
1420 /**
1421  * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
1422  * @doi_def: the DOI definition
1423  * @tag: the CIPSO tag
1424  * @secattr: the security attributes
1425  *
1426  * Description:
1427  * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
1428  * in @secattr.  Return zero on success, negatives values on failure.
1429  *
1430  */
1431 static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1432                                  const unsigned char *tag,
1433                                  struct netlbl_lsm_secattr *secattr)
1434 {
1435         int ret_val;
1436         u8 tag_len = tag[1];
1437         u32 level;
1438 
1439         ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1440         if (ret_val != 0)
1441                 return ret_val;
1442         secattr->attr.mls.lvl = level;
1443         secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1444 
1445         if (tag_len > 4) {
1446                 ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1447                                                     &tag[4],
1448                                                     tag_len - 4,
1449                                                     secattr);
1450                 if (ret_val != 0) {
1451                         netlbl_catmap_free(secattr->attr.mls.cat);
1452                         return ret_val;
1453                 }
1454 
1455                 secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1456         }
1457 
1458         return 0;
1459 }
1460 
1461 /**
1462  * cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard)
1463  * @doi_def: the DOI definition
1464  * @secattr: the security attributes
1465  * @buffer: the option buffer
1466  * @buffer_len: length of buffer in bytes
1467  *
1468  * Description:
1469  * Generate a CIPSO option using the local tag.  Returns the size of the tag
1470  * on success, negative values on failure.
1471  *
1472  */
1473 static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
1474                                const struct netlbl_lsm_secattr *secattr,
1475                                unsigned char *buffer,
1476                                u32 buffer_len)
1477 {
1478         if (!(secattr->flags & NETLBL_SECATTR_SECID))
1479                 return -EPERM;
1480 
1481         buffer[0] = CIPSO_V4_TAG_LOCAL;
1482         buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
1483         *(u32 *)&buffer[2] = secattr->attr.secid;
1484 
1485         return CIPSO_V4_TAG_LOC_BLEN;
1486 }
1487 
1488 /**
1489  * cipso_v4_parsetag_loc - Parse a CIPSO local tag
1490  * @doi_def: the DOI definition
1491  * @tag: the CIPSO tag
1492  * @secattr: the security attributes
1493  *
1494  * Description:
1495  * Parse a CIPSO local tag and return the security attributes in @secattr.
1496  * Return zero on success, negatives values on failure.
1497  *
1498  */
1499 static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
1500                                  const unsigned char *tag,
1501                                  struct netlbl_lsm_secattr *secattr)
1502 {
1503         secattr->attr.secid = *(u32 *)&tag[2];
1504         secattr->flags |= NETLBL_SECATTR_SECID;
1505 
1506         return 0;
1507 }
1508 
1509 /**
1510  * cipso_v4_optptr - Find the CIPSO option in the packet
1511  * @skb: the packet
1512  *
1513  * Description:
1514  * Parse the packet's IP header looking for a CIPSO option.  Returns a pointer
1515  * to the start of the CIPSO option on success, NULL if one if not found.
1516  *
1517  */
1518 unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
1519 {
1520         const struct iphdr *iph = ip_hdr(skb);
1521         unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
1522         int optlen;
1523         int taglen;
1524 
1525         for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
1526                 if (optptr[0] == IPOPT_CIPSO)
1527                         return optptr;
1528                 taglen = optptr[1];
1529                 optlen -= taglen;
1530                 optptr += taglen;
1531         }
1532 
1533         return NULL;
1534 }
1535 
1536 /**
1537  * cipso_v4_validate - Validate a CIPSO option
1538  * @option: the start of the option, on error it is set to point to the error
1539  *
1540  * Description:
1541  * This routine is called to validate a CIPSO option, it checks all of the
1542  * fields to ensure that they are at least valid, see the draft snippet below
1543  * for details.  If the option is valid then a zero value is returned and
1544  * the value of @option is unchanged.  If the option is invalid then a
1545  * non-zero value is returned and @option is adjusted to point to the
1546  * offending portion of the option.  From the IETF draft ...
