net/netlabel/netlabel_addrlist.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * NetLabel Network Address Lists
   4  *
   5  * This file contains network address list functions used to manage ordered
   6  * lists of network addresses for use by the NetLabel subsystem.  The NetLabel
   7  * system manages static and dynamic label mappings for network protocols such
   8  * as CIPSO and RIPSO.
   9  *
  10  * Author: Paul Moore <paul@paul-moore.com>
  11  */
  12
  13 /*
  14  * (c) Copyright Hewlett-Packard Development Company, L.P., 2008
  15  */
  16
  17 #include <linux/types.h>
  18 #include <linux/rcupdate.h>
  19 #include <linux/list.h>
  20 #include <linux/spinlock.h>
  21 #include <linux/in.h>
  22 #include <linux/in6.h>
  23 #include <linux/ip.h>
  24 #include <linux/ipv6.h>
  25 #include <net/ip.h>
  26 #include <net/ipv6.h>
  27 #include <linux/audit.h>
  28
  29 #include "netlabel_addrlist.h"
  30
  31 /*
  32  * Address List Functions
  33  */
  34
  35 /**
  36  * netlbl_af4list_search - Search for a matching IPv4 address entry
  37  * @addr: IPv4 address
  38  * @head: the list head
  39  *
  40  * Description:
  41  * Searches the IPv4 address list given by @head.  If a matching address entry
  42  * is found it is returned, otherwise NULL is returned.  The caller is
  43  * responsible for calling the rcu_read_[un]lock() functions.
  44  *
  45  */
  46 struct netlbl_af4list *netlbl_af4list_search(__be32 addr,
  47                                              struct list_head *head)
  48 {
  49         struct netlbl_af4list *iter;
  50
  51         list_for_each_entry_rcu(iter, head, list)
  52                 if (iter->valid && (addr & iter->mask) == iter->addr)
  53                         return iter;
  54
  55         return NULL;
  56 }
  57
  58 /**
  59  * netlbl_af4list_search_exact - Search for an exact IPv4 address entry
  60  * @addr: IPv4 address
  61  * @mask: IPv4 address mask
  62  * @head: the list head
  63  *
  64  * Description:
  65  * Searches the IPv4 address list given by @head.  If an exact match if found
  66  * it is returned, otherwise NULL is returned.  The caller is responsible for
  67  * calling the rcu_read_[un]lock() functions.
  68  *
  69  */
  70 struct netlbl_af4list *netlbl_af4list_search_exact(__be32 addr,
  71                                                    __be32 mask,
  72                                                    struct list_head *head)
  73 {
  74         struct netlbl_af4list *iter;
  75
  76         list_for_each_entry_rcu(iter, head, list)
  77                 if (iter->valid && iter->addr == addr && iter->mask == mask)
  78                         return iter;
  79
  80         return NULL;
  81 }
  82
  83
  84 #if IS_ENABLED(CONFIG_IPV6)
  85 /**
  86  * netlbl_af6list_search - Search for a matching IPv6 address entry
  87  * @addr: IPv6 address
  88  * @head: the list head
  89  *
  90  * Description:
  91  * Searches the IPv6 address list given by @head.  If a matching address entry
  92  * is found it is returned, otherwise NULL is returned.  The caller is
  93  * responsible for calling the rcu_read_[un]lock() functions.
  94  *
  95  */
  96 struct netlbl_af6list *netlbl_af6list_search(const struct in6_addr *addr,
  97                                              struct list_head *head)
  98 {
  99         struct netlbl_af6list *iter;
 100
 101         list_for_each_entry_rcu(iter, head, list)
 102                 if (iter->valid &&
 103                     ipv6_masked_addr_cmp(&iter->addr, &iter->mask, addr) == 0)
 104                         return iter;
 105
 106         return NULL;
 107 }
 108
 109 /**
 110  * netlbl_af6list_search_exact - Search for an exact IPv6 address entry
 111  * @addr: IPv6 address
 112  * @mask: IPv6 address mask
 113  * @head: the list head
 114  *
 115  * Description:
 116  * Searches the IPv6 address list given by @head.  If an exact match if found
 117  * it is returned, otherwise NULL is returned.  The caller is responsible for
 118  * calling the rcu_read_[un]lock() functions.
