1// SPDX-License-Identifier: GPL-2.0-or-later
   2/*
   3 * NetLabel Unlabeled Support
   4 *
   5 * This file defines functions for dealing with unlabeled packets for the
   6 * NetLabel system.  The NetLabel system manages static and dynamic label
   7 * mappings for network protocols such as CIPSO and RIPSO.
   8 *
   9 * Author: Paul Moore <paul@paul-moore.com>
  10 */
  11
  12/*
  13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
  14 */
  15
  16#include <linux/types.h>
  17#include <linux/rcupdate.h>
  18#include <linux/list.h>
  19#include <linux/spinlock.h>
  20#include <linux/socket.h>
  21#include <linux/string.h>
  22#include <linux/skbuff.h>
  23#include <linux/audit.h>
  24#include <linux/in.h>
  25#include <linux/in6.h>
  26#include <linux/ip.h>
  27#include <linux/ipv6.h>
  28#include <linux/notifier.h>
  29#include <linux/netdevice.h>
  30#include <linux/security.h>
  31#include <linux/slab.h>
  32#include <net/sock.h>
  33#include <net/netlink.h>
  34#include <net/genetlink.h>
  35#include <net/ip.h>
  36#include <net/ipv6.h>
  37#include <net/net_namespace.h>
  38#include <net/netlabel.h>
  39#include <asm/bug.h>
  40#include <linux/atomic.h>
  41
  42#include "netlabel_user.h"
  43#include "netlabel_addrlist.h"
  44#include "netlabel_domainhash.h"
  45#include "netlabel_unlabeled.h"
  46#include "netlabel_mgmt.h"
  47
  48/* NOTE: at present we always use init's network namespace since we don't
  49 *       presently support different namespaces even though the majority of
  50 *       the functions in this file are "namespace safe" */
  51
  52/* The unlabeled connection hash table which we use to map network interfaces
  53 * and addresses of unlabeled packets to a user specified secid value for the
  54 * LSM.  The hash table is used to lookup the network interface entry
  55 * (struct netlbl_unlhsh_iface) and then the interface entry is used to
  56 * lookup an IP address match from an ordered list.  If a network interface
  57 * match can not be found in the hash table then the default entry
  58 * (netlbl_unlhsh_def) is used.  The IP address entry list
  59 * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
  60 * larger netmask come first.
  61 */
  62struct netlbl_unlhsh_tbl {
  63	struct list_head *tbl;
  64	u32 size;
  65};
  66#define netlbl_unlhsh_addr4_entry(iter) \
  67	container_of(iter, struct netlbl_unlhsh_addr4, list)
  68struct netlbl_unlhsh_addr4 {
  69	u32 secid;
  70
  71	struct netlbl_af4list list;
  72	struct rcu_head rcu;
  73};
  74#define netlbl_unlhsh_addr6_entry(iter) \
  75	container_of(iter, struct netlbl_unlhsh_addr6, list)
  76struct netlbl_unlhsh_addr6 {
  77	u32 secid;
  78
  79	struct netlbl_af6list list;
  80	struct rcu_head rcu;
  81};
  82struct netlbl_unlhsh_iface {
  83	int ifindex;
  84	struct list_head addr4_list;
  85	struct list_head addr6_list;
  86
  87	u32 valid;
  88	struct list_head list;
  89	struct rcu_head rcu;
  90};
  91
  92/* Argument struct for netlbl_unlhsh_walk() */
  93struct netlbl_unlhsh_walk_arg {
  94	struct netlink_callback *nl_cb;
  95	struct sk_buff *skb;
  96	u32 seq;
  97};
  98
  99/* Unlabeled connection hash table */
 100/* updates should be so rare that having one spinlock for the entire
 101 * hash table should be okay */
 102static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
 103#define netlbl_unlhsh_rcu_deref(p) \
 104	rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
 105static struct netlbl_unlhsh_tbl __rcu *netlbl_unlhsh;
 106static struct netlbl_unlhsh_iface __rcu *netlbl_unlhsh_def;
 107
 108/* Accept unlabeled packets flag */
 109static u8 netlabel_unlabel_acceptflg;
 110
 111/* NetLabel Generic NETLINK unlabeled family */
 112static struct genl_family netlbl_unlabel_gnl_family;
 113
 114/* NetLabel Netlink attribute policy */
 115static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
 116	[NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
 117	[NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
 118				      .len = sizeof(struct in6_addr) },
 119	[NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
 120				      .len = sizeof(struct in6_addr) },
 121	[NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
 122				      .len = sizeof(struct in_addr) },
 123	[NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
 124				      .len = sizeof(struct in_addr) },
 125	[NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
 126				   .len = IFNAMSIZ - 1 },
 127	[NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
 128};
 129
 130/*
 131 * Unlabeled Connection Hash Table Functions
 132 */
 133
 134/**
 135 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
 136 * @entry: the entry's RCU field
 137 *
 138 * Description:
 139 * This function is designed to be used as a callback to the call_rcu()
 140 * function so that memory allocated to a hash table interface entry can be
 141 * released safely.  It is important to note that this function does not free
 142 * the IPv4 and IPv6 address lists contained as part of an interface entry.  It
 143 * is up to the rest of the code to make sure an interface entry is only freed
 144 * once it's address lists are empty.
 145 *
 146 */
 147static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
 148{
 149	struct netlbl_unlhsh_iface *iface;
 150	struct netlbl_af4list *iter4;
 151	struct netlbl_af4list *tmp4;
 152#if IS_ENABLED(CONFIG_IPV6)
 153	struct netlbl_af6list *iter6;
 154	struct netlbl_af6list *tmp6;
 155#endif /* IPv6 */
 156
 157	iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
 158
 159	/* no need for locks here since we are the only one with access to this
 160	 * structure */
 161
 162	netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
 163		netlbl_af4list_remove_entry(iter4);
 164		kfree(netlbl_unlhsh_addr4_entry(iter4));
 165	}
 166#if IS_ENABLED(CONFIG_IPV6)
 167	netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
 168		netlbl_af6list_remove_entry(iter6);
 169		kfree(netlbl_unlhsh_addr6_entry(iter6));
 170	}
 171#endif /* IPv6 */
 172	kfree(iface);
 173}
 174
 175/**
 176 * netlbl_unlhsh_hash - Hashing function for the hash table
 177 * @ifindex: the network interface/device to hash
 178 *
 179 * Description:
 180 * This is the hashing function for the unlabeled hash table, it returns the
 181 * bucket number for the given device/interface.  The caller is responsible for
 182 * ensuring that the hash table is protected with either a RCU read lock or
 183 * the hash table lock.
