security/selinux/netport.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * Network port table
   4  *
   5  * SELinux must keep a mapping of network ports to labels/SIDs.  This
   6  * mapping is maintained as part of the normal policy but a fast cache is
   7  * needed to reduce the lookup overhead.
   8  *
   9  * Author: Paul Moore <paul@paul-moore.com>
  10  *
  11  * This code is heavily based on the "netif" concept originally developed by
  12  * James Morris <jmorris@redhat.com>
  13  *   (see security/selinux/netif.c for more information)
  14  */
  15
  16 /*
  17  * (c) Copyright Hewlett-Packard Development Company, L.P., 2008
  18  */
  19
  20 #include <linux/types.h>
  21 #include <linux/rcupdate.h>
  22 #include <linux/list.h>
  23 #include <linux/slab.h>
  24 #include <linux/spinlock.h>
  25 #include <linux/in.h>
  26 #include <linux/in6.h>
  27 #include <linux/ip.h>
  28 #include <linux/ipv6.h>
  29 #include <net/ip.h>
  30 #include <net/ipv6.h>
  31
  32 #include "netport.h"
  33 #include "objsec.h"
  34
  35 #define SEL_NETPORT_HASH_SIZE       256
  36 #define SEL_NETPORT_HASH_BKT_LIMIT   16
  37
  38 struct sel_netport_bkt {
  39         int size;
  40         struct list_head list;
  41 };
  42
  43 struct sel_netport {
  44         struct netport_security_struct psec;
  45
  46         struct list_head list;
  47         struct rcu_head rcu;
  48 };
  49
  50 /* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason
  51  * for this is that I suspect most users will not make heavy use of both
  52  * address families at the same time so one table will usually end up wasted,
  53  * if this becomes a problem we can always add a hash table for each address
  54  * family later */
  55
  56 static LIST_HEAD(sel_netport_list);
  57 static DEFINE_SPINLOCK(sel_netport_lock);
  58 static struct sel_netport_bkt sel_netport_hash[SEL_NETPORT_HASH_SIZE];
  59
  60 /**
  61  * sel_netport_hashfn - Hashing function for the port table
  62  * @pnum: port number
  63  *
  64  * Description:
  65  * This is the hashing function for the port table, it returns the bucket
  66  * number for the given port.
  67  *
  68  */
  69 static unsigned int sel_netport_hashfn(u16 pnum)
  70 {
  71         return (pnum & (SEL_NETPORT_HASH_SIZE - 1));
  72 }
  73
  74 /**
  75  * sel_netport_find - Search for a port record
  76  * @protocol: protocol
  77  * @port: pnum
  78  *
  79  * Description:
  80  * Search the network port table and return the matching record.  If an entry
  81  * can not be found in the table return NULL.
  82  *
  83  */
  84 static struct sel_netport *sel_netport_find(u8 protocol, u16 pnum)
  85 {
  86         unsigned int idx;
  87         struct sel_netport *port;
  88
  89         idx = sel_netport_hashfn(pnum);
  90         list_for_each_entry_rcu(port, &sel_netport_hash[idx].list, list)
  91                 if (port->psec.port == pnum && port->psec.protocol == protocol)
  92                         return port;
  93
  94         return NULL;
  95 }
  96
  97 /**
  98  * sel_netport_insert - Insert a new port into the table
  99  * @port: the new port record
 100  *
 101  * Description:
 102  * Add a new port record to the network address hash table.
 103  *
 104  */
 105 static void sel_netport_insert(struct sel_netport *port)
 106 {
 107         unsigned int idx;
 108
 109         /* we need to impose a limit on the growth of the hash table so check
 110          * this bucket to make sure it is within the specified bounds */
 111         idx = sel_netport_hashfn(port->psec.port);
 112         list_add_rcu(&port->list, &sel_netport_hash[idx].list);
 113         if (sel_netport_hash[idx].size == SEL_NETPORT_HASH_BKT_LIMIT) {
 114                 struct sel_netport *tail;
 115                 tail = list_entry(
 116                         rcu_dereference_protected(
 117                                 sel_netport_hash[idx].list.prev,
 118                                 lockdep_is_held(&sel_netport_lock)),
 119                         struct sel_netport, list);
 120                 list_del_rcu(&tail->list);
 121                 kfree_rcu(tail, rcu);
 122         } else
 123                 sel_netport_hash[idx].size++;
 124 }
 125
 126 /**
 127  * sel_netport_sid_slow - Lookup the SID of a network address using the policy
 128  * @protocol: protocol
 129  * @pnum: port
 130  * @sid: port SID
 131  *
 132  * Description:
 133  * This function determines the SID of a network port by quering the security
 134  * policy.  The result is added to the network port table to speedup future
 135  * queries.  Returns zero on success, negative values on failure.
