1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * NetLabel Unlabeled Support
5 * This file defines functions for dealing with unlabeled packets for the
6 * NetLabel system. The NetLabel system manages static and dynamic label
7 * mappings for network protocols such as CIPSO and RIPSO.
9 * Author: Paul Moore <paul@paul-moore.com>
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 - 2008
16 #include <linux/types.h>
17 #include <linux/rcupdate.h>
18 #include <linux/list.h>
19 #include <linux/spinlock.h>
20 #include <linux/socket.h>
21 #include <linux/string.h>
22 #include <linux/skbuff.h>
23 #include <linux/audit.h>
25 #include <linux/in6.h>
27 #include <linux/ipv6.h>
28 #include <linux/notifier.h>
29 #include <linux/netdevice.h>
30 #include <linux/security.h>
31 #include <linux/slab.h>
33 #include <net/netlink.h>
34 #include <net/genetlink.h>
37 #include <net/net_namespace.h>
38 #include <net/netlabel.h>
40 #include <linux/atomic.h>
42 #include "netlabel_user.h"
43 #include "netlabel_addrlist.h"
44 #include "netlabel_domainhash.h"
45 #include "netlabel_unlabeled.h"
46 #include "netlabel_mgmt.h"
48 /* NOTE: at present we always use init's network namespace since we don't
49 * presently support different namespaces even though the majority of
50 * the functions in this file are "namespace safe" */
52 /* The unlabeled connection hash table which we use to map network interfaces
53 * and addresses of unlabeled packets to a user specified secid value for the
54 * LSM. The hash table is used to lookup the network interface entry
55 * (struct netlbl_unlhsh_iface) and then the interface entry is used to
56 * lookup an IP address match from an ordered list. If a network interface
57 * match can not be found in the hash table then the default entry
58 * (netlbl_unlhsh_def) is used. The IP address entry list
59 * (struct netlbl_unlhsh_addr) is ordered such that the entries with a
60 * larger netmask come first.
62 struct netlbl_unlhsh_tbl {
63 struct list_head *tbl;
66 #define netlbl_unlhsh_addr4_entry(iter) \
67 container_of(iter, struct netlbl_unlhsh_addr4, list)
68 struct netlbl_unlhsh_addr4 {
71 struct netlbl_af4list list;
74 #define netlbl_unlhsh_addr6_entry(iter) \
75 container_of(iter, struct netlbl_unlhsh_addr6, list)
76 struct netlbl_unlhsh_addr6 {
79 struct netlbl_af6list list;
82 struct netlbl_unlhsh_iface {
84 struct list_head addr4_list;
85 struct list_head addr6_list;
88 struct list_head list;
92 /* Argument struct for netlbl_unlhsh_walk() */
93 struct netlbl_unlhsh_walk_arg {
94 struct netlink_callback *nl_cb;
99 /* Unlabeled connection hash table */
100 /* updates should be so rare that having one spinlock for the entire
101 * hash table should be okay */
102 static DEFINE_SPINLOCK(netlbl_unlhsh_lock);
103 #define netlbl_unlhsh_rcu_deref(p) \
104 rcu_dereference_check(p, lockdep_is_held(&netlbl_unlhsh_lock))
105 static struct netlbl_unlhsh_tbl __rcu *netlbl_unlhsh;
106 static struct netlbl_unlhsh_iface __rcu *netlbl_unlhsh_def;
108 /* Accept unlabeled packets flag */
109 static u8 netlabel_unlabel_acceptflg;
111 /* NetLabel Generic NETLINK unlabeled family */
112 static struct genl_family netlbl_unlabel_gnl_family;
114 /* NetLabel Netlink attribute policy */
115 static const struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = {
116 [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 },
117 [NLBL_UNLABEL_A_IPV6ADDR] = { .type = NLA_BINARY,
118 .len = sizeof(struct in6_addr) },
119 [NLBL_UNLABEL_A_IPV6MASK] = { .type = NLA_BINARY,
120 .len = sizeof(struct in6_addr) },
121 [NLBL_UNLABEL_A_IPV4ADDR] = { .type = NLA_BINARY,
122 .len = sizeof(struct in_addr) },
123 [NLBL_UNLABEL_A_IPV4MASK] = { .type = NLA_BINARY,
124 .len = sizeof(struct in_addr) },
125 [NLBL_UNLABEL_A_IFACE] = { .type = NLA_NUL_STRING,
126 .len = IFNAMSIZ - 1 },
127 [NLBL_UNLABEL_A_SECCTX] = { .type = NLA_BINARY }
131 * Unlabeled Connection Hash Table Functions
135 * netlbl_unlhsh_free_iface - Frees an interface entry from the hash table
136 * @entry: the entry's RCU field
139 * This function is designed to be used as a callback to the call_rcu()
140 * function so that memory allocated to a hash table interface entry can be
141 * released safely. It is important to note that this function does not free
142 * the IPv4 and IPv6 address lists contained as part of an interface entry. It
143 * is up to the rest of the code to make sure an interface entry is only freed
144 * once it's address lists are empty.
