netlabel_domainhash.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452
  1. /*
  2. * NetLabel Domain Hash Table
  3. *
  4. * This file manages the domain hash table that NetLabel uses to determine
  5. * which network labeling protocol to use for a given domain. The NetLabel
  6. * system manages static and dynamic label mappings for network protocols such
  7. * as CIPSO and RIPSO.
  8. *
  9. * Author: Paul Moore <paul.moore@hp.com>
  10. *
  11. */
  12. /*
  13. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14. *
  15. * This program is free software; you can redistribute it and/or modify
  16. * it under the terms of the GNU General Public License as published by
  17. * the Free Software Foundation; either version 2 of the License, or
  18. * (at your option) any later version.
  19. *
  20. * This program is distributed in the hope that it will be useful,
  21. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
  23. * the GNU General Public License for more details.
  24. *
  25. * You should have received a copy of the GNU General Public License
  26. * along with this program; if not, write to the Free Software
  27. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28. *
  29. */
  30. #include <linux/types.h>
  31. #include <linux/rcupdate.h>
  32. #include <linux/list.h>
  33. #include <linux/skbuff.h>
  34. #include <linux/spinlock.h>
  35. #include <linux/string.h>
  36. #include <linux/audit.h>
  37. #include <net/netlabel.h>
  38. #include <net/cipso_ipv4.h>
  39. #include <asm/bug.h>
  40. #include "netlabel_mgmt.h"
  41. #include "netlabel_domainhash.h"
  42. #include "netlabel_user.h"
  43. struct netlbl_domhsh_tbl {
  44. struct list_head *tbl;
  45. u32 size;
  46. };
  47. /* Domain hash table */
  48. /* XXX - updates should be so rare that having one spinlock for the entire
  49. * hash table should be okay */
  50. static DEFINE_SPINLOCK(netlbl_domhsh_lock);
  51. static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
  52. /* Default domain mapping */
  53. static DEFINE_SPINLOCK(netlbl_domhsh_def_lock);
  54. static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
  55. /*
  56. * Domain Hash Table Helper Functions
  57. */
  58. /**
  59. * netlbl_domhsh_free_entry - Frees a domain hash table entry
  60. * @entry: the entry's RCU field
  61. *
  62. * Description:
  63. * This function is designed to be used as a callback to the call_rcu()
  64. * function so that the memory allocated to a hash table entry can be released
  65. * safely.
  66. *
  67. */
  68. static void netlbl_domhsh_free_entry(struct rcu_head *entry)
  69. {
  70. struct netlbl_dom_map *ptr;
  71. ptr = container_of(entry, struct netlbl_dom_map, rcu);
  72. kfree(ptr->domain);
  73. kfree(ptr);
  74. }
  75. /**
  76. * netlbl_domhsh_hash - Hashing function for the domain hash table
  77. * @domain: the domain name to hash
  78. *
  79. * Description:
  80. * This is the hashing function for the domain hash table, it returns the
  81. * correct bucket number for the domain. The caller is responsibile for
  82. * calling the rcu_read_[un]lock() functions.
  83. *
  84. */
  85. static u32 netlbl_domhsh_hash(const char *key)
  86. {
  87. u32 iter;
  88. u32 val;
  89. u32 len;
  90. /* This is taken (with slight modification) from
  91. * security/selinux/ss/symtab.c:symhash() */
  92. for (iter = 0, val = 0, len = strlen(key); iter < len; iter++)
  93. val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];
  94. return val & (rcu_dereference(netlbl_domhsh)->size - 1);
  95. }
  96. /**
  97. * netlbl_domhsh_search - Search for a domain entry
  98. * @domain: the domain
  99. *
  100. * Description:
  101. * Searches the domain hash table and returns a pointer to the hash table
  102. * entry if found, otherwise NULL is returned. The caller is responsibile for
  103. * the rcu hash table locks (i.e. the caller much call rcu_read_[un]lock()).
