1/*
   2 * CIPSO - Commercial IP Security Option
   3 *
   4 * This is an implementation of the CIPSO 2.2 protocol as specified in
   5 * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
   6 * FIPS-188.  While CIPSO never became a full IETF RFC standard many vendors
   7 * have chosen to adopt the protocol and over the years it has become a
   8 * de-facto standard for labeled networking.
   9 *
  10 * The CIPSO draft specification can be found in the kernel's Documentation
  11 * directory as well as the following URL:
  12 *   http://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
  13 * The FIPS-188 specification can be found at the following URL:
  14 *   http://www.itl.nist.gov/fipspubs/fip188.htm
  15 *
  16 * Author: Paul Moore <paul.moore@hp.com>
  17 *
  18 */
  19
  20/*
  21 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  22 *
  23 * This program is free software;  you can redistribute it and/or modify
  24 * it under the terms of the GNU General Public License as published by
  25 * the Free Software Foundation; either version 2 of the License, or
  26 * (at your option) any later version.
  27 *
  28 * This program is distributed in the hope that it will be useful,
  29 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  30 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  31 * the GNU General Public License for more details.
  32 *
  33 * You should have received a copy of the GNU General Public License
  34 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  35 *
  36 */
  37
  38#include <linux/init.h>
  39#include <linux/types.h>
  40#include <linux/rcupdate.h>
  41#include <linux/list.h>
  42#include <linux/spinlock.h>
  43#include <linux/string.h>
  44#include <linux/jhash.h>
  45#include <linux/audit.h>
  46#include <linux/slab.h>
  47#include <net/ip.h>
  48#include <net/icmp.h>
  49#include <net/tcp.h>
  50#include <net/netlabel.h>
  51#include <net/cipso_ipv4.h>
  52#include <linux/atomic.h>
  53#include <asm/bug.h>
  54#include <asm/unaligned.h>
  55
  56/* List of available DOI definitions */
  57/* XXX - This currently assumes a minimal number of different DOIs in use,
  58 * if in practice there are a lot of different DOIs this list should
  59 * probably be turned into a hash table or something similar so we
  60 * can do quick lookups. */
  61static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
  62static LIST_HEAD(cipso_v4_doi_list);
  63
  64/* Label mapping cache */
  65int cipso_v4_cache_enabled = 1;
  66int cipso_v4_cache_bucketsize = 10;
  67#define CIPSO_V4_CACHE_BUCKETBITS     7
  68#define CIPSO_V4_CACHE_BUCKETS        (1 << CIPSO_V4_CACHE_BUCKETBITS)
  69#define CIPSO_V4_CACHE_REORDERLIMIT   10
  70struct cipso_v4_map_cache_bkt {
  71	spinlock_t lock;
  72	u32 size;
  73	struct list_head list;
  74};
  75struct cipso_v4_map_cache_entry {
  76	u32 hash;
  77	unsigned char *key;
  78	size_t key_len;
  79
  80	struct netlbl_lsm_cache *lsm_data;
  81
  82	u32 activity;
  83	struct list_head list;
  84};
  85static struct cipso_v4_map_cache_bkt *cipso_v4_cache = NULL;
  86
  87/* Restricted bitmap (tag #1) flags */
  88int cipso_v4_rbm_optfmt = 0;
  89int cipso_v4_rbm_strictvalid = 1;
  90
  91/*
  92 * Protocol Constants
  93 */
  94
  95/* Maximum size of the CIPSO IP option, derived from the fact that the maximum
  96 * IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
  97#define CIPSO_V4_OPT_LEN_MAX          40
  98
  99/* Length of the base CIPSO option, this includes the option type (1 byte), the
 100 * option length (1 byte), and the DOI (4 bytes). */
 101#define CIPSO_V4_HDR_LEN              6
 102
 103/* Base length of the restrictive category bitmap tag (tag #1). */
 104#define CIPSO_V4_TAG_RBM_BLEN         4
 105
 106/* Base length of the enumerated category tag (tag #2). */
 107#define CIPSO_V4_TAG_ENUM_BLEN        4
 108
 109/* Base length of the ranged categories bitmap tag (tag #5). */
 110#define CIPSO_V4_TAG_RNG_BLEN         4
 111/* The maximum number of category ranges permitted in the ranged category tag
 112 * (tag #5).  You may note that the IETF draft states that the maximum number
 113 * of category ranges is 7, but if the low end of the last category range is
 114 * zero then it is possible to fit 8 category ranges because the zero should
 115 * be omitted. */
 116#define CIPSO_V4_TAG_RNG_CAT_MAX      8
 117
 118/* Base length of the local tag (non-standard tag).
 119 *  Tag definition (may change between kernel versions)
 120 *
 121 * 0          8          16         24         32
 122 * +----------+----------+----------+----------+
 123 * | 10000000 | 00000110 | 32-bit secid value  |
 124 * +----------+----------+----------+----------+
 125 * | in (host byte order)|
 126 * +----------+----------+
 127 *
 128 */
 129#define CIPSO_V4_TAG_LOC_BLEN         6
 130
 131/*
 132 * Helper Functions
 133 */
 134
 135/**
 136 * cipso_v4_bitmap_walk - Walk a bitmap looking for a bit
 137 * @bitmap: the bitmap
 138 * @bitmap_len: length in bits
 139 * @offset: starting offset
 140 * @state: if non-zero, look for a set (1) bit else look for a cleared (0) bit
 141 *
 142 * Description:
 143 * Starting at @offset, walk the bitmap from left to right until either the
 144 * desired bit is found or we reach the end.  Return the bit offset, -1 if
 145 * not found, or -2 if error.
 146 */
 147static int cipso_v4_bitmap_walk(const unsigned char *bitmap,
 148				u32 bitmap_len,
 149				u32 offset,
 150				u8 state)
 151{
 152	u32 bit_spot;
 153	u32 byte_offset;
 154	unsigned char bitmask;
 155	unsigned char byte;
 156
 157	/* gcc always rounds to zero when doing integer division */
 158	byte_offset = offset / 8;
 159	byte = bitmap[byte_offset];
 160	bit_spot = offset;
 161	bitmask = 0x80 >> (offset % 8);
 162
 163	while (bit_spot < bitmap_len) {
 164		if ((state && (byte & bitmask) == bitmask) ||
 165		    (state == 0 && (byte & bitmask) == 0))
 166			return bit_spot;
 167
 168		bit_spot++;
 169		bitmask >>= 1;
 170		if (bitmask == 0) {
 171			byte = bitmap[++byte_offset];
 172			bitmask = 0x80;
 173		}
 174	}
 175
 176	return -1;
 177}
 178
 179/**
 180 * cipso_v4_bitmap_setbit - Sets a single bit in a bitmap
 181 * @bitmap: the bitmap
 182 * @bit: the bit
 183 * @state: if non-zero, set the bit (1) else clear the bit (0)
 184 *
 185 * Description:
 186 * Set a single bit in the bitmask.  Returns zero on success, negative values
 187 * on error.
 188 */
 189static void cipso_v4_bitmap_setbit(unsigned char *bitmap,
 190				   u32 bit,
 191				   u8 state)
 192{
 193	u32 byte_spot;
 194	u8 bitmask;
 195
 196	/* gcc always rounds to zero when doing integer division */
 197	byte_spot = bit / 8;
 198	bitmask = 0x80 >> (bit % 8);
 199	if (state)
 200		bitmap[byte_spot] |= bitmask;
 201	else
 202		bitmap[byte_spot] &= ~bitmask;
 203}
 204
 205/**
 206 * cipso_v4_cache_entry_free - Frees a cache entry
 207 * @entry: the entry to free
 208 *
 209 * Description:
 210 * This function frees the memory associated with a cache entry including the
 211 * LSM cache data if there are no longer any users, i.e. reference count == 0.
 212 *
 213 */
 214static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
 215{
 216	if (entry->lsm_data)
 217		netlbl_secattr_cache_free(entry->lsm_data);
 218	kfree(entry->key);
 219	kfree(entry);
 220}
 221
 222/**
 223 * cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
 224 * @key: the hash key
 225 * @key_len: the length of the key in bytes
 226 *
 227 * Description:
 228 * The CIPSO tag hashing function.  Returns a 32-bit hash value.
 229 *
 230 */
 231static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
 232{
 233	return jhash(key, key_len, 0);
 234}
 235
 236/*
 237 * Label Mapping Cache Functions
 238 */
 239
 240/**
 241 * cipso_v4_cache_init - Initialize the CIPSO cache
 242 *
 243 * Description:
 244 * Initializes the CIPSO label mapping cache, this function should be called
 245 * before any of the other functions defined in this file.  Returns zero on
 246 * success, negative values on error.
 247 *
 248 */
 249static int cipso_v4_cache_init(void)
 250{
 251	u32 iter;
 252
 253	cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
 254				 sizeof(struct cipso_v4_map_cache_bkt),
 255				 GFP_KERNEL);
 256	if (cipso_v4_cache == NULL)
 257		return -ENOMEM;
 258
 259	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
 260		spin_lock_init(&cipso_v4_cache[iter].lock);
 261		cipso_v4_cache[iter].size = 0;
 262		INIT_LIST_HEAD(&cipso_v4_cache[iter].list);
 263	}
 264
 265	return 0;
 266}
 267
 268/**
 269 * cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
 270 *
 271 * Description:
 272 * Invalidates and frees any entries in the CIPSO cache.  Returns zero on
 273 * success and negative values on failure.