147 static void netlbl_unlhsh_free_iface(struct rcu_head *entry)
149 struct netlbl_unlhsh_iface *iface;
150 struct netlbl_af4list *iter4;
151 struct netlbl_af4list *tmp4;
152 #if IS_ENABLED(CONFIG_IPV6)
153 struct netlbl_af6list *iter6;
154 struct netlbl_af6list *tmp6;
157 iface = container_of(entry, struct netlbl_unlhsh_iface, rcu);
159 /* no need for locks here since we are the only one with access to this
162 netlbl_af4list_foreach_safe(iter4, tmp4, &iface->addr4_list) {
163 netlbl_af4list_remove_entry(iter4);
164 kfree(netlbl_unlhsh_addr4_entry(iter4));
166 #if IS_ENABLED(CONFIG_IPV6)
167 netlbl_af6list_foreach_safe(iter6, tmp6, &iface->addr6_list) {
168 netlbl_af6list_remove_entry(iter6);
169 kfree(netlbl_unlhsh_addr6_entry(iter6));
176 * netlbl_unlhsh_hash - Hashing function for the hash table
177 * @ifindex: the network interface/device to hash
180 * This is the hashing function for the unlabeled hash table, it returns the
181 * bucket number for the given device/interface. The caller is responsible for
182 * ensuring that the hash table is protected with either a RCU read lock or
183 * the hash table lock.
186 static u32 netlbl_unlhsh_hash(int ifindex)
188 return ifindex & (netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->size - 1);
192 * netlbl_unlhsh_search_iface - Search for a matching interface entry
193 * @ifindex: the network interface
196 * Searches the unlabeled connection hash table and returns a pointer to the
197 * interface entry which matches @ifindex, otherwise NULL is returned. The
198 * caller is responsible for ensuring that the hash table is protected with
199 * either a RCU read lock or the hash table lock.
202 static struct netlbl_unlhsh_iface *netlbl_unlhsh_search_iface(int ifindex)
205 struct list_head *bkt_list;
206 struct netlbl_unlhsh_iface *iter;
208 bkt = netlbl_unlhsh_hash(ifindex);
209 bkt_list = &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt];
210 list_for_each_entry_rcu(iter, bkt_list, list)
211 if (iter->valid && iter->ifindex == ifindex)
218 * netlbl_unlhsh_add_addr4 - Add a new IPv4 address entry to the hash table
219 * @iface: the associated interface entry
220 * @addr: IPv4 address in network byte order
221 * @mask: IPv4 address mask in network byte order
222 * @secid: LSM secid value for entry
225 * Add a new address entry into the unlabeled connection hash table using the
226 * interface entry specified by @iface. On success zero is returned, otherwise
227 * a negative value is returned.
230 static int netlbl_unlhsh_add_addr4(struct netlbl_unlhsh_iface *iface,
231 const struct in_addr *addr,
232 const struct in_addr *mask,
236 struct netlbl_unlhsh_addr4 *entry;
238 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
242 entry->list.addr = addr->s_addr & mask->s_addr;
243 entry->list.mask = mask->s_addr;
244 entry->list.valid = 1;
245 entry->secid = secid;
247 spin_lock(&netlbl_unlhsh_lock);
248 ret_val = netlbl_af4list_add(&entry->list, &iface->addr4_list);
249 spin_unlock(&netlbl_unlhsh_lock);
256 #if IS_ENABLED(CONFIG_IPV6)
258 * netlbl_unlhsh_add_addr6 - Add a new IPv6 address entry to the hash table
259 * @iface: the associated interface entry
260 * @addr: IPv6 address in network byte order
261 * @mask: IPv6 address mask in network byte order
262 * @secid: LSM secid value for entry
265 * Add a new address entry into the unlabeled connection hash table using the
266 * interface entry specified by @iface. On success zero is returned, otherwise
267 * a negative value is returned.
270 static int netlbl_unlhsh_add_addr6(struct netlbl_unlhsh_iface *iface,
271 const struct in6_addr *addr,
272 const struct in6_addr *mask,
276 struct netlbl_unlhsh_addr6 *entry;
278 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
282 entry->list.addr = *addr;
283 entry->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
284 entry->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
285 entry->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
286 entry->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
287 entry->list.mask = *mask;
288 entry->list.valid = 1;
289 entry->secid = secid;
291 spin_lock(&netlbl_unlhsh_lock);
292 ret_val = netlbl_af6list_add(&entry->list, &iface->addr6_list);
293 spin_unlock(&netlbl_unlhsh_lock);
302 * netlbl_unlhsh_add_iface - Adds a new interface entry to the hash table
303 * @ifindex: network interface
306 * Add a new, empty, interface entry into the unlabeled connection hash table.
