net/netlabel/netlabel_addrlist.c

   1 /*
   2  * NetLabel Network Address Lists
   3  *
   4  * This file contains network address list functions used to manage ordered
   5  * lists of network addresses for use by the NetLabel subsystem.  The NetLabel
   6  * system manages static and dynamic label mappings for network protocols such
   7  * as CIPSO and RIPSO.
   8  *
   9  * Author: Paul Moore <paul@paul-moore.com>
  10  *
  11  */
  12
  13 /*
  14  * (c) Copyright Hewlett-Packard Development Company, L.P., 2008
  15  *
  16  * This program is free software;  you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License as published by
  18  * the Free Software Foundation; either version 2 of the License, or
  19  * (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  24  * the GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  28  *
  29  */
  30
  31 #include <linux/types.h>
  32 #include <linux/rcupdate.h>
  33 #include <linux/list.h>
  34 #include <linux/spinlock.h>
  35 #include <linux/in.h>
  36 #include <linux/in6.h>
  37 #include <linux/ip.h>
  38 #include <linux/ipv6.h>
  39 #include <net/ip.h>
  40 #include <net/ipv6.h>
  41 #include <linux/audit.h>
  42
  43 #include "netlabel_addrlist.h"
  44
  45 /*
  46  * Address List Functions
  47  */
  48
  49 /**
  50  * netlbl_af4list_search - Search for a matching IPv4 address entry
  51  * @addr: IPv4 address
  52  * @head: the list head
  53  *
  54  * Description:
  55  * Searches the IPv4 address list given by @head.  If a matching address entry
  56  * is found it is returned, otherwise NULL is returned.  The caller is
  57  * responsible for calling the rcu_read_[un]lock() functions.
  58  *
  59  */
  60 struct netlbl_af4list *netlbl_af4list_search(__be32 addr,
  61                                              struct list_head *head)
  62 {
  63         struct netlbl_af4list *iter;
  64
  65         list_for_each_entry_rcu(iter, head, list)
  66                 if (iter->valid && (addr & iter->mask) == iter->addr)
  67                         return iter;
  68
  69         return NULL;
  70 }
  71
  72 /**
  73  * netlbl_af4list_search_exact - Search for an exact IPv4 address entry
  74  * @addr: IPv4 address
  75  * @mask: IPv4 address mask
  76  * @head: the list head
  77  *
  78  * Description:
  79  * Searches the IPv4 address list given by @head.  If an exact match if found
  80  * it is returned, otherwise NULL is returned.  The caller is responsible for
  81  * calling the rcu_read_[un]lock() functions.
  82  *
  83  */
  84 struct netlbl_af4list *netlbl_af4list_search_exact(__be32 addr,
  85                                                    __be32 mask,
  86                                                    struct list_head *head)
  87 {
  88         struct netlbl_af4list *iter;
  89
  90         list_for_each_entry_rcu(iter, head, list)
  91                 if (iter->valid && iter->addr == addr && iter->mask == mask)
  92                         return iter;
  93
  94         return NULL;
  95 }
  96
  97
  98 #if IS_ENABLED(CONFIG_IPV6)
  99 /**
 100  * netlbl_af6list_search - Search for a matching IPv6 address entry
 101  * @addr: IPv6 address
 102  * @head: the list head
 103  *
 104  * Description:
 105  * Searches the IPv6 address list given by @head.  If a matching address entry
 106  * is found it is returned, otherwise NULL is returned.  The caller is
 107  * responsible for calling the rcu_read_[un]lock() functions.
 108  *
 109  */
 110 struct netlbl_af6list *netlbl_af6list_search(const struct in6_addr *addr,
 111                                              struct list_head *head)
 112 {
 113         struct netlbl_af6list *iter;
 114
 115         list_for_each_entry_rcu(iter, head, list)
 116                 if (iter->valid &&
 117                     ipv6_masked_addr_cmp(&iter->addr, &iter->mask, addr) == 0)
 118                         return iter;
 119
 120         return NULL;
 121 }
 122
 123 /**
 124  * netlbl_af6list_search_exact - Search for an exact IPv6 address entry
 125  * @addr: IPv6 address
 126  * @mask: IPv6 address mask
 127  * @head: the list head
 128  *
 129  * Description:
 130  * Searches the IPv6 address list given by @head.  If an exact match if found
 131  * it is returned, otherwise NULL is returned.  The caller is responsible for
 132  * calling the rcu_read_[un]lock() functions.
