Thomas Gleixner | 1ccea77 | 2019-05-19 15:51:43 +0200 | [diff] [blame] | 1 | /* SPDX-License-Identifier: GPL-2.0-or-later */ |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 2 | /* |
| 3 | * CIPSO - Commercial IP Security Option |
| 4 | * |
| 5 | * This is an implementation of the CIPSO 2.2 protocol as specified in |
| 6 | * draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in |
| 7 | * FIPS-188, copies of both documents can be found in the Documentation |
| 8 | * directory. While CIPSO never became a full IETF RFC standard many vendors |
| 9 | * have chosen to adopt the protocol and over the years it has become a |
| 10 | * de-facto standard for labeled networking. |
| 11 | * |
Paul Moore | 82c21bf | 2011-08-01 11:10:33 +0000 | [diff] [blame] | 12 | * Author: Paul Moore <paul@paul-moore.com> |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 13 | */ |
| 14 | |
| 15 | /* |
| 16 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 17 | */ |
| 18 | |
| 19 | #ifndef _CIPSO_IPV4_H |
| 20 | #define _CIPSO_IPV4_H |
| 21 | |
| 22 | #include <linux/types.h> |
| 23 | #include <linux/rcupdate.h> |
| 24 | #include <linux/list.h> |
Paul Moore | 7a0e1d6 | 2006-08-29 17:56:04 -0700 | [diff] [blame] | 25 | #include <linux/net.h> |
| 26 | #include <linux/skbuff.h> |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 27 | #include <net/netlabel.h> |
Paul Moore | 389fb800 | 2009-03-27 17:10:34 -0400 | [diff] [blame] | 28 | #include <net/request_sock.h> |
Arun Sharma | 60063497 | 2011-07-26 16:09:06 -0700 | [diff] [blame] | 29 | #include <linux/atomic.h> |
Reshetova, Elena | f6a6fed | 2017-07-04 09:35:01 +0300 | [diff] [blame] | 30 | #include <linux/refcount.h> |
Paul Moore | 20e2a86 | 2012-06-01 05:54:56 +0000 | [diff] [blame] | 31 | #include <asm/unaligned.h> |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 32 | |
| 33 | /* known doi values */ |
| 34 | #define CIPSO_V4_DOI_UNKNOWN 0x00000000 |
| 35 | |
Paul Moore | 15c45f7 | 2008-10-10 10:16:34 -0400 | [diff] [blame] | 36 | /* standard tag types */ |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 37 | #define CIPSO_V4_TAG_INVALID 0 |
| 38 | #define CIPSO_V4_TAG_RBITMAP 1 |
| 39 | #define CIPSO_V4_TAG_ENUM 2 |
| 40 | #define CIPSO_V4_TAG_RANGE 5 |
| 41 | #define CIPSO_V4_TAG_PBITMAP 6 |
| 42 | #define CIPSO_V4_TAG_FREEFORM 7 |
| 43 | |
Paul Moore | 15c45f7 | 2008-10-10 10:16:34 -0400 | [diff] [blame] | 44 | /* non-standard tag types (tags > 127) */ |
| 45 | #define CIPSO_V4_TAG_LOCAL 128 |
| 46 | |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 47 | /* doi mapping types */ |
| 48 | #define CIPSO_V4_MAP_UNKNOWN 0 |
Paul Moore | 15c45f7 | 2008-10-10 10:16:34 -0400 | [diff] [blame] | 49 | #define CIPSO_V4_MAP_TRANS 1 |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 50 | #define CIPSO_V4_MAP_PASS 2 |
Paul Moore | 15c45f7 | 2008-10-10 10:16:34 -0400 | [diff] [blame] | 51 | #define CIPSO_V4_MAP_LOCAL 3 |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 52 | |
| 53 | /* limits */ |
Paul Moore | c6b1677 | 2006-11-17 17:38:51 -0500 | [diff] [blame] | 54 | #define CIPSO_V4_MAX_REM_LVLS 255 |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 55 | #define CIPSO_V4_INV_LVL 0x80000000 |
| 56 | #define CIPSO_V4_MAX_LOC_LVLS (CIPSO_V4_INV_LVL - 1) |
Paul Moore | c6b1677 | 2006-11-17 17:38:51 -0500 | [diff] [blame] | 57 | #define CIPSO_V4_MAX_REM_CATS 65534 |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 58 | #define CIPSO_V4_INV_CAT 0x80000000 |
| 59 | #define CIPSO_V4_MAX_LOC_CATS (CIPSO_V4_INV_CAT - 1) |
| 60 | |
| 61 | /* |
| 62 | * CIPSO DOI definitions |
| 63 | */ |
| 64 | |
| 65 | /* DOI definition struct */ |
| 66 | #define CIPSO_V4_TAG_MAXCNT 5 |