307 * On success a pointer to the new interface entry is returned, on failure NULL
311 static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
314 struct netlbl_unlhsh_iface *iface;
316 iface = kzalloc(sizeof(*iface), GFP_ATOMIC);
320 iface->ifindex = ifindex;
321 INIT_LIST_HEAD(&iface->addr4_list);
322 INIT_LIST_HEAD(&iface->addr6_list);
325 spin_lock(&netlbl_unlhsh_lock);
327 bkt = netlbl_unlhsh_hash(ifindex);
328 if (netlbl_unlhsh_search_iface(ifindex) != NULL)
329 goto add_iface_failure;
330 list_add_tail_rcu(&iface->list,
331 &netlbl_unlhsh_rcu_deref(netlbl_unlhsh)->tbl[bkt]);
333 INIT_LIST_HEAD(&iface->list);
334 if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
335 goto add_iface_failure;
336 rcu_assign_pointer(netlbl_unlhsh_def, iface);
338 spin_unlock(&netlbl_unlhsh_lock);
343 spin_unlock(&netlbl_unlhsh_lock);
349 * netlbl_unlhsh_add - Adds a new entry to the unlabeled connection hash table
350 * @net: network namespace
351 * @dev_name: interface name
352 * @addr: IP address in network byte order
353 * @mask: address mask in network byte order
354 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
355 * @secid: LSM secid value for the entry
356 * @audit_info: NetLabel audit information
359 * Adds a new entry to the unlabeled connection hash table. Returns zero on
360 * success, negative values on failure.
363 int netlbl_unlhsh_add(struct net *net,
364 const char *dev_name,
369 struct netlbl_audit *audit_info)
373 struct net_device *dev;
374 struct netlbl_unlhsh_iface *iface;
375 struct audit_buffer *audit_buf = NULL;
379 if (addr_len != sizeof(struct in_addr) &&
380 addr_len != sizeof(struct in6_addr))
384 if (dev_name != NULL) {
385 dev = dev_get_by_name_rcu(net, dev_name);
388 goto unlhsh_add_return;
390 ifindex = dev->ifindex;
391 iface = netlbl_unlhsh_search_iface(ifindex);
394 iface = rcu_dereference(netlbl_unlhsh_def);
397 iface = netlbl_unlhsh_add_iface(ifindex);
400 goto unlhsh_add_return;
403 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCADD,
406 case sizeof(struct in_addr): {
407 const struct in_addr *addr4 = addr;
408 const struct in_addr *mask4 = mask;
410 ret_val = netlbl_unlhsh_add_addr4(iface, addr4, mask4, secid);
411 if (audit_buf != NULL)
412 netlbl_af4list_audit_addr(audit_buf, 1,
418 #if IS_ENABLED(CONFIG_IPV6)
419 case sizeof(struct in6_addr): {
420 const struct in6_addr *addr6 = addr;
421 const struct in6_addr *mask6 = mask;
423 ret_val = netlbl_unlhsh_add_addr6(iface, addr6, mask6, secid);
424 if (audit_buf != NULL)
425 netlbl_af6list_audit_addr(audit_buf, 1,
435 atomic_inc(&netlabel_mgmt_protocount);
439 if (audit_buf != NULL) {
440 if (security_secid_to_secctx(secid,
443 audit_log_format(audit_buf, " sec_obj=%s", secctx);
444 security_release_secctx(secctx, secctx_len);
446 audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
447 audit_log_end(audit_buf);
453 * netlbl_unlhsh_remove_addr4 - Remove an IPv4 address entry
454 * @net: network namespace
455 * @iface: interface entry
457 * @mask: IP address mask
458 * @audit_info: NetLabel audit information
461 * Remove an IP address entry from the unlabeled connection hash table.
462 * Returns zero on success, negative values on failure.
465 static int netlbl_unlhsh_remove_addr4(struct net *net,
466 struct netlbl_unlhsh_iface *iface,
467 const struct in_addr *addr,
468 const struct in_addr *mask,
469 struct netlbl_audit *audit_info)
471 struct netlbl_af4list *list_entry;
472 struct netlbl_unlhsh_addr4 *entry;
473 struct audit_buffer *audit_buf;
474 struct net_device *dev;
478 spin_lock(&netlbl_unlhsh_lock);
479 list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr,
481 spin_unlock(&netlbl_unlhsh_lock);
482 if (list_entry != NULL)
483 entry = netlbl_unlhsh_addr4_entry(list_entry);
487 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
489 if (audit_buf != NULL) {
490 dev = dev_get_by_index(net, iface->ifindex);
491 netlbl_af4list_audit_addr(audit_buf, 1,
492 (dev != NULL ? dev->name : NULL),
493 addr->s_addr, mask->s_addr);
497 security_secid_to_secctx(entry->secid,
498 &secctx, &secctx_len) == 0) {
499 audit_log_format(audit_buf, " sec_obj=%s", secctx);
500 security_release_secctx(secctx, secctx_len);
502 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
503 audit_log_end(audit_buf);
509 kfree_rcu(entry, rcu);
513 #if IS_ENABLED(CONFIG_IPV6)
515 * netlbl_unlhsh_remove_addr6 - Remove an IPv6 address entry
516 * @net: network namespace
517 * @iface: interface entry
519 * @mask: IP address mask
520 * @audit_info: NetLabel audit information
523 * Remove an IP address entry from the unlabeled connection hash table.
524 * Returns zero on success, negative values on failure.
