1 // SPDX-License-Identifier: GPL-2.0-or-later
10  * Author: Paul Moore <paul@paul-moore.com>
14  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
55  * netlbl_domhsh_free_entry - Frees a domain hash table entry
56  * @entry: the entry's RCU field
60  * function so that the memory allocated to a hash table entry can be released
64 static void netlbl_domhsh_free_entry(struct rcu_head *entry)  in netlbl_domhsh_free_entry()  argument
74 	ptr = container_of(entry, struct netlbl_dom_map, rcu);  in netlbl_domhsh_free_entry()
75 	if (ptr->def.type == NETLBL_NLTYPE_ADDRSELECT) {  in netlbl_domhsh_free_entry()
77 					    &ptr->def.addrsel->list4) {  in netlbl_domhsh_free_entry()
83 					    &ptr->def.addrsel->list6) {  in netlbl_domhsh_free_entry()
88 		kfree(ptr->def.addrsel);  in netlbl_domhsh_free_entry()
90 	kfree(ptr->domain);  in netlbl_domhsh_free_entry()
95  * netlbl_domhsh_hash - Hashing function for the domain hash table
115 		val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];  in netlbl_domhsh_hash()
116 	return val & (netlbl_domhsh_rcu_deref(netlbl_domhsh)->size - 1);  in netlbl_domhsh_hash()
125  * netlbl_domhsh_search - Search for a domain entry
127  * @family: the address family
131  * entry if found, otherwise NULL is returned.  @family may be %AF_UNSPEC
132  * which matches any address family entries.  The caller is responsible for
146 		bkt_list = &netlbl_domhsh_rcu_deref(netlbl_domhsh)->tbl[bkt];  in netlbl_domhsh_search()
149 			if (iter->valid &&  in netlbl_domhsh_search()
150 			    netlbl_family_match(iter->family, family) &&  in netlbl_domhsh_search()
151 			    strcmp(iter->domain, domain) == 0)  in netlbl_domhsh_search()
159  * netlbl_domhsh_search_def - Search for a domain entry
161  * @family: the address family
165  * entry if an exact match is found, if an exact match is not present in the
166  * hash table then the default entry is returned if valid otherwise NULL is
167  * returned.  @family may be %AF_UNSPEC which matches any address family
175 	struct netlbl_dom_map *entry;  in netlbl_domhsh_search_def()  local
177 	entry = netlbl_domhsh_search(domain, family);  in netlbl_domhsh_search_def()
178 	if (entry != NULL)  in netlbl_domhsh_search_def()
179 		return entry;  in netlbl_domhsh_search_def()
181 		entry = netlbl_domhsh_rcu_deref(netlbl_domhsh_def_ipv4);  in netlbl_domhsh_search_def()
182 		if (entry != NULL && entry->valid)  in netlbl_domhsh_search_def()
183 			return entry;  in netlbl_domhsh_search_def()
186 		entry = netlbl_domhsh_rcu_deref(netlbl_domhsh_def_ipv6);  in netlbl_domhsh_search_def()
187 		if (entry != NULL && entry->valid)  in netlbl_domhsh_search_def()
188 			return entry;  in netlbl_domhsh_search_def()
195  * netlbl_domhsh_audit_add - Generate an audit entry for an add event
196  * @entry: the entry being added
197  * @addr4: the IPv4 address information
198  * @addr6: the IPv6 address information
203  * Generate an audit record for adding a new NetLabel/LSM mapping entry with
208 static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry,  in netlbl_domhsh_audit_add()  argument
222 				 entry->domain ? entry->domain : "(default)");  in netlbl_domhsh_audit_add()
226 			type = map4->def.type;  in netlbl_domhsh_audit_add()
227 			cipsov4 = map4->def.cipso;  in netlbl_domhsh_audit_add()
229 						  addr4->addr, addr4->mask);  in netlbl_domhsh_audit_add()
234 			type = map6->def.type;  in netlbl_domhsh_audit_add()
235 			calipso = map6->def.calipso;  in netlbl_domhsh_audit_add()
237 						  &addr6->addr, &addr6->mask);  in netlbl_domhsh_audit_add()
240 			type = entry->def.type;  in netlbl_domhsh_audit_add()
241 			cipsov4 = entry->def.cipso;  in netlbl_domhsh_audit_add()
242 			calipso = entry->def.calipso;  in netlbl_domhsh_audit_add()
252 					 cipsov4->doi);  in netlbl_domhsh_audit_add()
258 					 calipso->doi);  in netlbl_domhsh_audit_add()
267  * netlbl_domhsh_validate - Validate a new domain mapping entry
268  * @entry: the entry to validate
270  * This function validates the new domain mapping entry to ensure that it is
271  * a valid entry.  Returns zero on success, negative values on failure.