| 67 | struct cipso_v4_doi { |
| 68 | u32 doi; |
| 69 | u32 type; |
| 70 | union { |
| 71 | struct cipso_v4_std_map_tbl *std; |
| 72 | } map; |
| 73 | u8 tags[CIPSO_V4_TAG_MAXCNT]; |
| 74 | |
Reshetova, Elena | f6a6fed | 2017-07-04 09:35:01 +0300 | [diff] [blame] | 75 | refcount_t refcount; |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 76 | struct list_head list; |
| 77 | struct rcu_head rcu; |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 78 | }; |
| 79 | |
| 80 | /* Standard CIPSO mapping table */ |
| 81 | /* NOTE: the highest order bit (i.e. 0x80000000) is an 'invalid' flag, if the |
| 82 | * bit is set then consider that value as unspecified, meaning the |
| 83 | * mapping for that particular level/category is invalid */ |
| 84 | struct cipso_v4_std_map_tbl { |
| 85 | struct { |
| 86 | u32 *cipso; |
| 87 | u32 *local; |
| 88 | u32 cipso_size; |
| 89 | u32 local_size; |
| 90 | } lvl; |
| 91 | struct { |
| 92 | u32 *cipso; |
| 93 | u32 *local; |
| 94 | u32 cipso_size; |
| 95 | u32 local_size; |
| 96 | } cat; |
| 97 | }; |
| 98 | |
| 99 | /* |
| 100 | * Sysctl Variables |
| 101 | */ |
| 102 | |
| 103 | #ifdef CONFIG_NETLABEL |
| 104 | extern int cipso_v4_cache_enabled; |
| 105 | extern int cipso_v4_cache_bucketsize; |
| 106 | extern int cipso_v4_rbm_optfmt; |
| 107 | extern int cipso_v4_rbm_strictvalid; |
| 108 | #endif |
| 109 | |
| 110 | /* |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 111 | * DOI List Functions |
| 112 | */ |
| 113 | |
| 114 | #ifdef CONFIG_NETLABEL |
Paul Moore | 6c2e8ac | 2008-12-31 12:54:11 -0500 | [diff] [blame] | 115 | int cipso_v4_doi_add(struct cipso_v4_doi *doi_def, |
| 116 | struct netlbl_audit *audit_info); |
Paul Moore | b1edeb1 | 2008-10-10 10:16:31 -0400 | [diff] [blame] | 117 | void cipso_v4_doi_free(struct cipso_v4_doi *doi_def); |
| 118 | int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info); |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 119 | struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi); |
Paul Moore | b1edeb1 | 2008-10-10 10:16:31 -0400 | [diff] [blame] | 120 | void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def); |
Paul Moore | fcd4828 | 2006-09-25 15:56:09 -0700 | [diff] [blame] | 121 | int cipso_v4_doi_walk(u32 *skip_cnt, |
| 122 | int (*callback) (struct cipso_v4_doi *doi_def, void *arg), |
| 123 | void *cb_arg); |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 124 | #else |
Paul Moore | 6c2e8ac | 2008-12-31 12:54:11 -0500 | [diff] [blame] | 125 | static inline int cipso_v4_doi_add(struct cipso_v4_doi *doi_def, |
| 126 | struct netlbl_audit *audit_info) |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 127 | { |
| 128 | return -ENOSYS; |
| 129 | } |
| 130 | |
Paul Moore | b1edeb1 | 2008-10-10 10:16:31 -0400 | [diff] [blame] | 131 | static inline void cipso_v4_doi_free(struct cipso_v4_doi *doi_def) |
| 132 | { |
| 133 | return; |
| 134 | } |
| 135 | |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 136 | static inline int cipso_v4_doi_remove(u32 doi, |
Paul Moore | b1edeb1 | 2008-10-10 10:16:31 -0400 | [diff] [blame] | 137 | struct netlbl_audit *audit_info) |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 138 | { |
| 139 | return 0; |
| 140 | } |
| 141 | |
| 142 | static inline struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi) |
| 143 | { |
| 144 | return NULL; |
| 145 | } |
| 146 | |
Paul Moore | fcd4828 | 2006-09-25 15:56:09 -0700 | [diff] [blame] | 147 | static inline int cipso_v4_doi_walk(u32 *skip_cnt, |
| 148 | int (*callback) (struct cipso_v4_doi *doi_def, void *arg), |
| 149 | void *cb_arg) |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 150 | { |