 274 *
 275 */
 276void cipso_v4_cache_invalidate(void)
 277{
 278	struct cipso_v4_map_cache_entry *entry, *tmp_entry;
 279	u32 iter;
 280
 281	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
 282		spin_lock_bh(&cipso_v4_cache[iter].lock);
 283		list_for_each_entry_safe(entry,
 284					 tmp_entry,
 285					 &cipso_v4_cache[iter].list, list) {
 286			list_del(&entry->list);
 287			cipso_v4_cache_entry_free(entry);
 288		}
 289		cipso_v4_cache[iter].size = 0;
 290		spin_unlock_bh(&cipso_v4_cache[iter].lock);
 291	}
 292}
 293
 294/**
 295 * cipso_v4_cache_check - Check the CIPSO cache for a label mapping
 296 * @key: the buffer to check
 297 * @key_len: buffer length in bytes
 298 * @secattr: the security attribute struct to use
 299 *
 300 * Description:
 301 * This function checks the cache to see if a label mapping already exists for
 302 * the given key.  If there is a match then the cache is adjusted and the
 303 * @secattr struct is populated with the correct LSM security attributes.  The
 304 * cache is adjusted in the following manner if the entry is not already the
 305 * first in the cache bucket:
 306 *
 307 *  1. The cache entry's activity counter is incremented
 308 *  2. The previous (higher ranking) entry's activity counter is decremented
 309 *  3. If the difference between the two activity counters is geater than
 310 *     CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
 311 *
 312 * Returns zero on success, -ENOENT for a cache miss, and other negative values
 313 * on error.
 314 *
 315 */
 316static int cipso_v4_cache_check(const unsigned char *key,
 317				u32 key_len,
 318				struct netlbl_lsm_secattr *secattr)
 319{
 320	u32 bkt;
 321	struct cipso_v4_map_cache_entry *entry;
 322	struct cipso_v4_map_cache_entry *prev_entry = NULL;
 323	u32 hash;
 324
 325	if (!cipso_v4_cache_enabled)
 326		return -ENOENT;
 327
 328	hash = cipso_v4_map_cache_hash(key, key_len);
 329	bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
 330	spin_lock_bh(&cipso_v4_cache[bkt].lock);
 331	list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
 332		if (entry->hash == hash &&
 333		    entry->key_len == key_len &&
 334		    memcmp(entry->key, key, key_len) == 0) {
 335			entry->activity += 1;
 336			atomic_inc(&entry->lsm_data->refcount);
 337			secattr->cache = entry->lsm_data;
 338			secattr->flags |= NETLBL_SECATTR_CACHE;
 339			secattr->type = NETLBL_NLTYPE_CIPSOV4;
 340			if (prev_entry == NULL) {
 341				spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 342				return 0;
 343			}
 344
 345			if (prev_entry->activity > 0)
 346				prev_entry->activity -= 1;
 347			if (entry->activity > prev_entry->activity &&
 348			    entry->activity - prev_entry->activity >
 349			    CIPSO_V4_CACHE_REORDERLIMIT) {
 350				__list_del(entry->list.prev, entry->list.next);
 351				__list_add(&entry->list,
 352					   prev_entry->list.prev,
 353					   &prev_entry->list);
 354			}
 355
 356			spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 357			return 0;
 358		}
 359		prev_entry = entry;
 360	}
 361	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 362
 363	return -ENOENT;
 364}
 365
 366/**
 367 * cipso_v4_cache_add - Add an entry to the CIPSO cache
 368 * @skb: the packet
 369 * @secattr: the packet's security attributes
 370 *
 371 * Description:
 372 * Add a new entry into the CIPSO label mapping cache.  Add the new entry to
 373 * head of the cache bucket's list, if the cache bucket is out of room remove
 374 * the last entry in the list first.  It is important to note that there is
 375 * currently no checking for duplicate keys.  Returns zero on success,
 376 * negative values on failure.
 377 *
 378 */
 379int cipso_v4_cache_add(const struct sk_buff *skb,
 380		       const struct netlbl_lsm_secattr *secattr)
 381{
 382	int ret_val = -EPERM;
 383	u32 bkt;
 384	struct cipso_v4_map_cache_entry *entry = NULL;
 385	struct cipso_v4_map_cache_entry *old_entry = NULL;
 386	unsigned char *cipso_ptr;
 387	u32 cipso_ptr_len;
 388
 389	if (!cipso_v4_cache_enabled || cipso_v4_cache_bucketsize <= 0)
 390		return 0;
 391
 392	cipso_ptr = CIPSO_V4_OPTPTR(skb);
 393	cipso_ptr_len = cipso_ptr[1];
 394
 395	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 396	if (entry == NULL)
 397		return -ENOMEM;
 398	entry->key = kmemdup(cipso_ptr, cipso_ptr_len, GFP_ATOMIC);
 399	if (entry->key == NULL) {
 400		ret_val = -ENOMEM;
 401		goto cache_add_failure;
 402	}
 403	entry->key_len = cipso_ptr_len;
 404	entry->hash = cipso_v4_map_cache_hash(cipso_ptr, cipso_ptr_len);
 405	atomic_inc(&secattr->cache->refcount);
 406	entry->lsm_data = secattr->cache;
 407
 408	bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
 409	spin_lock_bh(&cipso_v4_cache[bkt].lock);
 410	if (cipso_v4_cache[bkt].size < cipso_v4_cache_bucketsize) {
 411		list_add(&entry->list, &cipso_v4_cache[bkt].list);
 412		cipso_v4_cache[bkt].size += 1;
 413	} else {
 414		old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
 415				       struct cipso_v4_map_cache_entry, list);
 416		list_del(&old_entry->list);
 417		list_add(&entry->list, &cipso_v4_cache[bkt].list);
 418		cipso_v4_cache_entry_free(old_entry);
 419	}
 420	spin_unlock_bh(&cipso_v4_cache[bkt].lock);
 421
 422	return 0;
 423
 424cache_add_failure:
 425	if (entry)
 426		cipso_v4_cache_entry_free(entry);
 427	return ret_val;
 428}
 429
 430/*
 431 * DOI List Functions
 432 */
 433
 434/**
 435 * cipso_v4_doi_search - Searches for a DOI definition
 436 * @doi: the DOI to search for
 437 *
 438 * Description:
 439 * Search the DOI definition list for a DOI definition with a DOI value that
 440 * matches @doi.  The caller is responsible for calling rcu_read_[un]lock().
 441 * Returns a pointer to the DOI definition on success and NULL on failure.
 442 */
 443static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
 444{
 445	struct cipso_v4_doi *iter;
 446
 447	list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
 448		if (iter->doi == doi && atomic_read(&iter->refcount))
 449			return iter;
 450	return NULL;
 451}
 452
 453/**
 454 * cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
 455 * @doi_def: the DOI structure
 456 * @audit_info: NetLabel audit information
 457 *
 458 * Description:
 459 * The caller defines a new DOI for use by the CIPSO engine and calls this
 460 * function to add it to the list of acceptable domains.  The caller must
 461 * ensure that the mapping table specified in @doi_def->map meets all of the
 462 * requirements of the mapping type (see cipso_ipv4.h for details).  Returns
 463 * zero on success and non-zero on failure.
 464 *
 465 */
 466int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
 467		     struct netlbl_audit *audit_info)
 468{
 469	int ret_val = -EINVAL;
 470	u32 iter;
 471	u32 doi;
 472	u32 doi_type;
 473	struct audit_buffer *audit_buf;
 474
 475	doi = doi_def->doi;
 476	doi_type = doi_def->type;
 477
 478	if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
 479		goto doi_add_return;
 480	for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
 481		switch (doi_def->tags[iter]) {
 482		case CIPSO_V4_TAG_RBITMAP:
 483			break;
 484		case CIPSO_V4_TAG_RANGE:
 485		case CIPSO_V4_TAG_ENUM:
 486			if (doi_def->type != CIPSO_V4_MAP_PASS)
 487				goto doi_add_return;
 488			break;
 489		case CIPSO_V4_TAG_LOCAL:
 490			if (doi_def->type != CIPSO_V4_MAP_LOCAL)
 491				goto doi_add_return;
 492			break;
 493		case CIPSO_V4_TAG_INVALID:
 494			if (iter == 0)
 495				goto doi_add_return;
 496			break;
 497		default:
 498			goto doi_add_return;
 499		}
 500	}
 501
 502	atomic_set(&doi_def->refcount, 1);
 503
 504	spin_lock(&cipso_v4_doi_list_lock);
 505	if (cipso_v4_doi_search(doi_def->doi) != NULL) {
 506		spin_unlock(&cipso_v4_doi_list_lock);
 507		ret_val = -EEXIST;
 508		goto doi_add_return;
 509	}
 510	list_add_tail_rcu(&doi_def->list, &cipso_v4_doi_list);
 511	spin_unlock(&cipso_v4_doi_list_lock);
 512	ret_val = 0;
 513
 514doi_add_return:
 515	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
 516	if (audit_buf != NULL) {
 517		const char *type_str;
 518		switch (doi_type) {
 519		case CIPSO_V4_MAP_TRANS:
 520			type_str = "trans";
 521			break;
 522		case CIPSO_V4_MAP_PASS:
 523			type_str = "pass";
 524			break;
 525		case CIPSO_V4_MAP_LOCAL:
 526			type_str = "local";
 527			break;
 528		default:
 529			type_str = "(unknown)";
 530		}
 531		audit_log_format(audit_buf,
 532				 " cipso_doi=%u cipso_type=%s res=%u",
 533				 doi, type_str, ret_val == 0 ? 1 : 0);
 534		audit_log_end(audit_buf);
 535	}
 536
 537	return ret_val;
 538}
 539
 540/**
 541 * cipso_v4_doi_free - Frees a DOI definition
 542 * @entry: the entry's RCU field
 543 *
 544 * Description:
 545 * This function frees all of the memory associated with a DOI definition.
 546 *
 547 */
 548void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
 549{
 550	if (doi_def == NULL)
 551		return;
 552
 553	switch (doi_def->type) {
 554	case CIPSO_V4_MAP_TRANS:
 555		kfree(doi_def->map.std->lvl.cipso);
 556		kfree(doi_def->map.std->lvl.local);
 557		kfree(doi_def->map.std->cat.cipso);
 558		kfree(doi_def->map.std->cat.local);
 559		break;
 560	}
 561	kfree(doi_def);
 562}
 563
 564/**
 565 * cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer
 566 * @entry: the entry's RCU field
 567 *
 568 * Description:
 569 * This function is designed to be used as a callback to the call_rcu()
 570 * function so that the memory allocated to the DOI definition can be released
 571 * safely.
