Linux Audio

Check our new training course

Loading...
v3.15
   1/*
   2 * CIPSO - Commercial IP Security Option
   3 *
   4 * This is an implementation of the CIPSO 2.2 protocol as specified in
   5 * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
   6 * FIPS-188.  While CIPSO never became a full IETF RFC standard many vendors
   7 * have chosen to adopt the protocol and over the years it has become a
   8 * de-facto standard for labeled networking.
   9 *
  10 * The CIPSO draft specification can be found in the kernel's Documentation
  11 * directory as well as the following URL:
  12 *   http://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
  13 * The FIPS-188 specification can be found at the following URL:
  14 *   http://www.itl.nist.gov/fipspubs/fip188.htm
  15 *
  16 * Author: Paul Moore <paul.moore@hp.com>
  17 *
  18 */
  19
  20/*
  21 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  22 *
  23 * This program is free software;  you can redistribute it and/or modify
  24 * it under the terms of the GNU General Public License as published by
  25 * the Free Software Foundation; either version 2 of the License, or
  26 * (at your option) any later version.
  27 *
  28 * This program is distributed in the hope that it will be useful,
  29 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  30 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  31 * the GNU General Public License for more details.
  32 *
  33 * You should have received a copy of the GNU General Public License
  34 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  35 *
  36 */
  37
  38#include <linux/init.h>
  39#include <linux/types.h>
  40#include <linux/rcupdate.h>
  41#include <linux/list.h>
  42#include <linux/spinlock.h>
  43#include <linux/string.h>
  44#include <linux/jhash.h>
  45#include <linux/audit.h>
  46#include <linux/slab.h>
  47#include <net/ip.h>
  48#include <net/icmp.h>
  49#include <net/tcp.h>
  50#include <net/netlabel.h>
  51#include <net/cipso_ipv4.h>
  52#include <linux/atomic.h>
  53#include <asm/bug.h>
  54#include <asm/unaligned.h>
  55
  56/* List of available DOI definitions */
  57/* XXX - This currently assumes a minimal number of different DOIs in use,
  58 * if in practice there are a lot of different DOIs this list should
  59 * probably be turned into a hash table or something similar so we
  60 * can do quick lookups. */
  61static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
  62static LIST_HEAD(cipso_v4_doi_list);
  63
  64/* Label mapping cache */
  65int cipso_v4_cache_enabled = 1;
  66int cipso_v4_cache_bucketsize = 10;
  67#define CIPSO_V4_CACHE_BUCKETBITS     7
  68#define CIPSO_V4_CACHE_BUCKETS        (1 << CIPSO_V4_CACHE_BUCKETBITS)
  69#define CIPSO_V4_CACHE_REORDERLIMIT   10
  70struct cipso_v4_map_cache_bkt {
  71	spinlock_t lock;
  72	u32 size;
  73	struct list_head list;
  74};
 
  75struct cipso_v4_map_cache_entry {
  76	u32 hash;
  77	unsigned char *key;
  78	size_t key_len;
  79
  80	struct netlbl_lsm_cache *lsm_data;
  81
  82	u32 activity;
  83	struct list_head list;
  84};
  85static struct cipso_v4_map_cache_bkt *cipso_v4_cache = NULL;
 
