Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 1 | /* |
| 2 | * Network node table |
| 3 | * |
| 4 | * SELinux must keep a mapping of network nodes to labels/SIDs. This |
| 5 | * mapping is maintained as part of the normal policy but a fast cache is |
| 6 | * needed to reduce the lookup overhead since most of these queries happen on |
| 7 | * a per-packet basis. |
| 8 | * |
Paul Moore | 82c21bf | 2011-08-01 11:10:33 +0000 | [diff] [blame] | 9 | * Author: Paul Moore <paul@paul-moore.com> |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 10 | * |
| 11 | * This code is heavily based on the "netif" concept originally developed by |
| 12 | * James Morris <jmorris@redhat.com> |
| 13 | * (see security/selinux/netif.c for more information) |
| 14 | * |
| 15 | */ |
| 16 | |
| 17 | /* |
| 18 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2007 |
| 19 | * |
| 20 | * This program is free software: you can redistribute it and/or modify |
| 21 | * it under the terms of version 2 of the GNU General Public License as |
| 22 | * published by the Free Software Foundation. |
| 23 | * |
| 24 | * This program is distributed in the hope that it will be useful, |
| 25 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| 26 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| 27 | * GNU General Public License for more details. |
| 28 | * |
| 29 | */ |
| 30 | |
| 31 | #include <linux/types.h> |
| 32 | #include <linux/rcupdate.h> |
| 33 | #include <linux/list.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 34 | #include <linux/slab.h> |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 35 | #include <linux/spinlock.h> |
| 36 | #include <linux/in.h> |
| 37 | #include <linux/in6.h> |
| 38 | #include <linux/ip.h> |
| 39 | #include <linux/ipv6.h> |
| 40 | #include <net/ip.h> |
| 41 | #include <net/ipv6.h> |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 42 | |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 43 | #include "netnode.h" |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 44 | #include "objsec.h" |
| 45 | |
| 46 | #define SEL_NETNODE_HASH_SIZE 256 |
| 47 | #define SEL_NETNODE_HASH_BKT_LIMIT 16 |
| 48 | |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 49 | struct sel_netnode_bkt { |
| 50 | unsigned int size; |
| 51 | struct list_head list; |
| 52 | }; |
| 53 | |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 54 | struct sel_netnode { |
| 55 | struct netnode_security_struct nsec; |
| 56 | |
| 57 | struct list_head list; |
| 58 | struct rcu_head rcu; |
| 59 | }; |
| 60 | |
| 61 | /* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason |
| 62 | * for this is that I suspect most users will not make heavy use of both |
| 63 | * address families at the same time so one table will usually end up wasted, |
| 64 | * if this becomes a problem we can always add a hash table for each address |
| 65 | * family later */ |
| 66 | |
| 67 | static LIST_HEAD(sel_netnode_list); |
| 68 | static DEFINE_SPINLOCK(sel_netnode_lock); |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 69 | static struct sel_netnode_bkt sel_netnode_hash[SEL_NETNODE_HASH_SIZE]; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 70 | |
| 71 | /** |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 72 | * sel_netnode_hashfn_ipv4 - IPv4 hashing function for the node table |
| 73 | * @addr: IPv4 address |
| 74 | * |
| 75 | * Description: |
| 76 | * This is the IPv4 hashing function for the node interface table, it returns |
| 77 | * the bucket number for the given IP address. |
| 78 | * |
| 79 | */ |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 80 | static unsigned int sel_netnode_hashfn_ipv4(__be32 addr) |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 81 | { |
| 82 | /* at some point we should determine if the mismatch in byte order |
| 83 | * affects the hash function dramatically */ |
| 84 | return (addr & (SEL_NETNODE_HASH_SIZE - 1)); |
| 85 | } |
| 86 | |
| 87 | /** |
| 88 | * sel_netnode_hashfn_ipv6 - IPv6 hashing function for the node table |
| 89 | * @addr: IPv6 address |
| 90 | * |
| 91 | * Description: |
| 92 | * This is the IPv6 hashing function for the node interface table, it returns |
| 93 | * the bucket number for the given IP address. |
| 94 | * |
| 95 | */ |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 96 | static unsigned int sel_netnode_hashfn_ipv6(const struct in6_addr *addr) |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 97 | { |
| 98 | /* just hash the least significant 32 bits to keep things fast (they |
| 99 | * are the most likely to be different anyway), we can revisit this |
| 100 | * later if needed */ |
| 101 | return (addr->s6_addr32[3] & (SEL_NETNODE_HASH_SIZE - 1)); |
| 102 | } |
| 103 | |
| 104 | /** |
| 105 | * sel_netnode_find - Search for a node record |
| 106 | * @addr: IP address |