 119  *
 120  */
 121 struct netlbl_af6list *netlbl_af6list_search_exact(const struct in6_addr *addr,
 122                                                    const struct in6_addr *mask,
 123                                                    struct list_head *head)
 124 {
 125         struct netlbl_af6list *iter;
 126
 127         list_for_each_entry_rcu(iter, head, list)
 128                 if (iter->valid &&
 129                     ipv6_addr_equal(&iter->addr, addr) &&
 130                     ipv6_addr_equal(&iter->mask, mask))
 131                         return iter;
 132
 133         return NULL;
 134 }
 135 #endif /* IPv6 */
 136
 137 /**
 138  * netlbl_af4list_add - Add a new IPv4 address entry to a list
 139  * @entry: address entry
 140  * @head: the list head
 141  *
 142  * Description:
 143  * Add a new address entry to the list pointed to by @head.  On success zero is
 144  * returned, otherwise a negative value is returned.  The caller is responsible
 145  * for calling the necessary locking functions.
 146  *
 147  */
 148 int netlbl_af4list_add(struct netlbl_af4list *entry, struct list_head *head)
 149 {
 150         struct netlbl_af4list *iter;
 151
 152         iter = netlbl_af4list_search(entry->addr, head);
 153         if (iter != NULL &&
 154             iter->addr == entry->addr && iter->mask == entry->mask)
 155                 return -EEXIST;
 156
 157         /* in order to speed up address searches through the list (the common
 158          * case) we need to keep the list in order based on the size of the
 159          * address mask such that the entry with the widest mask (smallest
 160          * numerical value) appears first in the list */
 161         list_for_each_entry_rcu(iter, head, list)
 162                 if (iter->valid &&
 163                     ntohl(entry->mask) > ntohl(iter->mask)) {
 164                         __list_add_rcu(&entry->list,
 165                                        iter->list.prev,
 166                                        &iter->list);
 167                         return 0;
 168                 }
 169         list_add_tail_rcu(&entry->list, head);
 170         return 0;
 171 }
 172
 173 #if IS_ENABLED(CONFIG_IPV6)
 174 /**
 175  * netlbl_af6list_add - Add a new IPv6 address entry to a list
 176  * @entry: address entry
 177  * @head: the list head
 178  *
 179  * Description:
 180  * Add a new address entry to the list pointed to by @head.  On success zero is
 181  * returned, otherwise a negative value is returned.  The caller is responsible
 182  * for calling the necessary locking functions.
 183  *
 184  */
 185 int netlbl_af6list_add(struct netlbl_af6list *entry, struct list_head *head)
 186 {
 187         struct netlbl_af6list *iter;
 188
 189         iter = netlbl_af6list_search(&entry->addr, head);
 190         if (iter != NULL &&
 191             ipv6_addr_equal(&iter->addr, &entry->addr) &&
 192             ipv6_addr_equal(&iter->mask, &entry->mask))
 193                 return -EEXIST;
 194
 195         /* in order to speed up address searches through the list (the common
 196          * case) we need to keep the list in order based on the size of the
 197          * address mask such that the entry with the widest mask (smallest
 198          * numerical value) appears first in the list */
 199         list_for_each_entry_rcu(iter, head, list)
 200                 if (iter->valid &&
 201                     ipv6_addr_cmp(&entry->mask, &iter->mask) > 0) {
 202                         __list_add_rcu(&entry->list,
 203                                        iter->list.prev,
 204                                        &iter->list);
 205                         return 0;
 206                 }
 207         list_add_tail_rcu(&entry->list, head);
 208         return 0;
 209 }
 210 #endif /* IPv6 */
 211
 212 /**
 213  * netlbl_af4list_remove_entry - Remove an IPv4 address entry
 214  * @entry: address entry
 215  *
 216  * Description:
 217  * Remove the specified IP address entry.  The caller is responsible for
 218  * calling the necessary locking functions.
 219  *
 220  */
 221 void netlbl_af4list_remove_entry(struct netlbl_af4list *entry)
 222 {
 223         entry->valid = 0;
 224         list_del_rcu(&entry->list);
 225 }
 226
 227 /**
 228  * netlbl_af4list_remove - Remove an IPv4 address entry
 229  * @addr: IP address
 230  * @mask: IP address mask
 231  * @head: the list head
 232  *
 233  * Description:
 234  * Remove an IP address entry from the list pointed to by @head.  Returns the
 235  * entry on success, NULL on failure.  The caller is responsible for calling
 236  * the necessary locking functions.