  86
  87/* Restricted bitmap (tag #1) flags */
  88int cipso_v4_rbm_optfmt = 0;
  89int cipso_v4_rbm_strictvalid = 1;
  90
  91/*
  92 * Protocol Constants
  93 */
  94
  95/* Maximum size of the CIPSO IP option, derived from the fact that the maximum
  96 * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
  97#define CIPSO_V4_OPT_LEN_MAX          40
  98
  99/* Length of the base CIPSO option, this includes the option type (1 byte), the
 100 * option length (1 byte), and the DOI (4 bytes). */
 101#define CIPSO_V4_HDR_LEN              6
 102
 103/* Base length of the restrictive category bitmap tag (tag #1). */
 104#define CIPSO_V4_TAG_RBM_BLEN         4
 105
 106/* Base length of the enumerated category tag (tag #2). */
 107#define CIPSO_V4_TAG_ENUM_BLEN        4
 108
 109/* Base length of the ranged categories bitmap tag (tag #5). */
 110#define CIPSO_V4_TAG_RNG_BLEN         4
 111/* The maximum number of category ranges permitted in the ranged category tag
 112 * (tag #5).  You may note that the IETF draft states that the maximum number
 113 * of category ranges is 7, but if the low end of the last category range is
 114 * zero then it is possible to fit 8 category ranges because the zero should
 115 * be omitted. */
 116#define CIPSO_V4_TAG_RNG_CAT_MAX      8
 117
 118/* Base length of the local tag (non-standard tag).
 119 *  Tag definition (may change between kernel versions)
 120 *
 121 * 0          8          16         24         32
 122 * +----------+----------+----------+----------+
 123 * | 10000000 | 00000110 | 32-bit secid value  |
 124 * +----------+----------+----------+----------+
 125 * | in (host byte order)|
 126 * +----------+----------+
 127 *
 128 */
 129#define CIPSO_V4_TAG_LOC_BLEN         6
 130
 131/*
 132 * Helper Functions
 133 */
 134
 135/**
 136 * cipso_v4_bitmap_walk - Walk a bitmap looking for a bit
 137 * @bitmap: the bitmap
 138 * @bitmap_len: length in bits
 139 * @offset: starting offset
 140 * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
 141 *
 142 * Description:
 143 * Starting at @offset, walk the bitmap from left to right until either the
 144 * desired bit is found or we reach the end.  Return the bit offset, -1 if
 145 * not found, or -2 if error.
 146 */
 147static int cipso_v4_bitmap_walk(const unsigned char *bitmap,
 148				u32 bitmap_len,
 149				u32 offset,
 150				u8 state)
 151{
 152	u32 bit_spot;
 153	u32 byte_offset;
 154	unsigned char bitmask;
 155	unsigned char byte;
 156
 157	/* gcc always rounds to zero when doing integer division */
 158	byte_offset = offset / 8;
 159	byte = bitmap[byte_offset];
 160	bit_spot = offset;
 161	bitmask = 0x80 >> (offset % 8);
 162
 163	while (bit_spot < bitmap_len) {
 164		if ((state && (byte & bitmask) == bitmask) ||
 165		    (state == 0 && (byte & bitmask) == 0))
 166			return bit_spot;
 167
 168		bit_spot++;
 169		bitmask >>= 1;
 170		if (bitmask == 0) {
 171			byte = bitmap[++byte_offset];
 172			bitmask = 0x80;
 173		}
 174	}
 175
 176	return -1;
 177}
 178
 179/**
 180 * cipso_v4_bitmap_setbit - Sets a single bit in a bitmap
 181 * @bitmap: the bitmap
 182 * @bit: the bit
 183 * @state: if non-zero, set the bit (1) else clear the bit (0)
 184 *
 185 * Description:
 186 * Set a single bit in the bitmask.  Returns zero on success, negative values
 187 * on error.
 188 */
 189static void cipso_v4_bitmap_setbit(unsigned char *bitmap,
 190				   u32 bit,
 191				   u8 state)
 192{
 193	u32 byte_spot;
 194	u8 bitmask;
 195
 196	/* gcc always rounds to zero when doing integer division */
 197	byte_spot = bit / 8;
 198	bitmask = 0x80 >> (bit % 8);
 199	if (state)
 200		bitmap[byte_spot] |= bitmask;
 201	else
 202		bitmap[byte_spot] &= ~bitmask;
 203}
 204
 205/**
 206 * cipso_v4_cache_entry_free - Frees a cache entry
 207 * @entry: the entry to free
 208 *
 209 * Description:
 210 * This function frees the memory associated with a cache entry including the
 211 * LSM cache data if there are no longer any users, i.e. reference count == 0.
 212 *
 213 */
 214static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
 215{
 216	if (entry->lsm_data)
 217		netlbl_secattr_cache_free(entry->lsm_data);
 218	kfree(entry->key);
 219	kfree(entry);
 220}
 221
 222/**
 223 * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
 224 * @key: the hash key
 225 * @key_len: the length of the key in bytes
 226 *
 227 * Description:
 228 * The CIPSO tag hashing function.  Returns a 32-bit hash value.
 229 *
 230 */
 231static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
 232{
 233	return jhash(key, key_len, 0);
 234}
 235
 236/*
 237 * Label Mapping Cache Functions
 238 */
 239
 240/**
 241 * cipso_v4_cache_init - Initialize the CIPSO cache
 242 *
 243 * Description:
 244 * Initializes the CIPSO label mapping cache, this function should be called
 245 * before any of the other functions defined in this file.  Returns zero on
 246 * success, negative values on error.
 247 *
 248 */
 249static int cipso_v4_cache_init(void)
 250{
 251	u32 iter;
 252
 253	cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
 254				 sizeof(struct cipso_v4_map_cache_bkt),
 255				 GFP_KERNEL);
 256	if (cipso_v4_cache == NULL)
 257		return -ENOMEM;
 258
 259	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
 260		spin_lock_init(&cipso_v4_cache[iter].lock);
 261		cipso_v4_cache[iter].size = 0;
 262		INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
 263	}
 264
 265	return 0;
 266}
 267
 268/**
 269 * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
 270 *
 271 * Description:
 272 * Invalidates and frees any entries in the CIPSO cache.  Returns zero on
 273 * success and negative values on failure.
 274 *
 275 */
 276void cipso_v4_cache_invalidate(void)
 277{
 278	struct cipso_v4_map_cache_entry *entry, *tmp_entry;
 279	u32 iter;
 280
 281	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
 282		spin_lock_bh(&cipso_v4_cache[iter].lock);
 283		list_for_each_entry_safe(entry,
 284					 tmp_entry,
 285					 &cipso_v4_cache[iter].list, list) {
 286			list_del(&entry->list);
 287			cipso_v4_cache_entry_free(entry);
 288		}
 289		cipso_v4_cache[iter].size = 0;
 290		spin_unlock_bh(&cipso_v4_cache[iter].lock);
 291	}
 292}
 293
 294/**
 295 * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
 296 * @key: the buffer to check
 297 * @key_len: buffer length in bytes
 298 * @secattr: the security attribute struct to use
 299 *
 300 * Description:
 301 * This function checks the cache to see if a label mapping already exists for
 302 * the given key.  If there is a match then the cache is adjusted and the
 303 * @secattr struct is populated with the correct LSM security attributes.  The
 304 * cache is adjusted in the following manner if the entry is not already the
 305 * first in the cache bucket:
 306 *
 307 *  1. The cache entry's activity counter is incremented
 308 *  2. The previous (higher ranking) entry's activity counter is decremented
 309 *  3. If the difference between the two activity counters is geater than
 310 *     CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
 311 *
 312 * Returns zero on success, -ENOENT for a cache miss, and other negative values
 313 * on error.
 314 *
 315 */
 316static int cipso_v4_cache_check(const unsigned char *key,
 317				u32 key_len,
 318				struct netlbl_lsm_secattr *secattr)
 319{
 320	u32 bkt;
 321	struct cipso_v4_map_cache_entry *entry;
 322	struct cipso_v4_map_cache_entry *prev_entry = NULL;
 323	u32 hash;
 324
 325	if (!cipso_v4_cache_enabled)
 326		return -ENOENT;
 327
 328	hash = cipso_v4_map_cache_hash(key, key_len);
 329	bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
 330	spin_lock_bh(&cipso_v4_cache[bkt].lock);
 331	list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
 332		if (entry->hash == hash &&
 333		    entry->key_len == key_len &&
 334		    memcmp(entry->key, key, key_len) == 0) {
 335			entry->activity += 1;
 336			atomic_inc(&entry->lsm_data->refcount);
 337			secattr->cache = entry->lsm_data;
 338			secattr->flags |= NETLBL_SECATTR_CACHE;
 339			secattr->type = NETLBL_NLTYPE_CIPSOV4;
 340			if (prev_entry == NULL) {
 341				spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 342				return 0;
 343			}
 344
 345			if (prev_entry->activity > 0)
 346				prev_entry->activity -= 1;
 347			if (entry->activity > prev_entry->activity &&
 348			    entry->activity - prev_entry->activity >
 349			    CIPSO_V4_CACHE_REORDERLIMIT) {
 350				__list_del(entry->list.prev, entry->list.next);
 351				__list_add(&entry->list,
 352					   prev_entry->list.prev,
 353					   &prev_entry->list);
 354			}
 355
 356			spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 357			return 0;
 358		}
 359		prev_entry = entry;
 360	}
 361	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 362
 363	return -ENOENT;
 364}
 365
 366/**
 367 * cipso_v4_cache_add - Add an entry to the CIPSO cache
 368 * @skb: the packet
 369 * @secattr: the packet's security attributes
 370 *
 371 * Description:
 372 * Add a new entry into the CIPSO label mapping cache.  Add the new entry to
 373 * head of the cache bucket's list, if the cache bucket is out of room remove
 374 * the last entry in the list first.  It is important to note that there is
 375 * currently no checking for duplicate keys.  Returns zero on success,
 376 * negative values on failure.
 377 *
 378 */
 379int cipso_v4_cache_add(const struct sk_buff *skb,
 380		       const struct netlbl_lsm_secattr *secattr)
 381{
 382	int ret_val = -EPERM;
 383	u32 bkt;
 384	struct cipso_v4_map_cache_entry *entry = NULL;
 385	struct cipso_v4_map_cache_entry *old_entry = NULL;
 386	unsigned char *cipso_ptr;
 387	u32 cipso_ptr_len;
 388
 389	if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
 390		return 0;
 391
 392	cipso_ptr = CIPSO_V4_OPTPTR(skb);
 393	cipso_ptr_len = cipso_ptr[1];
 394
 395	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 396	if (entry == NULL)
 397		return -ENOMEM;
 398	entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
 399	if (entry->key == NULL) {
 400		ret_val = -ENOMEM;
 401		goto cache_add_failure;
 402	}
 403	entry->key_len = cipso_ptr_len;
 404	entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
 405	atomic_inc(&secattr->cache->refcount);
 406	entry->lsm_data = secattr->cache;
 407
 408	bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
 409	spin_lock_bh(&cipso_v4_cache[bkt].lock);
 410	if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
 411		list_add(&entry->list, &cipso_v4_cache[bkt].list);
 412		cipso_v4_cache[bkt].size += 1;
 413	} else {
 414		old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
 415				       struct cipso_v4_map_cache_entry, list);
 416		list_del(&old_entry->list);
 417		list_add(&entry->list, &cipso_v4_cache[bkt].list);
 418		cipso_v4_cache_entry_free(old_entry);
 419	}
 420	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 421
 422	return 0;
 423
 424cache_add_failure:
 425	if (entry)
 426		cipso_v4_cache_entry_free(entry);
 427	return ret_val;
 428}
 429
 430/*
 431 * DOI List Functions
 432 */
 433
 434/**
 435 * cipso_v4_doi_search - Searches for a DOI definition
 436 * @doi: the DOI to search for
 437 *
 438 * Description:
 439 * Search the DOI definition list for a DOI definition with a DOI value that
 440 * matches @doi.  The caller is responsible for calling rcu_read_[un]lock().
 441 * Returns a pointer to the DOI definition on success and NULL on failure.
 442 */
 443static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
 444{
 445	struct cipso_v4_doi *iter;
 446
 447	list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
 448		if (iter->doi == doi && atomic_read(&iter->refcount))
 449			return iter;
 450	return NULL;
 451}
 452
 453/**
 454 * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
 455 * @doi_def: the DOI structure
 456 * @audit_info: NetLabel audit information
 457 *
 458 * Description:
 459 * The caller defines a new DOI for use by the CIPSO engine and calls this
 460 * function to add it to the list of acceptable domains.  The caller must
 461 * ensure that the mapping table specified in @doi_def->map meets all of the
 462 * requirements of the mapping type (see cipso_ipv4.h for details).  Returns
 463 * zero on success and non-zero on failure.
 464 *
 465 */
 466int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
 467		     struct netlbl_audit *audit_info)
 468{
 469	int ret_val = -EINVAL;
 470	u32 iter;
 471	u32 doi;
 472	u32 doi_type;
 473	struct audit_buffer *audit_buf;
 474
 475	doi = doi_def->doi;
 476	doi_type = doi_def->type;
 477
 478	if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
 479		goto doi_add_return;
 480	for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
 481		switch (doi_def->tags[iter]) {
 482		case CIPSO_V4_TAG_RBITMAP:
 483			break;
 484		case CIPSO_V4_TAG_RANGE:
 485		case CIPSO_V4_TAG_ENUM:
 486			if (doi_def->type != CIPSO_V4_MAP_PASS)
 487				goto doi_add_return;
 488			break;
 489		case CIPSO_V4_TAG_LOCAL:
 490			if (doi_def->type != CIPSO_V4_MAP_LOCAL)
 491				goto doi_add_return;
 492			break;
 493		case CIPSO_V4_TAG_INVALID:
 494			if (iter == 0)
 495				goto doi_add_return;
 496			break;
 497		default:
 498			goto doi_add_return;
 499		}
 500	}
 501
 502	atomic_set(&doi_def->refcount, 1);
 503
 504	spin_lock(&cipso_v4_doi_list_lock);
 505	if (cipso_v4_doi_search(doi_def->doi) != NULL) {
 506		spin_unlock(&cipso_v4_doi_list_lock);
 507		ret_val = -EEXIST;
 508		goto doi_add_return;
 509	}
 510	list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
 511	spin_unlock(&cipso_v4_doi_list_lock);
 512	ret_val = 0;
 513
 514doi_add_return:
 515	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
 516	if (audit_buf != NULL) {
 517		const char *type_str;
 518		switch (doi_type) {
 519		case CIPSO_V4_MAP_TRANS:
 520			type_str = "trans";
 521			break;
 522		case CIPSO_V4_MAP_PASS:
 523			type_str = "pass";
 524			break;
 525		case CIPSO_V4_MAP_LOCAL:
 526			type_str = "local";
 527			break;
 528		default:
 529			type_str = "(unknown)";
 530		}
 531		audit_log_format(audit_buf,
 532				 " cipso_doi=%u cipso_type=%s res=%u",
 533				 doi, type_str, ret_val == 0 ? 1 : 0);
 534		audit_log_end(audit_buf);
 535	}
 536
 537	return ret_val;
 538}
 539
 540/**
 541 * cipso_v4_doi_free - Frees a DOI definition
 542 * @entry: the entry's RCU field
 543 *
 544 * Description:
 545 * This function frees all of the memory associated with a DOI definition.
 546 *
 547 */
 548void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
 549{
 550	if (doi_def == NULL)
 551		return;
 552
 553	switch (doi_def->type) {
 554	case CIPSO_V4_MAP_TRANS:
 555		kfree(doi_def->map.std->lvl.cipso);
 556		kfree(doi_def->map.std->lvl.local);
 557		kfree(doi_def->map.std->cat.cipso);
 558		kfree(doi_def->map.std->cat.local);
 559		break;
 560	}
 561	kfree(doi_def);
 562}
 563
 564/**
 565 * cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer
 566 * @entry: the entry's RCU field
 567 *
 568 * Description:
 569 * This function is designed to be used as a callback to the call_rcu()
 570 * function so that the memory allocated to the DOI definition can be released
 571 * safely.
 572 *
 573 */
 574static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
 575{
 576	struct cipso_v4_doi *doi_def;
 577
 578	doi_def = container_of(entry, struct cipso_v4_doi, rcu);
 579	cipso_v4_doi_free(doi_def);
 580}
 581
 582/**
 583 * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
 584 * @doi: the DOI value
 585 * @audit_secid: the LSM secid to use in the audit message
 586 *
 587 * Description:
 588 * Removes a DOI definition from the CIPSO engine.  The NetLabel routines will
 589 * be called to release their own LSM domain mappings as well as our own
 590 * domain list.  Returns zero on success and negative values on failure.
 591 *
 592 */
 593int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
 594{
 595	int ret_val;
 596	struct cipso_v4_doi *doi_def;
 597	struct audit_buffer *audit_buf;
 598
 599	spin_lock(&cipso_v4_doi_list_lock);
 600	doi_def = cipso_v4_doi_search(doi);
 601	if (doi_def == NULL) {
 602		spin_unlock(&cipso_v4_doi_list_lock);
 603		ret_val = -ENOENT;
 604		goto doi_remove_return;
 605	}
 606	if (!atomic_dec_and_test(&doi_def->refcount)) {
 607		spin_unlock(&cipso_v4_doi_list_lock);
 608		ret_val = -EBUSY;
 609		goto doi_remove_return;
 610	}
 611	list_del_rcu(&doi_def->list);
 612	spin_unlock(&cipso_v4_doi_list_lock);
 613
 614	cipso_v4_cache_invalidate();
 615	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 616	ret_val = 0;
 617
 618doi_remove_return:
 619	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
 620	if (audit_buf != NULL) {
 621		audit_log_format(audit_buf,
 622				 " cipso_doi=%u res=%u",
 623				 doi, ret_val == 0 ? 1 : 0);
 624		audit_log_end(audit_buf);
 625	}
 626
 627	return ret_val;
 628}
 629
 630/**
 631 * cipso_v4_doi_getdef - Returns a reference to a valid DOI definition
 632 * @doi: the DOI value
 633 *
 634 * Description:
 635 * Searches for a valid DOI definition and if one is found it is returned to
 636 * the caller.  Otherwise NULL is returned.  The caller must ensure that
 637 * rcu_read_lock() is held while accessing the returned definition and the DOI
 638 * definition reference count is decremented when the caller is done.
 639 *
 640 */
 641struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
 642{
 643	struct cipso_v4_doi *doi_def;
 644
 645	rcu_read_lock();
 646	doi_def = cipso_v4_doi_search(doi);
 647	if (doi_def == NULL)
 648		goto doi_getdef_return;
 649	if (!atomic_inc_not_zero(&doi_def->refcount))
 650		doi_def = NULL;
 651
 652doi_getdef_return:
 653	rcu_read_unlock();
 654	return doi_def;
 655}
 656
 657/**
 658 * cipso_v4_doi_putdef - Releases a reference for the given DOI definition
 659 * @doi_def: the DOI definition
 660 *
 661 * Description:
 662 * Releases a DOI definition reference obtained from cipso_v4_doi_getdef().
 663 *
 664 */
 665void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
 666{
 667	if (doi_def == NULL)
 668		return;
 669
 670	if (!atomic_dec_and_test(&doi_def->refcount))
 671		return;
 672	spin_lock(&cipso_v4_doi_list_lock);
 673	list_del_rcu(&doi_def->list);
 674	spin_unlock(&cipso_v4_doi_list_lock);
 675
 676	cipso_v4_cache_invalidate();
 677	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 678}
 679
 680/**
 681 * cipso_v4_doi_walk - Iterate through the DOI definitions
 682 * @skip_cnt: skip past this number of DOI definitions, updated
 683 * @callback: callback for each DOI definition
 684 * @cb_arg: argument for the callback function
 685 *
 686 * Description:
 687 * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
 688 * For each entry call @callback, if @callback returns a negative value stop
 689 * 'walking' through the list and return.  Updates the value in @skip_cnt upon
 690 * return.  Returns zero on success, negative values on failure.
 691 *
 692 */
 693int cipso_v4_doi_walk(u32 *skip_cnt,
 694		     int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
 695		     void *cb_arg)
 696{
 697	int ret_val = -ENOENT;
 698	u32 doi_cnt = 0;
 699	struct cipso_v4_doi *iter_doi;
 700
 701	rcu_read_lock();
 702	list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
 703		if (atomic_read(&iter_doi->refcount) > 0) {
 704			if (doi_cnt++ < *skip_cnt)
 705				continue;
 706			ret_val = callback(iter_doi, cb_arg);
 707			if (ret_val < 0) {
 708				doi_cnt--;
 709				goto doi_walk_return;
 710			}
 711		}
 712
 713doi_walk_return:
 714	rcu_read_unlock();
 715	*skip_cnt = doi_cnt;
 716	return ret_val;
 717}
 718
 719/*
 720 * Label Mapping Functions
 721 */
 722
 723/**
 724 * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
 725 * @doi_def: the DOI definition
 726 * @level: the level to check
 727 *
 728 * Description:
 729 * Checks the given level against the given DOI definition and returns a
 730 * negative value if the level does not have a valid mapping and a zero value
 731 * if the level is defined by the DOI.
 732 *
 733 */
 734static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
 735{
 736	switch (doi_def->type) {
 737	case CIPSO_V4_MAP_PASS:
 738		return 0;
 739	case CIPSO_V4_MAP_TRANS:
 740		if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
 741			return 0;
 742		break;
 743	}
 744
 745	return -EFAULT;
 746}
 747
 748/**
 749 * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
 750 * @doi_def: the DOI definition
 751 * @host_lvl: the host MLS level
 752 * @net_lvl: the network/CIPSO MLS level
 753 *
 754 * Description:
 755 * Perform a label mapping to translate a local MLS level to the correct
 756 * CIPSO level using the given DOI definition.  Returns zero on success,
 757 * negative values otherwise.
 758 *
 759 */
 760static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
 761				 u32 host_lvl,
 762				 u32 *net_lvl)
 763{
 764	switch (doi_def->type) {
 765	case CIPSO_V4_MAP_PASS:
 766		*net_lvl = host_lvl;
 767		return 0;
 768	case CIPSO_V4_MAP_TRANS:
 769		if (host_lvl < doi_def->map.std->lvl.local_size &&
 770		    doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
 771			*net_lvl = doi_def->map.std->lvl.local[host_lvl];
 772			return 0;
 773		}
 774		return -EPERM;
 775	}
 776
 777	return -EINVAL;
 778}
 779
 780/**
 781 * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
 782 * @doi_def: the DOI definition
 783 * @net_lvl: the network/CIPSO MLS level
 784 * @host_lvl: the host MLS level
 785 *
 786 * Description:
 787 * Perform a label mapping to translate a CIPSO level to the correct local MLS
 788 * level using the given DOI definition.  Returns zero on success, negative
 789 * values otherwise.
 790 *
 791 */
 792static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
 793				 u32 net_lvl,
 794				 u32 *host_lvl)
 795{
 796	struct cipso_v4_std_map_tbl *map_tbl;
 797
 798	switch (doi_def->type) {
 799	case CIPSO_V4_MAP_PASS:
 800		*host_lvl = net_lvl;
 801		return 0;
 802	case CIPSO_V4_MAP_TRANS:
 803		map_tbl = doi_def->map.std;
 804		if (net_lvl < map_tbl->lvl.cipso_size &&
 805		    map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
 806			*host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
 807			return 0;
 808		}
 809		return -EPERM;
 810	}
 811
 812	return -EINVAL;
 813}
 814
 815/**
 816 * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
 817 * @doi_def: the DOI definition
 818 * @bitmap: category bitmap
 819 * @bitmap_len: bitmap length in bytes
 820 *
 821 * Description:
 822 * Checks the given category bitmap against the given DOI definition and
 823 * returns a negative value if any of the categories in the bitmap do not have
 824 * a valid mapping and a zero value if all of the categories are valid.
 825 *
 826 */
 827static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
 828				      const unsigned char *bitmap,
 829				      u32 bitmap_len)
 830{
 831	int cat = -1;
 832	u32 bitmap_len_bits = bitmap_len * 8;
 833	u32 cipso_cat_size;
 834	u32 *cipso_array;
 835
 836	switch (doi_def->type) {
 837	case CIPSO_V4_MAP_PASS:
 838		return 0;
 839	case CIPSO_V4_MAP_TRANS:
 840		cipso_cat_size = doi_def->map.std->cat.cipso_size;
 841		cipso_array = doi_def->map.std->cat.cipso;
 842		for (;;) {
 843			cat = cipso_v4_bitmap_walk(bitmap,
 844						   bitmap_len_bits,
 845						   cat + 1,
 846						   1);
 847			if (cat < 0)
 848				break;
 849			if (cat >= cipso_cat_size ||
 850			    cipso_array[cat] >= CIPSO_V4_INV_CAT)
 851				return -EFAULT;
 852		}
 853
 854		if (cat == -1)
 855			return 0;
 856		break;
 857	}
 858
 859	return -EFAULT;
 860}
 861
 862/**