527 static int netlbl_unlhsh_remove_addr6(struct net *net,
528 struct netlbl_unlhsh_iface *iface,
529 const struct in6_addr *addr,
530 const struct in6_addr *mask,
531 struct netlbl_audit *audit_info)
533 struct netlbl_af6list *list_entry;
534 struct netlbl_unlhsh_addr6 *entry;
535 struct audit_buffer *audit_buf;
536 struct net_device *dev;
540 spin_lock(&netlbl_unlhsh_lock);
541 list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list);
542 spin_unlock(&netlbl_unlhsh_lock);
543 if (list_entry != NULL)
544 entry = netlbl_unlhsh_addr6_entry(list_entry);
548 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_STCDEL,
550 if (audit_buf != NULL) {
551 dev = dev_get_by_index(net, iface->ifindex);
552 netlbl_af6list_audit_addr(audit_buf, 1,
553 (dev != NULL ? dev->name : NULL),
558 security_secid_to_secctx(entry->secid,
559 &secctx, &secctx_len) == 0) {
560 audit_log_format(audit_buf, " sec_obj=%s", secctx);
561 security_release_secctx(secctx, secctx_len);
563 audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0);
564 audit_log_end(audit_buf);
570 kfree_rcu(entry, rcu);
576 * netlbl_unlhsh_condremove_iface - Remove an interface entry
577 * @iface: the interface entry
580 * Remove an interface entry from the unlabeled connection hash table if it is
581 * empty. An interface entry is considered to be empty if there are no
582 * address entries assigned to it.
585 static void netlbl_unlhsh_condremove_iface(struct netlbl_unlhsh_iface *iface)
587 struct netlbl_af4list *iter4;
588 #if IS_ENABLED(CONFIG_IPV6)
589 struct netlbl_af6list *iter6;
592 spin_lock(&netlbl_unlhsh_lock);
593 netlbl_af4list_foreach_rcu(iter4, &iface->addr4_list)
594 goto unlhsh_condremove_failure;
595 #if IS_ENABLED(CONFIG_IPV6)
596 netlbl_af6list_foreach_rcu(iter6, &iface->addr6_list)
597 goto unlhsh_condremove_failure;
600 if (iface->ifindex > 0)
601 list_del_rcu(&iface->list);
603 RCU_INIT_POINTER(netlbl_unlhsh_def, NULL);
604 spin_unlock(&netlbl_unlhsh_lock);
606 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
609 unlhsh_condremove_failure:
610 spin_unlock(&netlbl_unlhsh_lock);
614 * netlbl_unlhsh_remove - Remove an entry from the unlabeled hash table
615 * @net: network namespace
616 * @dev_name: interface name
617 * @addr: IP address in network byte order
618 * @mask: address mask in network byte order
619 * @addr_len: length of address/mask (4 for IPv4, 16 for IPv6)
620 * @audit_info: NetLabel audit information
623 * Removes and existing entry from the unlabeled connection hash table.
624 * Returns zero on success, negative values on failure.
627 int netlbl_unlhsh_remove(struct net *net,
628 const char *dev_name,
632 struct netlbl_audit *audit_info)
635 struct net_device *dev;
636 struct netlbl_unlhsh_iface *iface;
638 if (addr_len != sizeof(struct in_addr) &&
639 addr_len != sizeof(struct in6_addr))
643 if (dev_name != NULL) {
644 dev = dev_get_by_name_rcu(net, dev_name);
647 goto unlhsh_remove_return;
649 iface = netlbl_unlhsh_search_iface(dev->ifindex);
651 iface = rcu_dereference(netlbl_unlhsh_def);
654 goto unlhsh_remove_return;
657 case sizeof(struct in_addr):
658 ret_val = netlbl_unlhsh_remove_addr4(net,
662 #if IS_ENABLED(CONFIG_IPV6)
663 case sizeof(struct in6_addr):
664 ret_val = netlbl_unlhsh_remove_addr6(net,
673 netlbl_unlhsh_condremove_iface(iface);
674 atomic_dec(&netlabel_mgmt_protocount);
677 unlhsh_remove_return:
683 * General Helper Functions
687 * netlbl_unlhsh_netdev_handler - Network device notification handler
688 * @this: notifier block
690 * @ptr: the netdevice notifier info (cast to void)
693 * Handle network device events, although at present all we care about is a
694 * network device going away. In the case of a device going away we clear any
695 * related entries from the unlabeled connection hash table.
698 static int netlbl_unlhsh_netdev_handler(struct notifier_block *this,
699 unsigned long event, void *ptr)
701 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
702 struct netlbl_unlhsh_iface *iface = NULL;
704 if (!net_eq(dev_net(dev), &init_net))
707 /* XXX - should this be a check for NETDEV_DOWN or _UNREGISTER? */
708 if (event == NETDEV_DOWN) {
709 spin_lock(&netlbl_unlhsh_lock);
710 iface = netlbl_unlhsh_search_iface(dev->ifindex);
711 if (iface != NULL && iface->valid) {
713 list_del_rcu(&iface->list);
716 spin_unlock(&netlbl_unlhsh_lock);
720 call_rcu(&iface->rcu, netlbl_unlhsh_free_iface);
726 * netlbl_unlabel_acceptflg_set - Set the unlabeled accept flag
727 * @value: desired value
728 * @audit_info: NetLabel audit information
731 * Set the value of the unlabeled accept flag to @value.