1547  *
1548  *  "If any field within the CIPSO options, such as the DOI identifier, is not
1549  *   recognized the IP datagram is discarded and an ICMP 'parameter problem'
1550  *   (type 12) is generated and returned.  The ICMP code field is set to 'bad
1551  *   parameter' (code 0) and the pointer is set to the start of the CIPSO field
1552  *   that is unrecognized."
1553  *
1554  */
1555 int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
1556 {
1557         unsigned char *opt = *option;
1558         unsigned char *tag;
1559         unsigned char opt_iter;
1560         unsigned char err_offset = 0;
1561         u8 opt_len;
1562         u8 tag_len;
1563         struct cipso_v4_doi *doi_def = NULL;
1564         u32 tag_iter;
1565 
1566         /* caller already checks for length values that are too large */
1567         opt_len = opt[1];
1568         if (opt_len < 8) {
1569                 err_offset = 1;
1570                 goto validate_return;
1571         }
1572 
1573         rcu_read_lock();
1574         doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2]));
1575         if (!doi_def) {
1576                 err_offset = 2;
1577                 goto validate_return_locked;
1578         }
1579 
1580         opt_iter = CIPSO_V4_HDR_LEN;
1581         tag = opt + opt_iter;
1582         while (opt_iter < opt_len) {
1583                 for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1584                         if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1585                             ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1586                                 err_offset = opt_iter;
1587                                 goto validate_return_locked;
1588                         }
1589 
1590                 if (opt_iter + 1 == opt_len) {
1591                         err_offset = opt_iter;
1592                         goto validate_return_locked;
1593                 }
1594                 tag_len = tag[1];
1595                 if (tag_len > (opt_len - opt_iter)) {
1596                         err_offset = opt_iter + 1;
1597                         goto validate_return_locked;
1598                 }
1599 
1600                 switch (tag[0]) {
1601                 case CIPSO_V4_TAG_RBITMAP:
1602                         if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
1603                                 err_offset = opt_iter + 1;
1604                                 goto validate_return_locked;
1605                         }
1606 
1607                         /* We are already going to do all the verification
1608                          * necessary at the socket layer so from our point of
1609                          * view it is safe to turn these checks off (and less
1610                          * work), however, the CIPSO draft says we should do
1611                          * all the CIPSO validations here but it doesn't
1612                          * really specify _exactly_ what we need to validate
1613                          * ... so, just make it a sysctl tunable. */
1614                         if (cipso_v4_rbm_strictvalid) {
1615                                 if (cipso_v4_map_lvl_valid(doi_def,
1616                                                            tag[3]) < 0) {
1617                                         err_offset = opt_iter + 3;
1618                                         goto validate_return_locked;
1619                                 }
1620                                 if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
1621                                     cipso_v4_map_cat_rbm_valid(doi_def,
1622                                                             &tag[4],
1623                                                             tag_len - 4) < 0) {
1624                                         err_offset = opt_iter + 4;
1625                                         goto validate_return_locked;
1626                                 }
1627                         }
1628                         break;
1629                 case CIPSO_V4_TAG_ENUM:
1630                         if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
1631                                 err_offset = opt_iter + 1;
1632                                 goto validate_return_locked;
1633                         }
1634 
1635                         if (cipso_v4_map_lvl_valid(doi_def,
1636                                                    tag[3]) < 0) {
1637                                 err_offset = opt_iter + 3;
1638                                 goto validate_return_locked;
1639                         }
1640                         if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
1641                             cipso_v4_map_cat_enum_valid(doi_def,
1642                                                         &tag[4],
1643                                                         tag_len - 4) < 0) {