 863 * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
 864 * @doi_def: the DOI definition
 865 * @secattr: the security attributes
 866 * @net_cat: the zero'd out category bitmap in network/CIPSO format
 867 * @net_cat_len: the length of the CIPSO bitmap in bytes
 868 *
 869 * Description:
 870 * Perform a label mapping to translate a local MLS category bitmap to the
 871 * correct CIPSO bitmap using the given DOI definition.  Returns the minimum
 872 * size in bytes of the network bitmap on success, negative values otherwise.
 873 *
 874 */
 875static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
 876				     const struct netlbl_lsm_secattr *secattr,
 877				     unsigned char *net_cat,
 878				     u32 net_cat_len)
 879{
 880	int host_spot = -1;
 881	u32 net_spot = CIPSO_V4_INV_CAT;
 882	u32 net_spot_max = 0;
 883	u32 net_clen_bits = net_cat_len * 8;
 884	u32 host_cat_size = 0;
 885	u32 *host_cat_array = NULL;
 886
 887	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
 888		host_cat_size = doi_def->map.std->cat.local_size;
 889		host_cat_array = doi_def->map.std->cat.local;
 890	}
 891
 892	for (;;) {
 893		host_spot = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
 894						       host_spot + 1);
 895		if (host_spot < 0)
 896			break;
 897
 898		switch (doi_def->type) {
 899		case CIPSO_V4_MAP_PASS:
 900			net_spot = host_spot;
 901			break;
 902		case CIPSO_V4_MAP_TRANS:
 903			if (host_spot >= host_cat_size)
 904				return -EPERM;
 905			net_spot = host_cat_array[host_spot];
 906			if (net_spot >= CIPSO_V4_INV_CAT)
 907				return -EPERM;
 908			break;
 909		}
 910		if (net_spot >= net_clen_bits)
 911			return -ENOSPC;
 912		cipso_v4_bitmap_setbit(net_cat, net_spot, 1);
 913
 914		if (net_spot > net_spot_max)
 915			net_spot_max = net_spot;
 916	}
 917
 918	if (++net_spot_max % 8)
 919		return net_spot_max / 8 + 1;
 920	return net_spot_max / 8;
 921}
 922
 923/**
 924 * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
 925 * @doi_def: the DOI definition
 926 * @net_cat: the category bitmap in network/CIPSO format
 927 * @net_cat_len: the length of the CIPSO bitmap in bytes
 928 * @secattr: the security attributes
 929 *
 930 * Description:
 931 * Perform a label mapping to translate a CIPSO bitmap to the correct local
 932 * MLS category bitmap using the given DOI definition.  Returns zero on
 933 * success, negative values on failure.
 934 *
 935 */
 936static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
 937				     const unsigned char *net_cat,
 938				     u32 net_cat_len,
 939				     struct netlbl_lsm_secattr *secattr)
 940{
 941	int ret_val;
 942	int net_spot = -1;
 943	u32 host_spot = CIPSO_V4_INV_CAT;
 944	u32 net_clen_bits = net_cat_len * 8;
 945	u32 net_cat_size = 0;
 946	u32 *net_cat_array = NULL;
 947
 948	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
 949		net_cat_size = doi_def->map.std->cat.cipso_size;
 950		net_cat_array = doi_def->map.std->cat.cipso;
 951	}
 952
 953	for (;;) {
 954		net_spot = cipso_v4_bitmap_walk(net_cat,
 955						net_clen_bits,
 956						net_spot + 1,
 957						1);
 958		if (net_spot < 0) {
 959			if (net_spot == -2)
 960				return -EFAULT;
 961			return 0;
 962		}
 963
 964		switch (doi_def->type) {
 965		case CIPSO_V4_MAP_PASS:
 966			host_spot = net_spot;
 967			break;
 968		case CIPSO_V4_MAP_TRANS:
 969			if (net_spot >= net_cat_size)
 970				return -EPERM;
 971			host_spot = net_cat_array[net_spot];
 972			if (host_spot >= CIPSO_V4_INV_CAT)
 973				return -EPERM;
 974			break;
 975		}
 976		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
 977						       host_spot,
 978						       GFP_ATOMIC);
 979		if (ret_val != 0)
 980			return ret_val;
 981	}
 982
 983	return -EINVAL;
 984}
 985
 986/**
 987 * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
 988 * @doi_def: the DOI definition
 989 * @enumcat: category list
 990 * @enumcat_len: length of the category list in bytes
 991 *
 992 * Description:
 993 * Checks the given categories against the given DOI definition and returns a
 994 * negative value if any of the categories do not have a valid mapping and a
 995 * zero value if all of the categories are valid.
 996 *
 997 */
 998static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
 999				       const unsigned char *enumcat,
1000				       u32 enumcat_len)
1001{
1002	u16 cat;
1003	int cat_prev = -1;
1004	u32 iter;
1005
1006	if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
1007		return -EFAULT;
1008
1009	for (iter = 0; iter < enumcat_len; iter += 2) {
1010		cat = get_unaligned_be16(&enumcat[iter]);
1011		if (cat <= cat_prev)
1012			return -EFAULT;
1013		cat_prev = cat;
1014	}
1015
1016	return 0;
1017}
1018
1019/**
1020 * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
1021 * @doi_def: the DOI definition
1022 * @secattr: the security attributes
1023 * @net_cat: the zero'd out category list in network/CIPSO format
1024 * @net_cat_len: the length of the CIPSO category list in bytes
1025 *
1026 * Description:
1027 * Perform a label mapping to translate a local MLS category bitmap to the
1028 * correct CIPSO category list using the given DOI definition.   Returns the
1029 * size in bytes of the network category bitmap on success, negative values
1030 * otherwise.
1031 *
1032 */
1033static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
1034				      const struct netlbl_lsm_secattr *secattr,
1035				      unsigned char *net_cat,
1036				      u32 net_cat_len)
1037{
1038	int cat = -1;
1039	u32 cat_iter = 0;
1040
1041	for (;;) {
1042		cat = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
1043						 cat + 1);
1044		if (cat < 0)
1045			break;
1046		if ((cat_iter + 2) > net_cat_len)
1047			return -ENOSPC;
1048
1049		*((__be16 *)&net_cat[cat_iter]) = htons(cat);
1050		cat_iter += 2;
1051	}
1052
1053	return cat_iter;
1054}
1055
1056/**
1057 * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
1058 * @doi_def: the DOI definition
1059 * @net_cat: the category list in network/CIPSO format
1060 * @net_cat_len: the length of the CIPSO bitmap in bytes
1061 * @secattr: the security attributes
1062 *
1063 * Description:
1064 * Perform a label mapping to translate a CIPSO category list to the correct
1065 * local MLS category bitmap using the given DOI definition.  Returns zero on
1066 * success, negative values on failure.
1067 *
1068 */
1069static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
1070				      const unsigned char *net_cat,
1071				      u32 net_cat_len,
1072				      struct netlbl_lsm_secattr *secattr)
1073{
1074	int ret_val;
1075	u32 iter;
1076
1077	for (iter = 0; iter < net_cat_len; iter += 2) {
1078		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
1079				get_unaligned_be16(&net_cat[iter]),
1080				GFP_ATOMIC);
1081		if (ret_val != 0)
1082			return ret_val;
1083	}
1084
1085	return 0;
1086}
1087
1088/**
1089 * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
1090 * @doi_def: the DOI definition
1091 * @rngcat: category list
1092 * @rngcat_len: length of the category list in bytes
1093 *
1094 * Description:
1095 * Checks the given categories against the given DOI definition and returns a
1096 * negative value if any of the categories do not have a valid mapping and a
1097 * zero value if all of the categories are valid.
1098 *
1099 */
1100static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1101				      const unsigned char *rngcat,
1102				      u32 rngcat_len)
1103{
1104	u16 cat_high;
1105	u16 cat_low;
1106	u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1107	u32 iter;
1108
1109	if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1110		return -EFAULT;
1111
1112	for (iter = 0; iter < rngcat_len; iter += 4) {
1113		cat_high = get_unaligned_be16(&rngcat[iter]);
1114		if ((iter + 4) <= rngcat_len)
1115			cat_low = get_unaligned_be16(&rngcat[iter + 2]);
1116		else
1117			cat_low = 0;
1118
1119		if (cat_high > cat_prev)
1120			return -EFAULT;
1121
1122		cat_prev = cat_low;
1123	}
1124
1125	return 0;
1126}
1127
1128/**
1129 * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
1130 * @doi_def: the DOI definition
1131 * @secattr: the security attributes
1132 * @net_cat: the zero'd out category list in network/CIPSO format
1133 * @net_cat_len: the length of the CIPSO category list in bytes
1134 *
1135 * Description:
1136 * Perform a label mapping to translate a local MLS category bitmap to the
1137 * correct CIPSO category list using the given DOI definition.   Returns the
1138 * size in bytes of the network category bitmap on success, negative values
1139 * otherwise.
1140 *
1141 */
1142static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1143				     const struct netlbl_lsm_secattr *secattr,
1144				     unsigned char *net_cat,
1145				     u32 net_cat_len)
1146{
1147	int iter = -1;
1148	u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1149	u32 array_cnt = 0;
1150	u32 cat_size = 0;
1151
1152	/* make sure we don't overflow the 'array[]' variable */
1153	if (net_cat_len >
1154	    (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1155		return -ENOSPC;
1156
1157	for (;;) {
1158		iter = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
1159						  iter + 1);
1160		if (iter < 0)
1161			break;
1162		cat_size += (iter == 0 ? 0 : sizeof(u16));
1163		if (cat_size > net_cat_len)
1164			return -ENOSPC;
1165		array[array_cnt++] = iter;
1166
1167		iter = netlbl_secattr_catmap_walk_rng(secattr->attr.mls.cat,
1168						      iter);
1169		if (iter < 0)
1170			return -EFAULT;
1171		cat_size += sizeof(u16);
1172		if (cat_size > net_cat_len)
1173			return -ENOSPC;
1174		array[array_cnt++] = iter;
1175	}
1176
1177	for (iter = 0; array_cnt > 0;) {
1178		*((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1179		iter += 2;
1180		array_cnt--;
1181		if (array[array_cnt] != 0) {
1182			*((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1183			iter += 2;
1184		}
1185	}
1186
1187	return cat_size;
1188}
1189
1190/**
1191 * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
1192 * @doi_def: the DOI definition
1193 * @net_cat: the category list in network/CIPSO format
1194 * @net_cat_len: the length of the CIPSO bitmap in bytes
1195 * @secattr: the security attributes
1196 *
1197 * Description:
1198 * Perform a label mapping to translate a CIPSO category list to the correct
1199 * local MLS category bitmap using the given DOI definition.  Returns zero on
1200 * success, negative values on failure.
1201 *
1202 */
1203static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1204				     const unsigned char *net_cat,
1205				     u32 net_cat_len,
1206				     struct netlbl_lsm_secattr *secattr)
1207{
1208	int ret_val;
1209	u32 net_iter;
1210	u16 cat_low;
1211	u16 cat_high;
1212
1213	for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
1214		cat_high = get_unaligned_be16(&net_cat[net_iter]);
1215		if ((net_iter + 4) <= net_cat_len)
1216			cat_low = get_unaligned_be16(&net_cat[net_iter + 2]);
1217		else
1218			cat_low = 0;
1219
1220		ret_val = netlbl_secattr_catmap_setrng(secattr->attr.mls.cat,
1221						       cat_low,
1222						       cat_high,
1223						       GFP_ATOMIC);
1224		if (ret_val != 0)
1225			return ret_val;
1226	}
1227
1228	return 0;
1229}
1230
1231/*
1232 * Protocol Handling Functions
1233 */
1234
1235/**
1236 * cipso_v4_gentag_hdr - Generate a CIPSO option header
1237 * @doi_def: the DOI definition
1238 * @len: the total tag length in bytes, not including this header
1239 * @buf: the CIPSO option buffer
1240 *
1241 * Description:
1242 * Write a CIPSO header into the beginning of @buffer.
1243 *
1244 */
1245static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1246				unsigned char *buf,
1247				u32 len)
1248{
1249	buf[0] = IPOPT_CIPSO;
1250	buf[1] = CIPSO_V4_HDR_LEN + len;
1251	*(__be32 *)&buf[2] = htonl(doi_def->doi);
1252}
1253
1254/**
1255 * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
1256 * @doi_def: the DOI definition
1257 * @secattr: the security attributes
1258 * @buffer: the option buffer
1259 * @buffer_len: length of buffer in bytes
1260 *
1261 * Description:
1262 * Generate a CIPSO option using the restricted bitmap tag, tag type #1.  The
1263 * actual buffer length may be larger than the indicated size due to
1264 * translation between host and network category bitmaps.  Returns the size of
1265 * the tag on success, negative values on failure.
1266 *
1267 */
1268static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1269			       const struct netlbl_lsm_secattr *secattr,
1270			       unsigned char *buffer,
1271			       u32 buffer_len)
1272{
1273	int ret_val;
1274	u32 tag_len;
1275	u32 level;
1276
1277	if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1278		return -EPERM;
1279
1280	ret_val = cipso_v4_map_lvl_hton(doi_def,
1281					secattr->attr.mls.lvl,
1282					&level);
1283	if (ret_val != 0)
1284		return ret_val;
1285
1286	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1287		ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
1288						    secattr,
1289						    &buffer[4],
1290						    buffer_len - 4);
1291		if (ret_val < 0)
1292			return ret_val;
1293
1294		/* This will send packets using the "optimized" format when
1295		 * possible as specified in  section 3.4.2.6 of the
1296		 * CIPSO draft. */
1297		if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
1298			tag_len = 14;
1299		else
1300			tag_len = 4 + ret_val;
1301	} else
1302		tag_len = 4;
1303
1304	buffer[0] = CIPSO_V4_TAG_RBITMAP;
1305	buffer[1] = tag_len;
1306	buffer[3] = level;
1307
1308	return tag_len;
1309}
1310
1311/**
1312 * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
1313 * @doi_def: the DOI definition
1314 * @tag: the CIPSO tag
1315 * @secattr: the security attributes
1316 *
1317 * Description:
1318 * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
1319 * attributes in @secattr.  Return zero on success, negatives values on
1320 * failure.
1321 *
1322 */
1323static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1324				 const unsigned char *tag,
1325				 struct netlbl_lsm_secattr *secattr)
1326{
1327	int ret_val;
1328	u8 tag_len = tag[1];
1329	u32 level;
1330
1331	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1332	if (ret_val != 0)
1333		return ret_val;
1334	secattr->attr.mls.lvl = level;
1335	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1336
1337	if (tag_len > 4) {
1338		secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1339		if (secattr->attr.mls.cat == NULL)
1340			return -ENOMEM;
1341
1342		ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1343						    &tag[4],
1344						    tag_len - 4,
1345						    secattr);
1346		if (ret_val != 0) {
1347			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1348			return ret_val;
1349		}
1350
1351		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1352	}
1353
1354	return 0;
1355}
1356
1357/**
1358 * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
1359 * @doi_def: the DOI definition
1360 * @secattr: the security attributes
1361 * @buffer: the option buffer
1362 * @buffer_len: length of buffer in bytes
1363 *
1364 * Description:
1365 * Generate a CIPSO option using the enumerated tag, tag type #2.  Returns the
1366 * size of the tag on success, negative values on failure.
1367 *
1368 */
1369static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1370				const struct netlbl_lsm_secattr *secattr,
1371				unsigned char *buffer,
1372				u32 buffer_len)
1373{
1374	int ret_val;
1375	u32 tag_len;
1376	u32 level;
1377
1378	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1379		return -EPERM;
1380
1381	ret_val = cipso_v4_map_lvl_hton(doi_def,
1382					secattr->attr.mls.lvl,
1383					&level);
1384	if (ret_val != 0)
1385		return ret_val;
1386
1387	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1388		ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1389						     secattr,
1390						     &buffer[4],
1391						     buffer_len - 4);
1392		if (ret_val < 0)
1393			return ret_val;
1394
1395		tag_len = 4 + ret_val;
1396	} else
1397		tag_len = 4;
1398
1399	buffer[0] = CIPSO_V4_TAG_ENUM;
1400	buffer[1] = tag_len;
1401	buffer[3] = level;
1402
1403	return tag_len;
1404}
1405
1406/**
1407 * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
1408 * @doi_def: the DOI definition
1409 * @tag: the CIPSO tag
1410 * @secattr: the security attributes
1411 *
1412 * Description:
1413 * Parse a CIPSO enumerated tag (tag type #2) and return the security
1414 * attributes in @secattr.  Return zero on success, negatives values on
1415 * failure.
1416 *
1417 */
1418static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1419				  const unsigned char *tag,
1420				  struct netlbl_lsm_secattr *secattr)
1421{
1422	int ret_val;
1423	u8 tag_len = tag[1];
1424	u32 level;
1425
1426	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1427	if (ret_val != 0)
1428		return ret_val;
1429	secattr->attr.mls.lvl = level;
1430	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1431
1432	if (tag_len > 4) {
1433		secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1434		if (secattr->attr.mls.cat == NULL)
1435			return -ENOMEM;
1436
1437		ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1438						     &tag[4],
1439						     tag_len - 4,
1440						     secattr);
1441		if (ret_val != 0) {
1442			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1443			return ret_val;
1444		}
1445
1446		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1447	}
1448
1449	return 0;
1450}
1451
1452/**
1453 * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
1454 * @doi_def: the DOI definition
1455 * @secattr: the security attributes
1456 * @buffer: the option buffer
1457 * @buffer_len: length of buffer in bytes
1458 *
1459 * Description:
1460 * Generate a CIPSO option using the ranged tag, tag type #5.  Returns the
1461 * size of the tag on success, negative values on failure.
1462 *
1463 */
1464static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1465			       const struct netlbl_lsm_secattr *secattr,
1466			       unsigned char *buffer,
1467			       u32 buffer_len)
1468{
1469	int ret_val;
1470	u32 tag_len;
1471	u32 level;
1472
1473	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1474		return -EPERM;
1475
1476	ret_val = cipso_v4_map_lvl_hton(doi_def,
1477					secattr->attr.mls.lvl,
1478					&level);
1479	if (ret_val != 0)
1480		return ret_val;
1481
1482	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1483		ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1484						    secattr,
1485						    &buffer[4],
1486						    buffer_len - 4);
1487		if (ret_val < 0)
1488			return ret_val;
1489
1490		tag_len = 4 + ret_val;
1491	} else
1492		tag_len = 4;
1493
1494	buffer[0] = CIPSO_V4_TAG_RANGE;
1495	buffer[1] = tag_len;
1496	buffer[3] = level;
1497
1498	return tag_len;
1499}
1500
1501/**
1502 * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
1503 * @doi_def: the DOI definition
1504 * @tag: the CIPSO tag
1505 * @secattr: the security attributes
1506 *
1507 * Description:
1508 * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
1509 * in @secattr.  Return zero on success, negatives values on failure.
1510 *
1511 */
1512static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1513				 const unsigned char *tag,
1514				 struct netlbl_lsm_secattr *secattr)
1515{
1516	int ret_val;
1517	u8 tag_len = tag[1];
1518	u32 level;
1519
1520	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1521	if (ret_val != 0)
1522		return ret_val;
1523	secattr->attr.mls.lvl = level;
1524	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1525
1526	if (tag_len > 4) {
1527		secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1528		if (secattr->attr.mls.cat == NULL)
1529			return -ENOMEM;
1530
1531		ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1532						    &tag[4],
1533						    tag_len - 4,
1534						    secattr);
1535		if (ret_val != 0) {
1536			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1537			return ret_val;
1538		}
1539
1540		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1541	}
1542
1543	return 0;
1544}
1545
1546/**
1547 * cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard)
1548 * @doi_def: the DOI definition
1549 * @secattr: the security attributes
1550 * @buffer: the option buffer
1551 * @buffer_len: length of buffer in bytes
1552 *
1553 * Description:
1554 * Generate a CIPSO option using the local tag.  Returns the size of the tag
1555 * on success, negative values on failure.
1556 *
1557 */
1558static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
1559			       const struct netlbl_lsm_secattr *secattr,
1560			       unsigned char *buffer,
1561			       u32 buffer_len)
1562{
1563	if (!(secattr->flags & NETLBL_SECATTR_SECID))
1564		return -EPERM;
1565
1566	buffer[0] = CIPSO_V4_TAG_LOCAL;
1567	buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
1568	*(u32 *)&buffer[2] = secattr->attr.secid;
1569
1570	return CIPSO_V4_TAG_LOC_BLEN;
1571}
1572
1573/**
1574 * cipso_v4_parsetag_loc - Parse a CIPSO local tag
1575 * @doi_def: the DOI definition
1576 * @tag: the CIPSO tag
1577 * @secattr: the security attributes
1578 *
1579 * Description:
1580 * Parse a CIPSO local tag and return the security attributes in @secattr.
1581 * Return zero on success, negatives values on failure.
1582 *
1583 */
1584static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
1585				 const unsigned char *tag,
1586				 struct netlbl_lsm_secattr *secattr)
1587{
1588	secattr->attr.secid = *(u32 *)&tag[2];
1589	secattr->flags |= NETLBL_SECATTR_SECID;
1590
1591	return 0;
1592}
1593
1594/**
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1595 * cipso_v4_validate - Validate a CIPSO option
1596 * @option: the start of the option, on error it is set to point to the error
1597 *
1598 * Description:
1599 * This routine is called to validate a CIPSO option, it checks all of the
1600 * fields to ensure that they are at least valid, see the draft snippet below
1601 * for details.  If the option is valid then a zero value is returned and
1602 * the value of @option is unchanged.  If the option is invalid then a
1603 * non-zero value is returned and @option is adjusted to point to the
1604 * offending portion of the option.  From the IETF draft ...
1605 *
1606 *  "If any field within the CIPSO options, such as the DOI identifier, is not
1607 *   recognized the IP datagram is discarded and an ICMP 'parameter problem'
1608 *   (type 12) is generated and returned.  The ICMP code field is set to 'bad
1609 *   parameter' (code 0) and the pointer is set to the start of the CIPSO field
1610 *   that is unrecognized."
1611 *
1612 */
1613int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
1614{
1615	unsigned char *opt = *option;
1616	unsigned char *tag;
1617	unsigned char opt_iter;
1618	unsigned char err_offset = 0;
1619	u8 opt_len;
1620	u8 tag_len;
1621	struct cipso_v4_doi *doi_def = NULL;
1622	u32 tag_iter;
1623
1624	/* caller already checks for length values that are too large */
1625	opt_len = opt[1];
1626	if (opt_len < 8) {
1627		err_offset = 1;
1628		goto validate_return;
1629	}
1630
1631	rcu_read_lock();
1632	doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2]));
1633	if (doi_def == NULL) {
1634		err_offset = 2;
1635		goto validate_return_locked;
1636	}
1637
1638	opt_iter = CIPSO_V4_HDR_LEN;
1639	tag = opt + opt_iter;
1640	while (opt_iter < opt_len) {
1641		for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1642			if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1643			    ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1644				err_offset = opt_iter;
1645				goto validate_return_locked;
1646			}
1647
 