 572 *
 573 */
 574static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
 575{
 576	struct cipso_v4_doi *doi_def;
 577
 578	doi_def = container_of(entry, struct cipso_v4_doi, rcu);
 579	cipso_v4_doi_free(doi_def);
 580}
 581
 582/**
 583 * cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
 584 * @doi: the DOI value
 585 * @audit_secid: the LSM secid to use in the audit message
 586 *
 587 * Description:
 588 * Removes a DOI definition from the CIPSO engine.  The NetLabel routines will
 589 * be called to release their own LSM domain mappings as well as our own
 590 * domain list.  Returns zero on success and negative values on failure.
 591 *
 592 */
 593int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
 594{
 595	int ret_val;
 596	struct cipso_v4_doi *doi_def;
 597	struct audit_buffer *audit_buf;
 598
 599	spin_lock(&cipso_v4_doi_list_lock);
 600	doi_def = cipso_v4_doi_search(doi);
 601	if (doi_def == NULL) {
 602		spin_unlock(&cipso_v4_doi_list_lock);
 603		ret_val = -ENOENT;
 604		goto doi_remove_return;
 605	}
 606	if (!atomic_dec_and_test(&doi_def->refcount)) {
 607		spin_unlock(&cipso_v4_doi_list_lock);
 608		ret_val = -EBUSY;
 609		goto doi_remove_return;
 610	}
 611	list_del_rcu(&doi_def->list);
 612	spin_unlock(&cipso_v4_doi_list_lock);
 613
 614	cipso_v4_cache_invalidate();
 615	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 616	ret_val = 0;
 617
 618doi_remove_return:
 619	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
 620	if (audit_buf != NULL) {
 621		audit_log_format(audit_buf,
 622				 " cipso_doi=%u res=%u",
 623				 doi, ret_val == 0 ? 1 : 0);
 624		audit_log_end(audit_buf);
 625	}
 626
 627	return ret_val;
 628}
 629
 630/**
 631 * cipso_v4_doi_getdef - Returns a reference to a valid DOI definition
 632 * @doi: the DOI value
 633 *
 634 * Description:
 635 * Searches for a valid DOI definition and if one is found it is returned to
 636 * the caller.  Otherwise NULL is returned.  The caller must ensure that
 637 * rcu_read_lock() is held while accessing the returned definition and the DOI
 638 * definition reference count is decremented when the caller is done.
 639 *
 640 */
 641struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
 642{
 643	struct cipso_v4_doi *doi_def;
 644
 645	rcu_read_lock();
 646	doi_def = cipso_v4_doi_search(doi);
 647	if (doi_def == NULL)
 648		goto doi_getdef_return;
 649	if (!atomic_inc_not_zero(&doi_def->refcount))
 650		doi_def = NULL;
 651
 652doi_getdef_return:
 653	rcu_read_unlock();
 654	return doi_def;
 655}
 656
 657/**
 658 * cipso_v4_doi_putdef - Releases a reference for the given DOI definition
 659 * @doi_def: the DOI definition
 660 *
 661 * Description:
 662 * Releases a DOI definition reference obtained from cipso_v4_doi_getdef().
 663 *
 664 */
 665void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
 666{
 667	if (doi_def == NULL)
 668		return;
 669
 670	if (!atomic_dec_and_test(&doi_def->refcount))
 671		return;
 672	spin_lock(&cipso_v4_doi_list_lock);
 673	list_del_rcu(&doi_def->list);
 674	spin_unlock(&cipso_v4_doi_list_lock);
 675
 676	cipso_v4_cache_invalidate();
 677	call_rcu(&doi_def->rcu, cipso_v4_doi_free_rcu);
 678}
 679
 680/**
 681 * cipso_v4_doi_walk - Iterate through the DOI definitions
 682 * @skip_cnt: skip past this number of DOI definitions, updated
 683 * @callback: callback for each DOI definition
 684 * @cb_arg: argument for the callback function
 685 *
 686 * Description:
 687 * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
 688 * For each entry call @callback, if @callback returns a negative value stop
 689 * 'walking' through the list and return.  Updates the value in @skip_cnt upon
 690 * return.  Returns zero on success, negative values on failure.
 691 *
 692 */
 693int cipso_v4_doi_walk(u32 *skip_cnt,
 694		     int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
 695		     void *cb_arg)
 696{
 697	int ret_val = -ENOENT;
 698	u32 doi_cnt = 0;
 699	struct cipso_v4_doi *iter_doi;
 700
 701	rcu_read_lock();
 702	list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
 703		if (atomic_read(&iter_doi->refcount) > 0) {
 704			if (doi_cnt++ < *skip_cnt)
 705				continue;
 706			ret_val = callback(iter_doi, cb_arg);
 707			if (ret_val < 0) {
 708				doi_cnt--;
 709				goto doi_walk_return;
 710			}
 711		}
 712
 713doi_walk_return:
 714	rcu_read_unlock();
 715	*skip_cnt = doi_cnt;
 716	return ret_val;
 717}
 718
 719/*
 720 * Label Mapping Functions
 721 */
 722
 723/**
 724 * cipso_v4_map_lvl_valid - Checks to see if the given level is understood
 725 * @doi_def: the DOI definition
 726 * @level: the level to check
 727 *
 728 * Description:
 729 * Checks the given level against the given DOI definition and returns a
 730 * negative value if the level does not have a valid mapping and a zero value
 731 * if the level is defined by the DOI.
 732 *
 733 */
 734static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
 735{
 736	switch (doi_def->type) {
 737	case CIPSO_V4_MAP_PASS:
 738		return 0;
 739	case CIPSO_V4_MAP_TRANS:
 740		if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
 741			return 0;
 742		break;
 743	}
 744
 745	return -EFAULT;
 746}
 747
 748/**
 749 * cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
 750 * @doi_def: the DOI definition
 751 * @host_lvl: the host MLS level
 752 * @net_lvl: the network/CIPSO MLS level
 753 *
 754 * Description:
 755 * Perform a label mapping to translate a local MLS level to the correct
 756 * CIPSO level using the given DOI definition.  Returns zero on success,
 757 * negative values otherwise.
 758 *
 759 */
 760static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
 761				 u32 host_lvl,
 762				 u32 *net_lvl)
 763{
 764	switch (doi_def->type) {
 765	case CIPSO_V4_MAP_PASS:
 766		*net_lvl = host_lvl;
 767		return 0;
 768	case CIPSO_V4_MAP_TRANS:
 769		if (host_lvl < doi_def->map.std->lvl.local_size &&
 770		    doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
 771			*net_lvl = doi_def->map.std->lvl.local[host_lvl];
 772			return 0;
 773		}
 774		return -EPERM;
 775	}
 776
 777	return -EINVAL;
 778}
 779
 780/**
 781 * cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
 782 * @doi_def: the DOI definition
 783 * @net_lvl: the network/CIPSO MLS level
 784 * @host_lvl: the host MLS level
 785 *
 786 * Description:
 787 * Perform a label mapping to translate a CIPSO level to the correct local MLS
 788 * level using the given DOI definition.  Returns zero on success, negative
 789 * values otherwise.
 790 *
 791 */
 792static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
 793				 u32 net_lvl,
 794				 u32 *host_lvl)
 795{
 796	struct cipso_v4_std_map_tbl *map_tbl;
 797
 798	switch (doi_def->type) {
 799	case CIPSO_V4_MAP_PASS:
 800		*host_lvl = net_lvl;
 801		return 0;
 802	case CIPSO_V4_MAP_TRANS:
 803		map_tbl = doi_def->map.std;
 804		if (net_lvl < map_tbl->lvl.cipso_size &&
 805		    map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
 806			*host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
 807			return 0;
 808		}
 809		return -EPERM;
 810	}
 811
 812	return -EINVAL;
 813}
 814
 815/**
 816 * cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
 817 * @doi_def: the DOI definition
 818 * @bitmap: category bitmap
 819 * @bitmap_len: bitmap length in bytes
 820 *
 821 * Description:
 822 * Checks the given category bitmap against the given DOI definition and
 823 * returns a negative value if any of the categories in the bitmap do not have
 824 * a valid mapping and a zero value if all of the categories are valid.
 825 *
 826 */
 827static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
 828				      const unsigned char *bitmap,
 829				      u32 bitmap_len)
 830{
 831	int cat = -1;
 832	u32 bitmap_len_bits = bitmap_len * 8;
 833	u32 cipso_cat_size;
 834	u32 *cipso_array;
 835
 836	switch (doi_def->type) {
 837	case CIPSO_V4_MAP_PASS:
 838		return 0;
 839	case CIPSO_V4_MAP_TRANS:
 840		cipso_cat_size = doi_def->map.std->cat.cipso_size;
 841		cipso_array = doi_def->map.std->cat.cipso;
 842		for (;;) {
 843			cat = cipso_v4_bitmap_walk(bitmap,
 844						   bitmap_len_bits,
 845						   cat + 1,
 846						   1);
 847			if (cat < 0)
 848				break;
 849			if (cat >= cipso_cat_size ||
 850			    cipso_array[cat] >= CIPSO_V4_INV_CAT)
 851				return -EFAULT;
 852		}
 853
 854		if (cat == -1)
 855			return 0;
 856		break;
 857	}
 858
 859	return -EFAULT;
 860}
 861
 862/**
 863 * cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
 864 * @doi_def: the DOI definition
 865 * @secattr: the security attributes
 866 * @net_cat: the zero'd out category bitmap in network/CIPSO format
 867 * @net_cat_len: the length of the CIPSO bitmap in bytes
 868 *
 869 * Description:
 870 * Perform a label mapping to translate a local MLS category bitmap to the
 871 * correct CIPSO bitmap using the given DOI definition.  Returns the minimum
 872 * size in bytes of the network bitmap on success, negative values otherwise.