Paul Moore | fcd4828 | 2006-09-25 15:56:09 -0700 | [diff] [blame] | 151 | return 0; |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 152 | } |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 153 | #endif /* CONFIG_NETLABEL */ |
| 154 | |
| 155 | /* |
| 156 | * Label Mapping Cache Functions |
| 157 | */ |
| 158 | |
| 159 | #ifdef CONFIG_NETLABEL |
| 160 | void cipso_v4_cache_invalidate(void); |
Paul Moore | 04f81f0 | 2015-02-11 14:46:37 -0500 | [diff] [blame] | 161 | int cipso_v4_cache_add(const unsigned char *cipso_ptr, |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 162 | const struct netlbl_lsm_secattr *secattr); |
| 163 | #else |
| 164 | static inline void cipso_v4_cache_invalidate(void) |
| 165 | { |
| 166 | return; |
| 167 | } |
| 168 | |
Paul Moore | 04f81f0 | 2015-02-11 14:46:37 -0500 | [diff] [blame] | 169 | static inline int cipso_v4_cache_add(const unsigned char *cipso_ptr, |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 170 | const struct netlbl_lsm_secattr *secattr) |
| 171 | { |
| 172 | return 0; |
| 173 | } |
| 174 | #endif /* CONFIG_NETLABEL */ |
| 175 | |
| 176 | /* |
| 177 | * Protocol Handling Functions |
| 178 | */ |
| 179 | |
| 180 | #ifdef CONFIG_NETLABEL |
| 181 | void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway); |
Paul Moore | 04f81f0 | 2015-02-11 14:46:37 -0500 | [diff] [blame] | 182 | int cipso_v4_getattr(const unsigned char *cipso, |
| 183 | struct netlbl_lsm_secattr *secattr); |
Paul Moore | ba6ff9f2 | 2007-06-07 18:37:15 -0700 | [diff] [blame] | 184 | int cipso_v4_sock_setattr(struct sock *sk, |
| 185 | const struct cipso_v4_doi *doi_def, |
| 186 | const struct netlbl_lsm_secattr *secattr); |
Paul Moore | 014ab19 | 2008-10-10 10:16:33 -0400 | [diff] [blame] | 187 | void cipso_v4_sock_delattr(struct sock *sk); |
Paul Moore | 14a72f5 | 2006-09-25 15:52:01 -0700 | [diff] [blame] | 188 | int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr); |
Paul Moore | 389fb800 | 2009-03-27 17:10:34 -0400 | [diff] [blame] | 189 | int cipso_v4_req_setattr(struct request_sock *req, |
| 190 | const struct cipso_v4_doi *doi_def, |
| 191 | const struct netlbl_lsm_secattr *secattr); |
| 192 | void cipso_v4_req_delattr(struct request_sock *req); |
Paul Moore | 948bf85 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 193 | int cipso_v4_skbuff_setattr(struct sk_buff *skb, |
| 194 | const struct cipso_v4_doi *doi_def, |
| 195 | const struct netlbl_lsm_secattr *secattr); |
| 196 | int cipso_v4_skbuff_delattr(struct sk_buff *skb); |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 197 | int cipso_v4_skbuff_getattr(const struct sk_buff *skb, |
| 198 | struct netlbl_lsm_secattr *secattr); |
Paul Moore | 04f81f0 | 2015-02-11 14:46:37 -0500 | [diff] [blame] | 199 | unsigned char *cipso_v4_optptr(const struct sk_buff *skb); |
Paul Moore | 15c45f7 | 2008-10-10 10:16:34 -0400 | [diff] [blame] | 200 | int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option); |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 201 | #else |
| 202 | static inline void cipso_v4_error(struct sk_buff *skb, |
| 203 | int error, |
| 204 | u32 gateway) |
| 205 | { |
| 206 | return; |
| 207 | } |
| 208 | |
Paul Moore | 04f81f0 | 2015-02-11 14:46:37 -0500 | [diff] [blame] | 209 | static inline int cipso_v4_getattr(const unsigned char *cipso, |
| 210 | struct netlbl_lsm_secattr *secattr) |
| 211 | { |
| 212 | return -ENOSYS; |
| 213 | } |
| 214 | |
Paul Moore | ba6ff9f2 | 2007-06-07 18:37:15 -0700 | [diff] [blame] | 215 | static inline int cipso_v4_sock_setattr(struct sock *sk, |
| 216 | const struct cipso_v4_doi *doi_def, |