 
 
 
1648		tag_len = tag[1];
1649		if (tag_len > (opt_len - opt_iter)) {
1650			err_offset = opt_iter + 1;
1651			goto validate_return_locked;
1652		}
1653
1654		switch (tag[0]) {
1655		case CIPSO_V4_TAG_RBITMAP:
1656			if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
1657				err_offset = opt_iter + 1;
1658				goto validate_return_locked;
1659			}
1660
1661			/* We are already going to do all the verification
1662			 * necessary at the socket layer so from our point of
1663			 * view it is safe to turn these checks off (and less
1664			 * work), however, the CIPSO draft says we should do
1665			 * all the CIPSO validations here but it doesn't
1666			 * really specify _exactly_ what we need to validate
1667			 * ... so, just make it a sysctl tunable. */
1668			if (cipso_v4_rbm_strictvalid) {
1669				if (cipso_v4_map_lvl_valid(doi_def,
1670							   tag[3]) < 0) {
1671					err_offset = opt_iter + 3;
1672					goto validate_return_locked;
1673				}
1674				if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
1675				    cipso_v4_map_cat_rbm_valid(doi_def,
1676							    &tag[4],
1677							    tag_len - 4) < 0) {
1678					err_offset = opt_iter + 4;
1679					goto validate_return_locked;
1680				}
1681			}
1682			break;
1683		case CIPSO_V4_TAG_ENUM:
1684			if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
1685				err_offset = opt_iter + 1;
1686				goto validate_return_locked;
1687			}
1688
1689			if (cipso_v4_map_lvl_valid(doi_def,
1690						   tag[3]) < 0) {
1691				err_offset = opt_iter + 3;
1692				goto validate_return_locked;
1693			}
1694			if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
1695			    cipso_v4_map_cat_enum_valid(doi_def,
1696							&tag[4],
1697							tag_len - 4) < 0) {
1698				err_offset = opt_iter + 4;
1699				goto validate_return_locked;
1700			}
1701			break;
1702		case CIPSO_V4_TAG_RANGE:
1703			if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
1704				err_offset = opt_iter + 1;
1705				goto validate_return_locked;
1706			}
1707
1708			if (cipso_v4_map_lvl_valid(doi_def,
1709						   tag[3]) < 0) {
1710				err_offset = opt_iter + 3;
1711				goto validate_return_locked;
1712			}
1713			if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
1714			    cipso_v4_map_cat_rng_valid(doi_def,
1715						       &tag[4],
1716						       tag_len - 4) < 0) {
1717				err_offset = opt_iter + 4;
1718				goto validate_return_locked;
1719			}
1720			break;
1721		case CIPSO_V4_TAG_LOCAL:
1722			/* This is a non-standard tag that we only allow for
1723			 * local connections, so if the incoming interface is
1724			 * not the loopback device drop the packet. Further,
1725			 * there is no legitimate reason for setting this from
1726			 * userspace so reject it if skb is NULL. */
1727			if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
1728				err_offset = opt_iter;
1729				goto validate_return_locked;
1730			}
1731			if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
1732				err_offset = opt_iter + 1;
1733				goto validate_return_locked;
1734			}
1735			break;
1736		default:
1737			err_offset = opt_iter;
1738			goto validate_return_locked;
1739		}
1740
1741		tag += tag_len;
1742		opt_iter += tag_len;
1743	}
1744
1745validate_return_locked:
1746	rcu_read_unlock();
1747validate_return:
1748	*option = opt + err_offset;
1749	return err_offset;
1750}
1751
1752/**
1753 * cipso_v4_error - Send the correct response for a bad packet
1754 * @skb: the packet
1755 * @error: the error code
1756 * @gateway: CIPSO gateway flag
1757 *
1758 * Description:
1759 * Based on the error code given in @error, send an ICMP error message back to
1760 * the originating host.  From the IETF draft ...
1761 *
1762 *  "If the contents of the CIPSO [option] are valid but the security label is
1763 *   outside of the configured host or port label range, the datagram is
1764 *   discarded and an ICMP 'destination unreachable' (type 3) is generated and
1765 *   returned.  The code field of the ICMP is set to 'communication with
1766 *   destination network administratively prohibited' (code 9) or to
1767 *   'communication with destination host administratively prohibited'
1768 *   (code 10).  The value of the code is dependent on whether the originator
1769 *   of the ICMP message is acting as a CIPSO host or a CIPSO gateway.  The
1770 *   recipient of the ICMP message MUST be able to handle either value.  The
1771 *   same procedure is performed if a CIPSO [option] can not be added to an
1772 *   IP packet because it is too large to fit in the IP options area."
1773 *
1774 *  "If the error is triggered by receipt of an ICMP message, the message is
1775 *   discarded and no response is permitted (consistent with general ICMP
1776 *   processing rules)."
1777 *
1778 */
1779void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1780{
1781	if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
1782		return;
1783
1784	if (gateway)
1785		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
1786	else
1787		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
1788}
1789
1790/**
1791 * cipso_v4_genopt - Generate a CIPSO option
1792 * @buf: the option buffer
1793 * @buf_len: the size of opt_buf
1794 * @doi_def: the CIPSO DOI to use
1795 * @secattr: the security attributes
1796 *
1797 * Description:
1798 * Generate a CIPSO option using the DOI definition and security attributes
1799 * passed to the function.  Returns the length of the option on success and
1800 * negative values on failure.
1801 *
1802 */
1803static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
1804			   const struct cipso_v4_doi *doi_def,
1805			   const struct netlbl_lsm_secattr *secattr)
1806{
1807	int ret_val;
1808	u32 iter;
1809
1810	if (buf_len <= CIPSO_V4_HDR_LEN)
1811		return -ENOSPC;
1812
1813	/* XXX - This code assumes only one tag per CIPSO option which isn't
1814	 * really a good assumption to make but since we only support the MAC
1815	 * tags right now it is a safe assumption. */
1816	iter = 0;
1817	do {
1818		memset(buf, 0, buf_len);
1819		switch (doi_def->tags[iter]) {
1820		case CIPSO_V4_TAG_RBITMAP:
1821			ret_val = cipso_v4_gentag_rbm(doi_def,
1822						   secattr,
1823						   &buf[CIPSO_V4_HDR_LEN],
1824						   buf_len - CIPSO_V4_HDR_LEN);
1825			break;
1826		case CIPSO_V4_TAG_ENUM:
1827			ret_val = cipso_v4_gentag_enum(doi_def,
1828						   secattr,
1829						   &buf[CIPSO_V4_HDR_LEN],
1830						   buf_len - CIPSO_V4_HDR_LEN);
1831			break;
1832		case CIPSO_V4_TAG_RANGE:
1833			ret_val = cipso_v4_gentag_rng(doi_def,
1834						   secattr,
1835						   &buf[CIPSO_V4_HDR_LEN],
1836						   buf_len - CIPSO_V4_HDR_LEN);
1837			break;
1838		case CIPSO_V4_TAG_LOCAL:
1839			ret_val = cipso_v4_gentag_loc(doi_def,
1840						   secattr,
1841						   &buf[CIPSO_V4_HDR_LEN],
1842						   buf_len - CIPSO_V4_HDR_LEN);
1843			break;
1844		default:
1845			return -EPERM;
1846		}
1847
1848		iter++;
1849	} while (ret_val < 0 &&
1850		 iter < CIPSO_V4_TAG_MAXCNT &&
1851		 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
1852	if (ret_val < 0)
1853		return ret_val;
1854	cipso_v4_gentag_hdr(doi_def, buf, ret_val);
1855	return CIPSO_V4_HDR_LEN + ret_val;
1856}
1857
1858/**
1859 * cipso_v4_sock_setattr - Add a CIPSO option to a socket
1860 * @sk: the socket
1861 * @doi_def: the CIPSO DOI to use
1862 * @secattr: the specific security attributes of the socket
1863 *
1864 * Description:
1865 * Set the CIPSO option on the given socket using the DOI definition and
1866 * security attributes passed to the function.  This function requires
1867 * exclusive access to @sk, which means it either needs to be in the
1868 * process of being created or locked.  Returns zero on success and negative
1869 * values on failure.
1870 *
1871 */
1872int cipso_v4_sock_setattr(struct sock *sk,
1873			  const struct cipso_v4_doi *doi_def,
1874			  const struct netlbl_lsm_secattr *secattr)
1875{
1876	int ret_val = -EPERM;
1877	unsigned char *buf = NULL;
1878	u32 buf_len;
1879	u32 opt_len;
1880	struct ip_options_rcu *old, *opt = NULL;
1881	struct inet_sock *sk_inet;
1882	struct inet_connection_sock *sk_conn;
1883
1884	/* In the case of sock_create_lite(), the sock->sk field is not
1885	 * defined yet but it is not a problem as the only users of these
1886	 * "lite" PF_INET sockets are functions which do an accept() call
1887	 * afterwards so we will label the socket as part of the accept(). */
1888	if (sk == NULL)
1889		return 0;
1890
1891	/* We allocate the maximum CIPSO option size here so we are probably
1892	 * being a little wasteful, but it makes our life _much_ easier later
1893	 * on and after all we are only talking about 40 bytes. */
1894	buf_len = CIPSO_V4_OPT_LEN_MAX;
1895	buf = kmalloc(buf_len, GFP_ATOMIC);
1896	if (buf == NULL) {
1897		ret_val = -ENOMEM;
1898		goto socket_setattr_failure;
1899	}
1900
1901	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1902	if (ret_val < 0)
1903		goto socket_setattr_failure;
1904	buf_len = ret_val;
1905
1906	/* We can't use ip_options_get() directly because it makes a call to
1907	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1908	 * we won't always have CAP_NET_RAW even though we _always_ want to
1909	 * set the IPOPT_CIPSO option. */
1910	opt_len = (buf_len + 3) & ~3;
1911	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1912	if (opt == NULL) {
1913		ret_val = -ENOMEM;
1914		goto socket_setattr_failure;
1915	}
1916	memcpy(opt->opt.__data, buf, buf_len);
1917	opt->opt.optlen = opt_len;
1918	opt->opt.cipso = sizeof(struct iphdr);
1919	kfree(buf);
1920	buf = NULL;
1921
1922	sk_inet = inet_sk(sk);
1923
1924	old = rcu_dereference_protected(sk_inet->inet_opt, sock_owned_by_user(sk));
 
1925	if (sk_inet->is_icsk) {
1926		sk_conn = inet_csk(sk);
1927		if (old)
1928			sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
1929		sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
1930		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1931	}
1932	rcu_assign_pointer(sk_inet->inet_opt, opt);
1933	if (old)
1934		kfree_rcu(old, rcu);
1935
1936	return 0;
1937
1938socket_setattr_failure:
1939	kfree(buf);
1940	kfree(opt);
1941	return ret_val;
1942}
1943
1944/**
1945 * cipso_v4_req_setattr - Add a CIPSO option to a connection request socket
1946 * @req: the connection request socket
1947 * @doi_def: the CIPSO DOI to use
1948 * @secattr: the specific security attributes of the socket
1949 *
1950 * Description:
1951 * Set the CIPSO option on the given socket using the DOI definition and
1952 * security attributes passed to the function.  Returns zero on success and
1953 * negative values on failure.
1954 *
1955 */
1956int cipso_v4_req_setattr(struct request_sock *req,
1957			 const struct cipso_v4_doi *doi_def,
1958			 const struct netlbl_lsm_secattr *secattr)
1959{
1960	int ret_val = -EPERM;
1961	unsigned char *buf = NULL;
1962	u32 buf_len;
1963	u32 opt_len;
1964	struct ip_options_rcu *opt = NULL;
1965	struct inet_request_sock *req_inet;
1966
1967	/* We allocate the maximum CIPSO option size here so we are probably
1968	 * being a little wasteful, but it makes our life _much_ easier later
1969	 * on and after all we are only talking about 40 bytes. */
1970	buf_len = CIPSO_V4_OPT_LEN_MAX;
1971	buf = kmalloc(buf_len, GFP_ATOMIC);
1972	if (buf == NULL) {
1973		ret_val = -ENOMEM;
1974		goto req_setattr_failure;
1975	}
1976
1977	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1978	if (ret_val < 0)
1979		goto req_setattr_failure;
1980	buf_len = ret_val;
1981
1982	/* We can't use ip_options_get() directly because it makes a call to
1983	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1984	 * we won't always have CAP_NET_RAW even though we _always_ want to
1985	 * set the IPOPT_CIPSO option. */
1986	opt_len = (buf_len + 3) & ~3;
1987	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1988	if (opt == NULL) {
1989		ret_val = -ENOMEM;
1990		goto req_setattr_failure;
1991	}
1992	memcpy(opt->opt.__data, buf, buf_len);
1993	opt->opt.optlen = opt_len;
1994	opt->opt.cipso = sizeof(struct iphdr);
1995	kfree(buf);
1996	buf = NULL;
1997
1998	req_inet = inet_rsk(req);
1999	opt = xchg(&req_inet->opt, opt);
2000	if (opt)
2001		kfree_rcu(opt, rcu);
2002
2003	return 0;
2004
2005req_setattr_failure:
2006	kfree(buf);
2007	kfree(opt);
2008	return ret_val;
2009}
2010
2011/**
2012 * cipso_v4_delopt - Delete the CIPSO option from a set of IP options
2013 * @opt_ptr: IP option pointer
2014 *
2015 * Description:
2016 * Deletes the CIPSO IP option from a set of IP options and makes the necessary
2017 * adjustments to the IP option structure.  Returns zero on success, negative
2018 * values on failure.
2019 *
2020 */
2021static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
2022{
 
2023	int hdr_delta = 0;
2024	struct ip_options_rcu *opt = *opt_ptr;
2025
 
 
2026	if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
2027		u8 cipso_len;
2028		u8 cipso_off;
2029		unsigned char *cipso_ptr;
2030		int iter;
2031		int optlen_new;
2032
2033		cipso_off = opt->opt.cipso - sizeof(struct iphdr);
2034		cipso_ptr = &opt->opt.__data[cipso_off];
2035		cipso_len = cipso_ptr[1];
2036
2037		if (opt->opt.srr > opt->opt.cipso)
2038			opt->opt.srr -= cipso_len;
2039		if (opt->opt.rr > opt->opt.cipso)
2040			opt->opt.rr -= cipso_len;
2041		if (opt->opt.ts > opt->opt.cipso)
2042			opt->opt.ts -= cipso_len;
2043		if (opt->opt.router_alert > opt->opt.cipso)
2044			opt->opt.router_alert -= cipso_len;
2045		opt->opt.cipso = 0;
2046
2047		memmove(cipso_ptr, cipso_ptr + cipso_len,
2048			opt->opt.optlen - cipso_off - cipso_len);
2049
2050		/* determining the new total option length is tricky because of
2051		 * the padding necessary, the only thing i can think to do at
2052		 * this point is walk the options one-by-one, skipping the
2053		 * padding at the end to determine the actual option size and
2054		 * from there we can determine the new total option length */
2055		iter = 0;
2056		optlen_new = 0;
2057		while (iter < opt->opt.optlen)
2058			if (opt->opt.__data[iter] != IPOPT_NOP) {
2059				iter += opt->opt.__data[iter + 1];
2060				optlen_new = iter;
2061			} else
2062				iter++;
2063		hdr_delta = opt->opt.optlen;
2064		opt->opt.optlen = (optlen_new + 3) & ~3;
2065		hdr_delta -= opt->opt.optlen;
2066	} else {
2067		/* only the cipso option was present on the socket so we can
2068		 * remove the entire option struct */
2069		*opt_ptr = NULL;
2070		hdr_delta = opt->opt.optlen;
2071		kfree_rcu(opt, rcu);
2072	}
2073
2074	return hdr_delta;
2075}
2076
2077/**
2078 * cipso_v4_sock_delattr - Delete the CIPSO option from a socket
2079 * @sk: the socket
2080 *
2081 * Description:
2082 * Removes the CIPSO option from a socket, if present.
2083 *
2084 */
2085void cipso_v4_sock_delattr(struct sock *sk)
2086{
2087	int hdr_delta;
2088	struct ip_options_rcu *opt;
2089	struct inet_sock *sk_inet;
 