| 107 | * @family: address family |
| 108 | * |
| 109 | * Description: |
| 110 | * Search the network node table and return the record matching @addr. If an |
| 111 | * entry can not be found in the table return NULL. |
| 112 | * |
| 113 | */ |
| 114 | static struct sel_netnode *sel_netnode_find(const void *addr, u16 family) |
| 115 | { |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 116 | unsigned int idx; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 117 | struct sel_netnode *node; |
| 118 | |
| 119 | switch (family) { |
| 120 | case PF_INET: |
| 121 | idx = sel_netnode_hashfn_ipv4(*(__be32 *)addr); |
| 122 | break; |
| 123 | case PF_INET6: |
| 124 | idx = sel_netnode_hashfn_ipv6(addr); |
| 125 | break; |
| 126 | default: |
| 127 | BUG(); |
Eric Paris | a35c6c83 | 2011-04-20 10:21:28 -0400 | [diff] [blame] | 128 | return NULL; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 129 | } |
| 130 | |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 131 | list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list) |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 132 | if (node->nsec.family == family) |
| 133 | switch (family) { |
| 134 | case PF_INET: |
| 135 | if (node->nsec.addr.ipv4 == *(__be32 *)addr) |
| 136 | return node; |
| 137 | break; |
| 138 | case PF_INET6: |
| 139 | if (ipv6_addr_equal(&node->nsec.addr.ipv6, |
| 140 | addr)) |
| 141 | return node; |
| 142 | break; |
| 143 | } |
| 144 | |
| 145 | return NULL; |
| 146 | } |
| 147 | |
| 148 | /** |
| 149 | * sel_netnode_insert - Insert a new node into the table |
| 150 | * @node: the new node record |
| 151 | * |
| 152 | * Description: |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 153 | * Add a new node record to the network address hash table. |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 154 | * |
| 155 | */ |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 156 | static void sel_netnode_insert(struct sel_netnode *node) |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 157 | { |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 158 | unsigned int idx; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 159 | |
| 160 | switch (node->nsec.family) { |
| 161 | case PF_INET: |
| 162 | idx = sel_netnode_hashfn_ipv4(node->nsec.addr.ipv4); |
| 163 | break; |
| 164 | case PF_INET6: |
| 165 | idx = sel_netnode_hashfn_ipv6(&node->nsec.addr.ipv6); |
| 166 | break; |
| 167 | default: |
| 168 | BUG(); |
| 169 | } |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 170 | |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 171 | /* we need to impose a limit on the growth of the hash table so check |
| 172 | * this bucket to make sure it is within the specified bounds */ |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 173 | list_add_rcu(&node->list, &sel_netnode_hash[idx].list); |
| 174 | if (sel_netnode_hash[idx].size == SEL_NETNODE_HASH_BKT_LIMIT) { |
| 175 | struct sel_netnode *tail; |
| 176 | tail = list_entry( |
| 177 | rcu_dereference(sel_netnode_hash[idx].list.prev), |
| 178 | struct sel_netnode, list); |
| 179 | list_del_rcu(&tail->list); |
Lai Jiangshan | 9801c60 | 2011-03-18 12:05:22 +0800 | [diff] [blame] | 180 | kfree_rcu(tail, rcu); |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 181 | } else |
| 182 | sel_netnode_hash[idx].size++; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 183 | } |
| 184 | |
| 185 | /** |
| 186 | * sel_netnode_sid_slow - Lookup the SID of a network address using the policy |
| 187 | * @addr: the IP address |
| 188 | * @family: the address family |
| 189 | * @sid: node SID |
| 190 | * |
| 191 | * Description: |
| 192 | * This function determines the SID of a network address by quering the |
| 193 | * security policy. The result is added to the network address table to |
| 194 | * speedup future queries. Returns zero on success, negative values on |
| 195 | * failure. |
| 196 | * |
| 197 | */ |
| 198 | static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid) |
| 199 | { |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 200 | int ret = -ENOMEM; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 201 | struct sel_netnode *node; |
| 202 | struct sel_netnode *new = NULL; |
| 203 | |
| 204 | spin_lock_bh(&sel_netnode_lock); |
| 205 | node = sel_netnode_find(addr, family); |
| 206 | if (node != NULL) { |
| 207 | *sid = node->nsec.sid; |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 208 | spin_unlock_bh(&sel_netnode_lock); |
| 209 | return 0; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 210 | } |
| 211 | new = kzalloc(sizeof(*new), GFP_ATOMIC); |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 212 | if (new == NULL) |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 213 | goto out; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 214 | switch (family) { |
| 215 | case PF_INET: |