 184 *
 185 */
 186static u32 netlbl_unlhsh_hash(int ifindex)
 187{
 188	return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
 189}
 190
 191/**
 192 * netlbl_unlhsh_search_iface - Search for a matching interface entry
 193 * @ifindex: the network interface
 194 *
 195 * Description:
 196 * Searches the unlabeled connection hash table and returns a pointer to the
 197 * interface entry which matches @ifindex, otherwise NULL is returned.  The
 198 * caller is responsible for ensuring that the hash table is protected with
 199 * either a RCU read lock or the hash table lock.
 200 *
 201 */
 202static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
 203{
 204	u32 bkt;
 205	struct list_head *bkt_list;
 206	struct netlbl_unlhsh_iface *iter;
 207
 208	bkt = netlbl_unlhsh_hash(ifindex);
 209	bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
 210	list_for_each_entry_rcu(iter, bkt_list, list,
 211				lockdep_is_held(&netlbl_unlhsh_lock))
 212		if (iter->valid && iter->ifindex == ifindex)
 213			return iter;
 214
 215	return NULL;
 216}
 217
 218/**
 219 * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
 220 * @iface: the associated interface entry
 221 * @addr: IPv4 address in network byte order
 222 * @mask: IPv4 address mask in network byte order
 223 * @secid: LSM secid value for entry
 224 *
 225 * Description:
 226 * Add a new address entry into the unlabeled connection hash table using the
 227 * interface entry specified by @iface.  On success zero is returned, otherwise
 228 * a negative value is returned.
 229 *
 230 */
 231static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
 232				   const struct in_addr *addr,
 233				   const struct in_addr *mask,
 234				   u32 secid)
 235{
 236	int ret_val;
 237	struct netlbl_unlhsh_addr4 *entry;
 238
 239	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 240	if (entry == NULL)
 241		return -ENOMEM;
 242
 243	entry->list.addr = addr->s_addr & mask->s_addr;
 244	entry->list.mask = mask->s_addr;
 245	entry->list.valid = 1;
 246	entry->secid = secid;
 247
 248	spin_lock(&netlbl_unlhsh_lock);
 249	ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
 250	spin_unlock(&netlbl_unlhsh_lock);
 251
 252	if (ret_val != 0)
 253		kfree(entry);
 254	return ret_val;
 255}
 256
 257#if IS_ENABLED(CONFIG_IPV6)
 258/**
 259 * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
 260 * @iface: the associated interface entry
 261 * @addr: IPv6 address in network byte order
 262 * @mask: IPv6 address mask in network byte order
 263 * @secid: LSM secid value for entry
 264 *
 265 * Description:
 266 * Add a new address entry into the unlabeled connection hash table using the
 267 * interface entry specified by @iface.  On success zero is returned, otherwise
 268 * a negative value is returned.
 269 *
 270 */
 271static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
 272				   const struct in6_addr *addr,
 273				   const struct in6_addr *mask,
 274				   u32 secid)
 275{
 276	int ret_val;
 277	struct netlbl_unlhsh_addr6 *entry;
 278
 279	entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 280	if (entry == NULL)
 281		return -ENOMEM;
 282
 283	entry->list.addr = *addr;
 284	entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
 285	entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
 286	entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
 287	entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
 288	entry->list.mask = *mask;
 289	entry->list.valid = 1;
 290	entry->secid = secid;
 291
 292	spin_lock(&netlbl_unlhsh_lock);
 293	ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
 294	spin_unlock(&netlbl_unlhsh_lock);
 295
 296	if (ret_val != 0)
 297		kfree(entry);
 298	return 0;
 299}
 300#endif /* IPv6 */
 301
 302/**
 303 * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
 304 * @ifindex: network interface
 305 *
 306 * Description:
 307 * Add a new, empty, interface entry into the unlabeled connection hash table.
 308 * On success a pointer to the new interface entry is returned, on failure NULL
 309 * is returned.
 310 *
 311 */
 312static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
 313{
 314	u32 bkt;
 315	struct netlbl_unlhsh_iface *iface;
 316
 317	iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
 318	if (iface == NULL)
 319		return NULL;
 320
 321	iface->ifindex = ifindex;
 322	INIT_LIST_HEAD(&iface->addr4_list);
 323	INIT_LIST_HEAD(&iface->addr6_list);
 324	iface->valid = 1;
 325
 326	spin_lock(&netlbl_unlhsh_lock);
 327	if (ifindex > 0) {
 328		bkt = netlbl_unlhsh_hash(ifindex);
 329		if (netlbl_unlhsh_search_iface(ifindex) != NULL)
 330			goto add_iface_failure;
 331		list_add_tail_rcu(&iface->list,
 332			     &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
 333	} else {
 334		INIT_LIST_HEAD(&iface->list);
 335		if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
 336			goto add_iface_failure;
 337		rcu_assign_pointer(netlbl_unlhsh_def, iface);
 338	}
 339	spin_unlock(&netlbl_unlhsh_lock);
 340
 341	return iface;
 342
 343add_iface_failure:
 344	spin_unlock(&netlbl_unlhsh_lock);
 345	kfree(iface);
 346	return NULL;
 347}
 348
 349/**
 350 * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
 351 * @net: network namespace
 352 * @dev_name: interface name
 353 * @addr: IP address in network byte order
 354 * @mask: address mask in network byte order
 355 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
 356 * @secid: LSM secid value for the entry
 357 * @audit_info: NetLabel audit information
 358 *
 359 * Description:
 360 * Adds a new entry to the unlabeled connection hash table.  Returns zero on
 361 * success, negative values on failure.