2090
2091	sk_inet = inet_sk(sk);
2092	opt = rcu_dereference_protected(sk_inet->inet_opt, 1);
2093	if (opt == NULL || opt->opt.cipso == 0)
2094		return;
2095
2096	hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
2097	if (sk_inet->is_icsk && hdr_delta > 0) {
2098		struct inet_connection_sock *sk_conn = inet_csk(sk);
2099		sk_conn->icsk_ext_hdr_len -= hdr_delta;
2100		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
2101	}
2102}
2103
2104/**
2105 * cipso_v4_req_delattr - Delete the CIPSO option from a request socket
2106 * @reg: the request socket
2107 *
2108 * Description:
2109 * Removes the CIPSO option from a request socket, if present.
2110 *
2111 */
2112void cipso_v4_req_delattr(struct request_sock *req)
2113{
2114	struct ip_options_rcu *opt;
2115	struct inet_request_sock *req_inet;
2116
2117	req_inet = inet_rsk(req);
2118	opt = req_inet->opt;
2119	if (opt == NULL || opt->opt.cipso == 0)
2120		return;
2121
2122	cipso_v4_delopt(&req_inet->opt);
2123}
2124
2125/**
2126 * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
2127 * @cipso: the CIPSO v4 option
2128 * @secattr: the security attributes
2129 *
2130 * Description:
2131 * Inspect @cipso and return the security attributes in @secattr.  Returns zero
2132 * on success and negative values on failure.
2133 *
2134 */
2135static int cipso_v4_getattr(const unsigned char *cipso,
2136			    struct netlbl_lsm_secattr *secattr)
2137{
2138	int ret_val = -ENOMSG;
2139	u32 doi;
2140	struct cipso_v4_doi *doi_def;
2141
2142	if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0)
2143		return 0;
2144
2145	doi = get_unaligned_be32(&cipso[2]);
2146	rcu_read_lock();
2147	doi_def = cipso_v4_doi_search(doi);
2148	if (doi_def == NULL)
2149		goto getattr_return;
2150	/* XXX - This code assumes only one tag per CIPSO option which isn't
2151	 * really a good assumption to make but since we only support the MAC
2152	 * tags right now it is a safe assumption. */
2153	switch (cipso[6]) {
2154	case CIPSO_V4_TAG_RBITMAP:
2155		ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr);
2156		break;
2157	case CIPSO_V4_TAG_ENUM:
2158		ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr);
2159		break;
2160	case CIPSO_V4_TAG_RANGE:
2161		ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr);
2162		break;
2163	case CIPSO_V4_TAG_LOCAL:
2164		ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr);
2165		break;
2166	}
2167	if (ret_val == 0)
2168		secattr->type = NETLBL_NLTYPE_CIPSOV4;
2169
2170getattr_return:
2171	rcu_read_unlock();
2172	return ret_val;
2173}
2174
2175/**
2176 * cipso_v4_sock_getattr - Get the security attributes from a sock
2177 * @sk: the sock
2178 * @secattr: the security attributes
2179 *
2180 * Description:
2181 * Query @sk to see if there is a CIPSO option attached to the sock and if
2182 * there is return the CIPSO security attributes in @secattr.  This function
2183 * requires that @sk be locked, or privately held, but it does not do any
2184 * locking itself.  Returns zero on success and negative values on failure.
2185 *
2186 */
2187int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
2188{
2189	struct ip_options_rcu *opt;
2190	int res = -ENOMSG;
2191
2192	rcu_read_lock();
2193	opt = rcu_dereference(inet_sk(sk)->inet_opt);
2194	if (opt && opt->opt.cipso)
2195		res = cipso_v4_getattr(opt->opt.__data +
2196						opt->opt.cipso -
2197						sizeof(struct iphdr),
2198				       secattr);
2199	rcu_read_unlock();
2200	return res;
2201}
2202
2203/**
2204 * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
2205 * @skb: the packet
2206 * @secattr: the security attributes
2207 *
2208 * Description:
2209 * Set the CIPSO option on the given packet based on the security attributes.
2210 * Returns a pointer to the IP header on success and NULL on failure.
2211 *
2212 */
2213int cipso_v4_skbuff_setattr(struct sk_buff *skb,
2214			    const struct cipso_v4_doi *doi_def,
2215			    const struct netlbl_lsm_secattr *secattr)
2216{
2217	int ret_val;
2218	struct iphdr *iph;
2219	struct ip_options *opt = &IPCB(skb)->opt;
2220	unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
2221	u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
2222	u32 opt_len;
2223	int len_delta;
2224
2225	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
2226	if (ret_val < 0)
2227		return ret_val;
2228	buf_len = ret_val;
2229	opt_len = (buf_len + 3) & ~3;
2230
2231	/* we overwrite any existing options to ensure that we have enough
2232	 * room for the CIPSO option, the reason is that we _need_ to guarantee
2233	 * that the security label is applied to the packet - we do the same
2234	 * thing when using the socket options and it hasn't caused a problem,
2235	 * if we need to we can always revisit this choice later */
2236
2237	len_delta = opt_len - opt->optlen;
2238	/* if we don't ensure enough headroom we could panic on the skb_push()
2239	 * call below so make sure we have enough, we are also "mangling" the
2240	 * packet so we should probably do a copy-on-write call anyway */
2241	ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
2242	if (ret_val < 0)
2243		return ret_val;
2244
2245	if (len_delta > 0) {
2246		/* we assume that the header + opt->optlen have already been
2247		 * "pushed" in ip_options_build() or similar */
2248		iph = ip_hdr(skb);
2249		skb_push(skb, len_delta);
2250		memmove((char *)iph - len_delta, iph, iph->ihl << 2);
2251		skb_reset_network_header(skb);
2252		iph = ip_hdr(skb);
2253	} else if (len_delta < 0) {
2254		iph = ip_hdr(skb);
2255		memset(iph + 1, IPOPT_NOP, opt->optlen);
2256	} else
2257		iph = ip_hdr(skb);
2258
2259	if (opt->optlen > 0)
2260		memset(opt, 0, sizeof(*opt));
2261	opt->optlen = opt_len;
2262	opt->cipso = sizeof(struct iphdr);
2263	opt->is_changed = 1;
2264
2265	/* we have to do the following because we are being called from a
2266	 * netfilter hook which means the packet already has had the header
2267	 * fields populated and the checksum calculated - yes this means we
2268	 * are doing more work than needed but we do it to keep the core
2269	 * stack clean and tidy */
2270	memcpy(iph + 1, buf, buf_len);
2271	if (opt_len > buf_len)
2272		memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
2273	if (len_delta != 0) {
2274		iph->ihl = 5 + (opt_len >> 2);
2275		iph->tot_len = htons(skb->len);
2276	}
2277	ip_send_check(iph);
2278
2279	return 0;
2280}
2281
2282/**
2283 * cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet
2284 * @skb: the packet
2285 *
2286 * Description:
2287 * Removes any and all CIPSO options from the given packet.  Returns zero on
2288 * success, negative values on failure.
2289 *
2290 */
2291int cipso_v4_skbuff_delattr(struct sk_buff *skb)
2292{
2293	int ret_val;
2294	struct iphdr *iph;
2295	struct ip_options *opt = &IPCB(skb)->opt;
2296	unsigned char *cipso_ptr;
2297
2298	if (opt->cipso == 0)
2299		return 0;
2300
2301	/* since we are changing the packet we should make a copy */
2302	ret_val = skb_cow(skb, skb_headroom(skb));
2303	if (ret_val < 0)
2304		return ret_val;
2305
2306	/* the easiest thing to do is just replace the cipso option with noop
2307	 * options since we don't change the size of the packet, although we
2308	 * still need to recalculate the checksum */
2309
2310	iph = ip_hdr(skb);
2311	cipso_ptr = (unsigned char *)iph + opt->cipso;
2312	memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
2313	opt->cipso = 0;
2314	opt->is_changed = 1;
2315
2316	ip_send_check(iph);
2317
2318	return 0;
2319}
2320
2321/**
2322 * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
2323 * @skb: the packet
2324 * @secattr: the security attributes
2325 *
2326 * Description:
2327 * Parse the given packet's CIPSO option and return the security attributes.
2328 * Returns zero on success and negative values on failure.
2329 *
2330 */
2331int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
2332			    struct netlbl_lsm_secattr *secattr)
2333{
2334	return cipso_v4_getattr(CIPSO_V4_OPTPTR(skb), secattr);
2335}
2336
2337/*
2338 * Setup Functions
2339 */
2340
2341/**
2342 * cipso_v4_init - Initialize the CIPSO module
2343 *
2344 * Description:
2345 * Initialize the CIPSO module and prepare it for use.  Returns zero on success
2346 * and negative values on failure.
2347 *
2348 */
2349static int __init cipso_v4_init(void)
2350{
2351	int ret_val;
2352
2353	ret_val = cipso_v4_cache_init();
2354	if (ret_val != 0)
2355		panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
2356		      ret_val);
2357
2358	return 0;
2359}
2360
2361subsys_initcall(cipso_v4_init);
v4.17
   1/*
   2 * CIPSO - Commercial IP Security Option
   3 *
   4 * This is an implementation of the CIPSO 2.2 protocol as specified in
   5 * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
   6 * FIPS-188.  While CIPSO never became a full IETF RFC standard many vendors
   7 * have chosen to adopt the protocol and over the years it has become a
   8 * de-facto standard for labeled networking.
   9 *
  10 * The CIPSO draft specification can be found in the kernel's Documentation
  11 * directory as well as the following URL:
  12 *   http://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
  13 * The FIPS-188 specification can be found at the following URL:
  14 *   http://www.itl.nist.gov/fipspubs/fip188.htm
  15 *
  16 * Author: Paul Moore <paul.moore@hp.com>
  17 *
  18 */
  19
  20/*
  21 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  22 *
  23 * This program is free software;  you can redistribute it and/or modify
  24 * it under the terms of the GNU General Public License as published by
  25 * the Free Software Foundation; either version 2 of the License, or
  26 * (at your option) any later version.
  27 *
  28 * This program is distributed in the hope that it will be useful,
  29 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  30 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  31 * the GNU General Public License for more details.
  32 *
  33 * You should have received a copy of the GNU General Public License
  34 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  35 *
  36 */
  37
  38#include <linux/init.h>
  39#include <linux/types.h>
  40#include <linux/rcupdate.h>
  41#include <linux/list.h>
  42#include <linux/spinlock.h>
  43#include <linux/string.h>
  44#include <linux/jhash.h>
  45#include <linux/audit.h>
  46#include <linux/slab.h>
  47#include <net/ip.h>
  48#include <net/icmp.h>
  49#include <net/tcp.h>
  50#include <net/netlabel.h>
  51#include <net/cipso_ipv4.h>
  52#include <linux/atomic.h>
  53#include <linux/bug.h>
  54#include <asm/unaligned.h>
  55
  56/* List of available DOI definitions */
  57/* XXX - This currently assumes a minimal number of different DOIs in use,
  58 * if in practice there are a lot of different DOIs this list should
  59 * probably be turned into a hash table or something similar so we
  60 * can do quick lookups. */
  61static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
  62static LIST_HEAD(cipso_v4_doi_list);
  63
  64/* Label mapping cache */
  65int cipso_v4_cache_enabled = 1;
  66int cipso_v4_cache_bucketsize = 10;
  67#define CIPSO_V4_CACHE_BUCKETBITS     7
  68#define CIPSO_V4_CACHE_BUCKETS        (1 << CIPSO_V4_CACHE_BUCKETBITS)
  69#define CIPSO_V4_CACHE_REORDERLIMIT   10
  70struct cipso_v4_map_cache_bkt {
  71	spinlock_t lock;
  72	u32 size;
  73	struct list_head list;
  74};
  75
  76struct cipso_v4_map_cache_entry {
  77	u32 hash;
  78	unsigned char *key;
  79	size_t key_len;
  80
  81	struct netlbl_lsm_cache *lsm_data;
  82
  83	u32 activity;
  84	struct list_head list;
  85};
  86
  87static struct cipso_v4_map_cache_bkt *cipso_v4_cache;
  88
  89/* Restricted bitmap (tag #1) flags */
  90int cipso_v4_rbm_optfmt = 0;
  91int cipso_v4_rbm_strictvalid = 1;
  92
  93/*
  94 * Protocol Constants
  95 */
  96
  97/* Maximum size of the CIPSO IP option, derived from the fact that the maximum
  98 * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
  99#define CIPSO_V4_OPT_LEN_MAX          40
 100
 101/* Length of the base CIPSO option, this includes the option type (1 byte), the
 102 * option length (1 byte), and the DOI (4 bytes). */
 103#define CIPSO_V4_HDR_LEN              6
 104
 105/* Base length of the restrictive category bitmap tag (tag #1). */
 106#define CIPSO_V4_TAG_RBM_BLEN         4
 107
 108/* Base length of the enumerated category tag (tag #2). */
 109#define CIPSO_V4_TAG_ENUM_BLEN        4
 110
 111/* Base length of the ranged categories bitmap tag (tag #5). */
 112#define CIPSO_V4_TAG_RNG_BLEN         4
 113/* The maximum number of category ranges permitted in the ranged category tag
 114 * (tag #5).  You may note that the IETF draft states that the maximum number
 115 * of category ranges is 7, but if the low end of the last category range is
 116 * zero then it is possible to fit 8 category ranges because the zero should
 117 * be omitted. */
 118#define CIPSO_V4_TAG_RNG_CAT_MAX      8
 119
 120/* Base length of the local tag (non-standard tag).
 121 *  Tag definition (may change between kernel versions)
 122 *
 123 * 0          8          16         24         32
 124 * +----------+----------+----------+----------+
 125 * | 10000000 | 00000110 | 32-bit secid value  |
 126 * +----------+----------+----------+----------+
 127 * | in (host byte order)|
 128 * +----------+----------+
 129 *
 130 */
 131#define CIPSO_V4_TAG_LOC_BLEN         6
 132
 133/*
 134 * Helper Functions
 135 */
 136
 137/**
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 138 * cipso_v4_cache_entry_free - Frees a cache entry
 139 * @entry: the entry to free
 140 *
 141 * Description:
 142 * This function frees the memory associated with a cache entry including the
 143 * LSM cache data if there are no longer any users, i.e. reference count == 0.
 144 *
 145 */
 146static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
 147{
 148	if (entry->lsm_data)
 149		netlbl_secattr_cache_free(entry->lsm_data);
 150	kfree(entry->key);
 151	kfree(entry);
 152}
 153
 154/**
 155 * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
 156 * @key: the hash key
 157 * @key_len: the length of the key in bytes
 158 *
 159 * Description:
 160 * The CIPSO tag hashing function.  Returns a 32-bit hash value.
 161 *
 162 */
 163static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
 164{
 165	return jhash(key, key_len, 0);
 166}
 167
 168/*
 169 * Label Mapping Cache Functions
 170 */
 171
 172/**
 173 * cipso_v4_cache_init - Initialize the CIPSO cache
 174 *
 175 * Description:
 176 * Initializes the CIPSO label mapping cache, this function should be called
 177 * before any of the other functions defined in this file.  Returns zero on
 178 * success, negative values on error.
 179 *
 180 */
 181static int __init cipso_v4_cache_init(void)
 182{
 183	u32 iter;
 184
 185	cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
 186				 sizeof(struct cipso_v4_map_cache_bkt),
 187				 GFP_KERNEL);
 188	if (!cipso_v4_cache)
 189		return -ENOMEM;
 190
 191	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
 192		spin_lock_init(&cipso_v4_cache[iter].lock);
 193		cipso_v4_cache[iter].size = 0;
 194		INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
 195	}
 196
 197	return 0;
 198}
 199
 200/**
 201 * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
 202 *
 203 * Description:
 204 * Invalidates and frees any entries in the CIPSO cache.  Returns zero on
 205 * success and negative values on failure.
 206 *
 207 */
 208void cipso_v4_cache_invalidate(void)
 209{
 210	struct cipso_v4_map_cache_entry *entry, *tmp_entry;
 211	u32 iter;
 212
 213	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
 214		spin_lock_bh(&cipso_v4_cache[iter].lock);
 215		list_for_each_entry_safe(entry,
 216					 tmp_entry,
 217					 &cipso_v4_cache[iter].list, list) {
 218			list_del(&entry->list);
 219			cipso_v4_cache_entry_free(entry);
 220		}
 221		cipso_v4_cache[iter].size = 0;
 222		spin_unlock_bh(&cipso_v4_cache[iter].lock);
 223	}
 224}
 225
 226/**
 227 * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
 228 * @key: the buffer to check
 229 * @key_len: buffer length in bytes
 230 * @secattr: the security attribute struct to use
 231 *
 232 * Description:
 233 * This function checks the cache to see if a label mapping already exists for
 234 * the given key.  If there is a match then the cache is adjusted and the
 235 * @secattr struct is populated with the correct LSM security attributes.  The
 236 * cache is adjusted in the following manner if the entry is not already the
 237 * first in the cache bucket:
 238 *
 239 *  1. The cache entry's activity counter is incremented
 240 *  2. The previous (higher ranking) entry's activity counter is decremented
 241 *  3. If the difference between the two activity counters is geater than
 242 *     CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
 243 *
 244 * Returns zero on success, -ENOENT for a cache miss, and other negative values
 245 * on error.
 246 *
 247 */
 248static int cipso_v4_cache_check(const unsigned char *key,
 249				u32 key_len,
 250				struct netlbl_lsm_secattr *secattr)
 251{
 252	u32 bkt;
 253	struct cipso_v4_map_cache_entry *entry;
 254	struct cipso_v4_map_cache_entry *prev_entry = NULL;
 255	u32 hash;
 256
 257	if (!cipso_v4_cache_enabled)
 258		return -ENOENT;
 259
 260	hash = cipso_v4_map_cache_hash(key, key_len);
 261	bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
 262	spin_lock_bh(&cipso_v4_cache[bkt].lock);
 263	list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
 264		if (entry->hash == hash &&
 265		    entry->key_len == key_len &&
 266		    memcmp(entry->key, key, key_len) == 0) {
 267			entry->activity += 1;
 268			refcount_inc(&entry->lsm_data->refcount);
 269			secattr->cache = entry->lsm_data;
 270			secattr->flags |= NETLBL_SECATTR_CACHE;
 271			secattr->type = NETLBL_NLTYPE_CIPSOV4;
 272			if (!prev_entry) {
 273				spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 274				return 0;
 275			}
 276
 277			if (prev_entry->activity > 0)
 278				prev_entry->activity -= 1;
 279			if (entry->activity > prev_entry->activity &&
 280			    entry->activity - prev_entry->activity >
 281			    CIPSO_V4_CACHE_REORDERLIMIT) {
 282				__list_del(entry->list.prev, entry->list.next);
 283				__list_add(&entry->list,
 284					   prev_entry->list.prev,
 285					   &prev_entry->list);
 286			}
 287
 288			spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 289			return 0;
 290		}
 291		prev_entry = entry;
 292	}
 293	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 294
 295	return -ENOENT;
 296}
 297
 298/**
 299 * cipso_v4_cache_add - Add an entry to the CIPSO cache
 300 * @skb: the packet
 301 * @secattr: the packet's security attributes
 302 *
 303 * Description:
 304 * Add a new entry into the CIPSO label mapping cache.  Add the new entry to
 305 * head of the cache bucket's list, if the cache bucket is out of room remove
 306 * the last entry in the list first.  It is important to note that there is
 307 * currently no checking for duplicate keys.  Returns zero on success,
 308 * negative values on failure.
 309 *
 310 */
 311int cipso_v4_cache_add(const unsigned char *cipso_ptr,
 312		       const struct netlbl_lsm_secattr *secattr)
 313{
 314	int ret_val = -EPERM;
 315	u32 bkt;
 316	struct cipso_v4_map_cache_entry *entry = NULL;
 317	struct cipso_v4_map_cache_entry *old_entry = NULL;
 
 318	u32 cipso_ptr_len;
 319
 320	if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
 321		return 0;
 322
 