1644                                 err_offset = opt_iter + 4;
1645                                 goto validate_return_locked;
1646                         }
1647                         break;
1648                 case CIPSO_V4_TAG_RANGE:
1649                         if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
1650                                 err_offset = opt_iter + 1;
1651                                 goto validate_return_locked;
1652                         }
1653 
1654                         if (cipso_v4_map_lvl_valid(doi_def,
1655                                                    tag[3]) < 0) {
1656                                 err_offset = opt_iter + 3;
1657                                 goto validate_return_locked;
1658                         }
1659                         if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
1660                             cipso_v4_map_cat_rng_valid(doi_def,
1661                                                        &tag[4],
1662                                                        tag_len - 4) < 0) {
1663                                 err_offset = opt_iter + 4;
1664                                 goto validate_return_locked;
1665                         }
1666                         break;
1667                 case CIPSO_V4_TAG_LOCAL:
1668                         /* This is a non-standard tag that we only allow for
1669                          * local connections, so if the incoming interface is
1670                          * not the loopback device drop the packet. Further,
1671                          * there is no legitimate reason for setting this from
1672                          * userspace so reject it if skb is NULL. */
1673                         if (!skb || !(skb->dev->flags & IFF_LOOPBACK)) {
1674                                 err_offset = opt_iter;
1675                                 goto validate_return_locked;
1676                         }
1677                         if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
1678                                 err_offset = opt_iter + 1;
1679                                 goto validate_return_locked;
1680                         }
1681                         break;
1682                 default:
1683                         err_offset = opt_iter;
1684                         goto validate_return_locked;
1685                 }
1686 
1687                 tag += tag_len;
1688                 opt_iter += tag_len;
1689         }
1690 
1691 validate_return_locked:
1692         rcu_read_unlock();
1693 validate_return:
1694         *option = opt + err_offset;
1695         return err_offset;
1696 }
1697 
1698 /**
1699  * cipso_v4_error - Send the correct response for a bad packet
1700  * @skb: the packet
1701  * @error: the error code
1702  * @gateway: CIPSO gateway flag
1703  *
1704  * Description:
1705  * Based on the error code given in @error, send an ICMP error message back to
1706  * the originating host.  From the IETF draft ...
1707  *
1708  *  "If the contents of the CIPSO [option] are valid but the security label is
1709  *   outside of the configured host or port label range, the datagram is
1710  *   discarded and an ICMP 'destination unreachable' (type 3) is generated and
1711  *   returned.  The code field of the ICMP is set to 'communication with
1712  *   destination network administratively prohibited' (code 9) or to
1713  *   'communication with destination host administratively prohibited'
1714  *   (code 10).  The value of the code is dependent on whether the originator
1715  *   of the ICMP message is acting as a CIPSO host or a CIPSO gateway.  The
1716  *   recipient of the ICMP message MUST be able to handle either value.  The
1717  *   same procedure is performed if a CIPSO [option] can not be added to an
1718  *   IP packet because it is too large to fit in the IP options area."
1719  *
1720  *  "If the error is triggered by receipt of an ICMP message, the message is
1721  *   discarded and no response is permitted (consistent with general ICMP
1722  *   processing rules)."
1723  *
1724  */
1725 void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1726 {
1727         if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
1728                 return;
1729 
1730         if (gateway)
1731                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
1732         else
1733                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
1734 }
1735 
1736 /**
1737  * cipso_v4_genopt - Generate a CIPSO option
1738  * @buf: the option buffer
1739  * @buf_len: the size of opt_buf
1740  * @doi_def: the CIPSO DOI to use
1741  * @secattr: the security attributes
1742  *
1743  * Description:
1744  * Generate a CIPSO option using the DOI definition and security attributes
1745  * passed to the function.  Returns the length of the option on success and
1746  * negative values on failure.