734 static void netlbl_unlabel_acceptflg_set(u8 value,
735 struct netlbl_audit *audit_info)
737 struct audit_buffer *audit_buf;
740 old_val = netlabel_unlabel_acceptflg;
741 netlabel_unlabel_acceptflg = value;
742 audit_buf = netlbl_audit_start_common(AUDIT_MAC_UNLBL_ALLOW,
744 if (audit_buf != NULL) {
745 audit_log_format(audit_buf,
746 " unlbl_accept=%u old=%u", value, old_val);
747 audit_log_end(audit_buf);
752 * netlbl_unlabel_addrinfo_get - Get the IPv4/6 address information
753 * @info: the Generic NETLINK info block
754 * @addr: the IP address
755 * @mask: the IP address mask
756 * @len: the address length
759 * Examine the Generic NETLINK message and extract the IP address information.
760 * Returns zero on success, negative values on failure.
763 static int netlbl_unlabel_addrinfo_get(struct genl_info *info,
770 if (info->attrs[NLBL_UNLABEL_A_IPV4ADDR] &&
771 info->attrs[NLBL_UNLABEL_A_IPV4MASK]) {
772 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
773 if (addr_len != sizeof(struct in_addr) &&
774 addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV4MASK]))
777 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4ADDR]);
778 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV4MASK]);
780 } else if (info->attrs[NLBL_UNLABEL_A_IPV6ADDR]) {
781 addr_len = nla_len(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
782 if (addr_len != sizeof(struct in6_addr) &&
783 addr_len != nla_len(info->attrs[NLBL_UNLABEL_A_IPV6MASK]))
786 *addr = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6ADDR]);
787 *mask = nla_data(info->attrs[NLBL_UNLABEL_A_IPV6MASK]);
795 * NetLabel Command Handlers
799 * netlbl_unlabel_accept - Handle an ACCEPT message
800 * @skb: the NETLINK buffer
801 * @info: the Generic NETLINK info block
804 * Process a user generated ACCEPT message and set the accept flag accordingly.
805 * Returns zero on success, negative values on failure.
808 static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)
811 struct netlbl_audit audit_info;
813 if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) {
814 value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]);
815 if (value == 1 || value == 0) {
816 netlbl_netlink_auditinfo(skb, &audit_info);
817 netlbl_unlabel_acceptflg_set(value, &audit_info);
826 * netlbl_unlabel_list - Handle a LIST message
827 * @skb: the NETLINK buffer
828 * @info: the Generic NETLINK info block
831 * Process a user generated LIST message and respond with the current status.
832 * Returns zero on success, negative values on failure.
835 static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info)
837 int ret_val = -EINVAL;
838 struct sk_buff *ans_skb;
841 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
844 data = genlmsg_put_reply(ans_skb, info, &netlbl_unlabel_gnl_family,
845 0, NLBL_UNLABEL_C_LIST);
851 ret_val = nla_put_u8(ans_skb,
852 NLBL_UNLABEL_A_ACPTFLG,
853 netlabel_unlabel_acceptflg);
857 genlmsg_end(ans_skb, data);
858 return genlmsg_reply(ans_skb, info);
866 * netlbl_unlabel_staticadd - Handle a STATICADD message
867 * @skb: the NETLINK buffer
868 * @info: the Generic NETLINK info block
871 * Process a user generated STATICADD message and add a new unlabeled
872 * connection entry to the hash table. Returns zero on success, negative
876 static int netlbl_unlabel_staticadd(struct sk_buff *skb,
877 struct genl_info *info)
885 struct netlbl_audit audit_info;
887 /* Don't allow users to add both IPv4 and IPv6 addresses for a
888 * single entry. However, allow users to create two entries, one each
889 * for IPv4 and IPv4, with the same LSM security context which should
890 * achieve the same result. */
891 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
892 !info->attrs[NLBL_UNLABEL_A_IFACE] ||
893 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
894 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
895 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
896 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
899 netlbl_netlink_auditinfo(skb, &audit_info);
901 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
904 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
905 ret_val = security_secctx_to_secid(
906 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
907 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
912 return netlbl_unlhsh_add(&init_net,
913 dev_name, addr, mask, addr_len, secid,
918 * netlbl_unlabel_staticadddef - Handle a STATICADDDEF message
919 * @skb: the NETLINK buffer
920 * @info: the Generic NETLINK info block
923 * Process a user generated STATICADDDEF message and add a new default
924 * unlabeled connection entry. Returns zero on success, negative values on
928 static int netlbl_unlabel_staticadddef(struct sk_buff *skb,
929 struct genl_info *info)
936 struct netlbl_audit audit_info;
938 /* Don't allow users to add both IPv4 and IPv6 addresses for a
939 * single entry. However, allow users to create two entries, one each
940 * for IPv4 and IPv6, with the same LSM security context which should
941 * achieve the same result. */
942 if (!info->attrs[NLBL_UNLABEL_A_SECCTX] ||