 323	cipso_ptr_len = cipso_ptr[1];
 324
 325	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 326	if (!entry)
 327		return -ENOMEM;
 328	entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
 329	if (!entry->key) {
 330		ret_val = -ENOMEM;
 331		goto cache_add_failure;
 332	}
 333	entry->key_len = cipso_ptr_len;
 334	entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
 335	refcount_inc(&secattr->cache->refcount);
 336	entry->lsm_data = secattr->cache;
 337
 338	bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
 339	spin_lock_bh(&cipso_v4_cache[bkt].lock);
 340	if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
 341		list_add(&entry->list, &cipso_v4_cache[bkt].list);
 342		cipso_v4_cache[bkt].size += 1;
 343	} else {
 344		old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
 345				       struct cipso_v4_map_cache_entry, list);
 346		list_del(&old_entry->list);
 347		list_add(&entry->list, &cipso_v4_cache[bkt].list);
 348		cipso_v4_cache_entry_free(old_entry);
 349	}
 350	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 351
 352	return 0;
 353
 354cache_add_failure:
 355	if (entry)
 356		cipso_v4_cache_entry_free(entry);
 357	return ret_val;
 358}
 359
 360/*
 361 * DOI List Functions
 362 */
 363
 364/**
 365 * cipso_v4_doi_search - Searches for a DOI definition
 366 * @doi: the DOI to search for
 367 *
 368 * Description:
 369 * Search the DOI definition list for a DOI definition with a DOI value that
 370 * matches @doi.  The caller is responsible for calling rcu_read_[un]lock().
 371 * Returns a pointer to the DOI definition on success and NULL on failure.
 372 */
 373static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
 374{
 375	struct cipso_v4_doi *iter;
 376
 377	list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
 378		if (iter->doi == doi && refcount_read(&iter->refcount))
 379			return iter;
 380	return NULL;
 381}
 382
 383/**
 384 * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
 385 * @doi_def: the DOI structure
 386 * @audit_info: NetLabel audit information
 387 *
 388 * Description:
 389 * The caller defines a new DOI for use by the CIPSO engine and calls this
 390 * function to add it to the list of acceptable domains.  The caller must
 391 * ensure that the mapping table specified in @doi_def->map meets all of the
 392 * requirements of the mapping type (see cipso_ipv4.h for details).  Returns
 393 * zero on success and non-zero on failure.
 394 *
 395 */
 396int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
 397		     struct netlbl_audit *audit_info)
 398{
 399	int ret_val = -EINVAL;
 400	u32 iter;
 401	u32 doi;
 402	u32 doi_type;
 403	struct audit_buffer *audit_buf;
 404
 405	doi = doi_def->doi;
 406	doi_type = doi_def->type;
 407
 408	if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
 409		goto doi_add_return;
 410	for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
 411		switch (doi_def->tags[iter]) {
 412		case CIPSO_V4_TAG_RBITMAP:
 413			break;
 414		case CIPSO_V4_TAG_RANGE:
 415		case CIPSO_V4_TAG_ENUM:
 416			if (doi_def->type != CIPSO_V4_MAP_PASS)
 417				goto doi_add_return;
 418			break;
 419		case CIPSO_V4_TAG_LOCAL:
 420			if (doi_def->type != CIPSO_V4_MAP_LOCAL)
 421				goto doi_add_return;
 422			break;
 423		case CIPSO_V4_TAG_INVALID:
 424			if (iter == 0)
 425				goto doi_add_return;
 426			break;
 427		default:
 428			goto doi_add_return;
 429		}
 430	}
 431
 432	refcount_set(&doi_def->refcount, 1);
 433
 434	spin_lock(&cipso_v4_doi_list_lock);
 435	if (cipso_v4_doi_search(doi_def->doi)) {
 436		spin_unlock(&cipso_v4_doi_list_lock);
 437		ret_val = -EEXIST;
 438		goto doi_add_return;
 439	}
 440	list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
 441	spin_unlock(&cipso_v4_doi_list_lock);
 442	ret_val = 0;
 443
 444doi_add_return:
 445	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
 446	if (audit_buf) {
 447		const char *type_str;
 448		switch (doi_type) {
 449		case CIPSO_V4_MAP_TRANS:
 450			type_str = "trans";
 451			break;
 452		case CIPSO_V4_MAP_PASS:
 453			type_str = "pass";
 454			break;
 455		case CIPSO_V4_MAP_LOCAL:
 456			type_str = "local";
 457			break;
 458		default:
 459			type_str = "(unknown)";
 460		}
 461		audit_log_format(audit_buf,
 462				 " cipso_doi=%u cipso_type=%s res=%u",
 463				 doi, type_str, ret_val == 0 ? 1 : 0);
 464		audit_log_end(audit_buf);
 465	}
 466
 467	return ret_val;
 468}
 469
 470/**
 471 * cipso_v4_doi_free - Frees a DOI definition
 472 * @doi_def: the DOI definition
 473 *
 474 * Description:
 475 * This function frees all of the memory associated with a DOI definition.
 476 *
 477 */
 478void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
 479{
 480	if (!doi_def)
 481		return;
 482
 483	switch (doi_def->type) {
 484	case CIPSO_V4_MAP_TRANS:
 485		kfree(doi_def->map.std->lvl.cipso);
 486		kfree(doi_def->map.std->lvl.local);
 487		kfree(doi_def->map.std->cat.cipso);
 488		kfree(doi_def->map.std->cat.local);
 489		break;
 490	}
 491	kfree(doi_def);
 492}
 493
 494/**
 495 * cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer
 496 * @entry: the entry's RCU field
 497 *
 498 * Description:
 499 * This function is designed to be used as a callback to the call_rcu()
 500 * function so that the memory allocated to the DOI definition can be released
 501 * safely.
 502 *
 503 */
 504static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
 505{
 506	struct cipso_v4_doi *doi_def;
 507
 508	doi_def = container_of(entry, struct cipso_v4_doi, rcu);
 509	cipso_v4_doi_free(doi_def);
 510}
 511
 512/**
 513 * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
 514 * @doi: the DOI value
 515 * @audit_secid: the LSM secid to use in the audit message
 516 *
 517 * Description:
 518 * Removes a DOI definition from the CIPSO engine.  The NetLabel routines will
 519 * be called to release their own LSM domain mappings as well as our own
 520 * domain list.  Returns zero on success and negative values on failure.
 521 *
 522 */
 523int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
 524{
 525	int ret_val;
 526	struct cipso_v4_doi *doi_def;
 527	struct audit_buffer *audit_buf;
 528
 529	spin_lock(&cipso_v4_doi_list_lock);
 530	doi_def = cipso_v4_doi_search(doi);
 531	if (!doi_def) {
 532		spin_unlock(&cipso_v4_doi_list_lock);
 533		ret_val = -ENOENT;
 534		goto doi_remove_return;
 535	}
 536	if (!refcount_dec_and_test(&doi_def->refcount)) {
 537		spin_unlock(&cipso_v4_doi_list_lock);
 538		ret_val = -EBUSY;
 539		goto doi_remove_return;
 540	}
 541	list_del_rcu(&doi_def->list);
 542	spin_unlock(&cipso_v4_doi_list_lock);
 543
 544	cipso_v4_cache_invalidate();
 545	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 546	ret_val = 0;
 547
 548doi_remove_return:
 549	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
 550	if (audit_buf) {
 551		audit_log_format(audit_buf,
 552				 " cipso_doi=%u res=%u",
 553				 doi, ret_val == 0 ? 1 : 0);
 554		audit_log_end(audit_buf);
 555	}
 556
 557	return ret_val;
 558}
 559
 560/**
 561 * cipso_v4_doi_getdef - Returns a reference to a valid DOI definition
 562 * @doi: the DOI value
 563 *
 564 * Description:
 565 * Searches for a valid DOI definition and if one is found it is returned to
 566 * the caller.  Otherwise NULL is returned.  The caller must ensure that
 567 * rcu_read_lock() is held while accessing the returned definition and the DOI
 568 * definition reference count is decremented when the caller is done.
 569 *
 570 */
 571struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
 572{
 573	struct cipso_v4_doi *doi_def;
 574
 575	rcu_read_lock();
 576	doi_def = cipso_v4_doi_search(doi);
 577	if (!doi_def)
 578		goto doi_getdef_return;
 579	if (!refcount_inc_not_zero(&doi_def->refcount))
 580		doi_def = NULL;
 581
 582doi_getdef_return:
 583	rcu_read_unlock();
 584	return doi_def;
 585}
 586
 587/**
 588 * cipso_v4_doi_putdef - Releases a reference for the given DOI definition
 589 * @doi_def: the DOI definition
 590 *
 591 * Description:
 592 * Releases a DOI definition reference obtained from cipso_v4_doi_getdef().
 593 *
 594 */
 595void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
 596{
 597	if (!doi_def)
 598		return;
 599
 600	if (!refcount_dec_and_test(&doi_def->refcount))
 601		return;
 602	spin_lock(&cipso_v4_doi_list_lock);
 603	list_del_rcu(&doi_def->list);
 604	spin_unlock(&cipso_v4_doi_list_lock);
 605
 606	cipso_v4_cache_invalidate();
 607	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 608}
 609
 610/**
 611 * cipso_v4_doi_walk - Iterate through the DOI definitions
 612 * @skip_cnt: skip past this number of DOI definitions, updated
 613 * @callback: callback for each DOI definition
 614 * @cb_arg: argument for the callback function
 615 *
 616 * Description:
 617 * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
 618 * For each entry call @callback, if @callback returns a negative value stop
 619 * 'walking' through the list and return.  Updates the value in @skip_cnt upon
 620 * return.  Returns zero on success, negative values on failure.
 621 *
 622 */
 623int cipso_v4_doi_walk(u32 *skip_cnt,
 624		     int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
 625		     void *cb_arg)
 626{
 627	int ret_val = -ENOENT;
 628	u32 doi_cnt = 0;
 629	struct cipso_v4_doi *iter_doi;
 630
 631	rcu_read_lock();
 632	list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
 633		if (refcount_read(&iter_doi->refcount) > 0) {
 634			if (doi_cnt++ < *skip_cnt)
 635				continue;
 636			ret_val = callback(iter_doi, cb_arg);
 637			if (ret_val < 0) {
 638				doi_cnt--;
 639				goto doi_walk_return;
 640			}
 641		}
 642
 643doi_walk_return:
 644	rcu_read_unlock();
 645	*skip_cnt = doi_cnt;
 646	return ret_val;
 647}
 648
 649/*
 650 * Label Mapping Functions
 651 */
 652
 653/**
 654 * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
 655 * @doi_def: the DOI definition
 656 * @level: the level to check
 657 *
 658 * Description:
 659 * Checks the given level against the given DOI definition and returns a
 660 * negative value if the level does not have a valid mapping and a zero value
 661 * if the level is defined by the DOI.
 662 *
 663 */
 664static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
 665{
 666	switch (doi_def->type) {
 667	case CIPSO_V4_MAP_PASS:
 668		return 0;
 669	case CIPSO_V4_MAP_TRANS:
 670		if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
 671			return 0;
 672		break;
 673	}
 674
 675	return -EFAULT;
 676}
 677
 678/**
 679 * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
 680 * @doi_def: the DOI definition
 681 * @host_lvl: the host MLS level
 682 * @net_lvl: the network/CIPSO MLS level
 683 *
 684 * Description:
 685 * Perform a label mapping to translate a local MLS level to the correct
 686 * CIPSO level using the given DOI definition.  Returns zero on success,
 687 * negative values otherwise.
 688 *
 689 */
 690static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
 691				 u32 host_lvl,
 692				 u32 *net_lvl)
 693{
 694	switch (doi_def->type) {
 695	case CIPSO_V4_MAP_PASS:
 696		*net_lvl = host_lvl;
 697		return 0;
 698	case CIPSO_V4_MAP_TRANS:
 699		if (host_lvl < doi_def->map.std->lvl.local_size &&
 700		    doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
 701			*net_lvl = doi_def->map.std->lvl.local[host_lvl];
 702			return 0;
 703		}
 704		return -EPERM;
 705	}
 706
 707	return -EINVAL;
 708}
 709
 710/**
 711 * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
 712 * @doi_def: the DOI definition
 713 * @net_lvl: the network/CIPSO MLS level
 714 * @host_lvl: the host MLS level
 715 *
 716 * Description:
 717 * Perform a label mapping to translate a CIPSO level to the correct local MLS
 718 * level using the given DOI definition.  Returns zero on success, negative
 719 * values otherwise.
 720 *
 721 */
 722static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
 723				 u32 net_lvl,
 724				 u32 *host_lvl)
 725{
 726	struct cipso_v4_std_map_tbl *map_tbl;
 727
 728	switch (doi_def->type) {
 729	case CIPSO_V4_MAP_PASS:
 730		*host_lvl = net_lvl;
 731		return 0;
 732	case CIPSO_V4_MAP_TRANS:
 733		map_tbl = doi_def->map.std;
 734		if (net_lvl < map_tbl->lvl.cipso_size &&
 735		    map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
 736			*host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
 737			return 0;
 738		}
 739		return -EPERM;
 740	}
 741
 742	return -EINVAL;
 743}
 744
 745/**
 746 * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
 747 * @doi_def: the DOI definition
 748 * @bitmap: category bitmap
 749 * @bitmap_len: bitmap length in bytes
 750 *
 751 * Description:
 752 * Checks the given category bitmap against the given DOI definition and
 753 * returns a negative value if any of the categories in the bitmap do not have
 754 * a valid mapping and a zero value if all of the categories are valid.
 755 *
 756 */
 757static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
 758				      const unsigned char *bitmap,
 759				      u32 bitmap_len)
 760{
 761	int cat = -1;
 762	u32 bitmap_len_bits = bitmap_len * 8;
 763	u32 cipso_cat_size;
 764	u32 *cipso_array;
 765
 766	switch (doi_def->type) {
 767	case CIPSO_V4_MAP_PASS:
 768		return 0;
 769	case CIPSO_V4_MAP_TRANS:
 770		cipso_cat_size = doi_def->map.std->cat.cipso_size;
 771		cipso_array = doi_def->map.std->cat.cipso;
 772		for (;;) {
 773			cat = netlbl_bitmap_walk(bitmap,
 774						 bitmap_len_bits,
 775						 cat + 1,
 776						 1);
 777			if (cat < 0)
 778				break;
 779			if (cat >= cipso_cat_size ||
 780			    cipso_array[cat] >= CIPSO_V4_INV_CAT)
 781				return -EFAULT;
 782		}
 783
 784		if (cat == -1)
 785			return 0;
 786		break;
 787	}
 788
 789	return -EFAULT;
 790}
 791
 792/**
 793 * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
 794 * @doi_def: the DOI definition
 795 * @secattr: the security attributes
 796 * @net_cat: the zero'd out category bitmap in network/CIPSO format
 797 * @net_cat_len: the length of the CIPSO bitmap in bytes
 798 *
 799 * Description:
 800 * Perform a label mapping to translate a local MLS category bitmap to the
 801 * correct CIPSO bitmap using the given DOI definition.  Returns the minimum
 802 * size in bytes of the network bitmap on success, negative values otherwise.
 803 *
 804 */
 805static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
 806				     const struct netlbl_lsm_secattr *secattr,
 807				     unsigned char *net_cat,
 808				     u32 net_cat_len)
 809{
 810	int host_spot = -1;
 811	u32 net_spot = CIPSO_V4_INV_CAT;
 812	u32 net_spot_max = 0;
 813	u32 net_clen_bits = net_cat_len * 8;
 814	u32 host_cat_size = 0;
 815	u32 *host_cat_array = NULL;
 816
 817	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
 818		host_cat_size = doi_def->map.std->cat.local_size;
 819		host_cat_array = doi_def->map.std->cat.local;
 820	}
 821
 822	for (;;) {
 823		host_spot = netlbl_catmap_walk(secattr->attr.mls.cat,
 824					       host_spot + 1);
 825		if (host_spot < 0)
 826			break;
 827
 828		switch (doi_def->type) {
 829		case CIPSO_V4_MAP_PASS:
 830			net_spot = host_spot;
 831			break;
 832		case CIPSO_V4_MAP_TRANS:
 833			if (host_spot >= host_cat_size)
 834				return -EPERM;
 835			net_spot = host_cat_array[host_spot];
 836			if (net_spot >= CIPSO_V4_INV_CAT)
 837				return -EPERM;
 838			break;
 839		}
 840		if (net_spot >= net_clen_bits)
 841			return -ENOSPC;
 842		netlbl_bitmap_setbit(net_cat, net_spot, 1);
 843
 844		if (net_spot > net_spot_max)
 845			net_spot_max = net_spot;
 846	}
 847
 848	if (++net_spot_max % 8)
 849		return net_spot_max / 8 + 1;
 850	return net_spot_max / 8;
 851}
 852
 853/**
 854 * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
 855 * @doi_def: the DOI definition
 856 * @net_cat: the category bitmap in network/CIPSO format
 857 * @net_cat_len: the length of the CIPSO bitmap in bytes
 858 * @secattr: the security attributes
 859 *
 860 * Description:
 861 * Perform a label mapping to translate a CIPSO bitmap to the correct local
 862 * MLS category bitmap using the given DOI definition.  Returns zero on
 863 * success, negative values on failure.
 864 *
 865 */
 866static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
 867				     const unsigned char *net_cat,
 868				     u32 net_cat_len,
 869				     struct netlbl_lsm_secattr *secattr)
 870{
 871	int ret_val;
 872	int net_spot = -1;
 873	u32 host_spot = CIPSO_V4_INV_CAT;
 874	u32 net_clen_bits = net_cat_len * 8;
 875	u32 net_cat_size = 0;
 876	u32 *net_cat_array = NULL;
 877
 878	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
 879		net_cat_size = doi_def->map.std->cat.cipso_size;
 880		net_cat_array = doi_def->map.std->cat.cipso;
 881	}
 882
 883	for (;;) {
 884		net_spot = netlbl_bitmap_walk(net_cat,
 885					      net_clen_bits,
 886					      net_spot + 1,
 887					      1);
 888		if (net_spot < 0) {
 889			if (net_spot == -2)
 890				return -EFAULT;
 891			return 0;
 892		}
 893
 894		switch (doi_def->type) {
 895		case CIPSO_V4_MAP_PASS:
 896			host_spot = net_spot;
 897			break;
 898		case CIPSO_V4_MAP_TRANS:
 899			if (net_spot >= net_cat_size)
 900				return -EPERM;
 901			host_spot = net_cat_array[net_spot];
 902			if (host_spot >= CIPSO_V4_INV_CAT)
 903				return -EPERM;
 904			break;
 905		}
 906		ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
 907						       host_spot,
 908						       GFP_ATOMIC);
 909		if (ret_val != 0)
 910			return ret_val;
 911	}
 912
 913	return -EINVAL;
 914}
 915
 916/**
 917 * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
 918 * @doi_def: the DOI definition
 919 * @enumcat: category list
 920 * @enumcat_len: length of the category list in bytes
 921 *
 922 * Description:
 923 * Checks the given categories against the given DOI definition and returns a
 924 * negative value if any of the categories do not have a valid mapping and a
 925 * zero value if all of the categories are valid.
 926 *
 927 */
 928static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
 929				       const unsigned char *enumcat,
 930				       u32 enumcat_len)
 931{
 932	u16 cat;
 933	int cat_prev = -1;
 934	u32 iter;
 935
 936	if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
 937		return -EFAULT;
 938
 939	for (iter = 0; iter < enumcat_len; iter += 2) {
 940		cat = get_unaligned_be16(&enumcat[iter]);
 941		if (cat <= cat_prev)
 942			return -EFAULT;
 943		cat_prev = cat;
 944	}
 945
 946	return 0;
 947}
 948
 949/**
 950 * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
 951 * @doi_def: the DOI definition
 952 * @secattr: the security attributes
 953 * @net_cat: the zero'd out category list in network/CIPSO format
 954 * @net_cat_len: the length of the CIPSO category list in bytes
 955 *
 956 * Description:
 957 * Perform a label mapping to translate a local MLS category bitmap to the
 958 * correct CIPSO category list using the given DOI definition.   Returns the
 959 * size in bytes of the network category bitmap on success, negative values
 960 * otherwise.
 961 *
 962 */
 963static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
 964				      const struct netlbl_lsm_secattr *secattr,
 965				      unsigned char *net_cat,
 966				      u32 net_cat_len)
 967{
 968	int cat = -1;
 969	u32 cat_iter = 0;
 970
 971	for (;;) {
 972		cat = netlbl_catmap_walk(secattr->attr.mls.cat, cat + 1);
 
 973		if (cat < 0)
 974			break;
 975		if ((cat_iter + 2) > net_cat_len)
 976			return -ENOSPC;
 977
 978		*((__be16 *)&net_cat[cat_iter]) = htons(cat);
 979		cat_iter += 2;
 980	}
 981
 982	return cat_iter;
 983}
 984
 985/**
 986 * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
 987 * @doi_def: the DOI definition
 988 * @net_cat: the category list in network/CIPSO format
 989 * @net_cat_len: the length of the CIPSO bitmap in bytes
 990 * @secattr: the security attributes
 991 *
 992 * Description:
 993 * Perform a label mapping to translate a CIPSO category list to the correct
 994 * local MLS category bitmap using the given DOI definition.  Returns zero on
 995 * success, negative values on failure.
 996 *
 997 */
 998static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
 999				      const unsigned char *net_cat,
1000				      u32 net_cat_len,
1001				      struct netlbl_lsm_secattr *secattr)
1002{
1003	int ret_val;
1004	u32 iter;
1005
1006	for (iter = 0; iter < net_cat_len; iter += 2) {
1007		ret_val = netlbl_catmap_setbit(&secattr->attr.mls.cat,
1008					     get_unaligned_be16(&net_cat[iter]),
1009					     GFP_ATOMIC);
1010		if (ret_val != 0)
1011			return ret_val;
1012	}
1013
1014	return 0;
1015}
1016
1017/**
1018 * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
1019 * @doi_def: the DOI definition
1020 * @rngcat: category list
1021 * @rngcat_len: length of the category list in bytes
1022 *
1023 * Description:
1024 * Checks the given categories against the given DOI definition and returns a
1025 * negative value if any of the categories do not have a valid mapping and a
1026 * zero value if all of the categories are valid.
1027 *
1028 */
1029static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1030				      const unsigned char *rngcat,
1031				      u32 rngcat_len)
1032{
1033	u16 cat_high;
1034	u16 cat_low;
1035	u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1036	u32 iter;
1037
1038	if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1039		return -EFAULT;
1040
1041	for (iter = 0; iter < rngcat_len; iter += 4) {
1042		cat_high = get_unaligned_be16(&rngcat[iter]);
1043		if ((iter + 4) <= rngcat_len)
1044			cat_low = get_unaligned_be16(&rngcat[iter + 2]);
1045		else
1046			cat_low = 0;
1047
1048		if (cat_high > cat_prev)
1049			return -EFAULT;
1050
1051		cat_prev = cat_low;
1052	}
1053
1054	return 0;
1055}
1056
1057/**
1058 * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
1059 * @doi_def: the DOI definition
1060 * @secattr: the security attributes
1061 * @net_cat: the zero'd out category list in network/CIPSO format
1062 * @net_cat_len: the length of the CIPSO category list in bytes
1063 *
1064 * Description:
1065 * Perform a label mapping to translate a local MLS category bitmap to the
1066 * correct CIPSO category list using the given DOI definition.   Returns the
1067 * size in bytes of the network category bitmap on success, negative values
1068 * otherwise.
1069 *
1070 */
1071static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1072				     const struct netlbl_lsm_secattr *secattr,
1073				     unsigned char *net_cat,
1074				     u32 net_cat_len)
1075{
1076	int iter = -1;
1077	u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1078	u32 array_cnt = 0;
1079	u32 cat_size = 0;
1080
1081	/* make sure we don't overflow the 'array[]' variable */
1082	if (net_cat_len >
1083	    (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1084		return -ENOSPC;
1085
1086	for (;;) {
1087		iter = netlbl_catmap_walk(secattr->attr.mls.cat, iter + 1);
 
1088		if (iter < 0)
1089			break;
1090		cat_size += (iter == 0 ? 0 : sizeof(u16));
1091		if (cat_size > net_cat_len)
1092			return -ENOSPC;
1093		array[array_cnt++] = iter;
1094
1095		iter = netlbl_catmap_walkrng(secattr->attr.mls.cat, iter);
 