 873 *
 874 */
 875static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
 876				     const struct netlbl_lsm_secattr *secattr,
 877				     unsigned char *net_cat,
 878				     u32 net_cat_len)
 879{
 880	int host_spot = -1;
 881	u32 net_spot = CIPSO_V4_INV_CAT;
 882	u32 net_spot_max = 0;
 883	u32 net_clen_bits = net_cat_len * 8;
 884	u32 host_cat_size = 0;
 885	u32 *host_cat_array = NULL;
 886
 887	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
 888		host_cat_size = doi_def->map.std->cat.local_size;
 889		host_cat_array = doi_def->map.std->cat.local;
 890	}
 891
 892	for (;;) {
 893		host_spot = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
 894						       host_spot + 1);
 895		if (host_spot < 0)
 896			break;
 897
 898		switch (doi_def->type) {
 899		case CIPSO_V4_MAP_PASS:
 900			net_spot = host_spot;
 901			break;
 902		case CIPSO_V4_MAP_TRANS:
 903			if (host_spot >= host_cat_size)
 904				return -EPERM;
 905			net_spot = host_cat_array[host_spot];
 906			if (net_spot >= CIPSO_V4_INV_CAT)
 907				return -EPERM;
 908			break;
 909		}
 910		if (net_spot >= net_clen_bits)
 911			return -ENOSPC;
 912		cipso_v4_bitmap_setbit(net_cat, net_spot, 1);
 913
 914		if (net_spot > net_spot_max)
 915			net_spot_max = net_spot;
 916	}
 917
 918	if (++net_spot_max % 8)
 919		return net_spot_max / 8 + 1;
 920	return net_spot_max / 8;
 921}
 922
 923/**
 924 * cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
 925 * @doi_def: the DOI definition
 926 * @net_cat: the category bitmap in network/CIPSO format
 927 * @net_cat_len: the length of the CIPSO bitmap in bytes
 928 * @secattr: the security attributes
 929 *
 930 * Description:
 931 * Perform a label mapping to translate a CIPSO bitmap to the correct local
 932 * MLS category bitmap using the given DOI definition.  Returns zero on
 933 * success, negative values on failure.
 934 *
 935 */
 936static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
 937				     const unsigned char *net_cat,
 938				     u32 net_cat_len,
 939				     struct netlbl_lsm_secattr *secattr)
 940{
 941	int ret_val;
 942	int net_spot = -1;
 943	u32 host_spot = CIPSO_V4_INV_CAT;
 944	u32 net_clen_bits = net_cat_len * 8;
 945	u32 net_cat_size = 0;
 946	u32 *net_cat_array = NULL;
 947
 948	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
 949		net_cat_size = doi_def->map.std->cat.cipso_size;
 950		net_cat_array = doi_def->map.std->cat.cipso;
 951	}
 952
 953	for (;;) {
 954		net_spot = cipso_v4_bitmap_walk(net_cat,
 955						net_clen_bits,
 956						net_spot + 1,
 957						1);
 958		if (net_spot < 0) {
 959			if (net_spot == -2)
 960				return -EFAULT;
 961			return 0;
 962		}
 963
 964		switch (doi_def->type) {
 965		case CIPSO_V4_MAP_PASS:
 966			host_spot = net_spot;
 967			break;
 968		case CIPSO_V4_MAP_TRANS:
 969			if (net_spot >= net_cat_size)
 970				return -EPERM;
 971			host_spot = net_cat_array[net_spot];
 972			if (host_spot >= CIPSO_V4_INV_CAT)
 973				return -EPERM;
 974			break;
 975		}
 976		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
 977						       host_spot,
 978						       GFP_ATOMIC);
 979		if (ret_val != 0)
 980			return ret_val;
 981	}
 982
 983	return -EINVAL;
 984}
 985
 986/**
 987 * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
 988 * @doi_def: the DOI definition
 989 * @enumcat: category list
 990 * @enumcat_len: length of the category list in bytes
 991 *
 992 * Description:
 993 * Checks the given categories against the given DOI definition and returns a
 994 * negative value if any of the categories do not have a valid mapping and a
 995 * zero value if all of the categories are valid.
 996 *
 997 */
 998static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
 999				       const unsigned char *enumcat,
1000				       u32 enumcat_len)
1001{
1002	u16 cat;
1003	int cat_prev = -1;
1004	u32 iter;
1005
1006	if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
1007		return -EFAULT;
1008
1009	for (iter = 0; iter < enumcat_len; iter += 2) {
1010		cat = get_unaligned_be16(&enumcat[iter]);
1011		if (cat <= cat_prev)
1012			return -EFAULT;
1013		cat_prev = cat;
1014	}
1015
1016	return 0;
1017}
1018
1019/**
1020 * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
1021 * @doi_def: the DOI definition
1022 * @secattr: the security attributes
1023 * @net_cat: the zero'd out category list in network/CIPSO format
1024 * @net_cat_len: the length of the CIPSO category list in bytes
1025 *
1026 * Description:
1027 * Perform a label mapping to translate a local MLS category bitmap to the
1028 * correct CIPSO category list using the given DOI definition.   Returns the
1029 * size in bytes of the network category bitmap on success, negative values
1030 * otherwise.
1031 *
1032 */
1033static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
1034				      const struct netlbl_lsm_secattr *secattr,
1035				      unsigned char *net_cat,
1036				      u32 net_cat_len)
1037{
1038	int cat = -1;
1039	u32 cat_iter = 0;
1040
1041	for (;;) {
1042		cat = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
1043						 cat + 1);
1044		if (cat < 0)
1045			break;
1046		if ((cat_iter + 2) > net_cat_len)
1047			return -ENOSPC;
1048
1049		*((__be16 *)&net_cat[cat_iter]) = htons(cat);
1050		cat_iter += 2;
1051	}
1052
1053	return cat_iter;
1054}
1055
1056/**
1057 * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
1058 * @doi_def: the DOI definition
1059 * @net_cat: the category list in network/CIPSO format
1060 * @net_cat_len: the length of the CIPSO bitmap in bytes
1061 * @secattr: the security attributes
1062 *
1063 * Description:
1064 * Perform a label mapping to translate a CIPSO category list to the correct
1065 * local MLS category bitmap using the given DOI definition.  Returns zero on
1066 * success, negative values on failure.
1067 *
1068 */
1069static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
1070				      const unsigned char *net_cat,
1071				      u32 net_cat_len,
1072				      struct netlbl_lsm_secattr *secattr)
1073{
1074	int ret_val;
1075	u32 iter;
1076
1077	for (iter = 0; iter < net_cat_len; iter += 2) {
1078		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
1079				get_unaligned_be16(&net_cat[iter]),
1080				GFP_ATOMIC);
1081		if (ret_val != 0)
1082			return ret_val;
1083	}
1084
1085	return 0;
1086}
1087
1088/**
1089 * cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
1090 * @doi_def: the DOI definition
1091 * @rngcat: category list
1092 * @rngcat_len: length of the category list in bytes
1093 *
1094 * Description:
1095 * Checks the given categories against the given DOI definition and returns a
1096 * negative value if any of the categories do not have a valid mapping and a
1097 * zero value if all of the categories are valid.
1098 *
1099 */
1100static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1101				      const unsigned char *rngcat,
1102				      u32 rngcat_len)
1103{
1104	u16 cat_high;
1105	u16 cat_low;
1106	u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1107	u32 iter;
1108
1109	if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1110		return -EFAULT;
1111
1112	for (iter = 0; iter < rngcat_len; iter += 4) {
1113		cat_high = get_unaligned_be16(&rngcat[iter]);
1114		if ((iter + 4) <= rngcat_len)
1115			cat_low = get_unaligned_be16(&rngcat[iter + 2]);
1116		else
1117			cat_low = 0;
1118
1119		if (cat_high > cat_prev)
1120			return -EFAULT;
1121
1122		cat_prev = cat_low;
1123	}
1124
1125	return 0;
1126}
1127
1128/**
1129 * cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
1130 * @doi_def: the DOI definition
1131 * @secattr: the security attributes
1132 * @net_cat: the zero'd out category list in network/CIPSO format
1133 * @net_cat_len: the length of the CIPSO category list in bytes
1134 *
1135 * Description:
1136 * Perform a label mapping to translate a local MLS category bitmap to the
1137 * correct CIPSO category list using the given DOI definition.   Returns the
1138 * size in bytes of the network category bitmap on success, negative values
1139 * otherwise.
1140 *
1141 */
1142static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1143				     const struct netlbl_lsm_secattr *secattr,
1144				     unsigned char *net_cat,
1145				     u32 net_cat_len)
1146{
1147	int iter = -1;
1148	u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1149	u32 array_cnt = 0;
1150	u32 cat_size = 0;
1151
1152	/* make sure we don't overflow the 'array[]' variable */
1153	if (net_cat_len >
1154	    (CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1155		return -ENOSPC;
1156
1157	for (;;) {
1158		iter = netlbl_secattr_catmap_walk(secattr->attr.mls.cat,
1159						  iter + 1);
1160		if (iter < 0)
1161			break;
1162		cat_size += (iter == 0 ? 0 : sizeof(u16));
1163		if (cat_size > net_cat_len)
1164			return -ENOSPC;
1165		array[array_cnt++] = iter;
1166
1167		iter = netlbl_secattr_catmap_walk_rng(secattr->attr.mls.cat,
1168						      iter);
1169		if (iter < 0)
1170			return -EFAULT;
1171		cat_size += sizeof(u16);
1172		if (cat_size > net_cat_len)
1173			return -ENOSPC;
1174		array[array_cnt++] = iter;
1175	}
1176
1177	for (iter = 0; array_cnt > 0;) {
1178		*((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1179		iter += 2;
1180		array_cnt--;
1181		if (array[array_cnt] != 0) {
1182			*((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1183			iter += 2;
1184		}
1185	}
1186
1187	return cat_size;
1188}
1189
1190/**
1191 * cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
1192 * @doi_def: the DOI definition
1193 * @net_cat: the category list in network/CIPSO format
1194 * @net_cat_len: the length of the CIPSO bitmap in bytes
1195 * @secattr: the security attributes
1196 *
1197 * Description:
1198 * Perform a label mapping to translate a CIPSO category list to the correct
1199 * local MLS category bitmap using the given DOI definition.  Returns zero on
1200 * success, negative values on failure.