 237  *
 238  */
 239 struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,
 240                                              struct list_head *head)
 241 {
 242         struct netlbl_af4list *entry;
 243
 244         entry = netlbl_af4list_search_exact(addr, mask, head);
 245         if (entry == NULL)
 246                 return NULL;
 247         netlbl_af4list_remove_entry(entry);
 248         return entry;
 249 }
 250
 251 #if IS_ENABLED(CONFIG_IPV6)
 252 /**
 253  * netlbl_af6list_remove_entry - Remove an IPv6 address entry
 254  * @entry: address entry
 255  *
 256  * Description:
 257  * Remove the specified IP address entry.  The caller is responsible for
 258  * calling the necessary locking functions.
 259  *
 260  */
 261 void netlbl_af6list_remove_entry(struct netlbl_af6list *entry)
 262 {
 263         entry->valid = 0;
 264         list_del_rcu(&entry->list);
 265 }
 266
 267 /**
 268  * netlbl_af6list_remove - Remove an IPv6 address entry
 269  * @addr: IP address
 270  * @mask: IP address mask
 271  * @head: the list head
 272  *
 273  * Description:
 274  * Remove an IP address entry from the list pointed to by @head.  Returns the
 275  * entry on success, NULL on failure.  The caller is responsible for calling
 276  * the necessary locking functions.
 277  *
 278  */
 279 struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,
 280                                              const struct in6_addr *mask,
 281                                              struct list_head *head)
 282 {
 283         struct netlbl_af6list *entry;
 284
 285         entry = netlbl_af6list_search_exact(addr, mask, head);
 286         if (entry == NULL)
 287                 return NULL;
 288         netlbl_af6list_remove_entry(entry);
 289         return entry;
 290 }
 291 #endif /* IPv6 */
 292
 293 /*
 294  * Audit Helper Functions
 295  */
 296
 297 #ifdef CONFIG_AUDIT
 298 /**
 299  * netlbl_af4list_audit_addr - Audit an IPv4 address
 300  * @audit_buf: audit buffer
 301  * @src: true if source address, false if destination
 302  * @dev: network interface
 303  * @addr: IP address
 304  * @mask: IP address mask
 305  *
 306  * Description:
 307  * Write the IPv4 address and address mask, if necessary, to @audit_buf.
 308  *
 309  */
 310 void netlbl_af4list_audit_addr(struct audit_buffer *audit_buf,
 311                                         int src, const char *dev,
 312                                         __be32 addr, __be32 mask)
 313 {
 314         u32 mask_val = ntohl(mask);
 315         char *dir = (src ? "src" : "dst");
 316
 317         if (dev != NULL)
 318                 audit_log_format(audit_buf, " netif=%s", dev);
 319         audit_log_format(audit_buf, " %s=%pI4", dir, &addr);
 320         if (mask_val != 0xffffffff) {
 321                 u32 mask_len = 0;
 322                 while (mask_val > 0) {
 323                         mask_val <<= 1;
 324                         mask_len++;
 325                 }
 326                 audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
 327         }
 328 }
 329
 330 #if IS_ENABLED(CONFIG_IPV6)
 331 /**
 332  * netlbl_af6list_audit_addr - Audit an IPv6 address
 333  * @audit_buf: audit buffer
 334  * @src: true if source address, false if destination
 335  * @dev: network interface
 336  * @addr: IP address
 337  * @mask: IP address mask
 338  *
 339  * Description:
 340  * Write the IPv6 address and address mask, if necessary, to @audit_buf.
 341  *
 342  */
 343 void netlbl_af6list_audit_addr(struct audit_buffer *audit_buf,
 344                                  int src,
 345                                  const char *dev,
 346                                  const struct in6_addr *addr,
 347                                  const struct in6_addr *mask)
 348 {
 349         char *dir = (src ? "src" : "dst");
 350
 351         if (dev != NULL)
 352                 audit_log_format(audit_buf, " netif=%s", dev);
 353         audit_log_format(audit_buf, " %s=%pI6", dir, addr);
 354         if (ntohl(mask->s6_addr32[3]) != 0xffffffff) {
 355                 u32 mask_len = 0;
 356                 u32 mask_val;
 357                 int iter = -1;
 358                 while (ntohl(mask->s6_addr32[++iter]) == 0xffffffff)
 359                         mask_len += 32;
 360                 mask_val = ntohl(mask->s6_addr32[iter]);
 361                 while (mask_val > 0) {
 362                         mask_val <<= 1;
 363                         mask_len++;
 364                 }
 365                 audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
 366         }
 367 }
 368 #endif /* IPv6 */
 369 #endif /* CONFIG_AUDIT */