943 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
944 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
945 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
946 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
949 netlbl_netlink_auditinfo(skb, &audit_info);
951 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
954 ret_val = security_secctx_to_secid(
955 nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]),
956 nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]),
961 return netlbl_unlhsh_add(&init_net,
962 NULL, addr, mask, addr_len, secid,
967 * netlbl_unlabel_staticremove - Handle a STATICREMOVE message
968 * @skb: the NETLINK buffer
969 * @info: the Generic NETLINK info block
972 * Process a user generated STATICREMOVE message and remove the specified
973 * unlabeled connection entry. Returns zero on success, negative values on
977 static int netlbl_unlabel_staticremove(struct sk_buff *skb,
978 struct genl_info *info)
985 struct netlbl_audit audit_info;
987 /* See the note in netlbl_unlabel_staticadd() about not allowing both
988 * IPv4 and IPv6 in the same entry. */
989 if (!info->attrs[NLBL_UNLABEL_A_IFACE] ||
990 !((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
991 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
992 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
993 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
996 netlbl_netlink_auditinfo(skb, &audit_info);
998 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1001 dev_name = nla_data(info->attrs[NLBL_UNLABEL_A_IFACE]);
1003 return netlbl_unlhsh_remove(&init_net,
1004 dev_name, addr, mask, addr_len,
1009 * netlbl_unlabel_staticremovedef - Handle a STATICREMOVEDEF message
1010 * @skb: the NETLINK buffer
1011 * @info: the Generic NETLINK info block
1014 * Process a user generated STATICREMOVEDEF message and remove the default
1015 * unlabeled connection entry. Returns zero on success, negative values on
1019 static int netlbl_unlabel_staticremovedef(struct sk_buff *skb,
1020 struct genl_info *info)
1026 struct netlbl_audit audit_info;
1028 /* See the note in netlbl_unlabel_staticadd() about not allowing both
1029 * IPv4 and IPv6 in the same entry. */
1030 if (!((!info->attrs[NLBL_UNLABEL_A_IPV4ADDR] ||
1031 !info->attrs[NLBL_UNLABEL_A_IPV4MASK]) ^
1032 (!info->attrs[NLBL_UNLABEL_A_IPV6ADDR] ||
1033 !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))
1036 netlbl_netlink_auditinfo(skb, &audit_info);
1038 ret_val = netlbl_unlabel_addrinfo_get(info, &addr, &mask, &addr_len);
1042 return netlbl_unlhsh_remove(&init_net,
1043 NULL, addr, mask, addr_len,
1049 * netlbl_unlabel_staticlist_gen - Generate messages for STATICLIST[DEF]
1050 * @cmd: command/message
1051 * @iface: the interface entry
1052 * @addr4: the IPv4 address entry
1053 * @addr6: the IPv6 address entry
1054 * @arg: the netlbl_unlhsh_walk_arg structure
1057 * This function is designed to be used to generate a response for a
1058 * STATICLIST or STATICLISTDEF message. When called either @addr4 or @addr6
1059 * can be specified, not both, the other unspecified entry should be set to
1060 * NULL by the caller. Returns the size of the message on success, negative
1061 * values on failure.
1064 static int netlbl_unlabel_staticlist_gen(u32 cmd,
1065 const struct netlbl_unlhsh_iface *iface,
1066 const struct netlbl_unlhsh_addr4 *addr4,
1067 const struct netlbl_unlhsh_addr6 *addr6,
1070 int ret_val = -ENOMEM;
1071 struct netlbl_unlhsh_walk_arg *cb_arg = arg;
1072 struct net_device *dev;
1078 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
1079 cb_arg->seq, &netlbl_unlabel_gnl_family,
1082 goto list_cb_failure;
1084 if (iface->ifindex > 0) {
1085 dev = dev_get_by_index(&init_net, iface->ifindex);
1088 goto list_cb_failure;
1090 ret_val = nla_put_string(cb_arg->skb,
1091 NLBL_UNLABEL_A_IFACE, dev->name);
1094 goto list_cb_failure;
1098 struct in_addr addr_struct;
1100 addr_struct.s_addr = addr4->list.addr;
1101 ret_val = nla_put_in_addr(cb_arg->skb,
1102 NLBL_UNLABEL_A_IPV4ADDR,
1103 addr_struct.s_addr);
1105 goto list_cb_failure;
1107 addr_struct.s_addr = addr4->list.mask;
1108 ret_val = nla_put_in_addr(cb_arg->skb,
1109 NLBL_UNLABEL_A_IPV4MASK,
1110 addr_struct.s_addr);
1112 goto list_cb_failure;
1114 secid = addr4->secid;
1116 ret_val = nla_put_in6_addr(cb_arg->skb,
1117 NLBL_UNLABEL_A_IPV6ADDR,
1120 goto list_cb_failure;
1122 ret_val = nla_put_in6_addr(cb_arg->skb,
1123 NLBL_UNLABEL_A_IPV6MASK,
1126 goto list_cb_failure;
1128 secid = addr6->secid;
1131 ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len);
1133 goto list_cb_failure;
1134 ret_val = nla_put(cb_arg->skb,
1135 NLBL_UNLABEL_A_SECCTX,
1138 security_release_secctx(secctx, secctx_len);
1140 goto list_cb_failure;
1143 genlmsg_end(cb_arg->skb, data);
1147 genlmsg_cancel(cb_arg->skb, data);
1152 * netlbl_unlabel_staticlist - Handle a STATICLIST message
1153 * @skb: the NETLINK buffer
1154 * @cb: the NETLINK callback
1157 * Process a user generated STATICLIST message and dump the unlabeled
1158 * connection hash table in a form suitable for use in a kernel generated
1159 * STATICLIST message. Returns the length of @skb.