1096		if (iter < 0)
1097			return -EFAULT;
1098		cat_size += sizeof(u16);
1099		if (cat_size > net_cat_len)
1100			return -ENOSPC;
1101		array[array_cnt++] = iter;
1102	}
1103
1104	for (iter = 0; array_cnt > 0;) {
1105		*((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1106		iter += 2;
1107		array_cnt--;
1108		if (array[array_cnt] != 0) {
1109			*((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1110			iter += 2;
1111		}
1112	}
1113
1114	return cat_size;
1115}
1116
1117/**
1118 * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
1119 * @doi_def: the DOI definition
1120 * @net_cat: the category list in network/CIPSO format
1121 * @net_cat_len: the length of the CIPSO bitmap in bytes
1122 * @secattr: the security attributes
1123 *
1124 * Description:
1125 * Perform a label mapping to translate a CIPSO category list to the correct
1126 * local MLS category bitmap using the given DOI definition.  Returns zero on
1127 * success, negative values on failure.
1128 *
1129 */
1130static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1131				     const unsigned char *net_cat,
1132				     u32 net_cat_len,
1133				     struct netlbl_lsm_secattr *secattr)
1134{
1135	int ret_val;
1136	u32 net_iter;
1137	u16 cat_low;
1138	u16 cat_high;
1139
1140	for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
1141		cat_high = get_unaligned_be16(&net_cat[net_iter]);
1142		if ((net_iter + 4) <= net_cat_len)
1143			cat_low = get_unaligned_be16(&net_cat[net_iter + 2]);
1144		else
1145			cat_low = 0;
1146
1147		ret_val = netlbl_catmap_setrng(&secattr->attr.mls.cat,
1148					       cat_low,
1149					       cat_high,
1150					       GFP_ATOMIC);
1151		if (ret_val != 0)
1152			return ret_val;
1153	}
1154
1155	return 0;
1156}
1157
1158/*
1159 * Protocol Handling Functions
1160 */
1161
1162/**
1163 * cipso_v4_gentag_hdr - Generate a CIPSO option header
1164 * @doi_def: the DOI definition
1165 * @len: the total tag length in bytes, not including this header
1166 * @buf: the CIPSO option buffer
1167 *
1168 * Description:
1169 * Write a CIPSO header into the beginning of @buffer.
1170 *
1171 */
1172static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1173				unsigned char *buf,
1174				u32 len)
1175{
1176	buf[0] = IPOPT_CIPSO;
1177	buf[1] = CIPSO_V4_HDR_LEN + len;
1178	*(__be32 *)&buf[2] = htonl(doi_def->doi);
1179}
1180
1181/**
1182 * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
1183 * @doi_def: the DOI definition
1184 * @secattr: the security attributes
1185 * @buffer: the option buffer
1186 * @buffer_len: length of buffer in bytes
1187 *
1188 * Description:
1189 * Generate a CIPSO option using the restricted bitmap tag, tag type #1.  The
1190 * actual buffer length may be larger than the indicated size due to
1191 * translation between host and network category bitmaps.  Returns the size of
1192 * the tag on success, negative values on failure.
1193 *
1194 */
1195static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1196			       const struct netlbl_lsm_secattr *secattr,
1197			       unsigned char *buffer,
1198			       u32 buffer_len)
1199{
1200	int ret_val;
1201	u32 tag_len;
1202	u32 level;
1203
1204	if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1205		return -EPERM;
1206
1207	ret_val = cipso_v4_map_lvl_hton(doi_def,
1208					secattr->attr.mls.lvl,
1209					&level);
1210	if (ret_val != 0)
1211		return ret_val;
1212
1213	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1214		ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
1215						    secattr,
1216						    &buffer[4],
1217						    buffer_len - 4);
1218		if (ret_val < 0)
1219			return ret_val;
1220
1221		/* This will send packets using the "optimized" format when
1222		 * possible as specified in  section 3.4.2.6 of the
1223		 * CIPSO draft. */
1224		if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
1225			tag_len = 14;
1226		else
1227			tag_len = 4 + ret_val;
1228	} else
1229		tag_len = 4;
1230
1231	buffer[0] = CIPSO_V4_TAG_RBITMAP;
1232	buffer[1] = tag_len;
1233	buffer[3] = level;
1234
1235	return tag_len;
1236}
1237
1238/**
1239 * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
1240 * @doi_def: the DOI definition
1241 * @tag: the CIPSO tag
1242 * @secattr: the security attributes
1243 *
1244 * Description:
1245 * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
1246 * attributes in @secattr.  Return zero on success, negatives values on
1247 * failure.
1248 *
1249 */
1250static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1251				 const unsigned char *tag,
1252				 struct netlbl_lsm_secattr *secattr)
1253{
1254	int ret_val;
1255	u8 tag_len = tag[1];
1256	u32 level;
1257
1258	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1259	if (ret_val != 0)
1260		return ret_val;
1261	secattr->attr.mls.lvl = level;
1262	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1263
1264	if (tag_len > 4) {
 
 
 
 
1265		ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1266						    &tag[4],
1267						    tag_len - 4,
1268						    secattr);
1269		if (ret_val != 0) {
1270			netlbl_catmap_free(secattr->attr.mls.cat);
1271			return ret_val;
1272		}
1273
1274		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1275	}
1276
1277	return 0;
1278}
1279
1280/**
1281 * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
1282 * @doi_def: the DOI definition
1283 * @secattr: the security attributes
1284 * @buffer: the option buffer
1285 * @buffer_len: length of buffer in bytes
1286 *
1287 * Description:
1288 * Generate a CIPSO option using the enumerated tag, tag type #2.  Returns the
1289 * size of the tag on success, negative values on failure.
1290 *
1291 */
1292static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1293				const struct netlbl_lsm_secattr *secattr,
1294				unsigned char *buffer,
1295				u32 buffer_len)
1296{
1297	int ret_val;
1298	u32 tag_len;
1299	u32 level;
1300
1301	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1302		return -EPERM;
1303
1304	ret_val = cipso_v4_map_lvl_hton(doi_def,
1305					secattr->attr.mls.lvl,
1306					&level);
1307	if (ret_val != 0)
1308		return ret_val;
1309
1310	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1311		ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1312						     secattr,
1313						     &buffer[4],
1314						     buffer_len - 4);
1315		if (ret_val < 0)
1316			return ret_val;
1317
1318		tag_len = 4 + ret_val;
1319	} else
1320		tag_len = 4;
1321
1322	buffer[0] = CIPSO_V4_TAG_ENUM;
1323	buffer[1] = tag_len;
1324	buffer[3] = level;
1325
1326	return tag_len;
1327}
1328
1329/**
1330 * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
1331 * @doi_def: the DOI definition
1332 * @tag: the CIPSO tag
1333 * @secattr: the security attributes
1334 *
1335 * Description:
1336 * Parse a CIPSO enumerated tag (tag type #2) and return the security
1337 * attributes in @secattr.  Return zero on success, negatives values on
1338 * failure.
1339 *
1340 */
1341static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1342				  const unsigned char *tag,
1343				  struct netlbl_lsm_secattr *secattr)
1344{
1345	int ret_val;
1346	u8 tag_len = tag[1];
1347	u32 level;
1348
1349	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1350	if (ret_val != 0)
1351		return ret_val;
1352	secattr->attr.mls.lvl = level;
1353	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1354
1355	if (tag_len > 4) {
 
 
 
 
1356		ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1357						     &tag[4],
1358						     tag_len - 4,
1359						     secattr);
1360		if (ret_val != 0) {
1361			netlbl_catmap_free(secattr->attr.mls.cat);
1362			return ret_val;
1363		}
1364
1365		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1366	}
1367
1368	return 0;
1369}
1370
1371/**
1372 * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
1373 * @doi_def: the DOI definition
1374 * @secattr: the security attributes
1375 * @buffer: the option buffer
1376 * @buffer_len: length of buffer in bytes
1377 *
1378 * Description:
1379 * Generate a CIPSO option using the ranged tag, tag type #5.  Returns the
1380 * size of the tag on success, negative values on failure.
1381 *
1382 */
1383static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1384			       const struct netlbl_lsm_secattr *secattr,
1385			       unsigned char *buffer,
1386			       u32 buffer_len)
1387{
1388	int ret_val;
1389	u32 tag_len;
1390	u32 level;
1391
1392	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1393		return -EPERM;
1394
1395	ret_val = cipso_v4_map_lvl_hton(doi_def,
1396					secattr->attr.mls.lvl,
1397					&level);
1398	if (ret_val != 0)
1399		return ret_val;
1400
1401	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1402		ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1403						    secattr,
1404						    &buffer[4],
1405						    buffer_len - 4);
1406		if (ret_val < 0)
1407			return ret_val;
1408
1409		tag_len = 4 + ret_val;
1410	} else
1411		tag_len = 4;
1412
1413	buffer[0] = CIPSO_V4_TAG_RANGE;
1414	buffer[1] = tag_len;
1415	buffer[3] = level;
1416
1417	return tag_len;
1418}
1419
1420/**
1421 * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
1422 * @doi_def: the DOI definition
1423 * @tag: the CIPSO tag
1424 * @secattr: the security attributes
1425 *
1426 * Description:
1427 * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
1428 * in @secattr.  Return zero on success, negatives values on failure.
1429 *
1430 */
1431static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1432				 const unsigned char *tag,
1433				 struct netlbl_lsm_secattr *secattr)
1434{
1435	int ret_val;
1436	u8 tag_len = tag[1];
1437	u32 level;
1438
1439	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1440	if (ret_val != 0)
1441		return ret_val;
1442	secattr->attr.mls.lvl = level;
1443	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1444
1445	if (tag_len > 4) {
 
 
 
 
1446		ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1447						    &tag[4],
1448						    tag_len - 4,
1449						    secattr);
1450		if (ret_val != 0) {
1451			netlbl_catmap_free(secattr->attr.mls.cat);
1452			return ret_val;
1453		}
1454
1455		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1456	}
1457
1458	return 0;
1459}
1460
1461/**
1462 * cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard)
1463 * @doi_def: the DOI definition
1464 * @secattr: the security attributes
1465 * @buffer: the option buffer
1466 * @buffer_len: length of buffer in bytes
1467 *
1468 * Description:
1469 * Generate a CIPSO option using the local tag.  Returns the size of the tag
1470 * on success, negative values on failure.
1471 *
1472 */
1473static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
1474			       const struct netlbl_lsm_secattr *secattr,
1475			       unsigned char *buffer,
1476			       u32 buffer_len)
1477{
1478	if (!(secattr->flags & NETLBL_SECATTR_SECID))
1479		return -EPERM;
1480
1481	buffer[0] = CIPSO_V4_TAG_LOCAL;
1482	buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
1483	*(u32 *)&buffer[2] = secattr->attr.secid;
1484
1485	return CIPSO_V4_TAG_LOC_BLEN;
1486}
1487
1488/**
1489 * cipso_v4_parsetag_loc - Parse a CIPSO local tag
1490 * @doi_def: the DOI definition
1491 * @tag: the CIPSO tag
1492 * @secattr: the security attributes
1493 *
1494 * Description:
1495 * Parse a CIPSO local tag and return the security attributes in @secattr.
1496 * Return zero on success, negatives values on failure.
1497 *
1498 */
1499static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
1500				 const unsigned char *tag,
1501				 struct netlbl_lsm_secattr *secattr)
1502{
1503	secattr->attr.secid = *(u32 *)&tag[2];
1504	secattr->flags |= NETLBL_SECATTR_SECID;
1505
1506	return 0;
1507}
1508
1509/**
1510 * cipso_v4_optptr - Find the CIPSO option in the packet
1511 * @skb: the packet
1512 *
1513 * Description:
1514 * Parse the packet's IP header looking for a CIPSO option.  Returns a pointer
1515 * to the start of the CIPSO option on success, NULL if one if not found.
1516 *
1517 */
1518unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
1519{
1520	const struct iphdr *iph = ip_hdr(skb);
1521	unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
1522	int optlen;
1523	int taglen;
1524
1525	for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
1526		switch (optptr[0]) {
1527		case IPOPT_CIPSO:
1528			return optptr;
1529		case IPOPT_END:
1530			return NULL;
1531		case IPOPT_NOOP:
1532			taglen = 1;
1533			break;
1534		default:
1535			taglen = optptr[1];
1536		}
1537		optlen -= taglen;
1538		optptr += taglen;
1539	}
1540
1541	return NULL;
1542}
1543
1544/**
1545 * cipso_v4_validate - Validate a CIPSO option
1546 * @option: the start of the option, on error it is set to point to the error
1547 *
1548 * Description:
1549 * This routine is called to validate a CIPSO option, it checks all of the
1550 * fields to ensure that they are at least valid, see the draft snippet below
1551 * for details.  If the option is valid then a zero value is returned and
1552 * the value of @option is unchanged.  If the option is invalid then a
1553 * non-zero value is returned and @option is adjusted to point to the
1554 * offending portion of the option.  From the IETF draft ...
1555 *
1556 *  "If any field within the CIPSO options, such as the DOI identifier, is not
1557 *   recognized the IP datagram is discarded and an ICMP 'parameter problem'
1558 *   (type 12) is generated and returned.  The ICMP code field is set to 'bad
1559 *   parameter' (code 0) and the pointer is set to the start of the CIPSO field
1560 *   that is unrecognized."
1561 *
1562 */
1563int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
1564{
1565	unsigned char *opt = *option;
1566	unsigned char *tag;
1567	unsigned char opt_iter;
1568	unsigned char err_offset = 0;
1569	u8 opt_len;
1570	u8 tag_len;
1571	struct cipso_v4_doi *doi_def = NULL;
1572	u32 tag_iter;
1573
1574	/* caller already checks for length values that are too large */
1575	opt_len = opt[1];
1576	if (opt_len < 8) {
1577		err_offset = 1;
1578		goto validate_return;
1579	}
1580
1581	rcu_read_lock();
1582	doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2]));
1583	if (!doi_def) {
1584		err_offset = 2;
1585		goto validate_return_locked;
1586	}
1587
1588	opt_iter = CIPSO_V4_HDR_LEN;
1589	tag = opt + opt_iter;
1590	while (opt_iter < opt_len) {
1591		for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1592			if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1593			    ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1594				err_offset = opt_iter;
1595				goto validate_return_locked;
1596			}
1597
1598		if (opt_iter + 1 == opt_len) {
1599			err_offset = opt_iter;
1600			goto validate_return_locked;
1601		}
1602		tag_len = tag[1];
1603		if (tag_len > (opt_len - opt_iter)) {
1604			err_offset = opt_iter + 1;
1605			goto validate_return_locked;
1606		}
1607
1608		switch (tag[0]) {
1609		case CIPSO_V4_TAG_RBITMAP:
1610			if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
1611				err_offset = opt_iter + 1;
1612				goto validate_return_locked;
1613			}
1614
1615			/* We are already going to do all the verification
1616			 * necessary at the socket layer so from our point of
1617			 * view it is safe to turn these checks off (and less
1618			 * work), however, the CIPSO draft says we should do
1619			 * all the CIPSO validations here but it doesn't
1620			 * really specify _exactly_ what we need to validate
1621			 * ... so, just make it a sysctl tunable. */
1622			if (cipso_v4_rbm_strictvalid) {
1623				if (cipso_v4_map_lvl_valid(doi_def,
1624							   tag[3]) < 0) {
1625					err_offset = opt_iter + 3;
1626					goto validate_return_locked;
1627				}
1628				if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
1629				    cipso_v4_map_cat_rbm_valid(doi_def,
1630							    &tag[4],
1631							    tag_len - 4) < 0) {
1632					err_offset = opt_iter + 4;
1633					goto validate_return_locked;
1634				}
1635			}
1636			break;
1637		case CIPSO_V4_TAG_ENUM:
1638			if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
1639				err_offset = opt_iter + 1;
1640				goto validate_return_locked;
1641			}
1642
1643			if (cipso_v4_map_lvl_valid(doi_def,
1644						   tag[3]) < 0) {
1645				err_offset = opt_iter + 3;
1646				goto validate_return_locked;
1647			}
1648			if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
1649			    cipso_v4_map_cat_enum_valid(doi_def,
1650							&tag[4],
1651							tag_len - 4) < 0) {
1652				err_offset = opt_iter + 4;
1653				goto validate_return_locked;
1654			}
1655			break;
1656		case CIPSO_V4_TAG_RANGE:
1657			if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
1658				err_offset = opt_iter + 1;
1659				goto validate_return_locked;
1660			}
1661
1662			if (cipso_v4_map_lvl_valid(doi_def,
1663						   tag[3]) < 0) {
1664				err_offset = opt_iter + 3;
1665				goto validate_return_locked;
1666			}
1667			if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
1668			    cipso_v4_map_cat_rng_valid(doi_def,
1669						       &tag[4],
1670						       tag_len - 4) < 0) {
1671				err_offset = opt_iter + 4;
1672				goto validate_return_locked;
1673			}
1674			break;
1675		case CIPSO_V4_TAG_LOCAL:
1676			/* This is a non-standard tag that we only allow for
1677			 * local connections, so if the incoming interface is
1678			 * not the loopback device drop the packet. Further,
1679			 * there is no legitimate reason for setting this from
1680			 * userspace so reject it if skb is NULL. */
1681			if (!skb || !(skb->dev->flags & IFF_LOOPBACK)) {
1682				err_offset = opt_iter;
1683				goto validate_return_locked;
1684			}
1685			if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
1686				err_offset = opt_iter + 1;
1687				goto validate_return_locked;
1688			}
1689			break;
1690		default:
1691			err_offset = opt_iter;
1692			goto validate_return_locked;
1693		}
1694
1695		tag += tag_len;
1696		opt_iter += tag_len;
1697	}
1698
1699validate_return_locked:
1700	rcu_read_unlock();
1701validate_return:
1702	*option = opt + err_offset;
1703	return err_offset;
1704}
1705
1706/**
1707 * cipso_v4_error - Send the correct response for a bad packet
1708 * @skb: the packet
1709 * @error: the error code
1710 * @gateway: CIPSO gateway flag
1711 *
1712 * Description:
1713 * Based on the error code given in @error, send an ICMP error message back to
1714 * the originating host.  From the IETF draft ...
1715 *
1716 *  "If the contents of the CIPSO [option] are valid but the security label is
1717 *   outside of the configured host or port label range, the datagram is
1718 *   discarded and an ICMP 'destination unreachable' (type 3) is generated and
1719 *   returned.  The code field of the ICMP is set to 'communication with
1720 *   destination network administratively prohibited' (code 9) or to
1721 *   'communication with destination host administratively prohibited'
1722 *   (code 10).  The value of the code is dependent on whether the originator
1723 *   of the ICMP message is acting as a CIPSO host or a CIPSO gateway.  The
1724 *   recipient of the ICMP message MUST be able to handle either value.  The
1725 *   same procedure is performed if a CIPSO [option] can not be added to an
1726 *   IP packet because it is too large to fit in the IP options area."
1727 *
1728 *  "If the error is triggered by receipt of an ICMP message, the message is
1729 *   discarded and no response is permitted (consistent with general ICMP
1730 *   processing rules)."
1731 *
1732 */
1733void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1734{
1735	if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
1736		return;
1737
1738	if (gateway)
1739		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
1740	else
1741		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
1742}
1743
1744/**
1745 * cipso_v4_genopt - Generate a CIPSO option
1746 * @buf: the option buffer
1747 * @buf_len: the size of opt_buf
1748 * @doi_def: the CIPSO DOI to use
1749 * @secattr: the security attributes
1750 *
1751 * Description:
1752 * Generate a CIPSO option using the DOI definition and security attributes
1753 * passed to the function.  Returns the length of the option on success and
1754 * negative values on failure.
1755 *
1756 */
1757static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
1758			   const struct cipso_v4_doi *doi_def,
1759			   const struct netlbl_lsm_secattr *secattr)
1760{
1761	int ret_val;
1762	u32 iter;
1763
1764	if (buf_len <= CIPSO_V4_HDR_LEN)
1765		return -ENOSPC;
1766
1767	/* XXX - This code assumes only one tag per CIPSO option which isn't
1768	 * really a good assumption to make but since we only support the MAC
1769	 * tags right now it is a safe assumption. */
1770	iter = 0;
1771	do {
1772		memset(buf, 0, buf_len);
1773		switch (doi_def->tags[iter]) {
1774		case CIPSO_V4_TAG_RBITMAP:
1775			ret_val = cipso_v4_gentag_rbm(doi_def,
1776						   secattr,
1777						   &buf[CIPSO_V4_HDR_LEN],
1778						   buf_len - CIPSO_V4_HDR_LEN);
1779			break;
1780		case CIPSO_V4_TAG_ENUM:
1781			ret_val = cipso_v4_gentag_enum(doi_def,
1782						   secattr,
1783						   &buf[CIPSO_V4_HDR_LEN],
1784						   buf_len - CIPSO_V4_HDR_LEN);
1785			break;
1786		case CIPSO_V4_TAG_RANGE:
1787			ret_val = cipso_v4_gentag_rng(doi_def,
1788						   secattr,
1789						   &buf[CIPSO_V4_HDR_LEN],
1790						   buf_len - CIPSO_V4_HDR_LEN);
1791			break;
1792		case CIPSO_V4_TAG_LOCAL:
1793			ret_val = cipso_v4_gentag_loc(doi_def,
1794						   secattr,
1795						   &buf[CIPSO_V4_HDR_LEN],
1796						   buf_len - CIPSO_V4_HDR_LEN);
1797			break;
1798		default:
1799			return -EPERM;
1800		}
1801
1802		iter++;
1803	} while (ret_val < 0 &&
1804		 iter < CIPSO_V4_TAG_MAXCNT &&
1805		 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
1806	if (ret_val < 0)
1807		return ret_val;
1808	cipso_v4_gentag_hdr(doi_def, buf, ret_val);
1809	return CIPSO_V4_HDR_LEN + ret_val;
1810}
1811
1812/**
1813 * cipso_v4_sock_setattr - Add a CIPSO option to a socket
1814 * @sk: the socket
1815 * @doi_def: the CIPSO DOI to use
1816 * @secattr: the specific security attributes of the socket
1817 *
1818 * Description:
1819 * Set the CIPSO option on the given socket using the DOI definition and
1820 * security attributes passed to the function.  This function requires
1821 * exclusive access to @sk, which means it either needs to be in the
1822 * process of being created or locked.  Returns zero on success and negative
1823 * values on failure.
1824 *
1825 */
1826int cipso_v4_sock_setattr(struct sock *sk,
1827			  const struct cipso_v4_doi *doi_def,
1828			  const struct netlbl_lsm_secattr *secattr)
1829{
1830	int ret_val = -EPERM;
1831	unsigned char *buf = NULL;
1832	u32 buf_len;
1833	u32 opt_len;
1834	struct ip_options_rcu *old, *opt = NULL;
1835	struct inet_sock *sk_inet;
1836	struct inet_connection_sock *sk_conn;
1837
1838	/* In the case of sock_create_lite(), the sock->sk field is not
1839	 * defined yet but it is not a problem as the only users of these
1840	 * "lite" PF_INET sockets are functions which do an accept() call
1841	 * afterwards so we will label the socket as part of the accept(). */
1842	if (!sk)
1843		return 0;
1844
1845	/* We allocate the maximum CIPSO option size here so we are probably
1846	 * being a little wasteful, but it makes our life _much_ easier later
1847	 * on and after all we are only talking about 40 bytes. */
1848	buf_len = CIPSO_V4_OPT_LEN_MAX;
1849	buf = kmalloc(buf_len, GFP_ATOMIC);
1850	if (!buf) {
1851		ret_val = -ENOMEM;
1852		goto socket_setattr_failure;
1853	}
1854
1855	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1856	if (ret_val < 0)
1857		goto socket_setattr_failure;
1858	buf_len = ret_val;
1859
1860	/* We can't use ip_options_get() directly because it makes a call to
1861	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1862	 * we won't always have CAP_NET_RAW even though we _always_ want to
1863	 * set the IPOPT_CIPSO option. */
1864	opt_len = (buf_len + 3) & ~3;
1865	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1866	if (!opt) {
1867		ret_val = -ENOMEM;
1868		goto socket_setattr_failure;
1869	}
1870	memcpy(opt->opt.__data, buf, buf_len);
1871	opt->opt.optlen = opt_len;
1872	opt->opt.cipso = sizeof(struct iphdr);
1873	kfree(buf);
1874	buf = NULL;
1875
1876	sk_inet = inet_sk(sk);
1877
1878	old = rcu_dereference_protected(sk_inet->inet_opt,
1879					lockdep_sock_is_held(sk));
1880	if (sk_inet->is_icsk) {
1881		sk_conn = inet_csk(sk);
1882		if (old)
1883			sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
1884		sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
1885		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1886	}
1887	rcu_assign_pointer(sk_inet->inet_opt, opt);
1888	if (old)
1889		kfree_rcu(old, rcu);
1890
1891	return 0;
1892
1893socket_setattr_failure:
1894	kfree(buf);
1895	kfree(opt);
1896	return ret_val;
1897}
1898
1899/**
1900 * cipso_v4_req_setattr - Add a CIPSO option to a connection request socket
1901 * @req: the connection request socket
1902 * @doi_def: the CIPSO DOI to use
1903 * @secattr: the specific security attributes of the socket
1904 *
1905 * Description:
1906 * Set the CIPSO option on the given socket using the DOI definition and
1907 * security attributes passed to the function.  Returns zero on success and
1908 * negative values on failure.
1909 *
1910 */
1911int cipso_v4_req_setattr(struct request_sock *req,
1912			 const struct cipso_v4_doi *doi_def,
1913			 const struct netlbl_lsm_secattr *secattr)
1914{
1915	int ret_val = -EPERM;
1916	unsigned char *buf = NULL;
1917	u32 buf_len;
1918	u32 opt_len;
1919	struct ip_options_rcu *opt = NULL;
1920	struct inet_request_sock *req_inet;
1921
1922	/* We allocate the maximum CIPSO option size here so we are probably
1923	 * being a little wasteful, but it makes our life _much_ easier later
1924	 * on and after all we are only talking about 40 bytes. */
1925	buf_len = CIPSO_V4_OPT_LEN_MAX;
1926	buf = kmalloc(buf_len, GFP_ATOMIC);
1927	if (!buf) {
1928		ret_val = -ENOMEM;
1929		goto req_setattr_failure;
1930	}
1931
1932	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1933	if (ret_val < 0)
1934		goto req_setattr_failure;
1935	buf_len = ret_val;
1936
1937	/* We can't use ip_options_get() directly because it makes a call to
1938	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1939	 * we won't always have CAP_NET_RAW even though we _always_ want to
1940	 * set the IPOPT_CIPSO option. */
1941	opt_len = (buf_len + 3) & ~3;
1942	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1943	if (!opt) {
1944		ret_val = -ENOMEM;
1945		goto req_setattr_failure;
1946	}
1947	memcpy(opt->opt.__data, buf, buf_len);
1948	opt->opt.optlen = opt_len;
1949	opt->opt.cipso = sizeof(struct iphdr);
1950	kfree(buf);
1951	buf = NULL;
1952
1953	req_inet = inet_rsk(req);
1954	opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt);
1955	if (opt)
1956		kfree_rcu(opt, rcu);
1957
1958	return 0;
1959
1960req_setattr_failure:
1961	kfree(buf);
1962	kfree(opt);
1963	return ret_val;
1964}
1965
1966/**
1967 * cipso_v4_delopt - Delete the CIPSO option from a set of IP options
1968 * @opt_ptr: IP option pointer
1969 *
1970 * Description:
1971 * Deletes the CIPSO IP option from a set of IP options and makes the necessary
1972 * adjustments to the IP option structure.  Returns zero on success, negative
1973 * values on failure.
1974 *
1975 */
1976static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
1977{
1978	struct ip_options_rcu *opt = rcu_dereference_protected(*opt_ptr, 1);
1979	int hdr_delta = 0;
 