| 216 | ret = security_node_sid(PF_INET, |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 217 | addr, sizeof(struct in_addr), sid); |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 218 | new->nsec.addr.ipv4 = *(__be32 *)addr; |
| 219 | break; |
| 220 | case PF_INET6: |
| 221 | ret = security_node_sid(PF_INET6, |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 222 | addr, sizeof(struct in6_addr), sid); |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 223 | ipv6_addr_copy(&new->nsec.addr.ipv6, addr); |
| 224 | break; |
| 225 | default: |
| 226 | BUG(); |
| 227 | } |
| 228 | if (ret != 0) |
| 229 | goto out; |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 230 | |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 231 | new->nsec.family = family; |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 232 | new->nsec.sid = *sid; |
| 233 | sel_netnode_insert(new); |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 234 | |
| 235 | out: |
| 236 | spin_unlock_bh(&sel_netnode_lock); |
Paul Moore | 71f1cb0 | 2008-01-29 08:51:16 -0500 | [diff] [blame] | 237 | if (unlikely(ret)) { |
| 238 | printk(KERN_WARNING |
| 239 | "SELinux: failure in sel_netnode_sid_slow()," |
| 240 | " unable to determine network node label\n"); |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 241 | kfree(new); |
Paul Moore | 71f1cb0 | 2008-01-29 08:51:16 -0500 | [diff] [blame] | 242 | } |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 243 | return ret; |
| 244 | } |
| 245 | |
| 246 | /** |
| 247 | * sel_netnode_sid - Lookup the SID of a network address |
| 248 | * @addr: the IP address |
| 249 | * @family: the address family |
| 250 | * @sid: node SID |
| 251 | * |
| 252 | * Description: |
| 253 | * This function determines the SID of a network address using the fastest |
| 254 | * method possible. First the address table is queried, but if an entry |
| 255 | * can't be found then the policy is queried and the result is added to the |
| 256 | * table to speedup future queries. Returns zero on success, negative values |
| 257 | * on failure. |
| 258 | * |
| 259 | */ |
| 260 | int sel_netnode_sid(void *addr, u16 family, u32 *sid) |
| 261 | { |
| 262 | struct sel_netnode *node; |
| 263 | |
| 264 | rcu_read_lock(); |
| 265 | node = sel_netnode_find(addr, family); |
| 266 | if (node != NULL) { |
| 267 | *sid = node->nsec.sid; |
| 268 | rcu_read_unlock(); |
| 269 | return 0; |
| 270 | } |
| 271 | rcu_read_unlock(); |
| 272 | |
| 273 | return sel_netnode_sid_slow(addr, family, sid); |
| 274 | } |
| 275 | |
| 276 | /** |
| 277 | * sel_netnode_flush - Flush the entire network address table |
| 278 | * |
| 279 | * Description: |
| 280 | * Remove all entries from the network address table. |
| 281 | * |
| 282 | */ |
| 283 | static void sel_netnode_flush(void) |
| 284 | { |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 285 | unsigned int idx; |
| 286 | struct sel_netnode *node, *node_tmp; |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 287 | |
| 288 | spin_lock_bh(&sel_netnode_lock); |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 289 | for (idx = 0; idx < SEL_NETNODE_HASH_SIZE; idx++) { |
| 290 | list_for_each_entry_safe(node, node_tmp, |
| 291 | &sel_netnode_hash[idx].list, list) { |
| 292 | list_del_rcu(&node->list); |
Lai Jiangshan | 9801c60 | 2011-03-18 12:05:22 +0800 | [diff] [blame] | 293 | kfree_rcu(node, rcu); |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 294 | } |
| 295 | sel_netnode_hash[idx].size = 0; |
| 296 | } |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 297 | spin_unlock_bh(&sel_netnode_lock); |
| 298 | } |
| 299 | |
| 300 | static int sel_netnode_avc_callback(u32 event, u32 ssid, u32 tsid, |
| 301 | u16 class, u32 perms, u32 *retained) |
| 302 | { |
| 303 | if (event == AVC_CALLBACK_RESET) { |
| 304 | sel_netnode_flush(); |
| 305 | synchronize_net(); |
| 306 | } |
| 307 | return 0; |
| 308 | } |
| 309 | |
| 310 | static __init int sel_netnode_init(void) |
| 311 | { |
| 312 | int iter; |
| 313 | int ret; |
| 314 | |
| 315 | if (!selinux_enabled) |
| 316 | return 0; |
| 317 | |
Paul Moore | a639e7ca | 2008-04-25 15:03:34 -0400 | [diff] [blame] | 318 | for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) { |
| 319 | INIT_LIST_HEAD(&sel_netnode_hash[iter].list); |
| 320 | sel_netnode_hash[iter].size = 0; |
| 321 | } |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 322 | |
| 323 | ret = avc_add_callback(sel_netnode_avc_callback, AVC_CALLBACK_RESET, |
Eric Paris | 7b6b239 | 2008-04-18 17:38:25 -0400 | [diff] [blame] | 324 | SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0); |
Paul Moore | 224dfbd | 2008-01-29 08:38:13 -0500 | [diff] [blame] | 325 | if (ret != 0) |
| 326 | panic("avc_add_callback() failed, error %d\n", ret); |
| 327 | |
| 328 | return ret; |
| 329 | } |
| 330 | |
| 331 | __initcall(sel_netnode_init); |