1162 static int netlbl_unlabel_staticlist(struct sk_buff *skb,
1163 struct netlink_callback *cb)
1165 struct netlbl_unlhsh_walk_arg cb_arg;
1166 u32 skip_bkt = cb->args[0];
1167 u32 skip_chain = cb->args[1];
1169 u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
1170 struct netlbl_unlhsh_iface *iface;
1171 struct list_head *iter_list;
1172 struct netlbl_af4list *addr4;
1173 #if IS_ENABLED(CONFIG_IPV6)
1174 struct netlbl_af6list *addr6;
1179 cb_arg.seq = cb->nlh->nlmsg_seq;
1182 for (iter_bkt = skip_bkt;
1183 iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
1184 iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
1185 iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
1186 list_for_each_entry_rcu(iface, iter_list, list) {
1187 if (!iface->valid ||
1188 iter_chain++ < skip_chain)
1190 netlbl_af4list_foreach_rcu(addr4,
1191 &iface->addr4_list) {
1192 if (iter_addr4++ < cb->args[2])
1194 if (netlbl_unlabel_staticlist_gen(
1195 NLBL_UNLABEL_C_STATICLIST,
1197 netlbl_unlhsh_addr4_entry(addr4),
1202 goto unlabel_staticlist_return;
1205 #if IS_ENABLED(CONFIG_IPV6)
1206 netlbl_af6list_foreach_rcu(addr6,
1207 &iface->addr6_list) {
1208 if (iter_addr6++ < cb->args[3])
1210 if (netlbl_unlabel_staticlist_gen(
1211 NLBL_UNLABEL_C_STATICLIST,
1214 netlbl_unlhsh_addr6_entry(addr6),
1218 goto unlabel_staticlist_return;
1225 unlabel_staticlist_return:
1227 cb->args[0] = iter_bkt;
1228 cb->args[1] = iter_chain;
1229 cb->args[2] = iter_addr4;
1230 cb->args[3] = iter_addr6;
1235 * netlbl_unlabel_staticlistdef - Handle a STATICLISTDEF message
1236 * @skb: the NETLINK buffer
1237 * @cb: the NETLINK callback
1240 * Process a user generated STATICLISTDEF message and dump the default
1241 * unlabeled connection entry in a form suitable for use in a kernel generated
1242 * STATICLISTDEF message. Returns the length of @skb.
1245 static int netlbl_unlabel_staticlistdef(struct sk_buff *skb,
1246 struct netlink_callback *cb)
1248 struct netlbl_unlhsh_walk_arg cb_arg;
1249 struct netlbl_unlhsh_iface *iface;
1250 u32 iter_addr4 = 0, iter_addr6 = 0;
1251 struct netlbl_af4list *addr4;
1252 #if IS_ENABLED(CONFIG_IPV6)
1253 struct netlbl_af6list *addr6;
1258 cb_arg.seq = cb->nlh->nlmsg_seq;
1261 iface = rcu_dereference(netlbl_unlhsh_def);
1262 if (iface == NULL || !iface->valid)
1263 goto unlabel_staticlistdef_return;
1265 netlbl_af4list_foreach_rcu(addr4, &iface->addr4_list) {
1266 if (iter_addr4++ < cb->args[0])
1268 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1270 netlbl_unlhsh_addr4_entry(addr4),
1274 goto unlabel_staticlistdef_return;
1277 #if IS_ENABLED(CONFIG_IPV6)
1278 netlbl_af6list_foreach_rcu(addr6, &iface->addr6_list) {
1279 if (iter_addr6++ < cb->args[1])
1281 if (netlbl_unlabel_staticlist_gen(NLBL_UNLABEL_C_STATICLISTDEF,
1284 netlbl_unlhsh_addr6_entry(addr6),
1287 goto unlabel_staticlistdef_return;
1292 unlabel_staticlistdef_return:
1294 cb->args[0] = iter_addr4;
1295 cb->args[1] = iter_addr6;
1300 * NetLabel Generic NETLINK Command Definitions
1303 static const struct genl_ops netlbl_unlabel_genl_ops[] = {
1305 .cmd = NLBL_UNLABEL_C_STATICADD,
1306 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1307 .flags = GENL_ADMIN_PERM,
1308 .doit = netlbl_unlabel_staticadd,
1312 .cmd = NLBL_UNLABEL_C_STATICREMOVE,
1313 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1314 .flags = GENL_ADMIN_PERM,
1315 .doit = netlbl_unlabel_staticremove,
1319 .cmd = NLBL_UNLABEL_C_STATICLIST,
1320 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1323 .dumpit = netlbl_unlabel_staticlist,
1326 .cmd = NLBL_UNLABEL_C_STATICADDDEF,
1327 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1328 .flags = GENL_ADMIN_PERM,
1329 .doit = netlbl_unlabel_staticadddef,
1333 .cmd = NLBL_UNLABEL_C_STATICREMOVEDEF,
1334 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1335 .flags = GENL_ADMIN_PERM,
1336 .doit = netlbl_unlabel_staticremovedef,
1340 .cmd = NLBL_UNLABEL_C_STATICLISTDEF,
1341 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1344 .dumpit = netlbl_unlabel_staticlistdef,
1347 .cmd = NLBL_UNLABEL_C_ACCEPT,
1348 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1349 .flags = GENL_ADMIN_PERM,
1350 .doit = netlbl_unlabel_accept,
1354 .cmd = NLBL_UNLABEL_C_LIST,
1355 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
1357 .doit = netlbl_unlabel_list,
1362 static struct genl_family netlbl_unlabel_gnl_family __ro_after_init = {
1364 .name = NETLBL_NLTYPE_UNLABELED_NAME,
1365 .version = NETLBL_PROTO_VERSION,
1366 .maxattr = NLBL_UNLABEL_A_MAX,
1367 .policy = netlbl_unlabel_genl_policy,
1368 .module = THIS_MODULE,
1369 .ops = netlbl_unlabel_genl_ops,
1370 .n_ops = ARRAY_SIZE(netlbl_unlabel_genl_ops),
1374 * NetLabel Generic NETLINK Protocol Functions
1378 * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component
1381 * Register the unlabeled packet NetLabel component with the Generic NETLINK
1382 * mechanism. Returns zero on success, negative values on failure.