1980
1981	if (!opt || opt->opt.cipso == 0)
1982		return 0;
1983	if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
1984		u8 cipso_len;
1985		u8 cipso_off;
1986		unsigned char *cipso_ptr;
1987		int iter;
1988		int optlen_new;
1989
1990		cipso_off = opt->opt.cipso - sizeof(struct iphdr);
1991		cipso_ptr = &opt->opt.__data[cipso_off];
1992		cipso_len = cipso_ptr[1];
1993
1994		if (opt->opt.srr > opt->opt.cipso)
1995			opt->opt.srr -= cipso_len;
1996		if (opt->opt.rr > opt->opt.cipso)
1997			opt->opt.rr -= cipso_len;
1998		if (opt->opt.ts > opt->opt.cipso)
1999			opt->opt.ts -= cipso_len;
2000		if (opt->opt.router_alert > opt->opt.cipso)
2001			opt->opt.router_alert -= cipso_len;
2002		opt->opt.cipso = 0;
2003
2004		memmove(cipso_ptr, cipso_ptr + cipso_len,
2005			opt->opt.optlen - cipso_off - cipso_len);
2006
2007		/* determining the new total option length is tricky because of
2008		 * the padding necessary, the only thing i can think to do at
2009		 * this point is walk the options one-by-one, skipping the
2010		 * padding at the end to determine the actual option size and
2011		 * from there we can determine the new total option length */
2012		iter = 0;
2013		optlen_new = 0;
2014		while (iter < opt->opt.optlen)
2015			if (opt->opt.__data[iter] != IPOPT_NOP) {
2016				iter += opt->opt.__data[iter + 1];
2017				optlen_new = iter;
2018			} else
2019				iter++;
2020		hdr_delta = opt->opt.optlen;
2021		opt->opt.optlen = (optlen_new + 3) & ~3;
2022		hdr_delta -= opt->opt.optlen;
2023	} else {
2024		/* only the cipso option was present on the socket so we can
2025		 * remove the entire option struct */
2026		*opt_ptr = NULL;
2027		hdr_delta = opt->opt.optlen;
2028		kfree_rcu(opt, rcu);
2029	}
2030
2031	return hdr_delta;
2032}
2033
2034/**
2035 * cipso_v4_sock_delattr - Delete the CIPSO option from a socket
2036 * @sk: the socket
2037 *
2038 * Description:
2039 * Removes the CIPSO option from a socket, if present.
2040 *
2041 */
2042void cipso_v4_sock_delattr(struct sock *sk)
2043{
 
 
2044	struct inet_sock *sk_inet;
2045	int hdr_delta;
2046
2047	sk_inet = inet_sk(sk);
 
 
 
2048
2049	hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
2050	if (sk_inet->is_icsk && hdr_delta > 0) {
2051		struct inet_connection_sock *sk_conn = inet_csk(sk);
2052		sk_conn->icsk_ext_hdr_len -= hdr_delta;
2053		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
2054	}
2055}
2056
2057/**
2058 * cipso_v4_req_delattr - Delete the CIPSO option from a request socket
2059 * @reg: the request socket
2060 *
2061 * Description:
2062 * Removes the CIPSO option from a request socket, if present.
2063 *
2064 */
2065void cipso_v4_req_delattr(struct request_sock *req)
2066{
2067	cipso_v4_delopt(&inet_rsk(req)->ireq_opt);
 
 
 
 
 
 
 
 
2068}
2069
2070/**
2071 * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
2072 * @cipso: the CIPSO v4 option
2073 * @secattr: the security attributes
2074 *
2075 * Description:
2076 * Inspect @cipso and return the security attributes in @secattr.  Returns zero
2077 * on success and negative values on failure.
2078 *
2079 */
2080int cipso_v4_getattr(const unsigned char *cipso,
2081		     struct netlbl_lsm_secattr *secattr)
2082{
2083	int ret_val = -ENOMSG;
2084	u32 doi;
2085	struct cipso_v4_doi *doi_def;
2086
2087	if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0)
2088		return 0;
2089
2090	doi = get_unaligned_be32(&cipso[2]);
2091	rcu_read_lock();
2092	doi_def = cipso_v4_doi_search(doi);
2093	if (!doi_def)
2094		goto getattr_return;
2095	/* XXX - This code assumes only one tag per CIPSO option which isn't
2096	 * really a good assumption to make but since we only support the MAC
2097	 * tags right now it is a safe assumption. */
2098	switch (cipso[6]) {
2099	case CIPSO_V4_TAG_RBITMAP:
2100		ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr);
2101		break;
2102	case CIPSO_V4_TAG_ENUM:
2103		ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr);
2104		break;
2105	case CIPSO_V4_TAG_RANGE:
2106		ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr);
2107		break;
2108	case CIPSO_V4_TAG_LOCAL:
2109		ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr);
2110		break;
2111	}
2112	if (ret_val == 0)
2113		secattr->type = NETLBL_NLTYPE_CIPSOV4;
2114
2115getattr_return:
2116	rcu_read_unlock();
2117	return ret_val;
2118}
2119
2120/**
2121 * cipso_v4_sock_getattr - Get the security attributes from a sock
2122 * @sk: the sock
2123 * @secattr: the security attributes
2124 *
2125 * Description:
2126 * Query @sk to see if there is a CIPSO option attached to the sock and if
2127 * there is return the CIPSO security attributes in @secattr.  This function
2128 * requires that @sk be locked, or privately held, but it does not do any
2129 * locking itself.  Returns zero on success and negative values on failure.
2130 *
2131 */
2132int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
2133{
2134	struct ip_options_rcu *opt;
2135	int res = -ENOMSG;
2136
2137	rcu_read_lock();
2138	opt = rcu_dereference(inet_sk(sk)->inet_opt);
2139	if (opt && opt->opt.cipso)
2140		res = cipso_v4_getattr(opt->opt.__data +
2141						opt->opt.cipso -
2142						sizeof(struct iphdr),
2143				       secattr);
2144	rcu_read_unlock();
2145	return res;
2146}
2147
2148/**
2149 * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
2150 * @skb: the packet
2151 * @secattr: the security attributes
2152 *
2153 * Description:
2154 * Set the CIPSO option on the given packet based on the security attributes.
2155 * Returns a pointer to the IP header on success and NULL on failure.
2156 *
2157 */
2158int cipso_v4_skbuff_setattr(struct sk_buff *skb,
2159			    const struct cipso_v4_doi *doi_def,
2160			    const struct netlbl_lsm_secattr *secattr)
2161{
2162	int ret_val;
2163	struct iphdr *iph;
2164	struct ip_options *opt = &IPCB(skb)->opt;
2165	unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
2166	u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
2167	u32 opt_len;
2168	int len_delta;
2169
2170	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
2171	if (ret_val < 0)
2172		return ret_val;
2173	buf_len = ret_val;
2174	opt_len = (buf_len + 3) & ~3;
2175
2176	/* we overwrite any existing options to ensure that we have enough
2177	 * room for the CIPSO option, the reason is that we _need_ to guarantee
2178	 * that the security label is applied to the packet - we do the same
2179	 * thing when using the socket options and it hasn't caused a problem,
2180	 * if we need to we can always revisit this choice later */
2181
2182	len_delta = opt_len - opt->optlen;
2183	/* if we don't ensure enough headroom we could panic on the skb_push()
2184	 * call below so make sure we have enough, we are also "mangling" the
2185	 * packet so we should probably do a copy-on-write call anyway */
2186	ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
2187	if (ret_val < 0)
2188		return ret_val;
2189
2190	if (len_delta > 0) {
2191		/* we assume that the header + opt->optlen have already been
2192		 * "pushed" in ip_options_build() or similar */
2193		iph = ip_hdr(skb);
2194		skb_push(skb, len_delta);
2195		memmove((char *)iph - len_delta, iph, iph->ihl << 2);
2196		skb_reset_network_header(skb);
2197		iph = ip_hdr(skb);
2198	} else if (len_delta < 0) {
2199		iph = ip_hdr(skb);
2200		memset(iph + 1, IPOPT_NOP, opt->optlen);
2201	} else
2202		iph = ip_hdr(skb);
2203
2204	if (opt->optlen > 0)
2205		memset(opt, 0, sizeof(*opt));
2206	opt->optlen = opt_len;
2207	opt->cipso = sizeof(struct iphdr);
2208	opt->is_changed = 1;
2209
2210	/* we have to do the following because we are being called from a
2211	 * netfilter hook which means the packet already has had the header
2212	 * fields populated and the checksum calculated - yes this means we
2213	 * are doing more work than needed but we do it to keep the core
2214	 * stack clean and tidy */
2215	memcpy(iph + 1, buf, buf_len);
2216	if (opt_len > buf_len)
2217		memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
2218	if (len_delta != 0) {
2219		iph->ihl = 5 + (opt_len >> 2);
2220		iph->tot_len = htons(skb->len);
2221	}
2222	ip_send_check(iph);
2223
2224	return 0;
2225}
2226
2227/**
2228 * cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet
2229 * @skb: the packet
2230 *
2231 * Description:
2232 * Removes any and all CIPSO options from the given packet.  Returns zero on
2233 * success, negative values on failure.
2234 *
2235 */
2236int cipso_v4_skbuff_delattr(struct sk_buff *skb)
2237{
2238	int ret_val;
2239	struct iphdr *iph;
2240	struct ip_options *opt = &IPCB(skb)->opt;
2241	unsigned char *cipso_ptr;
2242
2243	if (opt->cipso == 0)
2244		return 0;
2245
2246	/* since we are changing the packet we should make a copy */
2247	ret_val = skb_cow(skb, skb_headroom(skb));
2248	if (ret_val < 0)
2249		return ret_val;
2250
2251	/* the easiest thing to do is just replace the cipso option with noop
2252	 * options since we don't change the size of the packet, although we
2253	 * still need to recalculate the checksum */
2254
2255	iph = ip_hdr(skb);
2256	cipso_ptr = (unsigned char *)iph + opt->cipso;
2257	memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
2258	opt->cipso = 0;
2259	opt->is_changed = 1;
2260
2261	ip_send_check(iph);
2262
2263	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2264}
2265
2266/*
2267 * Setup Functions
2268 */
2269
2270/**
2271 * cipso_v4_init - Initialize the CIPSO module
2272 *
2273 * Description:
2274 * Initialize the CIPSO module and prepare it for use.  Returns zero on success
2275 * and negative values on failure.
2276 *
2277 */
2278static int __init cipso_v4_init(void)
2279{
2280	int ret_val;
2281
2282	ret_val = cipso_v4_cache_init();
2283	if (ret_val != 0)
2284		panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
2285		      ret_val);
2286
2287	return 0;
2288}
2289
2290subsys_initcall(cipso_v4_init);