1747  *
1748  */
1749 static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
1750                            const struct cipso_v4_doi *doi_def,
1751                            const struct netlbl_lsm_secattr *secattr)
1752 {
1753         int ret_val;
1754         u32 iter;
1755 
1756         if (buf_len <= CIPSO_V4_HDR_LEN)
1757                 return -ENOSPC;
1758 
1759         /* XXX - This code assumes only one tag per CIPSO option which isn't
1760          * really a good assumption to make but since we only support the MAC
1761          * tags right now it is a safe assumption. */
1762         iter = 0;
1763         do {
1764                 memset(buf, 0, buf_len);
1765                 switch (doi_def->tags[iter]) {
1766                 case CIPSO_V4_TAG_RBITMAP:
1767                         ret_val = cipso_v4_gentag_rbm(doi_def,
1768                                                    secattr,
1769                                                    &buf[CIPSO_V4_HDR_LEN],
1770                                                    buf_len - CIPSO_V4_HDR_LEN);
1771                         break;
1772                 case CIPSO_V4_TAG_ENUM:
1773                         ret_val = cipso_v4_gentag_enum(doi_def,
1774                                                    secattr,
1775                                                    &buf[CIPSO_V4_HDR_LEN],
1776                                                    buf_len - CIPSO_V4_HDR_LEN);
1777                         break;
1778                 case CIPSO_V4_TAG_RANGE:
1779                         ret_val = cipso_v4_gentag_rng(doi_def,
1780                                                    secattr,
1781                                                    &buf[CIPSO_V4_HDR_LEN],
1782                                                    buf_len - CIPSO_V4_HDR_LEN);
1783                         break;
1784                 case CIPSO_V4_TAG_LOCAL:
1785                         ret_val = cipso_v4_gentag_loc(doi_def,
1786                                                    secattr,
1787                                                    &buf[CIPSO_V4_HDR_LEN],
1788                                                    buf_len - CIPSO_V4_HDR_LEN);
1789                         break;
1790                 default:
1791                         return -EPERM;
1792                 }
1793 
1794                 iter++;
1795         } while (ret_val < 0 &&
1796                  iter < CIPSO_V4_TAG_MAXCNT &&
1797                  doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
1798         if (ret_val < 0)
1799                 return ret_val;
1800         cipso_v4_gentag_hdr(doi_def, buf, ret_val);
1801         return CIPSO_V4_HDR_LEN + ret_val;
1802 }
1803 
1804 /**
1805  * cipso_v4_sock_setattr - Add a CIPSO option to a socket
1806  * @sk: the socket
1807  * @doi_def: the CIPSO DOI to use
1808  * @secattr: the specific security attributes of the socket
1809  *
1810  * Description:
1811  * Set the CIPSO option on the given socket using the DOI definition and
1812  * security attributes passed to the function.  This function requires
1813  * exclusive access to @sk, which means it either needs to be in the
1814  * process of being created or locked.  Returns zero on success and negative
1815  * values on failure.
1816  *
1817  */
1818 int cipso_v4_sock_setattr(struct sock *sk,
1819                           const struct cipso_v4_doi *doi_def,
1820                           const struct netlbl_lsm_secattr *secattr)
1821 {
1822         int ret_val = -EPERM;
1823         unsigned char *buf = NULL;
1824         u32 buf_len;
1825         u32 opt_len;
1826         struct ip_options_rcu *old, *opt = NULL;
1827         struct inet_sock *sk_inet;
1828         struct inet_connection_sock *sk_conn;
1829 
1830         /* In the case of sock_create_lite(), the sock->sk field is not
1831          * defined yet but it is not a problem as the only users of these
1832          * "lite" PF_INET sockets are functions which do an accept() call
1833          * afterwards so we will label the socket as part of the accept(). */
1834         if (!sk)
1835                 return 0;
1836 
1837         /* We allocate the maximum CIPSO option size here so we are probably
1838          * being a little wasteful, but it makes our life _much_ easier later
1839          * on and after all we are only talking about 40 bytes. */
1840         buf_len = CIPSO_V4_OPT_LEN_MAX;
1841         buf = kmalloc(buf_len, GFP_ATOMIC);
1842         if (!buf) {
1843                 ret_val = -ENOMEM;
1844                 goto socket_setattr_failure;
1845         }
