Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308// SPDX-License-Identifier: GPL-2.0-only/* * Network node table * * SELinux must keep a mapping of network nodes to labels/SIDs. This * mapping is maintained as part of the normal policy but a fast cache is * needed to reduce the lookup overhead since most of these queries happen on * a per-packet basis. * * Author: Paul Moore <paul@paul-moore.com> * * This code is heavily based on the "netif" concept originally developed by * James Morris <jmorris@redhat.com> * (see security/selinux/netif.c for more information) */
/* * (c) Copyright Hewlett-Packard Development Company, L.P., 2007 */
#include <linux/types.h>#include <linux/rcupdate.h>#include <linux/list.h>#include <linux/slab.h>#include <linux/spinlock.h>#include <linux/in.h>#include <linux/in6.h>#include <linux/ip.h>#include <linux/ipv6.h>#include <net/ip.h>#include <net/ipv6.h>
#include "initcalls.h"#include "netnode.h"#include "objsec.h"
#define SEL_NETNODE_HASH_SIZE 256#define SEL_NETNODE_HASH_BKT_LIMIT 16
struct sel_netnode_bkt { unsigned int size; struct list_head list;};
struct sel_netnode { struct netnode_security_struct nsec;
struct list_head list; struct rcu_head rcu;};
/* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason * for this is that I suspect most users will not make heavy use of both * address families at the same time so one table will usually end up wasted, * if this becomes a problem we can always add a hash table for each address * family later */
static DEFINE_SPINLOCK(sel_netnode_lock);static struct sel_netnode_bkt sel_netnode_hash[SEL_NETNODE_HASH_SIZE];
/** * sel_netnode_hashfn_ipv4 - IPv4 hashing function for the node table * @addr: IPv4 address * * Description: * This is the IPv4 hashing function for the node interface table, it returns * the bucket number for the given IP address. * */static unsigned int sel_netnode_hashfn_ipv4(__be32 addr){ /* at some point we should determine if the mismatch in byte order * affects the hash function dramatically */ return (addr & (SEL_NETNODE_HASH_SIZE - 1));}
/** * sel_netnode_hashfn_ipv6 - IPv6 hashing function for the node table * @addr: IPv6 address * * Description: * This is the IPv6 hashing function for the node interface table, it returns * the bucket number for the given IP address. * */static unsigned int sel_netnode_hashfn_ipv6(const struct in6_addr *addr){ /* just hash the least significant 32 bits to keep things fast (they * are the most likely to be different anyway), we can revisit this * later if needed */ return (addr->s6_addr32[3] & (SEL_NETNODE_HASH_SIZE - 1));}
/** * sel_netnode_find - Search for a node record * @addr: IP address * @family: address family * * Description: * Search the network node table and return the record matching @addr. If an * entry can not be found in the table return NULL. * */static struct sel_netnode *sel_netnode_find(const void *addr, u16 family){ unsigned int idx; struct sel_netnode *node;
switch (family) { case PF_INET: idx = sel_netnode_hashfn_ipv4(*(const __be32 *)addr); break; case PF_INET6: idx = sel_netnode_hashfn_ipv6(addr); break; default: BUG(); return NULL; }
list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list) if (node->nsec.family == family) switch (family) { case PF_INET: if (node->nsec.addr.ipv4 == *(const __be32 *)addr) return node; break; case PF_INET6: if (ipv6_addr_equal(&node->nsec.addr.ipv6, addr)) return node; break; }
return NULL;}
/** * sel_netnode_insert - Insert a new node into the table * @node: the new node record * * Description: * Add a new node record to the network address hash table. * */static void sel_netnode_insert(struct sel_netnode *node){ unsigned int idx;
switch (node->nsec.family) { case PF_INET: idx = sel_netnode_hashfn_ipv4(node->nsec.addr.ipv4); break; case PF_INET6: idx = sel_netnode_hashfn_ipv6(&node->nsec.addr.ipv6); break; default: BUG(); return; }
/* we need to impose a limit on the growth of the hash table so check * this bucket to make sure it is within the specified bounds */ list_add_rcu(&node->list, &sel_netnode_hash[idx].list); if (sel_netnode_hash[idx].size == SEL_NETNODE_HASH_BKT_LIMIT) { struct sel_netnode *tail; tail = list_entry( rcu_dereference_protected( list_tail_rcu(&sel_netnode_hash[idx].list), lockdep_is_held(&sel_netnode_lock)), struct sel_netnode, list); list_del_rcu(&tail->list); kfree_rcu(tail, rcu); } else sel_netnode_hash[idx].size++;}
/** * sel_netnode_sid_slow - Lookup the SID of a network address using the policy * @addr: the IP address * @family: the address family * @sid: node SID * * Description: * This function determines the SID of a network address by querying the * security policy. The result is added to the network address table to * speedup future queries. Returns zero on success, negative values on * failure. * */static int sel_netnode_sid_slow(const void *addr, u16 family, u32 *sid){ int ret; struct sel_netnode *node; struct sel_netnode *new;
spin_lock_bh(&sel_netnode_lock); node = sel_netnode_find(addr, family); if (node != NULL) { *sid = node->nsec.sid; spin_unlock_bh(&sel_netnode_lock); return 0; }
/* If this memory allocation fails still return 0. The SID * is valid, it just won't be added to the cache. */ new = kmalloc_obj(*new, GFP_ATOMIC); switch (family) { case PF_INET: ret = security_node_sid(PF_INET, addr, sizeof(struct in_addr), sid); if (new) new->nsec.addr.ipv4 = *(const __be32 *)addr; break; case PF_INET6: ret = security_node_sid(PF_INET6, addr, sizeof(struct in6_addr), sid); if (new) new->nsec.addr.ipv6 = *(const struct in6_addr *)addr; break; default: BUG(); ret = -EINVAL; } if (ret == 0 && new) { new->nsec.family = family; new->nsec.sid = *sid; sel_netnode_insert(new); } else kfree(new);
spin_unlock_bh(&sel_netnode_lock); if (unlikely(ret)) pr_warn("SELinux: failure in %s(), unable to determine network node label\n", __func__); return ret;}
/** * sel_netnode_sid - Lookup the SID of a network address * @addr: the IP address * @family: the address family * @sid: node SID * * Description: * This function determines the SID of a network address using the fastest * method possible. First the address table is queried, but if an entry * can't be found then the policy is queried and the result is added to the * table to speedup future queries. Returns zero on success, negative values * on failure. * */int sel_netnode_sid(const void *addr, u16 family, u32 *sid){ struct sel_netnode *node;
rcu_read_lock(); node = sel_netnode_find(addr, family); if (likely(node != NULL)) { *sid = node->nsec.sid; rcu_read_unlock(); return 0; } rcu_read_unlock();
return sel_netnode_sid_slow(addr, family, sid);}
/** * sel_netnode_flush - Flush the entire network address table * * Description: * Remove all entries from the network address table. * */void sel_netnode_flush(void){ unsigned int idx; struct sel_netnode *node, *node_tmp;
spin_lock_bh(&sel_netnode_lock); for (idx = 0; idx < SEL_NETNODE_HASH_SIZE; idx++) { list_for_each_entry_safe(node, node_tmp, &sel_netnode_hash[idx].list, list) { list_del_rcu(&node->list); kfree_rcu(node, rcu); } sel_netnode_hash[idx].size = 0; } spin_unlock_bh(&sel_netnode_lock);}
int __init sel_netnode_init(void){ int iter;
if (!selinux_enabled_boot) return 0;
for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) { INIT_LIST_HEAD(&sel_netnode_hash[iter].list); sel_netnode_hash[iter].size = 0; }
return 0;}