  104. *
  105. */
  106. static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain)
  107. {
  108. u32 bkt;
  109. struct netlbl_dom_map *iter;
  110. if (domain != NULL) {
  111. bkt = netlbl_domhsh_hash(domain);
  112. list_for_each_entry_rcu(iter,
  113. &rcu_dereference(netlbl_domhsh)->tbl[bkt],
  114. list)
  115. if (iter->valid && strcmp(iter->domain, domain) == 0)
  116. return iter;
  117. }
  118. return NULL;
  119. }
  120. /**
  121. * netlbl_domhsh_search_def - Search for a domain entry
  122. * @domain: the domain
  123. * @def: return default if no match is found
  124. *
  125. * Description:
  126. * Searches the domain hash table and returns a pointer to the hash table
  127. * entry if an exact match is found, if an exact match is not present in the
  128. * hash table then the default entry is returned if valid otherwise NULL is
  129. * returned. The caller is responsibile for the rcu hash table locks
  130. * (i.e. the caller much call rcu_read_[un]lock()).
  131. *
  132. */
  133. static struct netlbl_dom_map *netlbl_domhsh_search_def(const char *domain)
  134. {
  135. struct netlbl_dom_map *entry;
  136. entry = netlbl_domhsh_search(domain);
  137. if (entry == NULL) {
  138. entry = rcu_dereference(netlbl_domhsh_def);
  139. if (entry != NULL && entry->valid)
  140. return entry;
  141. }
  142. return NULL;
  143. }
  144. /*
  145. * Domain Hash Table Functions
  146. */
  147. /**
  148. * netlbl_domhsh_init - Init for the domain hash
  149. * @size: the number of bits to use for the hash buckets
  150. *
  151. * Description:
  152. * Initializes the domain hash table, should be called only by
  153. * netlbl_user_init() during initialization. Returns zero on success, non-zero
  154. * values on error.
  155. *
  156. */
  157. int netlbl_domhsh_init(u32 size)
  158. {
  159. u32 iter;
  160. struct netlbl_domhsh_tbl *hsh_tbl;
  161. if (size == 0)
  162. return -EINVAL;
  163. hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
  164. if (hsh_tbl == NULL)
  165. return -ENOMEM;
  166. hsh_tbl->size = 1 << size;
  167. hsh_tbl->tbl = kcalloc(hsh_tbl->size,
  168. sizeof(struct list_head),
  169. GFP_KERNEL);
  170. if (hsh_tbl->tbl == NULL) {
  171. kfree(hsh_tbl);
  172. return -ENOMEM;
  173. }
  174. for (iter = 0; iter < hsh_tbl->size; iter++)
  175. INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
  176. spin_lock(&netlbl_domhsh_lock);
  177. rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
  178. spin_unlock(&netlbl_domhsh_lock);
  179. return 0;
  180. }
  181. /**
  182. * netlbl_domhsh_add - Adds a entry to the domain hash table
  183. * @entry: the entry to add
  184. * @audit_info: NetLabel audit information
  185. *
  186. * Description:
  187. * Adds a new entry to the domain hash table and handles any updates to the
  188. * lower level protocol handler (i.e. CIPSO). Returns zero on success,
  189. * negative on failure.