1846 
1847         ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1848         if (ret_val < 0)
1849                 goto socket_setattr_failure;
1850         buf_len = ret_val;
1851 
1852         /* We can't use ip_options_get() directly because it makes a call to
1853          * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1854          * we won't always have CAP_NET_RAW even though we _always_ want to
1855          * set the IPOPT_CIPSO option. */
1856         opt_len = (buf_len + 3) & ~3;
1857         opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1858         if (!opt) {
1859                 ret_val = -ENOMEM;
1860                 goto socket_setattr_failure;
1861         }
1862         memcpy(opt->opt.__data, buf, buf_len);
1863         opt->opt.optlen = opt_len;
1864         opt->opt.cipso = sizeof(struct iphdr);
1865         kfree(buf);
1866         buf = NULL;
1867 
1868         sk_inet = inet_sk(sk);
1869 
1870         old = rcu_dereference_protected(sk_inet->inet_opt,
1871                                         lockdep_sock_is_held(sk));
1872         if (sk_inet->is_icsk) {
1873                 sk_conn = inet_csk(sk);
1874                 if (old)
1875                         sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
1876                 sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
1877                 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1878         }
1879         rcu_assign_pointer(sk_inet->inet_opt, opt);
1880         if (old)
1881                 kfree_rcu(old, rcu);
1882 
1883         return 0;
1884 
1885 socket_setattr_failure:
1886         kfree(buf);
1887         kfree(opt);
1888         return ret_val;
1889 }
1890 
1891 /**
1892  * cipso_v4_req_setattr - Add a CIPSO option to a connection request socket
1893  * @req: the connection request socket
1894  * @doi_def: the CIPSO DOI to use
1895  * @secattr: the specific security attributes of the socket
1896  *
1897  * Description:
1898  * Set the CIPSO option on the given socket using the DOI definition and
1899  * security attributes passed to the function.  Returns zero on success and
1900  * negative values on failure.
1901  *
1902  */
1903 int cipso_v4_req_setattr(struct request_sock *req,
1904                          const struct cipso_v4_doi *doi_def,
1905                          const struct netlbl_lsm_secattr *secattr)
1906 {
1907         int ret_val = -EPERM;
1908         unsigned char *buf = NULL;
1909         u32 buf_len;
1910         u32 opt_len;
1911         struct ip_options_rcu *opt = NULL;
1912         struct inet_request_sock *req_inet;
1913 
1914         /* We allocate the maximum CIPSO option size here so we are probably
1915          * being a little wasteful, but it makes our life _much_ easier later
1916          * on and after all we are only talking about 40 bytes. */
1917         buf_len = CIPSO_V4_OPT_LEN_MAX;
1918         buf = kmalloc(buf_len, GFP_ATOMIC);
1919         if (!buf) {
1920                 ret_val = -ENOMEM;
1921                 goto req_setattr_failure;
1922         }
1923 
1924         ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1925         if (ret_val < 0)
1926                 goto req_setattr_failure;
1927         buf_len = ret_val;
1928 
1929         /* We can't use ip_options_get() directly because it makes a call to
1930          * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1931          * we won't always have CAP_NET_RAW even though we _always_ want to
1932          * set the IPOPT_CIPSO option. */
1933         opt_len = (buf_len + 3) & ~3;
1934         opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1935         if (!opt) {
1936                 ret_val = -ENOMEM;
1937                 goto req_setattr_failure;
1938         }
1939         memcpy(opt->opt.__data, buf, buf_len);
1940         opt->opt.optlen = opt_len;
1941         opt->opt.cipso = sizeof(struct iphdr);
1942         kfree(buf);
1943         buf = NULL;
1944 
1945         req_inet = inet_rsk(req);
1946         opt = xchg(&req_inet->opt, opt);
1947         if (opt)
1948                 kfree_rcu(opt, rcu);
1949 
1950         return 0;
1951 
1952 req_setattr_failure:
1953         kfree(buf);
1954         kfree(opt);
1955         return ret_val;
1956 }
1957 
1958 /**
1959  * cipso_v4_delopt - Delete the CIPSO option from a set of IP options
1960  * @opt_ptr: IP option pointer
1961  *
1962  * Description:
1963  * Deletes the CIPSO IP option from a set of IP options and makes the necessary
1964  * adjustments to the IP option structure.  Returns zero on success, negative
1965  * values on failure.