| 217 | const struct netlbl_lsm_secattr *secattr) |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 218 | { |
| 219 | return -ENOSYS; |
| 220 | } |
| 221 | |
Paul Moore | 014ab19 | 2008-10-10 10:16:33 -0400 | [diff] [blame] | 222 | static inline void cipso_v4_sock_delattr(struct sock *sk) |
| 223 | { |
| 224 | } |
| 225 | |
Paul Moore | 14a72f5 | 2006-09-25 15:52:01 -0700 | [diff] [blame] | 226 | static inline int cipso_v4_sock_getattr(struct sock *sk, |
| 227 | struct netlbl_lsm_secattr *secattr) |
| 228 | { |
| 229 | return -ENOSYS; |
| 230 | } |
| 231 | |
Paul Moore | 389fb800 | 2009-03-27 17:10:34 -0400 | [diff] [blame] | 232 | static inline int cipso_v4_req_setattr(struct request_sock *req, |
| 233 | const struct cipso_v4_doi *doi_def, |
| 234 | const struct netlbl_lsm_secattr *secattr) |
| 235 | { |
| 236 | return -ENOSYS; |
| 237 | } |
| 238 | |
| 239 | static inline void cipso_v4_req_delattr(struct request_sock *req) |
| 240 | { |
| 241 | return; |
| 242 | } |
| 243 | |
Paul Moore | 948bf85 | 2008-10-10 10:16:32 -0400 | [diff] [blame] | 244 | static inline int cipso_v4_skbuff_setattr(struct sk_buff *skb, |
| 245 | const struct cipso_v4_doi *doi_def, |
| 246 | const struct netlbl_lsm_secattr *secattr) |
| 247 | { |
| 248 | return -ENOSYS; |
| 249 | } |
| 250 | |
| 251 | static inline int cipso_v4_skbuff_delattr(struct sk_buff *skb) |
| 252 | { |
| 253 | return -ENOSYS; |
| 254 | } |
| 255 | |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 256 | static inline int cipso_v4_skbuff_getattr(const struct sk_buff *skb, |
| 257 | struct netlbl_lsm_secattr *secattr) |
| 258 | { |
| 259 | return -ENOSYS; |
| 260 | } |
| 261 | |
Paul Moore | 04f81f0 | 2015-02-11 14:46:37 -0500 | [diff] [blame] | 262 | static inline unsigned char *cipso_v4_optptr(const struct sk_buff *skb) |
| 263 | { |
| 264 | return NULL; |
| 265 | } |
| 266 | |
Paul Moore | 15c45f7 | 2008-10-10 10:16:34 -0400 | [diff] [blame] | 267 | static inline int cipso_v4_validate(const struct sk_buff *skb, |
| 268 | unsigned char **option) |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 269 | { |
Paul Moore | 20e2a86 | 2012-06-01 05:54:56 +0000 | [diff] [blame] | 270 | unsigned char *opt = *option; |
| 271 | unsigned char err_offset = 0; |
| 272 | u8 opt_len = opt[1]; |
| 273 | u8 opt_iter; |
Seif Mazareeb | f2e5ddc | 2013-10-17 20:33:21 -0700 | [diff] [blame] | 274 | u8 tag_len; |
Paul Moore | 20e2a86 | 2012-06-01 05:54:56 +0000 | [diff] [blame] | 275 | |
| 276 | if (opt_len < 8) { |
| 277 | err_offset = 1; |
| 278 | goto out; |
| 279 | } |
| 280 | |
| 281 | if (get_unaligned_be32(&opt[2]) == 0) { |
| 282 | err_offset = 2; |
| 283 | goto out; |
| 284 | } |
| 285 | |
| 286 | for (opt_iter = 6; opt_iter < opt_len;) { |
Eric Dumazet | d71b789 | 2017-02-03 00:03:26 -0800 | [diff] [blame] | 287 | if (opt_iter + 1 == opt_len) { |
| 288 | err_offset = opt_iter; |
| 289 | goto out; |
| 290 | } |
Seif Mazareeb | f2e5ddc | 2013-10-17 20:33:21 -0700 | [diff] [blame] | 291 | tag_len = opt[opt_iter + 1]; |
Paul Moore | 10ae76f | 2013-12-10 15:00:50 -0500 | [diff] [blame] | 292 | if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) { |
Paul Moore | 20e2a86 | 2012-06-01 05:54:56 +0000 | [diff] [blame] | 293 | err_offset = opt_iter + 1; |
| 294 | goto out; |
| 295 | } |
Seif Mazareeb | f2e5ddc | 2013-10-17 20:33:21 -0700 | [diff] [blame] | 296 | opt_iter += tag_len; |
Paul Moore | 20e2a86 | 2012-06-01 05:54:56 +0000 | [diff] [blame] | 297 | } |
| 298 | |
| 299 | out: |
| 300 | *option = opt + err_offset; |
| 301 | return err_offset; |
| 302 | |
Paul Moore | 11a03f7 | 2006-08-03 16:46:20 -0700 | [diff] [blame] | 303 | } |
| 304 | #endif /* CONFIG_NETLABEL */ |
| 305 | |
| 306 | #endif /* _CIPSO_IPV4_H */ |