 133  *
 134  */
 135 struct netlbl_af6list *netlbl_af6list_search_exact(const struct in6_addr *addr,
 136                                                    const struct in6_addr *mask,
 137                                                    struct list_head *head)
 138 {
 139         struct netlbl_af6list *iter;
 140
 141         list_for_each_entry_rcu(iter, head, list)
 142                 if (iter->valid &&
 143                     ipv6_addr_equal(&iter->addr, addr) &&
 144                     ipv6_addr_equal(&iter->mask, mask))
 145                         return iter;
 146
 147         return NULL;
 148 }
 149 #endif /* IPv6 */
 150
 151 /**
 152  * netlbl_af4list_add - Add a new IPv4 address entry to a list
 153  * @entry: address entry
 154  * @head: the list head
 155  *
 156  * Description:
 157  * Add a new address entry to the list pointed to by @head.  On success zero is
 158  * returned, otherwise a negative value is returned.  The caller is responsible
 159  * for calling the necessary locking functions.
 160  *
 161  */
 162 int netlbl_af4list_add(struct netlbl_af4list *entry, struct list_head *head)
 163 {
 164         struct netlbl_af4list *iter;
 165
 166         iter = netlbl_af4list_search(entry->addr, head);
 167         if (iter != NULL &&
 168             iter->addr == entry->addr && iter->mask == entry->mask)
 169                 return -EEXIST;
 170
 171         /* in order to speed up address searches through the list (the common
 172          * case) we need to keep the list in order based on the size of the
 173          * address mask such that the entry with the widest mask (smallest
 174          * numerical value) appears first in the list */
 175         list_for_each_entry_rcu(iter, head, list)
 176                 if (iter->valid &&
 177                     ntohl(entry->mask) > ntohl(iter->mask)) {
 178                         __list_add_rcu(&entry->list,
 179                                        iter->list.prev,
 180                                        &iter->list);
 181                         return 0;
 182                 }
 183         list_add_tail_rcu(&entry->list, head);
 184         return 0;
 185 }
 186
 187 #if IS_ENABLED(CONFIG_IPV6)
 188 /**
 189  * netlbl_af6list_add - Add a new IPv6 address entry to a list
 190  * @entry: address entry
 191  * @head: the list head
 192  *
 193  * Description:
 194  * Add a new address entry to the list pointed to by @head.  On success zero is
 195  * returned, otherwise a negative value is returned.  The caller is responsible
 196  * for calling the necessary locking functions.
 197  *
 198  */
 199 int netlbl_af6list_add(struct netlbl_af6list *entry, struct list_head *head)
 200 {
 201         struct netlbl_af6list *iter;
 202
 203         iter = netlbl_af6list_search(&entry->addr, head);
 204         if (iter != NULL &&
 205             ipv6_addr_equal(&iter->addr, &entry->addr) &&
 206             ipv6_addr_equal(&iter->mask, &entry->mask))
 207                 return -EEXIST;
 208
 209         /* in order to speed up address searches through the list (the common
 210          * case) we need to keep the list in order based on the size of the
 211          * address mask such that the entry with the widest mask (smallest
 212          * numerical value) appears first in the list */
 213         list_for_each_entry_rcu(iter, head, list)
 214                 if (iter->valid &&
 215                     ipv6_addr_cmp(&entry->mask, &iter->mask) > 0) {
 216                         __list_add_rcu(&entry->list,
 217                                        iter->list.prev,
 218                                        &iter->list);
 219                         return 0;
 220                 }
 221         list_add_tail_rcu(&entry->list, head);
 222         return 0;
 223 }
 224 #endif /* IPv6 */
 225
 226 /**
 227  * netlbl_af4list_remove_entry - Remove an IPv4 address entry
 228  * @entry: address entry
 229  *
 230  * Description:
 231  * Remove the specified IP address entry.  The caller is responsible for
 232  * calling the necessary locking functions.
 233  *
 234  */
 235 void netlbl_af4list_remove_entry(struct netlbl_af4list *entry)
 236 {
 237         entry->valid = 0;
 238         list_del_rcu(&entry->list);
 239 }
 240
 241 /**
 242  * netlbl_af4list_remove - Remove an IPv4 address entry
 243  * @addr: IP address
 244  * @mask: IP address mask
 245  * @head: the list head
 246  *
 247  * Description:
 248  * Remove an IP address entry from the list pointed to by @head.  Returns the
 249  * entry on success, NULL on failure.  The caller is responsible for calling
 250  * the necessary locking functions.