  190. *
  191. */
  192. int netlbl_domhsh_add(struct netlbl_dom_map *entry,
  193. struct netlbl_audit *audit_info)
  194. {
  195. int ret_val;
  196. u32 bkt;
  197. struct audit_buffer *audit_buf;
  198. switch (entry->type) {
  199. case NETLBL_NLTYPE_UNLABELED:
  200. ret_val = 0;
  201. break;
  202. case NETLBL_NLTYPE_CIPSOV4:
  203. ret_val = cipso_v4_doi_domhsh_add(entry->type_def.cipsov4,
  204. entry->domain);
  205. break;
  206. default:
  207. return -EINVAL;
  208. }
  209. if (ret_val != 0)
  210. return ret_val;
  211. entry->valid = 1;
  212. INIT_RCU_HEAD(&entry->rcu);
  213. rcu_read_lock();
  214. if (entry->domain != NULL) {
  215. bkt = netlbl_domhsh_hash(entry->domain);
  216. spin_lock(&netlbl_domhsh_lock);
  217. if (netlbl_domhsh_search(entry->domain) == NULL)
  218. list_add_tail_rcu(&entry->list,
  219. &rcu_dereference(netlbl_domhsh)->tbl[bkt]);
  220. else
  221. ret_val = -EEXIST;
  222. spin_unlock(&netlbl_domhsh_lock);
  223. } else {
  224. INIT_LIST_HEAD(&entry->list);
  225. spin_lock(&netlbl_domhsh_def_lock);
  226. if (rcu_dereference(netlbl_domhsh_def) == NULL)
  227. rcu_assign_pointer(netlbl_domhsh_def, entry);
  228. else
  229. ret_val = -EEXIST;
  230. spin_unlock(&netlbl_domhsh_def_lock);
  231. }
  232. audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info);
  233. if (audit_buf != NULL) {
  234. audit_log_format(audit_buf,
  235. " nlbl_domain=%s",
  236. entry->domain ? entry->domain : "(default)");
  237. switch (entry->type) {
  238. case NETLBL_NLTYPE_UNLABELED:
  239. audit_log_format(audit_buf, " nlbl_protocol=unlbl");
  240. break;
  241. case NETLBL_NLTYPE_CIPSOV4:
  242. audit_log_format(audit_buf,
  243. " nlbl_protocol=cipsov4 cipso_doi=%u",
  244. entry->type_def.cipsov4->doi);
  245. break;
  246. }
  247. audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
  248. audit_log_end(audit_buf);
  249. }
  250. rcu_read_unlock();
  251. if (ret_val != 0) {
  252. switch (entry->type) {
  253. case NETLBL_NLTYPE_CIPSOV4:
  254. if (cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
  255. entry->domain) != 0)
  256. BUG();
  257. break;
  258. }
  259. }
  260. return ret_val;
  261. }
  262. /**
  263. * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
  264. * @entry: the entry to add
  265. * @audit_info: NetLabel audit information
  266. *
  267. * Description:
  268. * Adds a new default entry to the domain hash table and handles any updates
  269. * to the lower level protocol handler (i.e. CIPSO). Returns zero on success,
  270. * negative on failure.
  271. *
  272. */
  273. int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,
  274. struct netlbl_audit *audit_info)
  275. {
  276. return netlbl_domhsh_add(entry, audit_info);
  277. }
  278. /**
  279. * netlbl_domhsh_remove - Removes an entry from the domain hash table
  280. * @domain: the domain to remove
  281. * @audit_info: NetLabel audit information
  282. *
  283. * Description:
  284. * Removes an entry from the domain hash table and handles any updates to the
  285. * lower level protocol handler (i.e. CIPSO). Returns zero on success,
  286. * negative on failure.