1385 int __init netlbl_unlabel_genl_init(void)
1387 return genl_register_family(&netlbl_unlabel_gnl_family);
1391 * NetLabel KAPI Hooks
1394 static struct notifier_block netlbl_unlhsh_netdev_notifier = {
1395 .notifier_call = netlbl_unlhsh_netdev_handler,
1399 * netlbl_unlabel_init - Initialize the unlabeled connection hash table
1400 * @size: the number of bits to use for the hash buckets
1403 * Initializes the unlabeled connection hash table and registers a network
1404 * device notification handler. This function should only be called by the
1405 * NetLabel subsystem itself during initialization. Returns zero on success,
1406 * non-zero values on error.
1409 int __init netlbl_unlabel_init(u32 size)
1412 struct netlbl_unlhsh_tbl *hsh_tbl;
1417 hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
1418 if (hsh_tbl == NULL)
1420 hsh_tbl->size = 1 << size;
1421 hsh_tbl->tbl = kcalloc(hsh_tbl->size,
1422 sizeof(struct list_head),
1424 if (hsh_tbl->tbl == NULL) {
1428 for (iter = 0; iter < hsh_tbl->size; iter++)
1429 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
1431 spin_lock(&netlbl_unlhsh_lock);
1432 rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
1433 spin_unlock(&netlbl_unlhsh_lock);
1435 register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
1441 * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet
1443 * @family: protocol family
1444 * @secattr: the security attributes
1447 * Determine the security attributes, if any, for an unlabled packet and return
1448 * them in @secattr. Returns zero on success and negative values on failure.
1451 int netlbl_unlabel_getattr(const struct sk_buff *skb,
1453 struct netlbl_lsm_secattr *secattr)
1455 struct netlbl_unlhsh_iface *iface;
1458 iface = netlbl_unlhsh_search_iface(skb->skb_iif);
1460 iface = rcu_dereference(netlbl_unlhsh_def);
1461 if (iface == NULL || !iface->valid)
1462 goto unlabel_getattr_nolabel;
1464 #if IS_ENABLED(CONFIG_IPV6)
1465 /* When resolving a fallback label, check the sk_buff version as
1466 * it is possible (e.g. SCTP) to have family = PF_INET6 while
1467 * receiving ip_hdr(skb)->version = 4.
1469 if (family == PF_INET6 && ip_hdr(skb)->version == 4)
1476 struct netlbl_af4list *addr4;
1479 addr4 = netlbl_af4list_search(hdr4->saddr,
1480 &iface->addr4_list);
1482 goto unlabel_getattr_nolabel;
1483 secattr->attr.secid = netlbl_unlhsh_addr4_entry(addr4)->secid;
1486 #if IS_ENABLED(CONFIG_IPV6)
1488 struct ipv6hdr *hdr6;
1489 struct netlbl_af6list *addr6;
1491 hdr6 = ipv6_hdr(skb);
1492 addr6 = netlbl_af6list_search(&hdr6->saddr,
1493 &iface->addr6_list);
1495 goto unlabel_getattr_nolabel;
1496 secattr->attr.secid = netlbl_unlhsh_addr6_entry(addr6)->secid;
1501 goto unlabel_getattr_nolabel;
1505 secattr->flags |= NETLBL_SECATTR_SECID;
1506 secattr->type = NETLBL_NLTYPE_UNLABELED;
1509 unlabel_getattr_nolabel:
1511 if (netlabel_unlabel_acceptflg == 0)
1513 secattr->type = NETLBL_NLTYPE_UNLABELED;
1518 * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets
1521 * Set the default NetLabel configuration to allow incoming unlabeled packets
1522 * and to send unlabeled network traffic by default.
1525 int __init netlbl_unlabel_defconf(void)
1528 struct netlbl_dom_map *entry;
1529 struct netlbl_audit audit_info;
1531 /* Only the kernel is allowed to call this function and the only time
1532 * it is called is at bootup before the audit subsystem is reporting
1533 * messages so don't worry to much about these values. */
1534 security_task_getsecid(current, &audit_info.secid);
1535 audit_info.loginuid = GLOBAL_ROOT_UID;
1536 audit_info.sessionid = 0;
1538 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1541 entry->family = AF_UNSPEC;
1542 entry->def.type = NETLBL_NLTYPE_UNLABELED;
1543 ret_val = netlbl_domhsh_add_default(entry, &audit_info);
1547 netlbl_unlabel_acceptflg_set(1, &audit_info);