 251  *
 252  */
 253 struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,
 254                                              struct list_head *head)
 255 {
 256         struct netlbl_af4list *entry;
 257
 258         entry = netlbl_af4list_search_exact(addr, mask, head);
 259         if (entry == NULL)
 260                 return NULL;
 261         netlbl_af4list_remove_entry(entry);
 262         return entry;
 263 }
 264
 265 #if IS_ENABLED(CONFIG_IPV6)
 266 /**
 267  * netlbl_af6list_remove_entry - Remove an IPv6 address entry
 268  * @entry: address entry
 269  *
 270  * Description:
 271  * Remove the specified IP address entry.  The caller is responsible for
 272  * calling the necessary locking functions.
 273  *
 274  */
 275 void netlbl_af6list_remove_entry(struct netlbl_af6list *entry)
 276 {
 277         entry->valid = 0;
 278         list_del_rcu(&entry->list);
 279 }
 280
 281 /**
 282  * netlbl_af6list_remove - Remove an IPv6 address entry
 283  * @addr: IP address
 284  * @mask: IP address mask
 285  * @head: the list head
 286  *
 287  * Description:
 288  * Remove an IP address entry from the list pointed to by @head.  Returns the
 289  * entry on success, NULL on failure.  The caller is responsible for calling
 290  * the necessary locking functions.
 291  *
 292  */
 293 struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,
 294                                              const struct in6_addr *mask,
 295                                              struct list_head *head)
 296 {
 297         struct netlbl_af6list *entry;
 298
 299         entry = netlbl_af6list_search_exact(addr, mask, head);
 300         if (entry == NULL)
 301                 return NULL;
 302         netlbl_af6list_remove_entry(entry);
 303         return entry;
 304 }
 305 #endif /* IPv6 */
 306
 307 /*
 308  * Audit Helper Functions
 309  */
 310
 311 #ifdef CONFIG_AUDIT
 312 /**
 313  * netlbl_af4list_audit_addr - Audit an IPv4 address
 314  * @audit_buf: audit buffer
 315  * @src: true if source address, false if destination
 316  * @dev: network interface
 317  * @addr: IP address
 318  * @mask: IP address mask
 319  *
 320  * Description:
 321  * Write the IPv4 address and address mask, if necessary, to @audit_buf.
 322  *
 323  */
 324 void netlbl_af4list_audit_addr(struct audit_buffer *audit_buf,
 325                                         int src, const char *dev,
 326                                         __be32 addr, __be32 mask)
 327 {
 328         u32 mask_val = ntohl(mask);
 329         char *dir = (src ? "src" : "dst");
 330
 331         if (dev != NULL)
 332                 audit_log_format(audit_buf, " netif=%s", dev);
 333         audit_log_format(audit_buf, " %s=%pI4", dir, &addr);
 334         if (mask_val != 0xffffffff) {
 335                 u32 mask_len = 0;
 336                 while (mask_val > 0) {
 337                         mask_val <<= 1;
 338                         mask_len++;
 339                 }
 340                 audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
 341         }
 342 }
 343
 344 #if IS_ENABLED(CONFIG_IPV6)
 345 /**
 346  * netlbl_af6list_audit_addr - Audit an IPv6 address
 347  * @audit_buf: audit buffer
 348  * @src: true if source address, false if destination
 349  * @dev: network interface
 350  * @addr: IP address
 351  * @mask: IP address mask
 352  *
 353  * Description:
 354  * Write the IPv6 address and address mask, if necessary, to @audit_buf.
 355  *
 356  */
 357 void netlbl_af6list_audit_addr(struct audit_buffer *audit_buf,
 358                                  int src,
 359                                  const char *dev,
 360                                  const struct in6_addr *addr,
 361                                  const struct in6_addr *mask)
 362 {
 363         char *dir = (src ? "src" : "dst");
 364
 365         if (dev != NULL)
 366                 audit_log_format(audit_buf, " netif=%s", dev);
 367         audit_log_format(audit_buf, " %s=%pI6", dir, addr);
 368         if (ntohl(mask->s6_addr32[3]) != 0xffffffff) {
 369                 u32 mask_len = 0;
 370                 u32 mask_val;
 371                 int iter = -1;
 372                 while (ntohl(mask->s6_addr32[++iter]) == 0xffffffff)
 373                         mask_len += 32;
 374                 mask_val = ntohl(mask->s6_addr32[iter]);
 375                 while (mask_val > 0) {
 376                         mask_val <<= 1;
 377                         mask_len++;
 378                 }
 379                 audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len);
 380         }
 381 }
 382 #endif /* IPv6 */
 383 #endif /* CONFIG_AUDIT */