1201 *
1202 */
1203static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1204				     const unsigned char *net_cat,
1205				     u32 net_cat_len,
1206				     struct netlbl_lsm_secattr *secattr)
1207{
1208	int ret_val;
1209	u32 net_iter;
1210	u16 cat_low;
1211	u16 cat_high;
1212
1213	for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
1214		cat_high = get_unaligned_be16(&net_cat[net_iter]);
1215		if ((net_iter + 4) <= net_cat_len)
1216			cat_low = get_unaligned_be16(&net_cat[net_iter + 2]);
1217		else
1218			cat_low = 0;
1219
1220		ret_val = netlbl_secattr_catmap_setrng(secattr->attr.mls.cat,
1221						       cat_low,
1222						       cat_high,
1223						       GFP_ATOMIC);
1224		if (ret_val != 0)
1225			return ret_val;
1226	}
1227
1228	return 0;
1229}
1230
1231/*
1232 * Protocol Handling Functions
1233 */
1234
1235/**
1236 * cipso_v4_gentag_hdr - Generate a CIPSO option header
1237 * @doi_def: the DOI definition
1238 * @len: the total tag length in bytes, not including this header
1239 * @buf: the CIPSO option buffer
1240 *
1241 * Description:
1242 * Write a CIPSO header into the beginning of @buffer.
1243 *
1244 */
1245static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1246				unsigned char *buf,
1247				u32 len)
1248{
1249	buf[0] = IPOPT_CIPSO;
1250	buf[1] = CIPSO_V4_HDR_LEN + len;
1251	*(__be32 *)&buf[2] = htonl(doi_def->doi);
1252}
1253
1254/**
1255 * cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
1256 * @doi_def: the DOI definition
1257 * @secattr: the security attributes
1258 * @buffer: the option buffer
1259 * @buffer_len: length of buffer in bytes
1260 *
1261 * Description:
1262 * Generate a CIPSO option using the restricted bitmap tag, tag type #1.  The
1263 * actual buffer length may be larger than the indicated size due to
1264 * translation between host and network category bitmaps.  Returns the size of
1265 * the tag on success, negative values on failure.
1266 *
1267 */
1268static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1269			       const struct netlbl_lsm_secattr *secattr,
1270			       unsigned char *buffer,
1271			       u32 buffer_len)
1272{
1273	int ret_val;
1274	u32 tag_len;
1275	u32 level;
1276
1277	if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1278		return -EPERM;
1279
1280	ret_val = cipso_v4_map_lvl_hton(doi_def,
1281					secattr->attr.mls.lvl,
1282					&level);
1283	if (ret_val != 0)
1284		return ret_val;
1285
1286	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1287		ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
1288						    secattr,
1289						    &buffer[4],
1290						    buffer_len - 4);
1291		if (ret_val < 0)
1292			return ret_val;
1293
1294		/* This will send packets using the "optimized" format when
1295		 * possible as specified in  section 3.4.2.6 of the
1296		 * CIPSO draft. */
1297		if (cipso_v4_rbm_optfmt && ret_val > 0 && ret_val <= 10)
1298			tag_len = 14;
1299		else
1300			tag_len = 4 + ret_val;
1301	} else
1302		tag_len = 4;
1303
1304	buffer[0] = CIPSO_V4_TAG_RBITMAP;
1305	buffer[1] = tag_len;
1306	buffer[3] = level;
1307
1308	return tag_len;
1309}
1310
1311/**
1312 * cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
1313 * @doi_def: the DOI definition
1314 * @tag: the CIPSO tag
1315 * @secattr: the security attributes
1316 *
1317 * Description:
1318 * Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
1319 * attributes in @secattr.  Return zero on success, negatives values on
1320 * failure.
1321 *
1322 */
1323static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1324				 const unsigned char *tag,
1325				 struct netlbl_lsm_secattr *secattr)
1326{
1327	int ret_val;
1328	u8 tag_len = tag[1];
1329	u32 level;
1330
1331	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1332	if (ret_val != 0)
1333		return ret_val;
1334	secattr->attr.mls.lvl = level;
1335	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1336
1337	if (tag_len > 4) {
1338		secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1339		if (secattr->attr.mls.cat == NULL)
1340			return -ENOMEM;
1341
1342		ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1343						    &tag[4],
1344						    tag_len - 4,
1345						    secattr);
1346		if (ret_val != 0) {
1347			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1348			return ret_val;
1349		}
1350
1351		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1352	}
1353
1354	return 0;
1355}
1356
1357/**
1358 * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
1359 * @doi_def: the DOI definition
1360 * @secattr: the security attributes
1361 * @buffer: the option buffer
1362 * @buffer_len: length of buffer in bytes
1363 *
1364 * Description:
1365 * Generate a CIPSO option using the enumerated tag, tag type #2.  Returns the
1366 * size of the tag on success, negative values on failure.
1367 *
1368 */
1369static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1370				const struct netlbl_lsm_secattr *secattr,
1371				unsigned char *buffer,
1372				u32 buffer_len)
1373{
1374	int ret_val;
1375	u32 tag_len;
1376	u32 level;
1377
1378	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1379		return -EPERM;
1380
1381	ret_val = cipso_v4_map_lvl_hton(doi_def,
1382					secattr->attr.mls.lvl,
1383					&level);
1384	if (ret_val != 0)
1385		return ret_val;
1386
1387	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1388		ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1389						     secattr,
1390						     &buffer[4],
1391						     buffer_len - 4);
1392		if (ret_val < 0)
1393			return ret_val;
1394
1395		tag_len = 4 + ret_val;
1396	} else
1397		tag_len = 4;
1398
1399	buffer[0] = CIPSO_V4_TAG_ENUM;
1400	buffer[1] = tag_len;
1401	buffer[3] = level;
1402
1403	return tag_len;
1404}
1405
1406/**
1407 * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
1408 * @doi_def: the DOI definition
1409 * @tag: the CIPSO tag
1410 * @secattr: the security attributes
1411 *
1412 * Description:
1413 * Parse a CIPSO enumerated tag (tag type #2) and return the security
1414 * attributes in @secattr.  Return zero on success, negatives values on
1415 * failure.
1416 *
1417 */
1418static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1419				  const unsigned char *tag,
1420				  struct netlbl_lsm_secattr *secattr)
1421{
1422	int ret_val;
1423	u8 tag_len = tag[1];
1424	u32 level;
1425
1426	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1427	if (ret_val != 0)
1428		return ret_val;
1429	secattr->attr.mls.lvl = level;
1430	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1431
1432	if (tag_len > 4) {
1433		secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1434		if (secattr->attr.mls.cat == NULL)
1435			return -ENOMEM;
1436
1437		ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1438						     &tag[4],
1439						     tag_len - 4,
1440						     secattr);
1441		if (ret_val != 0) {
1442			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1443			return ret_val;
1444		}
1445
1446		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1447	}
1448
1449	return 0;
1450}
1451
1452/**
1453 * cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
1454 * @doi_def: the DOI definition
1455 * @secattr: the security attributes
1456 * @buffer: the option buffer
1457 * @buffer_len: length of buffer in bytes
1458 *
1459 * Description:
1460 * Generate a CIPSO option using the ranged tag, tag type #5.  Returns the
1461 * size of the tag on success, negative values on failure.
1462 *
1463 */
1464static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1465			       const struct netlbl_lsm_secattr *secattr,
1466			       unsigned char *buffer,
1467			       u32 buffer_len)
1468{
1469	int ret_val;
1470	u32 tag_len;
1471	u32 level;
1472
1473	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1474		return -EPERM;
1475
1476	ret_val = cipso_v4_map_lvl_hton(doi_def,
1477					secattr->attr.mls.lvl,
1478					&level);
1479	if (ret_val != 0)
1480		return ret_val;
1481
1482	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1483		ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1484						    secattr,
1485						    &buffer[4],
1486						    buffer_len - 4);
1487		if (ret_val < 0)
1488			return ret_val;
1489
1490		tag_len = 4 + ret_val;
1491	} else
1492		tag_len = 4;
1493
1494	buffer[0] = CIPSO_V4_TAG_RANGE;
1495	buffer[1] = tag_len;
1496	buffer[3] = level;
1497
1498	return tag_len;
1499}
1500
1501/**
1502 * cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
1503 * @doi_def: the DOI definition
1504 * @tag: the CIPSO tag
1505 * @secattr: the security attributes
1506 *
1507 * Description:
1508 * Parse a CIPSO ranged tag (tag type #5) and return the security attributes
1509 * in @secattr.  Return zero on success, negatives values on failure.
1510 *
1511 */
1512static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1513				 const unsigned char *tag,
1514				 struct netlbl_lsm_secattr *secattr)
1515{
1516	int ret_val;
1517	u8 tag_len = tag[1];
1518	u32 level;
1519
1520	ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
1521	if (ret_val != 0)
1522		return ret_val;
1523	secattr->attr.mls.lvl = level;
1524	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1525
1526	if (tag_len > 4) {
1527		secattr->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
1528		if (secattr->attr.mls.cat == NULL)
1529			return -ENOMEM;
1530
1531		ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1532						    &tag[4],
1533						    tag_len - 4,
1534						    secattr);
1535		if (ret_val != 0) {
1536			netlbl_secattr_catmap_free(secattr->attr.mls.cat);
1537			return ret_val;
1538		}
1539
1540		secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1541	}
1542
1543	return 0;
1544}
1545
1546/**
1547 * cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard)
1548 * @doi_def: the DOI definition
1549 * @secattr: the security attributes
1550 * @buffer: the option buffer
1551 * @buffer_len: length of buffer in bytes
1552 *
1553 * Description:
1554 * Generate a CIPSO option using the local tag.  Returns the size of the tag
1555 * on success, negative values on failure.
