net/netlabel/netlabel_kapi.c

   1 /*
   2  * NetLabel Kernel API
   3  *
   4  * This file defines the kernel API for the NetLabel system.  The NetLabel
   5  * system manages static and dynamic label mappings for network protocols such
   6  * as CIPSO and RIPSO.
   7  *
   8  * Author: Paul Moore <paul.moore@hp.com>
   9  *
  10  */
  11
  12 /*
  13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14  *
  15  * This program is free software;  you can redistribute it and/or modify
  16  * it under the terms of the GNU General Public License as published by
  17  * the Free Software Foundation; either version 2 of the License, or
  18  * (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  23  * the GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program;  if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28  *
  29  */
  30
  31 #include <linux/init.h>
  32 #include <linux/types.h>
  33 #include <net/ip.h>
  34 #include <net/netlabel.h>
  35 #include <net/cipso_ipv4.h>
  36 #include <asm/bug.h>
  37 #include <asm/atomic.h>
  38
  39 #include "netlabel_domainhash.h"
  40 #include "netlabel_unlabeled.h"
  41 #include "netlabel_user.h"
  42 #include "netlabel_mgmt.h"
  43
  44 /*
  45  * Security Attribute Functions
  46  */
  47
  48 /**
  49  * netlbl_secattr_catmap_walk - Walk a LSM secattr catmap looking for a bit
  50  * @catmap: the category bitmap
  51  * @offset: the offset to start searching at, in bits
  52  *
  53  * Description:
  54  * This function walks a LSM secattr category bitmap starting at @offset and
  55  * returns the spot of the first set bit or -ENOENT if no bits are set.
  56  *
  57  */
  58 int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
  59                                u32 offset)
  60 {
  61         struct netlbl_lsm_secattr_catmap *iter = catmap;
  62         u32 node_idx;
  63         u32 node_bit;
  64         NETLBL_CATMAP_MAPTYPE bitmap;
  65
  66         if (offset > iter->startbit) {
  67                 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
  68                         iter = iter->next;
  69                         if (iter == NULL)
  70                                 return -ENOENT;
  71                 }
  72                 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
  73                 node_bit = offset - iter->startbit -
  74                            (NETLBL_CATMAP_MAPSIZE * node_idx);
  75         } else {
  76                 node_idx = 0;
  77                 node_bit = 0;
  78         }
  79         bitmap = iter->bitmap[node_idx] >> node_bit;
  80
  81         for (;;) {
  82                 if (bitmap != 0) {
  83                         while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
  84                                 bitmap >>= 1;
  85                                 node_bit++;
  86                         }
  87                         return iter->startbit +
  88                                 (NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit;
  89                 }
  90                 if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
  91                         if (iter->next != NULL) {
  92                                 iter = iter->next;
  93                                 node_idx = 0;
  94                         } else
  95                                 return -ENOENT;
  96                 }
  97                 bitmap = iter->bitmap[node_idx];
  98                 node_bit = 0;
  99         }
 100
 101         return -ENOENT;
 102 }
 103
 104 /**
 105  * netlbl_secattr_catmap_walk_rng - Find the end of a string of set bits
 106  * @catmap: the category bitmap
 107  * @offset: the offset to start searching at, in bits
 108  *
 109  * Description:
 110  * This function walks a LSM secattr category bitmap starting at @offset and
 111  * returns the spot of the first cleared bit or -ENOENT if the offset is past
 112  * the end of the bitmap.
 113  *
 114  */
 115 int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
 116                                    u32 offset)
 117 {
 118         struct netlbl_lsm_secattr_catmap *iter = catmap;
 119         u32 node_idx;
 120         u32 node_bit;
 121         NETLBL_CATMAP_MAPTYPE bitmask;
 122         NETLBL_CATMAP_MAPTYPE bitmap;
 123
 124         if (offset > iter->startbit) {
 125                 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
 126                         iter = iter->next;
 127                         if (iter == NULL)
 128                                 return -ENOENT;
 129                 }
 130                 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
 131                 node_bit = offset - iter->startbit -
 132                            (NETLBL_CATMAP_MAPSIZE * node_idx);
 133         } else {
 134                 node_idx = 0;
 135                 node_bit = 0;
 136         }
 137         bitmask = NETLBL_CATMAP_BIT << node_bit;
 138
 139         for (;;) {
 140                 bitmap = iter->bitmap[node_idx];
 141                 while (bitmask != 0 && (bitmap & bitmask) != 0) {
 142                         bitmask <<= 1;
 143                         node_bit++;
 144                 }
 145
 146                 if (bitmask != 0)
 147                         return iter->startbit +
 148                                 (NETLBL_CATMAP_MAPSIZE * node_idx) +
 149                                 node_bit - 1;
 150                 else if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
 151                         if (iter->next == NULL)
 152                                 return iter->startbit + NETLBL_CATMAP_SIZE - 1;
 153                         iter = iter->next;
 154                         node_idx = 0;
 155                 }
 156                 bitmask = NETLBL_CATMAP_BIT;
 157                 node_bit = 0;
 158         }
 159
 160         return -ENOENT;
 161 }
 162
 163 /**
 164  * netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap
 165  * @catmap: the category bitmap
 166  * @bit: the bit to set
 167  * @flags: memory allocation flags
 168  *
 169  * Description:
 170  * Set the bit specified by @bit in @catmap.  Returns zero on success,
 171  * negative values on failure.