 362 *
 363 */
 364int netlbl_unlhsh_add(struct net *net,
 365		      const char *dev_name,
 366		      const void *addr,
 367		      const void *mask,
 368		      u32 addr_len,
 369		      u32 secid,
 370		      struct netlbl_audit *audit_info)
 371{
 372	int ret_val;
 373	int ifindex;
 374	struct net_device *dev;
 375	struct netlbl_unlhsh_iface *iface;
 376	struct audit_buffer *audit_buf = NULL;
 377	char *secctx = NULL;
 378	u32 secctx_len;
 379
 380	if (addr_len != sizeof(struct in_addr) &&
 381	    addr_len != sizeof(struct in6_addr))
 382		return -EINVAL;
 383
 384	rcu_read_lock();
 385	if (dev_name != NULL) {
 386		dev = dev_get_by_name_rcu(net, dev_name);
 387		if (dev == NULL) {
 388			ret_val = -ENODEV;
 389			goto unlhsh_add_return;
 390		}
 391		ifindex = dev->ifindex;
 392		iface = netlbl_unlhsh_search_iface(ifindex);
 393	} else {
 394		ifindex = 0;
 395		iface = rcu_dereference(netlbl_unlhsh_def);
 396	}
 397	if (iface == NULL) {
 398		iface = netlbl_unlhsh_add_iface(ifindex);
 399		if (iface == NULL) {
 400			ret_val = -ENOMEM;
 401			goto unlhsh_add_return;
 402		}
 403	}
 404	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
 405					      audit_info);
 406	switch (addr_len) {
 407	case sizeof(struct in_addr): {
 408		const struct in_addr *addr4 = addr;
 409		const struct in_addr *mask4 = mask;
 410
 411		ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
 412		if (audit_buf != NULL)
 413			netlbl_af4list_audit_addr(audit_buf, 1,
 414						  dev_name,
 415						  addr4->s_addr,
 416						  mask4->s_addr);
 417		break;
 418	}
 419#if IS_ENABLED(CONFIG_IPV6)
 420	case sizeof(struct in6_addr): {
 421		const struct in6_addr *addr6 = addr;
 422		const struct in6_addr *mask6 = mask;
 423
 424		ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
 425		if (audit_buf != NULL)
 426			netlbl_af6list_audit_addr(audit_buf, 1,
 427						  dev_name,
 428						  addr6, mask6);
 429		break;
 430	}
 431#endif /* IPv6 */
 432	default:
 433		ret_val = -EINVAL;
 434	}
 435	if (ret_val == 0)
 436		atomic_inc(&netlabel_mgmt_protocount);
 437
 438unlhsh_add_return:
 439	rcu_read_unlock();
 440	if (audit_buf != NULL) {
 441		if (security_secid_to_secctx(secid,
 442					     &secctx,
 443					     &secctx_len) == 0) {
 444			audit_log_format(audit_buf, " sec_obj=%s", secctx);
 445			security_release_secctx(secctx, secctx_len);
 446		}
 447		audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
 448		audit_log_end(audit_buf);
 449	}
 450	return ret_val;
 451}
 452
 453/**
 454 * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
 455 * @net: network namespace
 456 * @iface: interface entry
 457 * @addr: IP address
 458 * @mask: IP address mask
 459 * @audit_info: NetLabel audit information
 460 *
 461 * Description:
 462 * Remove an IP address entry from the unlabeled connection hash table.
 463 * Returns zero on success, negative values on failure.
 464 *
 465 */
 466static int netlbl_unlhsh_remove_addr4(struct net *net,
 467				      struct netlbl_unlhsh_iface *iface,
 468				      const struct in_addr *addr,
 469				      const struct in_addr *mask,
 470				      struct netlbl_audit *audit_info)
 471{
 472	struct netlbl_af4list *list_entry;
 473	struct netlbl_unlhsh_addr4 *entry;
 474	struct audit_buffer *audit_buf;
 475	struct net_device *dev;
 476	char *secctx;
 477	u32 secctx_len;
 478
 479	spin_lock(&netlbl_unlhsh_lock);
 480	list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
 481					   &iface->addr4_list);
 482	spin_unlock(&netlbl_unlhsh_lock);
 483	if (list_entry != NULL)
 484		entry = netlbl_unlhsh_addr4_entry(list_entry);
 485	else
 486		entry = NULL;
 487
 488	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
 489					      audit_info);
 490	if (audit_buf != NULL) {
 491		dev = dev_get_by_index(net, iface->ifindex);
 492		netlbl_af4list_audit_addr(audit_buf, 1,
 493					  (dev != NULL ? dev->name : NULL),
 494					  addr->s_addr, mask->s_addr);
 495		dev_put(dev);
 
 496		if (entry != NULL &&
 497		    security_secid_to_secctx(entry->secid,
 498					     &secctx, &secctx_len) == 0) {
 499			audit_log_format(audit_buf, " sec_obj=%s", secctx);
 500			security_release_secctx(secctx, secctx_len);
 501		}
 502		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
 503		audit_log_end(audit_buf);
 504	}
 505
 506	if (entry == NULL)
 507		return -ENOENT;
 508
 509	kfree_rcu(entry, rcu);
 510	return 0;
 511}
 512
 513#if IS_ENABLED(CONFIG_IPV6)
 514/**
 515 * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
 516 * @net: network namespace
 517 * @iface: interface entry
 518 * @addr: IP address
 519 * @mask: IP address mask
 520 * @audit_info: NetLabel audit information
 521 *
 522 * Description:
 523 * Remove an IP address entry from the unlabeled connection hash table.
 524 * Returns zero on success, negative values on failure.
 525 *
 526 */
 527static int netlbl_unlhsh_remove_addr6(struct net *net,
 528				      struct netlbl_unlhsh_iface *iface,
 529				      const struct in6_addr *addr,
 530				      const struct in6_addr *mask,
 531				      struct netlbl_audit *audit_info)
 532{
 533	struct netlbl_af6list *list_entry;
 534	struct netlbl_unlhsh_addr6 *entry;
 535	struct audit_buffer *audit_buf;
 536	struct net_device *dev;
 537	char *secctx;
 538	u32 secctx_len;
 539
 540	spin_lock(&netlbl_unlhsh_lock);
 541	list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
 542	spin_unlock(&netlbl_unlhsh_lock);
 543	if (list_entry != NULL)
 544		entry = netlbl_unlhsh_addr6_entry(list_entry);
 545	else
 546		entry = NULL;
 547
 548	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
 549					      audit_info);
 550	if (audit_buf != NULL) {
 551		dev = dev_get_by_index(net, iface->ifindex);
 552		netlbl_af6list_audit_addr(audit_buf, 1,
 553					  (dev != NULL ? dev->name : NULL),
 554					  addr, mask);
 555		dev_put(dev);
 
 556		if (entry != NULL &&
 557		    security_secid_to_secctx(entry->secid,
 558					     &secctx, &secctx_len) == 0) {
 559			audit_log_format(audit_buf, " sec_obj=%s", secctx);
 560			security_release_secctx(secctx, secctx_len);
 561		}
 562		audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
 563		audit_log_end(audit_buf);
 564	}
 565
 566	if (entry == NULL)
 567		return -ENOENT;
 568
 569	kfree_rcu(entry, rcu);
 570	return 0;
 571}
 572#endif /* IPv6 */
 573
 574/**
 575 * netlbl_unlhsh_condremove_iface - Remove an interface entry
 576 * @iface: the interface entry
 577 *
 578 * Description:
 579 * Remove an interface entry from the unlabeled connection hash table if it is
 580 * empty.  An interface entry is considered to be empty if there are no
 581 * address entries assigned to it.
 582 *
 583 */
 584static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
 585{
 586	struct netlbl_af4list *iter4;
 587#if IS_ENABLED(CONFIG_IPV6)
 588	struct netlbl_af6list *iter6;
 589#endif /* IPv6 */
 590
 591	spin_lock(&netlbl_unlhsh_lock);
 592	netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
 593		goto unlhsh_condremove_failure;
 594#if IS_ENABLED(CONFIG_IPV6)
 595	netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
 596		goto unlhsh_condremove_failure;
 597#endif /* IPv6 */
 598	iface->valid = 0;
 599	if (iface->ifindex > 0)
 600		list_del_rcu(&iface->list);
 601	else
 602		RCU_INIT_POINTER(netlbl_unlhsh_def, NULL);
 603	spin_unlock(&netlbl_unlhsh_lock);
 604
 605	call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
 606	return;
 607
 608unlhsh_condremove_failure:
 609	spin_unlock(&netlbl_unlhsh_lock);
 610}
 611
 612/**
 613 * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
 614 * @net: network namespace
 615 * @dev_name: interface name
 616 * @addr: IP address in network byte order
 617 * @mask: address mask in network byte order
 618 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
 619 * @audit_info: NetLabel audit information
 620 *
 621 * Description:
 622 * Removes and existing entry from the unlabeled connection hash table.
 623 * Returns zero on success, negative values on failure.
 624 *
 625 */
 626int netlbl_unlhsh_remove(struct net *net,
 627			 const char *dev_name,
 628			 const void *addr,
 629			 const void *mask,
 630			 u32 addr_len,
 631			 struct netlbl_audit *audit_info)
 632{
 633	int ret_val;
 634	struct net_device *dev;
 635	struct netlbl_unlhsh_iface *iface;
 636
 637	if (addr_len != sizeof(struct in_addr) &&
 638	    addr_len != sizeof(struct in6_addr))
 639		return -EINVAL;
 640
 641	rcu_read_lock();
 642	if (dev_name != NULL) {
 643		dev = dev_get_by_name_rcu(net, dev_name);
 644		if (dev == NULL) {
 645			ret_val = -ENODEV;
 646			goto unlhsh_remove_return;
 647		}
 648		iface = netlbl_unlhsh_search_iface(dev->ifindex);
 649	} else
 650		iface = rcu_dereference(netlbl_unlhsh_def);
 651	if (iface == NULL) {
 652		ret_val = -ENOENT;
 653		goto unlhsh_remove_return;
 654	}
 655	switch (addr_len) {
 656	case sizeof(struct in_addr):
 657		ret_val = netlbl_unlhsh_remove_addr4(net,
 658						     iface, addr, mask,
 659						     audit_info);
 660		break;
 661#if IS_ENABLED(CONFIG_IPV6)
 662	case sizeof(struct in6_addr):
 663		ret_val = netlbl_unlhsh_remove_addr6(net,
 664						     iface, addr, mask,
 665						     audit_info);
 666		break;
 667#endif /* IPv6 */
 668	default:
 669		ret_val = -EINVAL;
 670	}
 671	if (ret_val == 0) {
 672		netlbl_unlhsh_condremove_iface(iface);
 673		atomic_dec(&netlabel_mgmt_protocount);
 674	}
 675
 676unlhsh_remove_return:
 677	rcu_read_unlock();
 678	return ret_val;
 679}
 680
 681/*
 682 * General Helper Functions
 683 */
 684
 685/**
 686 * netlbl_unlhsh_netdev_handler - Network device notification handler
 687 * @this: notifier block
 688 * @event: the event
 689 * @ptr: the netdevice notifier info (cast to void)
 690 *
 691 * Description:
 692 * Handle network device events, although at present all we care about is a
 693 * network device going away.  In the case of a device going away we clear any
 694 * related entries from the unlabeled connection hash table.
 695 *
 696 */
 697static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
 698					unsigned long event, void *ptr)
 699{
 700	struct net_device *dev = netdev_notifier_info_to_dev(ptr);
 701	struct netlbl_unlhsh_iface *iface = NULL;
 702
 703	if (!net_eq(dev_net(dev), &init_net))
 704		return NOTIFY_DONE;
 705
 706	/* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
 707	if (event == NETDEV_DOWN) {
 708		spin_lock(&netlbl_unlhsh_lock);
 709		iface = netlbl_unlhsh_search_iface(dev->ifindex);
 710		if (iface != NULL && iface->valid) {
 711			iface->valid = 0;
 712			list_del_rcu(&iface->list);
 713		} else
 714			iface = NULL;
 715		spin_unlock(&netlbl_unlhsh_lock);
 716	}
 717
 718	if (iface != NULL)
 719		call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
 720
 721	return NOTIFY_DONE;
 722}
 723
 724/**
 725 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
 726 * @value: desired value
 727 * @audit_info: NetLabel audit information
 728 *
 729 * Description:
 730 * Set the value of the unlabeled accept flag to @value.
 731 *
 732 */
 733static void netlbl_unlabel_acceptflg_set(u8 value,
 734					 struct netlbl_audit *audit_info)
 735{
 736	struct audit_buffer *audit_buf;
 737	u8 old_val;
 738
 739	old_val = netlabel_unlabel_acceptflg;
 740	netlabel_unlabel_acceptflg = value;
 741	audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
 742					      audit_info);
 743	if (audit_buf != NULL) {
 744		audit_log_format(audit_buf,
 745				 " unlbl_accept=%u old=%u", value, old_val);
 746		audit_log_end(audit_buf);
 747	}
 748}
 749
 750/**
 751 * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
 752 * @info: the Generic NETLINK info block
 753 * @addr: the IP address
 754 * @mask: the IP address mask
 755 * @len: the address length
 756 *
 757 * Description:
 758 * Examine the Generic NETLINK message and extract the IP address information.
 759 * Returns zero on success, negative values on failure.
 760 *
 761 */
 762static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
 763				       void **addr,
 764				       void **mask,
 765				       u32 *len)
 766{
 767	u32 addr_len;
 768
 769	if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] &&
 770	    info->attrs[NLBL_UNLABEL_A_IPV4MASK]) {
 771		addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
 772		if (addr_len != sizeof(struct in_addr) &&
 773		    addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
 774			return -EINVAL;
 775		*len = addr_len;
 776		*addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
 777		*mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
 778		return 0;
 779	} else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
 780		addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
 781		if (addr_len != sizeof(struct in6_addr) &&
 782		    addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
 783			return -EINVAL;
 784		*len = addr_len;
 785		*addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
 786		*mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
 787		return 0;
 788	}
 789
 790	return -EINVAL;
 791}
 792
 793/*
 794 * NetLabel Command Handlers
 795 */
 796
 797/**
 798 * netlbl_unlabel_accept - Handle an ACCEPT message
 799 * @skb: the NETLINK buffer
 800 * @info: the Generic NETLINK info block
 801 *
 802 * Description:
 803 * Process a user generated ACCEPT message and set the accept flag accordingly.
 804 * Returns zero on success, negative values on failure.
 805 *
 806 */
 807static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
 808{
 809	u8 value;
 810	struct netlbl_audit audit_info;
 811
 812	if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
 813		value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
 814		if (value == 1 || value == 0) {
 815			netlbl_netlink_auditinfo(&audit_info);
 816			netlbl_unlabel_acceptflg_set(value, &audit_info);
 817			return 0;
 818		}
 819	}
 820
 821	return -EINVAL;
 822}
 823
 824/**
 825 * netlbl_unlabel_list - Handle a LIST message
 826 * @skb: the NETLINK buffer
 827 * @info: the Generic NETLINK info block
 828 *
 829 * Description:
 830 * Process a user generated LIST message and respond with the current status.
 831 * Returns zero on success, negative values on failure.
 832 *
 833 */
 834static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
 835{
 836	int ret_val = -EINVAL;
 837	struct sk_buff *ans_skb;
 838	void *data;
 839
 840	ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 841	if (ans_skb == NULL)
 842		goto list_failure;
 843	data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
 844				 0, NLBL_UNLABEL_C_LIST);
 845	if (data == NULL) {
 846		ret_val = -ENOMEM;
 847		goto list_failure;
 848	}
 849
 850	ret_val = nla_put_u8(ans_skb,
 851			     NLBL_UNLABEL_A_ACPTFLG,
 852			     netlabel_unlabel_acceptflg);
 853	if (ret_val != 0)
 854		goto list_failure;
 855
 856	genlmsg_end(ans_skb, data);
 857	return genlmsg_reply(ans_skb, info);
 858
 859list_failure:
 860	kfree_skb(ans_skb);
 861	return ret_val;
 862}
 863
 864/**
 865 * netlbl_unlabel_staticadd - Handle a STATICADD message
 866 * @skb: the NETLINK buffer
 867 * @info: the Generic NETLINK info block
 868 *
 869 * Description:
 870 * Process a user generated STATICADD message and add a new unlabeled
 871 * connection entry to the hash table.  Returns zero on success, negative
 872 * values on failure.
 873 *
 874 */
 875static int netlbl_unlabel_staticadd(struct sk_buff *skb,
 876				    struct genl_info *info)
 877{
 878	int ret_val;
 879	char *dev_name;
 880	void *addr;
 881	void *mask;
 882	u32 addr_len;
 883	u32 secid;
 884	struct netlbl_audit audit_info;
 885
 886	/* Don't allow users to add both IPv4 and IPv6 addresses for a
 887	 * single entry.  However, allow users to create two entries, one each
 888	 * for IPv4 and IPv6, with the same LSM security context which should
 889	 * achieve the same result. */
 890	if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
 891	    !info->attrs[NLBL_UNLABEL_A_IFACE] ||
 892	    !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
 893	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
 894	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
 895	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 896		return -EINVAL;
 897
 898	netlbl_netlink_auditinfo(&audit_info);
 899
 900	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 901	if (ret_val != 0)
 902		return ret_val;
 903	dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
 904	ret_val = security_secctx_to_secid(
 905		                  nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 906				  nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 907				  &secid);
 908	if (ret_val != 0)
 909		return ret_val;
 910
 911	return netlbl_unlhsh_add(&init_net,
 912				 dev_name, addr, mask, addr_len, secid,
 913				 &audit_info);
 914}
 915
 916/**
 917 * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
 918 * @skb: the NETLINK buffer
 919 * @info: the Generic NETLINK info block
 920 *
 921 * Description:
 922 * Process a user generated STATICADDDEF message and add a new default
 923 * unlabeled connection entry.  Returns zero on success, negative values on
 924 * failure.
 925 *
 926 */
 927static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
 928				       struct genl_info *info)
 929{
 930	int ret_val;
 931	void *addr;
 932	void *mask;
 933	u32 addr_len;
 934	u32 secid;
 935	struct netlbl_audit audit_info;
 936
 937	/* Don't allow users to add both IPv4 and IPv6 addresses for a
 938	 * single entry.  However, allow users to create two entries, one each
 939	 * for IPv4 and IPv6, with the same LSM security context which should
 940	 * achieve the same result. */
 941	if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
 942	    !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
 943	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
 944	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
 945	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 946		return -EINVAL;
 947
 948	netlbl_netlink_auditinfo(&audit_info);
 949
 950	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 951	if (ret_val != 0)
 952		return ret_val;
 953	ret_val = security_secctx_to_secid(
 954		                  nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 955				  nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
 956				  &secid);
 957	if (ret_val != 0)
 958		return ret_val;
 959
 960	return netlbl_unlhsh_add(&init_net,
 961				 NULL, addr, mask, addr_len, secid,
 962				 &audit_info);
 963}
 964
 965/**
 966 * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
 967 * @skb: the NETLINK buffer
 968 * @info: the Generic NETLINK info block
 969 *
 970 * Description:
 971 * Process a user generated STATICREMOVE message and remove the specified
 972 * unlabeled connection entry.  Returns zero on success, negative values on
 973 * failure.
 974 *
 975 */
 976static int netlbl_unlabel_staticremove(struct sk_buff *skb,
 977				       struct genl_info *info)
 978{
 979	int ret_val;
 980	char *dev_name;
 981	void *addr;
 982	void *mask;
 983	u32 addr_len;
 984	struct netlbl_audit audit_info;
 985
 986	/* See the note in netlbl_unlabel_staticadd() about not allowing both
 987	 * IPv4 and IPv6 in the same entry. */
 988	if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
 989	    !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
 990	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
 991	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
 992	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
 993		return -EINVAL;
 994
 995	netlbl_netlink_auditinfo(&audit_info);
 996
 997	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
 998	if (ret_val != 0)
 999		return ret_val;
1000	dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
1001
1002	return netlbl_unlhsh_remove(&init_net,
1003				    dev_name, addr, mask, addr_len,
1004				    &audit_info);
1005}
1006
1007/**
1008 * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1009 * @skb: the NETLINK buffer
1010 * @info: the Generic NETLINK info block
1011 *
1012 * Description:
1013 * Process a user generated STATICREMOVEDEF message and remove the default
1014 * unlabeled connection entry.  Returns zero on success, negative values on
1015 * failure.
1016 *
1017 */
1018static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
1019					  struct genl_info *info)
1020{
1021	int ret_val;
1022	void *addr;
1023	void *mask;
1024	u32 addr_len;
1025	struct netlbl_audit audit_info;
1026
1027	/* See the note in netlbl_unlabel_staticadd() about not allowing both
1028	 * IPv4 and IPv6 in the same entry. */
1029	if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1030	       !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1031	      (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1032	       !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1033		return -EINVAL;
1034
1035	netlbl_netlink_auditinfo(&audit_info);
1036
1037	ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1038	if (ret_val != 0)
1039		return ret_val;
1040
1041	return netlbl_unlhsh_remove(&init_net,
1042				    NULL, addr, mask, addr_len,
1043				    &audit_info);
1044}
1045
1046
1047/**
1048 * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1049 * @cmd: command/message
1050 * @iface: the interface entry
1051 * @addr4: the IPv4 address entry
1052 * @addr6: the IPv6 address entry
1053 * @arg: the netlbl_unlhsh_walk_arg structure
1054 *
1055 * Description:
1056 * This function is designed to be used to generate a response for a
1057 * STATICLIST or STATICLISTDEF message.  When called either @addr4 or @addr6
1058 * can be specified, not both, the other unspecified entry should be set to
1059 * NULL by the caller.  Returns the size of the message on success, negative
1060 * values on failure.
1061 *
1062 */
1063static int netlbl_unlabel_staticlist_gen(u32 cmd,
1064				       const struct netlbl_unlhsh_iface *iface,
1065				       const struct netlbl_unlhsh_addr4 *addr4,
1066				       const struct netlbl_unlhsh_addr6 *addr6,
1067				       void *arg)
1068{
1069	int ret_val = -ENOMEM;
1070	struct netlbl_unlhsh_walk_arg *cb_arg = arg;
1071	struct net_device *dev;
1072	void *data;
1073	u32 secid;
1074	char *secctx;
1075	u32 secctx_len;
1076
1077	data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
1078			   cb_arg->seq, &netlbl_unlabel_gnl_family,
1079			   NLM_F_MULTI, cmd);
1080	if (data == NULL)
1081		goto list_cb_failure;
1082
1083	if (iface->ifindex > 0) {
1084		dev = dev_get_by_index(&init_net, iface->ifindex);
1085		if (!dev) {
1086			ret_val = -ENODEV;
1087			goto list_cb_failure;
1088		}
1089		ret_val = nla_put_string(cb_arg->skb,
1090					 NLBL_UNLABEL_A_IFACE, dev->name);
1091		dev_put(dev);
1092		if (ret_val != 0)
1093			goto list_cb_failure;
1094	}
1095
1096	if (addr4) {
1097		struct in_addr addr_struct;
1098
1099		addr_struct.s_addr = addr4->list.addr;
1100		ret_val = nla_put_in_addr(cb_arg->skb,
1101					  NLBL_UNLABEL_A_IPV4ADDR,
1102					  addr_struct.s_addr);
1103		if (ret_val != 0)
1104			goto list_cb_failure;
1105
1106		addr_struct.s_addr = addr4->list.mask;
1107		ret_val = nla_put_in_addr(cb_arg->skb,
1108					  NLBL_UNLABEL_A_IPV4MASK,
1109					  addr_struct.s_addr);
1110		if (ret_val != 0)
1111			goto list_cb_failure;
1112
1113		secid = addr4->secid;
1114	} else {
1115		ret_val = nla_put_in6_addr(cb_arg->skb,
1116					   NLBL_UNLABEL_A_IPV6ADDR,
1117					   &addr6->list.addr);
1118		if (ret_val != 0)
1119			goto list_cb_failure;
1120
1121		ret_val = nla_put_in6_addr(cb_arg->skb,
1122					   NLBL_UNLABEL_A_IPV6MASK,
1123					   &addr6->list.mask);
1124		if (ret_val != 0)
1125			goto list_cb_failure;
1126
1127		secid = addr6->secid;
1128	}
1129
1130	ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
1131	if (ret_val != 0)
1132		goto list_cb_failure;
1133	ret_val = nla_put(cb_arg->skb,
1134			  NLBL_UNLABEL_A_SECCTX,
1135			  secctx_len,
1136			  secctx);
1137	security_release_secctx(secctx, secctx_len);
1138	if (ret_val != 0)
1139		goto list_cb_failure;
1140
1141	cb_arg->seq++;
1142	genlmsg_end(cb_arg->skb, data);
1143	return 0;
1144
1145list_cb_failure:
1146	genlmsg_cancel(cb_arg->skb, data);
1147	return ret_val;
1148}
1149
1150/**
1151 * netlbl_unlabel_staticlist - Handle a STATICLIST message
1152 * @skb: the NETLINK buffer
1153 * @cb: the NETLINK callback
1154 *
1155 * Description:
1156 * Process a user generated STATICLIST message and dump the unlabeled
1157 * connection hash table in a form suitable for use in a kernel generated
1158 * STATICLIST message.  Returns the length of @skb.
1159 *
1160 */
1161static int netlbl_unlabel_staticlist(struct sk_buff *skb,
1162				     struct netlink_callback *cb)
1163{
1164	struct netlbl_unlhsh_walk_arg cb_arg;
1165	u32 skip_bkt = cb->args[0];
1166	u32 skip_chain = cb->args[1];
1167	u32 skip_addr4 = cb->args[2];
1168	u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
1169	struct netlbl_unlhsh_iface *iface;
1170	struct list_head *iter_list;
1171	struct netlbl_af4list *addr4;
1172#if IS_ENABLED(CONFIG_IPV6)
1173	u32 skip_addr6 = cb->args[3];
1174	struct netlbl_af6list *addr6;
1175#endif
1176
1177	cb_arg.nl_cb = cb;
1178	cb_arg.skb = skb;
1179	cb_arg.seq = cb->nlh->nlmsg_seq;
1180
1181	rcu_read_lock();
1182	for (iter_bkt = skip_bkt;
1183	     iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
1184	     iter_bkt++) {
1185		iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
1186		list_for_each_entry_rcu(iface, iter_list, list) {
1187			if (!iface->valid ||
1188			    iter_chain++ < skip_chain)
1189				continue;
1190			netlbl_af4list_foreach_rcu(addr4,
1191						   &iface->addr4_list) {
1192				if (iter_addr4++ < skip_addr4)
1193					continue;
1194				if (netlbl_unlabel_staticlist_gen(
1195					      NLBL_UNLABEL_C_STATICLIST,
1196					      iface,
1197					      netlbl_unlhsh_addr4_entry(addr4),
1198					      NULL,
1199					      &cb_arg) < 0) {
1200					iter_addr4--;
1201					iter_chain--;
1202					goto unlabel_staticlist_return;
1203				}
1204			}
1205			iter_addr4 = 0;
1206			skip_addr4 = 0;
1207#if IS_ENABLED(CONFIG_IPV6)
1208			netlbl_af6list_foreach_rcu(addr6,
1209						   &iface->addr6_list) {
1210				if (iter_addr6++ < skip_addr6)
1211					continue;
1212				if (netlbl_unlabel_staticlist_gen(
1213					      NLBL_UNLABEL_C_STATICLIST,
1214					      iface,
1215					      NULL,
1216					      netlbl_unlhsh_addr6_entry(addr6),
1217					      &cb_arg) < 0) {
1218					iter_addr6--;
1219					iter_chain--;
1220					goto unlabel_staticlist_return;
1221				}
1222			}
1223			iter_addr6 = 0;
1224			skip_addr6 = 0;
1225#endif /* IPv6 */
1226		}
1227		iter_chain = 0;
1228		skip_chain = 0;
1229	}
1230
1231unlabel_staticlist_return:
1232	rcu_read_unlock();
1233	cb->args[0] = iter_bkt;
1234	cb->args[1] = iter_chain;
1235	cb->args[2] = iter_addr4;
1236	cb->args[3] = iter_addr6;
1237	return skb->len;
1238}
1239
1240/**
1241 * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1242 * @skb: the NETLINK buffer
1243 * @cb: the NETLINK callback
1244 *
1245 * Description:
1246 * Process a user generated STATICLISTDEF message and dump the default
1247 * unlabeled connection entry in a form suitable for use in a kernel generated
1248 * STATICLISTDEF message.  Returns the length of @skb.
1249 *
1250 */
1251static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
1252					struct netlink_callback *cb)
1253{
1254	struct netlbl_unlhsh_walk_arg cb_arg;
1255	struct netlbl_unlhsh_iface *iface;
1256	u32 iter_addr4 = 0, iter_addr6 = 0;
1257	struct netlbl_af4list *addr4;
1258#if IS_ENABLED(CONFIG_IPV6)
1259	struct netlbl_af6list *addr6;
1260#endif
1261
1262	cb_arg.nl_cb = cb;
1263	cb_arg.skb = skb;
1264	cb_arg.seq = cb->nlh->nlmsg_seq;
1265
1266	rcu_read_lock();
1267	iface = rcu_dereference(netlbl_unlhsh_def);
1268	if (iface == NULL || !iface->valid)
1269		goto unlabel_staticlistdef_return;
1270
1271	netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
1272		if (iter_addr4++ < cb->args[0])
1273			continue;
1274		if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1275					      iface,
1276					      netlbl_unlhsh_addr4_entry(addr4),
1277					      NULL,
1278					      &cb_arg) < 0) {
1279			iter_addr4--;
1280			goto unlabel_staticlistdef_return;
1281		}
1282	}
1283#if IS_ENABLED(CONFIG_IPV6)
1284	netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
1285		if (iter_addr6++ < cb->args[1])
1286			continue;
1287		if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1288					      iface,
1289					      NULL,
1290					      netlbl_unlhsh_addr6_entry(addr6),
1291					      &cb_arg) < 0) {
1292			iter_addr6--;
1293			goto unlabel_staticlistdef_return;
1294		}
1295	}
1296#endif /* IPv6 */
1297
1298unlabel_staticlistdef_return:
1299	rcu_read_unlock();
1300	cb->args[0] = iter_addr4;
1301	cb->args[1] = iter_addr6;
1302	return skb->len;
1303}
1304
1305/*
1306 * NetLabel Generic NETLINK Command Definitions
1307 */
1308
1309static const struct genl_small_ops netlbl_unlabel_genl_ops[] = {
1310	{
1311	.cmd = NLBL_UNLABEL_C_STATICADD,
1312	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1313	.flags = GENL_ADMIN_PERM,
1314	.doit = netlbl_unlabel_staticadd,
1315	.dumpit = NULL,
1316	},
1317	{
1318	.cmd = NLBL_UNLABEL_C_STATICREMOVE,
1319	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1320	.flags = GENL_ADMIN_PERM,
1321	.doit = netlbl_unlabel_staticremove,
1322	.dumpit = NULL,
1323	},
1324	{
1325	.cmd = NLBL_UNLABEL_C_STATICLIST,
1326	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1327	.flags = 0,
1328	.doit = NULL,
1329	.dumpit = netlbl_unlabel_staticlist,
1330	},
1331	{
1332	.cmd = NLBL_UNLABEL_C_STATICADDDEF,
1333	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1334	.flags = GENL_ADMIN_PERM,
1335	.doit = netlbl_unlabel_staticadddef,
1336	.dumpit = NULL,
1337	},
1338	{
1339	.cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
1340	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1341	.flags = GENL_ADMIN_PERM,
1342	.doit = netlbl_unlabel_staticremovedef,
1343	.dumpit = NULL,
1344	},
1345	{
1346	.cmd = NLBL_UNLABEL_C_STATICLISTDEF,
1347	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1348	.flags = 0,
1349	.doit = NULL,
1350	.dumpit = netlbl_unlabel_staticlistdef,
1351	},
1352	{
1353	.cmd = NLBL_UNLABEL_C_ACCEPT,
1354	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1355	.flags = GENL_ADMIN_PERM,
1356	.doit = netlbl_unlabel_accept,
1357	.dumpit = NULL,
1358	},
1359	{
1360	.cmd = NLBL_UNLABEL_C_LIST,
1361	.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1362	.flags = 0,
1363	.doit = netlbl_unlabel_list,
1364	.dumpit = NULL,
1365	},
1366};
1367
1368static struct genl_family netlbl_unlabel_gnl_family __ro_after_init = {
1369	.hdrsize = 0,
1370	.name = NETLBL_NLTYPE_UNLABELED_NAME,
1371	.version = NETLBL_PROTO_VERSION,
1372	.maxattr = NLBL_UNLABEL_A_MAX,
1373	.policy = netlbl_unlabel_genl_policy,
1374	.module = THIS_MODULE,
1375	.small_ops = netlbl_unlabel_genl_ops,
1376	.n_small_ops = ARRAY_SIZE(netlbl_unlabel_genl_ops),
1377	.resv_start_op = NLBL_UNLABEL_C_STATICLISTDEF + 1,
1378};
1379
1380/*
1381 * NetLabel Generic NETLINK Protocol Functions
1382 */
1383
1384/**
1385 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1386 *
1387 * Description:
1388 * Register the unlabeled packet NetLabel component with the Generic NETLINK
1389 * mechanism.  Returns zero on success, negative values on failure.
1390 *
1391 */
1392int __init netlbl_unlabel_genl_init(void)
1393{
1394	return genl_register_family(&netlbl_unlabel_gnl_family);
1395}
1396
1397/*
1398 * NetLabel KAPI Hooks
1399 */
1400
1401static struct notifier_block netlbl_unlhsh_netdev_notifier = {
1402	.notifier_call = netlbl_unlhsh_netdev_handler,
1403};
1404
1405/**
1406 * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1407 * @size: the number of bits to use for the hash buckets
1408 *
1409 * Description:
1410 * Initializes the unlabeled connection hash table and registers a network
1411 * device notification handler.  This function should only be called by the
1412 * NetLabel subsystem itself during initialization.  Returns zero on success,
1413 * non-zero values on error.
1414 *
1415 */
1416int __init netlbl_unlabel_init(u32 size)
1417{
1418	u32 iter;
1419	struct netlbl_unlhsh_tbl *hsh_tbl;
1420
1421	if (size == 0)
1422		return -EINVAL;
1423
1424	hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
1425	if (hsh_tbl == NULL)
1426		return -ENOMEM;
1427	hsh_tbl->size = 1 << size;
1428	hsh_tbl->tbl = kcalloc(hsh_tbl->size,
1429			       sizeof(struct list_head),
1430			       GFP_KERNEL);
1431	if (hsh_tbl->tbl == NULL) {
1432		kfree(hsh_tbl);
1433		return -ENOMEM;
1434	}
1435	for (iter = 0; iter < hsh_tbl->size; iter++)
1436		INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
1437
1438	spin_lock(&netlbl_unlhsh_lock);
1439	rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
1440	spin_unlock(&netlbl_unlhsh_lock);
1441
1442	register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
1443
1444	return 0;
1445}
1446
1447/**
1448 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1449 * @skb: the packet
1450 * @family: protocol family
1451 * @secattr: the security attributes
1452 *
1453 * Description:
1454 * Determine the security attributes, if any, for an unlabled packet and return
1455 * them in @secattr.  Returns zero on success and negative values on failure.
1456 *
1457 */
1458int netlbl_unlabel_getattr(const struct sk_buff *skb,
1459			   u16 family,
1460			   struct netlbl_lsm_secattr *secattr)
1461{
1462	struct netlbl_unlhsh_iface *iface;
1463
1464	rcu_read_lock();
1465	iface = netlbl_unlhsh_search_iface(skb->skb_iif);
1466	if (iface == NULL)
1467		iface = rcu_dereference(netlbl_unlhsh_def);
1468	if (iface == NULL || !iface->valid)
1469		goto unlabel_getattr_nolabel;
1470
1471#if IS_ENABLED(CONFIG_IPV6)
1472	/* When resolving a fallback label, check the sk_buff version as
1473	 * it is possible (e.g. SCTP) to have family = PF_INET6 while
1474	 * receiving ip_hdr(skb)->version = 4.
1475	 */
1476	if (family == PF_INET6 && ip_hdr(skb)->version == 4)
1477		family = PF_INET;
1478#endif /* IPv6 */
1479
1480	switch (family) {
1481	case PF_INET: {
1482		struct iphdr *hdr4;
1483		struct netlbl_af4list *addr4;
1484
1485		hdr4 = ip_hdr(skb);
1486		addr4 = netlbl_af4list_search(hdr4->saddr,
1487					      &iface->addr4_list);
1488		if (addr4 == NULL)
1489			goto unlabel_getattr_nolabel;
1490		secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
1491		break;
1492	}
1493#if IS_ENABLED(CONFIG_IPV6)
1494	case PF_INET6: {
1495		struct ipv6hdr *hdr6;
1496		struct netlbl_af6list *addr6;
1497
1498		hdr6 = ipv6_hdr(skb);
1499		addr6 = netlbl_af6list_search(&hdr6->saddr,
1500					      &iface->addr6_list);
1501		if (addr6 == NULL)
1502			goto unlabel_getattr_nolabel;
1503		secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
1504		break;
1505	}
1506#endif /* IPv6 */
1507	default:
1508		goto unlabel_getattr_nolabel;
1509	}
1510	rcu_read_unlock();
1511
1512	secattr->flags |= NETLBL_SECATTR_SECID;
1513	secattr->type = NETLBL_NLTYPE_UNLABELED;
1514	return 0;
1515
1516unlabel_getattr_nolabel:
1517	rcu_read_unlock();
1518	if (netlabel_unlabel_acceptflg == 0)
1519		return -ENOMSG;
1520	secattr->type = NETLBL_NLTYPE_UNLABELED;
1521	return 0;
1522}
1523
1524/**
1525 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1526 *
1527 * Description:
1528 * Set the default NetLabel configuration to allow incoming unlabeled packets
1529 * and to send unlabeled network traffic by default.
1530 *
1531 */
1532int __init netlbl_unlabel_defconf(void)
1533{
1534	int ret_val;
1535	struct netlbl_dom_map *entry;
1536	struct netlbl_audit audit_info;
1537
1538	/* Only the kernel is allowed to call this function and the only time
1539	 * it is called is at bootup before the audit subsystem is reporting
1540	 * messages so don't worry to much about these values. */
1541	security_current_getlsmprop_subj(&audit_info.prop);
1542	audit_info.loginuid = GLOBAL_ROOT_UID;
1543	audit_info.sessionid = 0;
1544
1545	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1546	if (entry == NULL)
1547		return -ENOMEM;
1548	entry->family = AF_UNSPEC;
1549	entry->def.type = NETLBL_NLTYPE_UNLABELED;
1550	ret_val = netlbl_domhsh_add_default(entry, &audit_info);
1551	if (ret_val != 0)
1552		return ret_val;
1553
1554	netlbl_unlabel_acceptflg_set(1, &audit_info);
1555
1556	return 0;
1557}