1966  *
1967  */
1968 static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
1969 {
1970         int hdr_delta = 0;
1971         struct ip_options_rcu *opt = *opt_ptr;
1972 
1973         if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
1974                 u8 cipso_len;
1975                 u8 cipso_off;
1976                 unsigned char *cipso_ptr;
1977                 int iter;
1978                 int optlen_new;
1979 
1980                 cipso_off = opt->opt.cipso - sizeof(struct iphdr);
1981                 cipso_ptr = &opt->opt.__data[cipso_off];
1982                 cipso_len = cipso_ptr[1];
1983 
1984                 if (opt->opt.srr > opt->opt.cipso)
1985                         opt->opt.srr -= cipso_len;
1986                 if (opt->opt.rr > opt->opt.cipso)
1987                         opt->opt.rr -= cipso_len;
1988                 if (opt->opt.ts > opt->opt.cipso)
1989                         opt->opt.ts -= cipso_len;
1990                 if (opt->opt.router_alert > opt->opt.cipso)
1991                         opt->opt.router_alert -= cipso_len;
1992                 opt->opt.cipso = 0;
1993 
1994                 memmove(cipso_ptr, cipso_ptr + cipso_len,
1995                         opt->opt.optlen - cipso_off - cipso_len);
1996 
1997                 /* determining the new total option length is tricky because of
1998                  * the padding necessary, the only thing i can think to do at
1999                  * this point is walk the options one-by-one, skipping the
2000                  * padding at the end to determine the actual option size and
2001                  * from there we can determine the new total option length */
2002                 iter = 0;
2003                 optlen_new = 0;
2004                 while (iter < opt->opt.optlen)
2005                         if (opt->opt.__data[iter] != IPOPT_NOP) {
2006                                 iter += opt->opt.__data[iter + 1];
2007                                 optlen_new = iter;
2008                         } else
2009                                 iter++;
2010                 hdr_delta = opt->opt.optlen;
2011                 opt->opt.optlen = (optlen_new + 3) & ~3;
2012                 hdr_delta -= opt->opt.optlen;
2013         } else {
2014                 /* only the cipso option was present on the socket so we can
2015                  * remove the entire option struct */
2016                 *opt_ptr = NULL;
2017                 hdr_delta = opt->opt.optlen;
2018                 kfree_rcu(opt, rcu);
2019         }
2020 
2021         return hdr_delta;
2022 }
2023 
2024 /**
2025  * cipso_v4_sock_delattr - Delete the CIPSO option from a socket
2026  * @sk: the socket
2027  *
2028  * Description:
2029  * Removes the CIPSO option from a socket, if present.
2030  *
2031  */
2032 void cipso_v4_sock_delattr(struct sock *sk)
2033 {
2034         int hdr_delta;
2035         struct ip_options_rcu *opt;
2036         struct inet_sock *sk_inet;
2037 
2038         sk_inet = inet_sk(sk);
2039         opt = rcu_dereference_protected(sk_inet->inet_opt, 1);
2040         if (!opt || opt->opt.cipso == 0)
2041                 return;
2042 
2043         hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
2044         if (sk_inet->is_icsk && hdr_delta > 0) {
2045                 struct inet_connection_sock *sk_conn = inet_csk(sk);
2046                 sk_conn->icsk_ext_hdr_len -= hdr_delta;
2047                 sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
2048         }
2049 }
2050 
2051 /**
2052  * cipso_v4_req_delattr - Delete the CIPSO option from a request socket
2053  * @reg: the request socket
2054  *
2055  * Description:
2056  * Removes the CIPSO option from a request socket, if present.