1556 *
1557 */
1558static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
1559			       const struct netlbl_lsm_secattr *secattr,
1560			       unsigned char *buffer,
1561			       u32 buffer_len)
1562{
1563	if (!(secattr->flags & NETLBL_SECATTR_SECID))
1564		return -EPERM;
1565
1566	buffer[0] = CIPSO_V4_TAG_LOCAL;
1567	buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
1568	*(u32 *)&buffer[2] = secattr->attr.secid;
1569
1570	return CIPSO_V4_TAG_LOC_BLEN;
1571}
1572
1573/**
1574 * cipso_v4_parsetag_loc - Parse a CIPSO local tag
1575 * @doi_def: the DOI definition
1576 * @tag: the CIPSO tag
1577 * @secattr: the security attributes
1578 *
1579 * Description:
1580 * Parse a CIPSO local tag and return the security attributes in @secattr.
1581 * Return zero on success, negatives values on failure.
1582 *
1583 */
1584static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
1585				 const unsigned char *tag,
1586				 struct netlbl_lsm_secattr *secattr)
1587{
1588	secattr->attr.secid = *(u32 *)&tag[2];
1589	secattr->flags |= NETLBL_SECATTR_SECID;
1590
1591	return 0;
1592}
1593
1594/**
1595 * cipso_v4_validate - Validate a CIPSO option
1596 * @option: the start of the option, on error it is set to point to the error
1597 *
1598 * Description:
1599 * This routine is called to validate a CIPSO option, it checks all of the
1600 * fields to ensure that they are at least valid, see the draft snippet below
1601 * for details.  If the option is valid then a zero value is returned and
1602 * the value of @option is unchanged.  If the option is invalid then a
1603 * non-zero value is returned and @option is adjusted to point to the
1604 * offending portion of the option.  From the IETF draft ...
1605 *
1606 *  "If any field within the CIPSO options, such as the DOI identifier, is not
1607 *   recognized the IP datagram is discarded and an ICMP 'parameter problem'
1608 *   (type 12) is generated and returned.  The ICMP code field is set to 'bad
1609 *   parameter' (code 0) and the pointer is set to the start of the CIPSO field
1610 *   that is unrecognized."
1611 *
1612 */
1613int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
1614{
1615	unsigned char *opt = *option;
1616	unsigned char *tag;
1617	unsigned char opt_iter;
1618	unsigned char err_offset = 0;
1619	u8 opt_len;
1620	u8 tag_len;
1621	struct cipso_v4_doi *doi_def = NULL;
1622	u32 tag_iter;
1623
1624	/* caller already checks for length values that are too large */
1625	opt_len = opt[1];
1626	if (opt_len < 8) {
1627		err_offset = 1;
1628		goto validate_return;
1629	}
1630
1631	rcu_read_lock();
1632	doi_def = cipso_v4_doi_search(get_unaligned_be32(&opt[2]));
1633	if (doi_def == NULL) {
1634		err_offset = 2;
1635		goto validate_return_locked;
1636	}
1637
1638	opt_iter = CIPSO_V4_HDR_LEN;
1639	tag = opt + opt_iter;
1640	while (opt_iter < opt_len) {
1641		for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1642			if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1643			    ++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1644				err_offset = opt_iter;
1645				goto validate_return_locked;
1646			}
1647
1648		tag_len = tag[1];
1649		if (tag_len > (opt_len - opt_iter)) {
1650			err_offset = opt_iter + 1;
1651			goto validate_return_locked;
1652		}
1653
1654		switch (tag[0]) {
1655		case CIPSO_V4_TAG_RBITMAP:
1656			if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
1657				err_offset = opt_iter + 1;
1658				goto validate_return_locked;
1659			}
1660
1661			/* We are already going to do all the verification
1662			 * necessary at the socket layer so from our point of
1663			 * view it is safe to turn these checks off (and less
1664			 * work), however, the CIPSO draft says we should do
1665			 * all the CIPSO validations here but it doesn't
1666			 * really specify _exactly_ what we need to validate
1667			 * ... so, just make it a sysctl tunable. */
1668			if (cipso_v4_rbm_strictvalid) {
1669				if (cipso_v4_map_lvl_valid(doi_def,
1670							   tag[3]) < 0) {
1671					err_offset = opt_iter + 3;
1672					goto validate_return_locked;
1673				}
1674				if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
1675				    cipso_v4_map_cat_rbm_valid(doi_def,
1676							    &tag[4],
1677							    tag_len - 4) < 0) {
1678					err_offset = opt_iter + 4;
1679					goto validate_return_locked;
1680				}
1681			}
1682			break;
1683		case CIPSO_V4_TAG_ENUM:
1684			if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
1685				err_offset = opt_iter + 1;
1686				goto validate_return_locked;
1687			}
1688
1689			if (cipso_v4_map_lvl_valid(doi_def,
1690						   tag[3]) < 0) {
1691				err_offset = opt_iter + 3;
1692				goto validate_return_locked;
1693			}
1694			if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
1695			    cipso_v4_map_cat_enum_valid(doi_def,
1696							&tag[4],
1697							tag_len - 4) < 0) {
1698				err_offset = opt_iter + 4;
1699				goto validate_return_locked;
1700			}
1701			break;
1702		case CIPSO_V4_TAG_RANGE:
1703			if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
1704				err_offset = opt_iter + 1;
1705				goto validate_return_locked;
1706			}
1707
1708			if (cipso_v4_map_lvl_valid(doi_def,
1709						   tag[3]) < 0) {
1710				err_offset = opt_iter + 3;
1711				goto validate_return_locked;
1712			}
1713			if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
1714			    cipso_v4_map_cat_rng_valid(doi_def,
1715						       &tag[4],
1716						       tag_len - 4) < 0) {
1717				err_offset = opt_iter + 4;
1718				goto validate_return_locked;
1719			}
1720			break;
1721		case CIPSO_V4_TAG_LOCAL:
1722			/* This is a non-standard tag that we only allow for
1723			 * local connections, so if the incoming interface is
1724			 * not the loopback device drop the packet. Further,
1725			 * there is no legitimate reason for setting this from
1726			 * userspace so reject it if skb is NULL. */
1727			if (skb == NULL || !(skb->dev->flags & IFF_LOOPBACK)) {
1728				err_offset = opt_iter;
1729				goto validate_return_locked;
1730			}
1731			if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
1732				err_offset = opt_iter + 1;
1733				goto validate_return_locked;
1734			}
1735			break;
1736		default:
1737			err_offset = opt_iter;
1738			goto validate_return_locked;
1739		}
1740
1741		tag += tag_len;
1742		opt_iter += tag_len;
1743	}
1744
1745validate_return_locked:
1746	rcu_read_unlock();
1747validate_return:
1748	*option = opt + err_offset;
1749	return err_offset;
1750}
1751
1752/**
1753 * cipso_v4_error - Send the correct response for a bad packet
1754 * @skb: the packet
1755 * @error: the error code
1756 * @gateway: CIPSO gateway flag
1757 *
1758 * Description:
1759 * Based on the error code given in @error, send an ICMP error message back to
1760 * the originating host.  From the IETF draft ...
1761 *
1762 *  "If the contents of the CIPSO [option] are valid but the security label is
1763 *   outside of the configured host or port label range, the datagram is
1764 *   discarded and an ICMP 'destination unreachable' (type 3) is generated and
1765 *   returned.  The code field of the ICMP is set to 'communication with
1766 *   destination network administratively prohibited' (code 9) or to
1767 *   'communication with destination host administratively prohibited'
1768 *   (code 10).  The value of the code is dependent on whether the originator
1769 *   of the ICMP message is acting as a CIPSO host or a CIPSO gateway.  The
1770 *   recipient of the ICMP message MUST be able to handle either value.  The
1771 *   same procedure is performed if a CIPSO [option] can not be added to an
1772 *   IP packet because it is too large to fit in the IP options area."
1773 *
1774 *  "If the error is triggered by receipt of an ICMP message, the message is
1775 *   discarded and no response is permitted (consistent with general ICMP
1776 *   processing rules)."
1777 *
1778 */
1779void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1780{
1781	if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
1782		return;
1783
1784	if (gateway)
1785		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, 0);
1786	else
1787		icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, 0);
1788}
1789
1790/**
1791 * cipso_v4_genopt - Generate a CIPSO option
1792 * @buf: the option buffer
1793 * @buf_len: the size of opt_buf
1794 * @doi_def: the CIPSO DOI to use
1795 * @secattr: the security attributes
1796 *
1797 * Description:
1798 * Generate a CIPSO option using the DOI definition and security attributes
1799 * passed to the function.  Returns the length of the option on success and
1800 * negative values on failure.