 136  *
 137  */
 138 static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid)
 139 {
 140         int ret = -ENOMEM;
 141         struct sel_netport *port;
 142         struct sel_netport *new = NULL;
 143
 144         spin_lock_bh(&sel_netport_lock);
 145         port = sel_netport_find(protocol, pnum);
 146         if (port != NULL) {
 147                 *sid = port->psec.sid;
 148                 spin_unlock_bh(&sel_netport_lock);
 149                 return 0;
 150         }
 151         new = kzalloc(sizeof(*new), GFP_ATOMIC);
 152         if (new == NULL)
 153                 goto out;
 154         ret = security_port_sid(&selinux_state, protocol, pnum, sid);
 155         if (ret != 0)
 156                 goto out;
 157
 158         new->psec.port = pnum;
 159         new->psec.protocol = protocol;
 160         new->psec.sid = *sid;
 161         sel_netport_insert(new);
 162
 163 out:
 164         spin_unlock_bh(&sel_netport_lock);
 165         if (unlikely(ret)) {
 166                 pr_warn("SELinux: failure in %s(), unable to determine network port label\n",
 167                         __func__);
 168                 kfree(new);
 169         }
 170         return ret;
 171 }
 172
 173 /**
 174  * sel_netport_sid - Lookup the SID of a network port
 175  * @protocol: protocol
 176  * @pnum: port
 177  * @sid: port SID
 178  *
 179  * Description:
 180  * This function determines the SID of a network port using the fastest method
 181  * possible.  First the port table is queried, but if an entry can't be found
 182  * then the policy is queried and the result is added to the table to speedup
 183  * future queries.  Returns zero on success, negative values on failure.
 184  *
 185  */
 186 int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid)
 187 {
 188         struct sel_netport *port;
 189
 190         rcu_read_lock();
 191         port = sel_netport_find(protocol, pnum);
 192         if (port != NULL) {
 193                 *sid = port->psec.sid;
 194                 rcu_read_unlock();
 195                 return 0;
 196         }
 197         rcu_read_unlock();
 198
 199         return sel_netport_sid_slow(protocol, pnum, sid);
 200 }
 201
 202 /**
 203  * sel_netport_flush - Flush the entire network port table
 204  *
 205  * Description:
 206  * Remove all entries from the network address table.
 207  *
 208  */
 209 void sel_netport_flush(void)
 210 {
 211         unsigned int idx;
 212         struct sel_netport *port, *port_tmp;
 213
 214         spin_lock_bh(&sel_netport_lock);
 215         for (idx = 0; idx < SEL_NETPORT_HASH_SIZE; idx++) {
 216                 list_for_each_entry_safe(port, port_tmp,
 217                                          &sel_netport_hash[idx].list, list) {
 218                         list_del_rcu(&port->list);
 219                         kfree_rcu(port, rcu);
 220                 }
 221                 sel_netport_hash[idx].size = 0;
 222         }
 223         spin_unlock_bh(&sel_netport_lock);
 224 }
 225
 226 static __init int sel_netport_init(void)
 227 {
 228         int iter;
 229
 230         if (!selinux_enabled)
 231                 return 0;
 232
 233         for (iter = 0; iter < SEL_NETPORT_HASH_SIZE; iter++) {
 234                 INIT_LIST_HEAD(&sel_netport_hash[iter].list);
 235                 sel_netport_hash[iter].size = 0;
 236         }
 237
 238         return 0;
 239 }
 240
 241 __initcall(sel_netport_init);