2057  *
2058  */
2059 void cipso_v4_req_delattr(struct request_sock *req)
2060 {
2061         struct ip_options_rcu *opt;
2062         struct inet_request_sock *req_inet;
2063 
2064         req_inet = inet_rsk(req);
2065         opt = req_inet->opt;
2066         if (!opt || opt->opt.cipso == 0)
2067                 return;
2068 
2069         cipso_v4_delopt(&req_inet->opt);
2070 }
2071 
2072 /**
2073  * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
2074  * @cipso: the CIPSO v4 option
2075  * @secattr: the security attributes
2076  *
2077  * Description:
2078  * Inspect @cipso and return the security attributes in @secattr.  Returns zero
2079  * on success and negative values on failure.
2080  *
2081  */
2082 int cipso_v4_getattr(const unsigned char *cipso,
2083                      struct netlbl_lsm_secattr *secattr)
2084 {
2085         int ret_val = -ENOMSG;
2086         u32 doi;
2087         struct cipso_v4_doi *doi_def;
2088 
2089         if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0)
2090                 return 0;
2091 
2092         doi = get_unaligned_be32(&cipso[2]);
2093         rcu_read_lock();
2094         doi_def = cipso_v4_doi_search(doi);
2095         if (!doi_def)
2096                 goto getattr_return;
2097         /* XXX - This code assumes only one tag per CIPSO option which isn't
2098          * really a good assumption to make but since we only support the MAC
2099          * tags right now it is a safe assumption. */
2100         switch (cipso[6]) {
2101         case CIPSO_V4_TAG_RBITMAP:
2102                 ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr);
2103                 break;
2104         case CIPSO_V4_TAG_ENUM:
2105                 ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr);
2106                 break;
2107         case CIPSO_V4_TAG_RANGE:
2108                 ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr);
2109                 break;
2110         case CIPSO_V4_TAG_LOCAL:
2111                 ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr);
2112                 break;
2113         }
2114         if (ret_val == 0)
2115                 secattr->type = NETLBL_NLTYPE_CIPSOV4;
2116 
2117 getattr_return:
2118         rcu_read_unlock();
2119         return ret_val;
2120 }
2121 
2122 /**
2123  * cipso_v4_sock_getattr - Get the security attributes from a sock
2124  * @sk: the sock
2125  * @secattr: the security attributes
2126  *
2127  * Description:
2128  * Query @sk to see if there is a CIPSO option attached to the sock and if
2129  * there is return the CIPSO security attributes in @secattr.  This function
2130  * requires that @sk be locked, or privately held, but it does not do any
2131  * locking itself.  Returns zero on success and negative values on failure.
2132  *
2133  */
2134 int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
2135 {
2136         struct ip_options_rcu *opt;
2137         int res = -ENOMSG;
2138 
2139         rcu_read_lock();
2140         opt = rcu_dereference(inet_sk(sk)->inet_opt);
2141         if (opt && opt->opt.cipso)
2142                 res = cipso_v4_getattr(opt->opt.__data +
2143                                                 opt->opt.cipso -
2144                                                 sizeof(struct iphdr),
2145                                        secattr);
2146         rcu_read_unlock();
2147         return res;
2148 }
2149 
2150 /**
2151  * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
2152  * @skb: the packet
2153  * @secattr: the security attributes
2154  *
2155  * Description:
2156  * Set the CIPSO option on the given packet based on the security attributes.
2157  * Returns a pointer to the IP header on success and NULL on failure.