1801 *
1802 */
1803static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
1804			   const struct cipso_v4_doi *doi_def,
1805			   const struct netlbl_lsm_secattr *secattr)
1806{
1807	int ret_val;
1808	u32 iter;
1809
1810	if (buf_len <= CIPSO_V4_HDR_LEN)
1811		return -ENOSPC;
1812
1813	/* XXX - This code assumes only one tag per CIPSO option which isn't
1814	 * really a good assumption to make but since we only support the MAC
1815	 * tags right now it is a safe assumption. */
1816	iter = 0;
1817	do {
1818		memset(buf, 0, buf_len);
1819		switch (doi_def->tags[iter]) {
1820		case CIPSO_V4_TAG_RBITMAP:
1821			ret_val = cipso_v4_gentag_rbm(doi_def,
1822						   secattr,
1823						   &buf[CIPSO_V4_HDR_LEN],
1824						   buf_len - CIPSO_V4_HDR_LEN);
1825			break;
1826		case CIPSO_V4_TAG_ENUM:
1827			ret_val = cipso_v4_gentag_enum(doi_def,
1828						   secattr,
1829						   &buf[CIPSO_V4_HDR_LEN],
1830						   buf_len - CIPSO_V4_HDR_LEN);
1831			break;
1832		case CIPSO_V4_TAG_RANGE:
1833			ret_val = cipso_v4_gentag_rng(doi_def,
1834						   secattr,
1835						   &buf[CIPSO_V4_HDR_LEN],
1836						   buf_len - CIPSO_V4_HDR_LEN);
1837			break;
1838		case CIPSO_V4_TAG_LOCAL:
1839			ret_val = cipso_v4_gentag_loc(doi_def,
1840						   secattr,
1841						   &buf[CIPSO_V4_HDR_LEN],
1842						   buf_len - CIPSO_V4_HDR_LEN);
1843			break;
1844		default:
1845			return -EPERM;
1846		}
1847
1848		iter++;
1849	} while (ret_val < 0 &&
1850		 iter < CIPSO_V4_TAG_MAXCNT &&
1851		 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
1852	if (ret_val < 0)
1853		return ret_val;
1854	cipso_v4_gentag_hdr(doi_def, buf, ret_val);
1855	return CIPSO_V4_HDR_LEN + ret_val;
1856}
1857
1858/**
1859 * cipso_v4_sock_setattr - Add a CIPSO option to a socket
1860 * @sk: the socket
1861 * @doi_def: the CIPSO DOI to use
1862 * @secattr: the specific security attributes of the socket
1863 *
1864 * Description:
1865 * Set the CIPSO option on the given socket using the DOI definition and
1866 * security attributes passed to the function.  This function requires
1867 * exclusive access to @sk, which means it either needs to be in the
1868 * process of being created or locked.  Returns zero on success and negative
1869 * values on failure.
1870 *
1871 */
1872int cipso_v4_sock_setattr(struct sock *sk,
1873			  const struct cipso_v4_doi *doi_def,
1874			  const struct netlbl_lsm_secattr *secattr)
1875{
1876	int ret_val = -EPERM;
1877	unsigned char *buf = NULL;
1878	u32 buf_len;
1879	u32 opt_len;
1880	struct ip_options_rcu *old, *opt = NULL;
1881	struct inet_sock *sk_inet;
1882	struct inet_connection_sock *sk_conn;
1883
1884	/* In the case of sock_create_lite(), the sock->sk field is not
1885	 * defined yet but it is not a problem as the only users of these
1886	 * "lite" PF_INET sockets are functions which do an accept() call
1887	 * afterwards so we will label the socket as part of the accept(). */
1888	if (sk == NULL)
1889		return 0;
1890
1891	/* We allocate the maximum CIPSO option size here so we are probably
1892	 * being a little wasteful, but it makes our life _much_ easier later
1893	 * on and after all we are only talking about 40 bytes. */
1894	buf_len = CIPSO_V4_OPT_LEN_MAX;
1895	buf = kmalloc(buf_len, GFP_ATOMIC);
1896	if (buf == NULL) {
1897		ret_val = -ENOMEM;
1898		goto socket_setattr_failure;
1899	}
1900
1901	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1902	if (ret_val < 0)
1903		goto socket_setattr_failure;
1904	buf_len = ret_val;
1905
1906	/* We can't use ip_options_get() directly because it makes a call to
1907	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1908	 * we won't always have CAP_NET_RAW even though we _always_ want to
1909	 * set the IPOPT_CIPSO option. */
1910	opt_len = (buf_len + 3) & ~3;
1911	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1912	if (opt == NULL) {
1913		ret_val = -ENOMEM;
1914		goto socket_setattr_failure;
1915	}
1916	memcpy(opt->opt.__data, buf, buf_len);
1917	opt->opt.optlen = opt_len;
1918	opt->opt.cipso = sizeof(struct iphdr);
1919	kfree(buf);
1920	buf = NULL;
1921
1922	sk_inet = inet_sk(sk);
1923
1924	old = rcu_dereference_protected(sk_inet->inet_opt, sock_owned_by_user(sk));
1925	if (sk_inet->is_icsk) {
1926		sk_conn = inet_csk(sk);
1927		if (old)
1928			sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
1929		sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
1930		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1931	}
1932	rcu_assign_pointer(sk_inet->inet_opt, opt);
1933	if (old)
1934		kfree_rcu(old, rcu);
1935
1936	return 0;
1937
1938socket_setattr_failure:
1939	kfree(buf);
1940	kfree(opt);
1941	return ret_val;
1942}
1943
1944/**
1945 * cipso_v4_req_setattr - Add a CIPSO option to a connection request socket
1946 * @req: the connection request socket
1947 * @doi_def: the CIPSO DOI to use
1948 * @secattr: the specific security attributes of the socket
1949 *
1950 * Description:
1951 * Set the CIPSO option on the given socket using the DOI definition and
1952 * security attributes passed to the function.  Returns zero on success and
1953 * negative values on failure.
1954 *
1955 */
1956int cipso_v4_req_setattr(struct request_sock *req,
1957			 const struct cipso_v4_doi *doi_def,
1958			 const struct netlbl_lsm_secattr *secattr)
1959{
1960	int ret_val = -EPERM;
1961	unsigned char *buf = NULL;
1962	u32 buf_len;
1963	u32 opt_len;
1964	struct ip_options_rcu *opt = NULL;
1965	struct inet_request_sock *req_inet;
1966
1967	/* We allocate the maximum CIPSO option size here so we are probably
1968	 * being a little wasteful, but it makes our life _much_ easier later
1969	 * on and after all we are only talking about 40 bytes. */
1970	buf_len = CIPSO_V4_OPT_LEN_MAX;
1971	buf = kmalloc(buf_len, GFP_ATOMIC);
1972	if (buf == NULL) {
1973		ret_val = -ENOMEM;
1974		goto req_setattr_failure;
1975	}
1976
1977	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1978	if (ret_val < 0)
1979		goto req_setattr_failure;
1980	buf_len = ret_val;
1981
1982	/* We can't use ip_options_get() directly because it makes a call to
1983	 * ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1984	 * we won't always have CAP_NET_RAW even though we _always_ want to
1985	 * set the IPOPT_CIPSO option. */
1986	opt_len = (buf_len + 3) & ~3;
1987	opt = kzalloc(sizeof(*opt) + opt_len, GFP_ATOMIC);
1988	if (opt == NULL) {
1989		ret_val = -ENOMEM;
1990		goto req_setattr_failure;
1991	}
1992	memcpy(opt->opt.__data, buf, buf_len);
1993	opt->opt.optlen = opt_len;
1994	opt->opt.cipso = sizeof(struct iphdr);
1995	kfree(buf);
1996	buf = NULL;
1997
1998	req_inet = inet_rsk(req);
1999	opt = xchg(&req_inet->opt, opt);
2000	if (opt)
2001		kfree_rcu(opt, rcu);
2002
2003	return 0;
2004
2005req_setattr_failure:
2006	kfree(buf);
2007	kfree(opt);
2008	return ret_val;
2009}
2010
2011/**
2012 * cipso_v4_delopt - Delete the CIPSO option from a set of IP options
2013 * @opt_ptr: IP option pointer
2014 *
2015 * Description:
2016 * Deletes the CIPSO IP option from a set of IP options and makes the necessary
2017 * adjustments to the IP option structure.  Returns zero on success, negative
2018 * values on failure.
2019 *
2020 */
2021static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr)
2022{
2023	int hdr_delta = 0;
2024	struct ip_options_rcu *opt = *opt_ptr;
2025
2026	if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
2027		u8 cipso_len;
2028		u8 cipso_off;
2029		unsigned char *cipso_ptr;
2030		int iter;
2031		int optlen_new;
2032
2033		cipso_off = opt->opt.cipso - sizeof(struct iphdr);
2034		cipso_ptr = &opt->opt.__data[cipso_off];
2035		cipso_len = cipso_ptr[1];
2036
2037		if (opt->opt.srr > opt->opt.cipso)
2038			opt->opt.srr -= cipso_len;
2039		if (opt->opt.rr > opt->opt.cipso)
2040			opt->opt.rr -= cipso_len;
2041		if (opt->opt.ts > opt->opt.cipso)
2042			opt->opt.ts -= cipso_len;
2043		if (opt->opt.router_alert > opt->opt.cipso)
2044			opt->opt.router_alert -= cipso_len;
2045		opt->opt.cipso = 0;
2046
2047		memmove(cipso_ptr, cipso_ptr + cipso_len,
2048			opt->opt.optlen - cipso_off - cipso_len);
2049
2050		/* determining the new total option length is tricky because of
2051		 * the padding necessary, the only thing i can think to do at
2052		 * this point is walk the options one-by-one, skipping the
2053		 * padding at the end to determine the actual option size and
2054		 * from there we can determine the new total option length */
2055		iter = 0;
2056		optlen_new = 0;
2057		while (iter < opt->opt.optlen)
2058			if (opt->opt.__data[iter] != IPOPT_NOP) {
2059				iter += opt->opt.__data[iter + 1];
2060				optlen_new = iter;
2061			} else
2062				iter++;
2063		hdr_delta = opt->opt.optlen;
2064		opt->opt.optlen = (optlen_new + 3) & ~3;
2065		hdr_delta -= opt->opt.optlen;
2066	} else {
2067		/* only the cipso option was present on the socket so we can
2068		 * remove the entire option struct */
2069		*opt_ptr = NULL;
2070		hdr_delta = opt->opt.optlen;
2071		kfree_rcu(opt, rcu);
2072	}
2073
2074	return hdr_delta;
2075}
2076
2077/**
2078 * cipso_v4_sock_delattr - Delete the CIPSO option from a socket
2079 * @sk: the socket
2080 *
2081 * Description:
2082 * Removes the CIPSO option from a socket, if present.