 172  *
 173  */
 174 int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
 175                                  u32 bit,
 176                                  gfp_t flags)
 177 {
 178         struct netlbl_lsm_secattr_catmap *iter = catmap;
 179         u32 node_bit;
 180         u32 node_idx;
 181
 182         while (iter->next != NULL &&
 183                bit >= (iter->startbit + NETLBL_CATMAP_SIZE))
 184                 iter = iter->next;
 185         if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
 186                 iter->next = netlbl_secattr_catmap_alloc(flags);
 187                 if (iter->next == NULL)
 188                         return -ENOMEM;
 189                 iter = iter->next;
 190                 iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1);
 191         }
 192
 193         /* gcc always rounds to zero when doing integer division */
 194         node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
 195         node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx);
 196         iter->bitmap[node_idx] |= NETLBL_CATMAP_BIT << node_bit;
 197
 198         return 0;
 199 }
 200
 201 /**
 202  * netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap
 203  * @catmap: the category bitmap
 204  * @start: the starting bit
 205  * @end: the last bit in the string
 206  * @flags: memory allocation flags
 207  *
 208  * Description:
 209  * Set a range of bits, starting at @start and ending with @end.  Returns zero
 210  * on success, negative values on failure.
 211  *
 212  */
 213 int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
 214                                  u32 start,
 215                                  u32 end,
 216                                  gfp_t flags)
 217 {
 218         int ret_val = 0;
 219         struct netlbl_lsm_secattr_catmap *iter = catmap;
 220         u32 iter_max_spot;
 221         u32 spot;
 222
 223         /* XXX - This could probably be made a bit faster by combining writes
 224          * to the catmap instead of setting a single bit each time, but for
 225          * right now skipping to the start of the range in the catmap should
 226          * be a nice improvement over calling the individual setbit function
 227          * repeatedly from a loop. */
 228
 229         while (iter->next != NULL &&
 230                start >= (iter->startbit + NETLBL_CATMAP_SIZE))
 231                 iter = iter->next;
 232         iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
 233
 234         for (spot = start; spot <= end && ret_val == 0; spot++) {
 235                 if (spot >= iter_max_spot && iter->next != NULL) {
 236                         iter = iter->next;
 237                         iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
 238                 }
 239                 ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC);
 240         }
 241
 242         return ret_val;
 243 }
 244
 245 /*
 246  * LSM Functions
 247  */
 248
 249 /**
 250  * netlbl_enabled - Determine if the NetLabel subsystem is enabled
 251  *
 252  * Description:
 253  * The LSM can use this function to determine if it should use NetLabel
 254  * security attributes in it's enforcement mechanism.  Currently, NetLabel is
 255  * considered to be enabled when it's configuration contains a valid setup for
 256  * at least one labeled protocol (i.e. NetLabel can understand incoming
 257  * labeled packets of at least one type); otherwise NetLabel is considered to
 258  * be disabled.
 259  *
 260  */
 261 int netlbl_enabled(void)
 262 {
 263         /* At some point we probably want to expose this mechanism to the user
 264          * as well so that admins can toggle NetLabel regardless of the
 265          * configuration */
 266         return (atomic_read(&netlabel_mgmt_protocount) > 0);
 267 }
 268
 269 /**
 270  * netlbl_socket_setattr - Label a socket using the correct protocol
 271  * @sk: the socket to label
 272  * @secattr: the security attributes
 273  *
 274  * Description:
 275  * Attach the correct label to the given socket using the security attributes
 276  * specified in @secattr.  This function requires exclusive access to @sk,
 277  * which means it either needs to be in the process of being created or locked.
 278  * Returns zero on success, negative values on failure.
 279  *
 280  */
 281 int netlbl_sock_setattr(struct sock *sk,
 282                         const struct netlbl_lsm_secattr *secattr)
 283 {
 284         int ret_val = -ENOENT;
 285         struct netlbl_dom_map *dom_entry;
 286
 287         rcu_read_lock();
 288         dom_entry = netlbl_domhsh_getentry(secattr->domain);
 289         if (dom_entry == NULL)
 290                 goto socket_setattr_return;
 291         switch (dom_entry->type) {
 292         case NETLBL_NLTYPE_CIPSOV4:
 293                 ret_val = cipso_v4_sock_setattr(sk,
 294                                                 dom_entry->type_def.cipsov4,
 295                                                 secattr);
 296                 break;
 297         case NETLBL_NLTYPE_UNLABELED:
 298                 ret_val = 0;
 299                 break;
 300         default:
 301                 ret_val = -ENOENT;
 302         }
 303
 304 socket_setattr_return:
 305         rcu_read_unlock();
 306         return ret_val;
 307 }
 308
 309 /**
 310  * netlbl_sock_getattr - Determine the security attributes of a sock
 311  * @sk: the sock
 312  * @secattr: the security attributes
 313  *
 314  * Description:
 315  * Examines the given sock to see if any NetLabel style labeling has been
 316  * applied to the sock, if so it parses the socket label and returns the
 317  * security attributes in @secattr.  Returns zero on success, negative values
 318  * on failure.
 319  *
 320  */
 321 int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
 322 {
 323         return cipso_v4_sock_getattr(sk, secattr);
 324 }
 325
 326 /**
 327  * netlbl_skbuff_getattr - Determine the security attributes of a packet
 328  * @skb: the packet
 329  * @family: protocol family
 330  * @secattr: the security attributes
 331  *
 332  * Description:
 333  * Examines the given packet to see if a recognized form of packet labeling
 334  * is present, if so it parses the packet label and returns the security
 335  * attributes in @secattr.  Returns zero on success, negative values on
 336  * failure.
 337  *
 338  */
 339 int netlbl_skbuff_getattr(const struct sk_buff *skb,
 340                           u16 family,
 341                           struct netlbl_lsm_secattr *secattr)
 342 {
 343         if (CIPSO_V4_OPTEXIST(skb) &&
 344             cipso_v4_skbuff_getattr(skb, secattr) == 0)
 345                 return 0;
 346
 347         return netlbl_unlabel_getattr(skb, family, secattr);
 348 }
 349
 350 /**
 351  * netlbl_skbuff_err - Handle a LSM error on a sk_buff
 352  * @skb: the packet
 353  * @error: the error code
 354  *
 355  * Description:
 356  * Deal with a LSM problem when handling the packet in @skb, typically this is
 357  * a permission denied problem (-EACCES).  The correct action is determined
 358  * according to the packet's labeling protocol.
 359  *
 360  */
 361 void netlbl_skbuff_err(struct sk_buff *skb, int error)
 362 {
 363         if (CIPSO_V4_OPTEXIST(skb))
 364                 cipso_v4_error(skb, error, 0);
 365 }
 366
 367 /**
 368  * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches
 369  *
 370  * Description:
 371  * For all of the NetLabel protocols that support some form of label mapping
 372  * cache, invalidate the cache.  Returns zero on success, negative values on
 373  * error.
 374  *
 375  */
 376 void netlbl_cache_invalidate(void)
 377 {
 378         cipso_v4_cache_invalidate();
 379 }
 380
 381 /**
 382  * netlbl_cache_add - Add an entry to a NetLabel protocol cache
 383  * @skb: the packet
 384  * @secattr: the packet's security attributes
 385  *
 386  * Description:
 387  * Add the LSM security attributes for the given packet to the underlying
 388  * NetLabel protocol's label mapping cache.  Returns zero on success, negative
 389  * values on error.
 390  *
 391  */
 392 int netlbl_cache_add(const struct sk_buff *skb,
 393                      const struct netlbl_lsm_secattr *secattr)
 394 {
 395         if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
 396                 return -ENOMSG;
 397
 398         if (CIPSO_V4_OPTEXIST(skb))
 399                 return cipso_v4_cache_add(skb, secattr);
 400
 401         return -ENOMSG;
 402 }
 403
 404 /*
 405  * Setup Functions
 406  */
 407
 408 /**
 409  * netlbl_init - Initialize NetLabel
 410  *
 411  * Description:
 412  * Perform the required NetLabel initialization before first use.
 413  *
 414  */
 415 static int __init netlbl_init(void)
 416 {
 417         int ret_val;
 418
 419         printk(KERN_INFO "NetLabel: Initializing\n");
 420         printk(KERN_INFO "NetLabel:  domain hash size = %u\n",
 421                (1 << NETLBL_DOMHSH_BITSIZE));
 422         printk(KERN_INFO "NetLabel:  protocols ="
 423                " UNLABELED"
 424                " CIPSOv4"
 425                "\n");
 426
 427         ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
 428         if (ret_val != 0)
 429                 goto init_failure;
 430
 431         ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE);
 432         if (ret_val != 0)
 433                 goto init_failure;
 434
 435         ret_val = netlbl_netlink_init();
 436         if (ret_val != 0)
 437                 goto init_failure;
 438
 439         ret_val = netlbl_unlabel_defconf();
 440         if (ret_val != 0)
 441                 goto init_failure;
 442         printk(KERN_INFO "NetLabel:  unlabeled traffic allowed by default\n");
 443
 444         return 0;
 445
 446 init_failure:
 447         panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
 448 }
 449
 450 subsys_initcall(netlbl_init);