  287. *
  288. */
  289. int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info)
  290. {
  291. int ret_val = -ENOENT;
  292. struct netlbl_dom_map *entry;
  293. struct audit_buffer *audit_buf;
  294. rcu_read_lock();
  295. if (domain)
  296. entry = netlbl_domhsh_search(domain);
  297. else
  298. entry = netlbl_domhsh_search_def(domain);
  299. if (entry == NULL)
  300. goto remove_return;
  301. switch (entry->type) {
  302. case NETLBL_NLTYPE_CIPSOV4:
  303. cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
  304. entry->domain);
  305. break;
  306. }
  307. if (entry != rcu_dereference(netlbl_domhsh_def)) {
  308. spin_lock(&netlbl_domhsh_lock);
  309. if (entry->valid) {
  310. entry->valid = 0;
  311. list_del_rcu(&entry->list);
  312. ret_val = 0;
  313. }
  314. spin_unlock(&netlbl_domhsh_lock);
  315. } else {
  316. spin_lock(&netlbl_domhsh_def_lock);
  317. if (entry->valid) {
  318. entry->valid = 0;
  319. rcu_assign_pointer(netlbl_domhsh_def, NULL);
  320. ret_val = 0;
  321. }
  322. spin_unlock(&netlbl_domhsh_def_lock);
  323. }
  324. audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
  325. if (audit_buf != NULL) {
  326. audit_log_format(audit_buf,
  327. " nlbl_domain=%s res=%u",
  328. entry->domain ? entry->domain : "(default)",
  329. ret_val == 0 ? 1 : 0);
  330. audit_log_end(audit_buf);
  331. }
  332. remove_return:
  333. rcu_read_unlock();
  334. if (ret_val == 0)
  335. call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
  336. return ret_val;
  337. }
  338. /**
  339. * netlbl_domhsh_remove_default - Removes the default entry from the table
  340. * @audit_info: NetLabel audit information
  341. *
  342. * Description:
  343. * Removes/resets the default entry for the domain hash table and handles any
  344. * updates to the lower level protocol handler (i.e. CIPSO). Returns zero on
  345. * success, non-zero on failure.
  346. *
  347. */
  348. int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info)
  349. {
  350. return netlbl_domhsh_remove(NULL, audit_info);
  351. }
  352. /**
  353. * netlbl_domhsh_getentry - Get an entry from the domain hash table
  354. * @domain: the domain name to search for
  355. *
  356. * Description:
  357. * Look through the domain hash table searching for an entry to match @domain,
  358. * return a pointer to a copy of the entry or NULL. The caller is responsibile
  359. * for ensuring that rcu_read_[un]lock() is called.
  360. *
  361. */
  362. struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
  363. {
  364. return netlbl_domhsh_search_def(domain);
  365. }
  366. /**
  367. * netlbl_domhsh_walk - Iterate through the domain mapping hash table
  368. * @skip_bkt: the number of buckets to skip at the start
  369. * @skip_chain: the number of entries to skip in the first iterated bucket
  370. * @callback: callback for each entry
  371. * @cb_arg: argument for the callback function
  372. *
  373. * Description:
  374. * Interate over the domain mapping hash table, skipping the first @skip_bkt
  375. * buckets and @skip_chain entries. For each entry in the table call
  376. * @callback, if @callback returns a negative value stop 'walking' through the
  377. * table and return. Updates the values in @skip_bkt and @skip_chain on
  378. * return. Returns zero on succcess, negative values on failure.
  379. *
  380. */
  381. int netlbl_domhsh_walk(u32 *skip_bkt,
  382. u32 *skip_chain,
  383. int (*callback) (struct netlbl_dom_map *entry, void *arg),
  384. void *cb_arg)
  385. {
  386. int ret_val = -ENOENT;
  387. u32 iter_bkt;
  388. struct netlbl_dom_map *iter_entry;
  389. u32 chain_cnt = 0;
  390. rcu_read_lock();
  391. for (iter_bkt = *skip_bkt;
  392. iter_bkt < rcu_dereference(netlbl_domhsh)->size;
  393. iter_bkt++, chain_cnt = 0) {
  394. list_for_each_entry_rcu(iter_entry,
  395. &rcu_dereference(netlbl_domhsh)->tbl[iter_bkt],
  396. list)
  397. if (iter_entry->valid) {
  398. if (chain_cnt++ < *skip_chain)
  399. continue;
  400. ret_val = callback(iter_entry, cb_arg);
  401. if (ret_val < 0) {
  402. chain_cnt--;
  403. goto walk_return;
  404. }
  405. }
  406. }
  407. walk_return:
  408. rcu_read_unlock();
  409. *skip_bkt = iter_bkt;
  410. *skip_chain = chain_cnt;
  411. return ret_val;
  412. }