2083 *
2084 */
2085void cipso_v4_sock_delattr(struct sock *sk)
2086{
2087	int hdr_delta;
2088	struct ip_options_rcu *opt;
2089	struct inet_sock *sk_inet;
2090
2091	sk_inet = inet_sk(sk);
2092	opt = rcu_dereference_protected(sk_inet->inet_opt, 1);
2093	if (opt == NULL || opt->opt.cipso == 0)
2094		return;
2095
2096	hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt);
2097	if (sk_inet->is_icsk && hdr_delta > 0) {
2098		struct inet_connection_sock *sk_conn = inet_csk(sk);
2099		sk_conn->icsk_ext_hdr_len -= hdr_delta;
2100		sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
2101	}
2102}
2103
2104/**
2105 * cipso_v4_req_delattr - Delete the CIPSO option from a request socket
2106 * @reg: the request socket
2107 *
2108 * Description:
2109 * Removes the CIPSO option from a request socket, if present.
2110 *
2111 */
2112void cipso_v4_req_delattr(struct request_sock *req)
2113{
2114	struct ip_options_rcu *opt;
2115	struct inet_request_sock *req_inet;
2116
2117	req_inet = inet_rsk(req);
2118	opt = req_inet->opt;
2119	if (opt == NULL || opt->opt.cipso == 0)
2120		return;
2121
2122	cipso_v4_delopt(&req_inet->opt);
2123}
2124
2125/**
2126 * cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
2127 * @cipso: the CIPSO v4 option
2128 * @secattr: the security attributes
2129 *
2130 * Description:
2131 * Inspect @cipso and return the security attributes in @secattr.  Returns zero
2132 * on success and negative values on failure.
2133 *
2134 */
2135static int cipso_v4_getattr(const unsigned char *cipso,
2136			    struct netlbl_lsm_secattr *secattr)
2137{
2138	int ret_val = -ENOMSG;
2139	u32 doi;
2140	struct cipso_v4_doi *doi_def;
2141
2142	if (cipso_v4_cache_check(cipso, cipso[1], secattr) == 0)
2143		return 0;
2144
2145	doi = get_unaligned_be32(&cipso[2]);
2146	rcu_read_lock();
2147	doi_def = cipso_v4_doi_search(doi);
2148	if (doi_def == NULL)
2149		goto getattr_return;
2150	/* XXX - This code assumes only one tag per CIPSO option which isn't
2151	 * really a good assumption to make but since we only support the MAC
2152	 * tags right now it is a safe assumption. */
2153	switch (cipso[6]) {
2154	case CIPSO_V4_TAG_RBITMAP:
2155		ret_val = cipso_v4_parsetag_rbm(doi_def, &cipso[6], secattr);
2156		break;
2157	case CIPSO_V4_TAG_ENUM:
2158		ret_val = cipso_v4_parsetag_enum(doi_def, &cipso[6], secattr);
2159		break;
2160	case CIPSO_V4_TAG_RANGE:
2161		ret_val = cipso_v4_parsetag_rng(doi_def, &cipso[6], secattr);
2162		break;
2163	case CIPSO_V4_TAG_LOCAL:
2164		ret_val = cipso_v4_parsetag_loc(doi_def, &cipso[6], secattr);
2165		break;
2166	}
2167	if (ret_val == 0)
2168		secattr->type = NETLBL_NLTYPE_CIPSOV4;
2169
2170getattr_return:
2171	rcu_read_unlock();
2172	return ret_val;
2173}
2174
2175/**
2176 * cipso_v4_sock_getattr - Get the security attributes from a sock
2177 * @sk: the sock
2178 * @secattr: the security attributes
2179 *
2180 * Description:
2181 * Query @sk to see if there is a CIPSO option attached to the sock and if
2182 * there is return the CIPSO security attributes in @secattr.  This function
2183 * requires that @sk be locked, or privately held, but it does not do any
2184 * locking itself.  Returns zero on success and negative values on failure.
2185 *
2186 */
2187int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
2188{
2189	struct ip_options_rcu *opt;
2190	int res = -ENOMSG;
2191
2192	rcu_read_lock();
2193	opt = rcu_dereference(inet_sk(sk)->inet_opt);
2194	if (opt && opt->opt.cipso)
2195		res = cipso_v4_getattr(opt->opt.__data +
2196						opt->opt.cipso -
2197						sizeof(struct iphdr),
2198				       secattr);
2199	rcu_read_unlock();
2200	return res;
2201}
2202
2203/**
2204 * cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
2205 * @skb: the packet
2206 * @secattr: the security attributes
2207 *
2208 * Description:
2209 * Set the CIPSO option on the given packet based on the security attributes.
2210 * Returns a pointer to the IP header on success and NULL on failure.
2211 *
2212 */
2213int cipso_v4_skbuff_setattr(struct sk_buff *skb,
2214			    const struct cipso_v4_doi *doi_def,
2215			    const struct netlbl_lsm_secattr *secattr)
2216{
2217	int ret_val;
2218	struct iphdr *iph;
2219	struct ip_options *opt = &IPCB(skb)->opt;
2220	unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
2221	u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
2222	u32 opt_len;
2223	int len_delta;
2224
2225	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
2226	if (ret_val < 0)
2227		return ret_val;
2228	buf_len = ret_val;
2229	opt_len = (buf_len + 3) & ~3;
2230
2231	/* we overwrite any existing options to ensure that we have enough
2232	 * room for the CIPSO option, the reason is that we _need_ to guarantee
2233	 * that the security label is applied to the packet - we do the same
2234	 * thing when using the socket options and it hasn't caused a problem,
2235	 * if we need to we can always revisit this choice later */
2236
2237	len_delta = opt_len - opt->optlen;
2238	/* if we don't ensure enough headroom we could panic on the skb_push()
2239	 * call below so make sure we have enough, we are also "mangling" the
2240	 * packet so we should probably do a copy-on-write call anyway */
2241	ret_val = skb_cow(skb, skb_headroom(skb) + len_delta);
2242	if (ret_val < 0)
2243		return ret_val;
2244
2245	if (len_delta > 0) {
2246		/* we assume that the header + opt->optlen have already been
2247		 * "pushed" in ip_options_build() or similar */
2248		iph = ip_hdr(skb);
2249		skb_push(skb, len_delta);
2250		memmove((char *)iph - len_delta, iph, iph->ihl << 2);
2251		skb_reset_network_header(skb);
2252		iph = ip_hdr(skb);
2253	} else if (len_delta < 0) {
2254		iph = ip_hdr(skb);
2255		memset(iph + 1, IPOPT_NOP, opt->optlen);
2256	} else
2257		iph = ip_hdr(skb);
2258
2259	if (opt->optlen > 0)
2260		memset(opt, 0, sizeof(*opt));
2261	opt->optlen = opt_len;
2262	opt->cipso = sizeof(struct iphdr);
2263	opt->is_changed = 1;
2264
2265	/* we have to do the following because we are being called from a
2266	 * netfilter hook which means the packet already has had the header
2267	 * fields populated and the checksum calculated - yes this means we
2268	 * are doing more work than needed but we do it to keep the core
2269	 * stack clean and tidy */
2270	memcpy(iph + 1, buf, buf_len);
2271	if (opt_len > buf_len)
2272		memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
2273	if (len_delta != 0) {
2274		iph->ihl = 5 + (opt_len >> 2);
2275		iph->tot_len = htons(skb->len);
2276	}
2277	ip_send_check(iph);
2278
2279	return 0;
2280}
2281
2282/**
2283 * cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet
2284 * @skb: the packet
2285 *
2286 * Description:
2287 * Removes any and all CIPSO options from the given packet.  Returns zero on
2288 * success, negative values on failure.
2289 *
2290 */
2291int cipso_v4_skbuff_delattr(struct sk_buff *skb)
2292{
2293	int ret_val;
2294	struct iphdr *iph;
2295	struct ip_options *opt = &IPCB(skb)->opt;
2296	unsigned char *cipso_ptr;
2297
2298	if (opt->cipso == 0)
2299		return 0;
2300
2301	/* since we are changing the packet we should make a copy */
2302	ret_val = skb_cow(skb, skb_headroom(skb));
2303	if (ret_val < 0)
2304		return ret_val;
2305
2306	/* the easiest thing to do is just replace the cipso option with noop
2307	 * options since we don't change the size of the packet, although we
2308	 * still need to recalculate the checksum */
2309
2310	iph = ip_hdr(skb);
2311	cipso_ptr = (unsigned char *)iph + opt->cipso;
2312	memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
2313	opt->cipso = 0;
2314	opt->is_changed = 1;
2315
2316	ip_send_check(iph);
2317
2318	return 0;
2319}
2320
2321/**
2322 * cipso_v4_skbuff_getattr - Get the security attributes from the CIPSO option
2323 * @skb: the packet
2324 * @secattr: the security attributes
2325 *
2326 * Description:
2327 * Parse the given packet's CIPSO option and return the security attributes.
2328 * Returns zero on success and negative values on failure.
2329 *
2330 */
2331int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
2332			    struct netlbl_lsm_secattr *secattr)
2333{
2334	return cipso_v4_getattr(CIPSO_V4_OPTPTR(skb), secattr);
2335}
2336
2337/*
2338 * Setup Functions
2339 */
2340
2341/**
2342 * cipso_v4_init - Initialize the CIPSO module
2343 *
2344 * Description:
2345 * Initialize the CIPSO module and prepare it for use.  Returns zero on success
2346 * and negative values on failure.
2347 *
2348 */
2349static int __init cipso_v4_init(void)
2350{
2351	int ret_val;
2352
2353	ret_val = cipso_v4_cache_init();
2354	if (ret_val != 0)
2355		panic("Failed to initialize the CIPSO/IPv4 cache (%d)\n",
2356		      ret_val);
2357
2358	return 0;
2359}
2360
2361subsys_initcall(cipso_v4_init);