274 static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry)  in netlbl_domhsh_validate()  argument
283 	if (entry == NULL)  in netlbl_domhsh_validate()
284 		return -EINVAL;  in netlbl_domhsh_validate()
286 	if (entry->family != AF_INET && entry->family != AF_INET6 &&  in netlbl_domhsh_validate()
287 	    (entry->family != AF_UNSPEC ||  in netlbl_domhsh_validate()
288 	     entry->def.type != NETLBL_NLTYPE_UNLABELED))  in netlbl_domhsh_validate()
289 		return -EINVAL;  in netlbl_domhsh_validate()
291 	switch (entry->def.type) {  in netlbl_domhsh_validate()
293 		if (entry->def.cipso != NULL || entry->def.calipso != NULL ||  in netlbl_domhsh_validate()
294 		    entry->def.addrsel != NULL)  in netlbl_domhsh_validate()
295 			return -EINVAL;  in netlbl_domhsh_validate()
298 		if (entry->family != AF_INET ||  in netlbl_domhsh_validate()
299 		    entry->def.cipso == NULL)  in netlbl_domhsh_validate()
300 			return -EINVAL;  in netlbl_domhsh_validate()
303 		if (entry->family != AF_INET6 ||  in netlbl_domhsh_validate()
304 		    entry->def.calipso == NULL)  in netlbl_domhsh_validate()
305 			return -EINVAL;  in netlbl_domhsh_validate()
308 		netlbl_af4list_foreach(iter4, &entry->def.addrsel->list4) {  in netlbl_domhsh_validate()
310 			switch (map4->def.type) {  in netlbl_domhsh_validate()
312 				if (map4->def.cipso != NULL)  in netlbl_domhsh_validate()
313 					return -EINVAL;  in netlbl_domhsh_validate()
316 				if (map4->def.cipso == NULL)  in netlbl_domhsh_validate()
317 					return -EINVAL;  in netlbl_domhsh_validate()
320 				return -EINVAL;  in netlbl_domhsh_validate()
324 		netlbl_af6list_foreach(iter6, &entry->def.addrsel->list6) {  in netlbl_domhsh_validate()
326 			switch (map6->def.type) {  in netlbl_domhsh_validate()
328 				if (map6->def.calipso != NULL)  in netlbl_domhsh_validate()
329 					return -EINVAL;  in netlbl_domhsh_validate()
332 				if (map6->def.calipso == NULL)  in netlbl_domhsh_validate()
333 					return -EINVAL;  in netlbl_domhsh_validate()
336 				return -EINVAL;  in netlbl_domhsh_validate()
342 		return -EINVAL;  in netlbl_domhsh_validate()
353  * netlbl_domhsh_init - Init for the domain hash
358  * netlbl_user_init() during initialization.  Returns zero on success, non-zero
368 		return -EINVAL;  in netlbl_domhsh_init()
372 		return -ENOMEM;  in netlbl_domhsh_init()
373 	hsh_tbl->size = 1 << size;  in netlbl_domhsh_init()
374 	hsh_tbl->tbl = kcalloc(hsh_tbl->size,  in netlbl_domhsh_init()
377 	if (hsh_tbl->tbl == NULL) {  in netlbl_domhsh_init()
379 		return -ENOMEM;  in netlbl_domhsh_init()
381 	for (iter = 0; iter < hsh_tbl->size; iter++)  in netlbl_domhsh_init()
382 		INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);  in netlbl_domhsh_init()
392  * netlbl_domhsh_add - Adds a entry to the domain hash table
393  * @entry: the entry to add
397  * Adds a new entry to the domain hash table and handles any updates to the
398  * lower level protocol handler (i.e. CIPSO).  @entry->family may be set to
399  * %AF_UNSPEC which will add an entry that matches all address families.  This
401  * existing entry for any address family with the same domain.  Returns zero
405 int netlbl_domhsh_add(struct netlbl_dom_map *entry,  in netlbl_domhsh_add()  argument
417 	ret_val = netlbl_domhsh_validate(entry);  in netlbl_domhsh_add()
421 	/* XXX - we can remove this RCU read lock as the spinlock protects the  in netlbl_domhsh_add()
427 	if (entry->domain != NULL)  in netlbl_domhsh_add()
428 		entry_old = netlbl_domhsh_search(entry->domain, entry->family);  in netlbl_domhsh_add()
430 		entry_old = netlbl_domhsh_search_def(entry->domain,  in netlbl_domhsh_add()
431 						     entry->family);  in netlbl_domhsh_add()
433 		entry->valid = 1;  in netlbl_domhsh_add()
435 		if (entry->domain != NULL) {  in netlbl_domhsh_add()
436 			u32 bkt = netlbl_domhsh_hash(entry->domain);  in netlbl_domhsh_add()
437 			list_add_tail_rcu(&entry->list,  in netlbl_domhsh_add()
438 				    &rcu_dereference(netlbl_domhsh)->tbl[bkt]);  in netlbl_domhsh_add()
440 			INIT_LIST_HEAD(&entry->list);  in netlbl_domhsh_add()
441 			switch (entry->family) {  in netlbl_domhsh_add()
444 						   entry);  in netlbl_domhsh_add()
448 						   entry);  in netlbl_domhsh_add()
451 				if (entry->def.type !=  in netlbl_domhsh_add()
453 					ret_val = -EINVAL;  in netlbl_domhsh_add()
458 					ret_val = -ENOMEM;  in netlbl_domhsh_add()
461 				entry_b->family = AF_INET6;  in netlbl_domhsh_add()
462 				entry_b->def.type = NETLBL_NLTYPE_UNLABELED;  in netlbl_domhsh_add()
463 				entry_b->valid = 1;  in netlbl_domhsh_add()
464 				entry->family = AF_INET;  in netlbl_domhsh_add()
466 						   entry);  in netlbl_domhsh_add()
473 				ret_val = -EINVAL;  in netlbl_domhsh_add()
478 		if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {  in netlbl_domhsh_add()
480 						   &entry->def.addrsel->list4)  in netlbl_domhsh_add()
481 				netlbl_domhsh_audit_add(entry, iter4, NULL,  in netlbl_domhsh_add()
485 						   &entry->def.addrsel->list6)  in netlbl_domhsh_add()
486 				netlbl_domhsh_audit_add(entry, NULL, iter6,  in netlbl_domhsh_add()
490 			netlbl_domhsh_audit_add(entry, NULL, NULL,  in netlbl_domhsh_add()
492 	} else if (entry_old->def.type == NETLBL_NLTYPE_ADDRSELECT &&  in netlbl_domhsh_add()
493 		   entry->def.type == NETLBL_NLTYPE_ADDRSELECT) {  in netlbl_domhsh_add()
497 		old_list4 = &entry_old->def.addrsel->list4;  in netlbl_domhsh_add()
498 		old_list6 = &entry_old->def.addrsel->list6;  in netlbl_domhsh_add()
500 		/* we only allow the addition of address selectors if all of  in netlbl_domhsh_add()
502 		netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4)  in netlbl_domhsh_add()
503 			if (netlbl_af4list_search_exact(iter4->addr,  in netlbl_domhsh_add()
504 							iter4->mask,  in netlbl_domhsh_add()
506 				ret_val = -EEXIST;  in netlbl_domhsh_add()
510 		netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6)  in netlbl_domhsh_add()
511 			if (netlbl_af6list_search_exact(&iter6->addr,  in netlbl_domhsh_add()
512 							&iter6->mask,  in netlbl_domhsh_add()
514 				ret_val = -EEXIST;  in netlbl_domhsh_add()
520 					    &entry->def.addrsel->list4) {  in netlbl_domhsh_add()
522 			iter4->valid = 1;  in netlbl_domhsh_add()
531 					    &entry->def.addrsel->list6) {  in netlbl_domhsh_add()
533 			iter6->valid = 1;  in netlbl_domhsh_add()
541 		/* cleanup the new entry since we've moved everything over */  in netlbl_domhsh_add()
542 		netlbl_domhsh_free_entry(&entry->rcu);  in netlbl_domhsh_add()
544 		ret_val = -EINVAL;  in netlbl_domhsh_add()
553  * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
554  * @entry: the entry to add
558  * Adds a new default entry to the domain hash table and handles any updates
563 int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,  in netlbl_domhsh_add_default()  argument
566 	return netlbl_domhsh_add(entry, audit_info);  in netlbl_domhsh_add_default()
570  * netlbl_domhsh_remove_entry - Removes a given entry from the domain table
571  * @entry: the entry to remove
575  * Removes an entry from the domain hash table and handles any updates to the
581 int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry,  in netlbl_domhsh_remove_entry()  argument
593 	if (entry == NULL)  in netlbl_domhsh_remove_entry()
594 		return -ENOENT;  in netlbl_domhsh_remove_entry()
597 	if (entry->valid) {  in netlbl_domhsh_remove_entry()
598 		entry->valid = 0;  in netlbl_domhsh_remove_entry()
599 		if (entry == rcu_dereference(netlbl_domhsh_def_ipv4))  in netlbl_domhsh_remove_entry()
601 		else if (entry == rcu_dereference(netlbl_domhsh_def_ipv6))  in netlbl_domhsh_remove_entry()
604 			list_del_rcu(&entry->list);  in netlbl_domhsh_remove_entry()
606 		ret_val = -ENOENT;  in netlbl_domhsh_remove_entry()
616 				 entry->domain ? entry->domain : "(default)");  in netlbl_domhsh_remove_entry()
620 	switch (entry->def.type) {  in netlbl_domhsh_remove_entry()
622 		netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {  in netlbl_domhsh_remove_entry()
624 			cipso_v4_doi_putdef(map4->def.cipso);  in netlbl_domhsh_remove_entry()
627 		netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {  in netlbl_domhsh_remove_entry()
629 			calipso_doi_putdef(map6->def.calipso);  in netlbl_domhsh_remove_entry()
634 		cipso_v4_doi_putdef(entry->def.cipso);  in netlbl_domhsh_remove_entry()
638 		calipso_doi_putdef(entry->def.calipso);  in netlbl_domhsh_remove_entry()
642 	call_rcu(&entry->rcu, netlbl_domhsh_free_entry);  in netlbl_domhsh_remove_entry()
648  * netlbl_domhsh_remove_af4 - Removes an address selector entry
650  * @addr: IPv4 address
651  * @mask: IPv4 address mask
655  * Removes an individual address selector from a domain mapping and potentially
671 	struct netlbl_domaddr4_map *entry;  in netlbl_domhsh_remove_af4()  local
680 	    entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)  in netlbl_domhsh_remove_af4()
684 	entry_addr = netlbl_af4list_remove(addr->s_addr, mask->s_addr,  in netlbl_domhsh_remove_af4()
685 					   &entry_map->def.addrsel->list4);  in netlbl_domhsh_remove_af4()
690 	netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)  in netlbl_domhsh_remove_af4()
693 	netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)  in netlbl_domhsh_remove_af4()
705 	entry = netlbl_domhsh_addr4_entry(entry_addr);  in netlbl_domhsh_remove_af4()
706 	cipso_v4_doi_putdef(entry->def.cipso);  in netlbl_domhsh_remove_af4()
707 	kfree(entry);  in netlbl_domhsh_remove_af4()
712 	return -ENOENT;  in netlbl_domhsh_remove_af4()
717  * netlbl_domhsh_remove_af6 - Removes an address selector entry
719  * @addr: IPv6 address
720  * @mask: IPv6 address mask
724  * Removes an individual address selector from a domain mapping and potentially
738 	struct netlbl_domaddr6_map *entry;  in netlbl_domhsh_remove_af6()  local
747 	    entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT)  in netlbl_domhsh_remove_af6()
752 					   &entry_map->def.addrsel->list6);  in netlbl_domhsh_remove_af6()
757 	netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4)  in netlbl_domhsh_remove_af6()
759 	netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6)  in netlbl_domhsh_remove_af6()
770 	entry = netlbl_domhsh_addr6_entry(entry_addr);  in netlbl_domhsh_remove_af6()
771 	calipso_doi_putdef(entry->def.calipso);  in netlbl_domhsh_remove_af6()
772 	kfree(entry);  in netlbl_domhsh_remove_af6()
777 	return -ENOENT;  in netlbl_domhsh_remove_af6()
782  * netlbl_domhsh_remove - Removes an entry from the domain hash table
784  * @family: address family
788  * Removes an entry from the domain hash table and handles any updates to the
790  * removes all address family entries.  Returns zero on success, negative on
797 	int ret_val = -EINVAL;  in netlbl_domhsh_remove()
798 	struct netlbl_dom_map *entry;  in netlbl_domhsh_remove()  local
804 			entry = netlbl_domhsh_search(domain, AF_INET);  in netlbl_domhsh_remove()
806 			entry = netlbl_domhsh_search_def(domain, AF_INET);  in netlbl_domhsh_remove()
807 		ret_val = netlbl_domhsh_remove_entry(entry, audit_info);  in netlbl_domhsh_remove()
808 		if (ret_val && ret_val != -ENOENT)  in netlbl_domhsh_remove()
815 			entry = netlbl_domhsh_search(domain, AF_INET6);  in netlbl_domhsh_remove()
817 			entry = netlbl_domhsh_search_def(domain, AF_INET6);  in netlbl_domhsh_remove()
818 		ret_val2 = netlbl_domhsh_remove_entry(entry, audit_info);  in netlbl_domhsh_remove()
819 		if (ret_val2 != -ENOENT)  in netlbl_domhsh_remove()
829  * netlbl_domhsh_remove_default - Removes the default entry from the table
830  * @family: address family
834  * Removes/resets the default entry corresponding to @family from the domain
836  * (i.e. CIPSO).  @family may be %AF_UNSPEC which removes all address family
846  * netlbl_domhsh_getentry - Get an entry from the domain hash table
848  * @family: address family
851  * Look through the domain hash table searching for an entry to match @domain,
852  * with address family @family, return a pointer to a copy of the entry or
865  * netlbl_domhsh_getentry_af4 - Get an entry from the domain hash table
867  * @addr: the IP address to search for
870  * Look through the domain hash table searching for an entry to match @domain
871  * and @addr, return a pointer to a copy of the entry or NULL.  The caller is
885 	if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)  in netlbl_domhsh_getentry_af4()
886 		return &dom_iter->def;  in netlbl_domhsh_getentry_af4()
887 	addr_iter = netlbl_af4list_search(addr, &dom_iter->def.addrsel->list4);  in netlbl_domhsh_getentry_af4()
890 	return &(netlbl_domhsh_addr4_entry(addr_iter)->def);  in netlbl_domhsh_getentry_af4()
895  * netlbl_domhsh_getentry_af6 - Get an entry from the domain hash table
897  * @addr: the IP address to search for
900  * Look through the domain hash table searching for an entry to match @domain
901  * and @addr, return a pointer to a copy of the entry or NULL.  The caller is
915 	if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT)  in netlbl_domhsh_getentry_af6()
916 		return &dom_iter->def;  in netlbl_domhsh_getentry_af6()
917 	addr_iter = netlbl_af6list_search(addr, &dom_iter->def.addrsel->list6);  in netlbl_domhsh_getentry_af6()
920 	return &(netlbl_domhsh_addr6_entry(addr_iter)->def);  in netlbl_domhsh_getentry_af6()
925  * netlbl_domhsh_walk - Iterate through the domain mapping hash table
928  * @callback: callback for each entry
933  * buckets and @skip_chain entries.  For each entry in the table call
941 		     int (*callback) (struct netlbl_dom_map *entry, void *arg),  in netlbl_domhsh_walk()
944 	int ret_val = -ENOENT;  in netlbl_domhsh_walk()
952 	     iter_bkt < rcu_dereference(netlbl_domhsh)->size;  in netlbl_domhsh_walk()
954 		iter_list = &rcu_dereference(netlbl_domhsh)->tbl[iter_bkt];  in netlbl_domhsh_walk()
956 			if (iter_entry->valid) {  in netlbl_domhsh_walk()
961 					chain_cnt--;  in netlbl_domhsh_walk()