2158  *
2159  */
2160 int cipso_v4_skbuff_setattr(struct sk_buff *skb,
2161                             const struct cipso_v4_doi *doi_def,
2162                             const struct netlbl_lsm_secattr *secattr)
2163 {
2164         int ret_val;
2165         struct iphdr *iph;
2166         struct ip_options *opt = &IPCB(skb)->opt;
2167         unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
2168         u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
2169         u32 opt_len;
2170         int len_delta;
2171 
2172         ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
2173         if (ret_val < 0)
2174                 return ret_val;
2175         buf_len = ret_val;
2176         opt_len = (buf_len + 3) & ~3;
2177 
2178         /* we overwrite any existing options to ensure that we have enough
2179          * room for the CIPSO option, the reason is that we _need_ to guarantee
2180          * that the security label is applied to the packet - we do the same
2181          * thing when using the socket options and it hasn't caused a problem,
2182          * if we need to we can always revisit this choice later */
2183 
2184         len_delta = opt_len - opt->optlen;
2185         /* if we don't ensure enough headroom we could panic on the skb_push()
2186          * call below so make sure we have enough, we are also "mangling" the
2187          * packet so we should probably do a copy-on-write call anyway */
2188         ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
2189         if (ret_val < 0)
2190                 return ret_val;
2191 
2192         if (len_delta > 0) {
2193                 /* we assume that the header + opt->optlen have already been
2194                  * "pushed" in ip_options_build() or similar */
2195                 iph = ip_hdr(skb);
2196                 skb_push(skb, len_delta);
2197                 memmove((char *)iph - len_delta, iph, iph->ihl << 2);
2198                 skb_reset_network_header(skb);
2199                 iph = ip_hdr(skb);
2200         } else if (len_delta < 0) {
2201                 iph = ip_hdr(skb);
2202                 memset(iph + 1, IPOPT_NOP, opt->optlen);
2203         } else
2204                 iph = ip_hdr(skb);
2205 
2206         if (opt->optlen > 0)
2207                 memset(opt, 0, sizeof(*opt));
2208         opt->optlen = opt_len;
2209         opt->cipso = sizeof(struct iphdr);
2210         opt->is_changed = 1;
2211 
2212         /* we have to do the following because we are being called from a
2213          * netfilter hook which means the packet already has had the header
2214          * fields populated and the checksum calculated - yes this means we
2215          * are doing more work than needed but we do it to keep the core
2216          * stack clean and tidy */
2217         memcpy(iph + 1, buf, buf_len);
2218         if (opt_len > buf_len)
2219                 memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
2220         if (len_delta != 0) {
2221                 iph->ihl = 5 + (opt_len >> 2);
2222                 iph->tot_len = htons(skb->len);
2223         }
2224         ip_send_check(iph);
2225 
2226         return 0;
2227 }
2228 
2229 /**
2230  * cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet
2231  * @skb: the packet
2232  *
2233  * Description:
2234  * Removes any and all CIPSO options from the given packet.  Returns zero on
2235  * success, negative values on failure.
2236  *
2237  */
2238 int cipso_v4_skbuff_delattr(struct sk_buff *skb)
2239 {
2240         int ret_val;
2241         struct iphdr *iph;
2242         struct ip_options *opt = &IPCB(skb)->opt;
2243         unsigned char *cipso_ptr;
2244 
2245         if (opt->cipso == 0)
2246                 return 0;
2247 
2248         /* since we are changing the packet we should make a copy */
2249         ret_val = skb_cow(skb, skb_headroom(skb));
2250         if (ret_val < 0)
2251                 return ret_val;
2252 
2253         /* the easiest thing to do is just replace the cipso option with noop
2254          * options since we don't change the size of the packet, although we
2255          * still need to recalculate the checksum */
2256 
2257         iph = ip_hdr(skb);
2258         cipso_ptr = (unsigned char *)iph + opt->cipso;
2259         memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
2260         opt->cipso = 0;
2261         opt->is_changed = 1;
2262 
2263         ip_send_check(iph);
2264 
2265         return 0;
2266 }
2267 
2268 /*
2269  * Setup Functions
2270  */
2271 
2272 /**
2273  * cipso_v4_init - Initialize the CIPSO module
2274  *
2275  * Description:
2276  * Initialize the CIPSO module and prepare it for use.  Returns zero on success
2277  * and negative values on failure.
2278  *
2279  */
2280 static int __init cipso_v4_init(void)
2281 {
2282         int ret_val;
2283 
2284         ret_val = cipso_v4_cache_init();
2285         if (ret_val != 0)
2286                 panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
2287                       ret_val);
2288 
2289         return 0;
2290 }
2291 
2292 subsys_initcall(cipso_v4_init);
2293 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp