netnode.c 8.67 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
/*
 * Network node table
 *
 * SELinux must keep a mapping of network nodes to labels/SIDs.  This
 * mapping is maintained as part of the normal policy but a fast cache is
 * needed to reduce the lookup overhead since most of these queries happen on
 * a per-packet basis.
 *
 * Author: Paul Moore <paul.moore@hp.com>
 *
 * This code is heavily based on the "netif" concept originally developed by
 * James Morris <jmorris@redhat.com>
 *   (see security/selinux/netif.c for more information)
 *
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2007
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 */

#include <linux/types.h>
#include <linux/rcupdate.h>
#include <linux/list.h>
34
#include <linux/slab.h>
35
36
37
38
39
40
41
42
#include <linux/spinlock.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <net/ip.h>
#include <net/ipv6.h>

43
#include "netnode.h"
44
45
46
47
48
#include "objsec.h"

#define SEL_NETNODE_HASH_SIZE       256
#define SEL_NETNODE_HASH_BKT_LIMIT   16

49
50
51
52
53
struct sel_netnode_bkt {
	unsigned int size;
	struct list_head list;
};

54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
struct sel_netnode {
	struct netnode_security_struct nsec;

	struct list_head list;
	struct rcu_head rcu;
};

/* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason
 * for this is that I suspect most users will not make heavy use of both
 * address families at the same time so one table will usually end up wasted,
 * if this becomes a problem we can always add a hash table for each address
 * family later */

static LIST_HEAD(sel_netnode_list);
static DEFINE_SPINLOCK(sel_netnode_lock);
69
static struct sel_netnode_bkt sel_netnode_hash[SEL_NETNODE_HASH_SIZE];
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

/**
 * sel_netnode_free - Frees a node entry
 * @p: the entry's RCU field
 *
 * Description:
 * This function is designed to be used as a callback to the call_rcu()
 * function so that memory allocated to a hash table node entry can be
 * released safely.
 *
 */
static void sel_netnode_free(struct rcu_head *p)
{
	struct sel_netnode *node = container_of(p, struct sel_netnode, rcu);
	kfree(node);
}

/**
 * sel_netnode_hashfn_ipv4 - IPv4 hashing function for the node table
 * @addr: IPv4 address
 *
 * Description:
 * This is the IPv4 hashing function for the node interface table, it returns
 * the bucket number for the given IP address.
 *
 */
96
static unsigned int sel_netnode_hashfn_ipv4(__be32 addr)
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
{
	/* at some point we should determine if the mismatch in byte order
	 * affects the hash function dramatically */
	return (addr & (SEL_NETNODE_HASH_SIZE - 1));
}

/**
 * sel_netnode_hashfn_ipv6 - IPv6 hashing function for the node table
 * @addr: IPv6 address
 *
 * Description:
 * This is the IPv6 hashing function for the node interface table, it returns
 * the bucket number for the given IP address.
 *
 */
112
static unsigned int sel_netnode_hashfn_ipv6(const struct in6_addr *addr)
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
{
	/* just hash the least significant 32 bits to keep things fast (they
	 * are the most likely to be different anyway), we can revisit this
	 * later if needed */
	return (addr->s6_addr32[3] & (SEL_NETNODE_HASH_SIZE - 1));
}

/**
 * sel_netnode_find - Search for a node record
 * @addr: IP address
 * @family: address family
 *
 * Description:
 * Search the network node table and return the record matching @addr.  If an
 * entry can not be found in the table return NULL.
 *
 */
static struct sel_netnode *sel_netnode_find(const void *addr, u16 family)
{
132
	unsigned int idx;
133
134
135
136
137
138
139
140
141
142
143
144
145
	struct sel_netnode *node;

	switch (family) {
	case PF_INET:
		idx = sel_netnode_hashfn_ipv4(*(__be32 *)addr);
		break;
	case PF_INET6:
		idx = sel_netnode_hashfn_ipv6(addr);
		break;
	default:
		BUG();
	}

146
	list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list)
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
		if (node->nsec.family == family)
			switch (family) {
			case PF_INET:
				if (node->nsec.addr.ipv4 == *(__be32 *)addr)
					return node;
				break;
			case PF_INET6:
				if (ipv6_addr_equal(&node->nsec.addr.ipv6,
						    addr))
					return node;
				break;
			}

	return NULL;
}

/**
 * sel_netnode_insert - Insert a new node into the table
 * @node: the new node record
 *
 * Description:
168
 * Add a new node record to the network address hash table.
169
170
 *
 */
171
static void sel_netnode_insert(struct sel_netnode *node)
172
{
173
	unsigned int idx;
174
175
176
177
178
179
180
181
182
183
184

	switch (node->nsec.family) {
	case PF_INET:
		idx = sel_netnode_hashfn_ipv4(node->nsec.addr.ipv4);
		break;
	case PF_INET6:
		idx = sel_netnode_hashfn_ipv6(&node->nsec.addr.ipv6);
		break;
	default:
		BUG();
	}
185

186
187
	/* we need to impose a limit on the growth of the hash table so check
	 * this bucket to make sure it is within the specified bounds */
188
189
190
191
192
193
194
195
196
197
	list_add_rcu(&node->list, &sel_netnode_hash[idx].list);
	if (sel_netnode_hash[idx].size == SEL_NETNODE_HASH_BKT_LIMIT) {
		struct sel_netnode *tail;
		tail = list_entry(
			rcu_dereference(sel_netnode_hash[idx].list.prev),
			struct sel_netnode, list);
		list_del_rcu(&tail->list);
		call_rcu(&tail->rcu, sel_netnode_free);
	} else
		sel_netnode_hash[idx].size++;
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
}

/**
 * sel_netnode_sid_slow - Lookup the SID of a network address using the policy
 * @addr: the IP address
 * @family: the address family
 * @sid: node SID
 *
 * Description:
 * This function determines the SID of a network address by quering the
 * security policy.  The result is added to the network address table to
 * speedup future queries.  Returns zero on success, negative values on
 * failure.
 *
 */
static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid)
{
215
	int ret = -ENOMEM;
216
217
218
219
220
221
222
	struct sel_netnode *node;
	struct sel_netnode *new = NULL;

	spin_lock_bh(&sel_netnode_lock);
	node = sel_netnode_find(addr, family);
	if (node != NULL) {
		*sid = node->nsec.sid;
223
224
		spin_unlock_bh(&sel_netnode_lock);
		return 0;
225
226
	}
	new = kzalloc(sizeof(*new), GFP_ATOMIC);
227
	if (new == NULL)
228
229
230
231
		goto out;
	switch (family) {
	case PF_INET:
		ret = security_node_sid(PF_INET,
232
					addr, sizeof(struct in_addr), sid);
233
234
235
236
		new->nsec.addr.ipv4 = *(__be32 *)addr;
		break;
	case PF_INET6:
		ret = security_node_sid(PF_INET6,
237
					addr, sizeof(struct in6_addr), sid);
238
239
240
241
242
243
244
		ipv6_addr_copy(&new->nsec.addr.ipv6, addr);
		break;
	default:
		BUG();
	}
	if (ret != 0)
		goto out;
245

246
	new->nsec.family = family;
247
248
	new->nsec.sid = *sid;
	sel_netnode_insert(new);
249
250
251

out:
	spin_unlock_bh(&sel_netnode_lock);
252
253
254
255
	if (unlikely(ret)) {
		printk(KERN_WARNING
		       "SELinux: failure in sel_netnode_sid_slow(),"
		       " unable to determine network node label\n");
256
		kfree(new);
257
	}
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
	return ret;
}

/**
 * sel_netnode_sid - Lookup the SID of a network address
 * @addr: the IP address
 * @family: the address family
 * @sid: node SID
 *
 * Description:
 * This function determines the SID of a network address using the fastest
 * method possible.  First the address table is queried, but if an entry
 * can't be found then the policy is queried and the result is added to the
 * table to speedup future queries.  Returns zero on success, negative values
 * on failure.
 *
 */
int sel_netnode_sid(void *addr, u16 family, u32 *sid)
{
	struct sel_netnode *node;

	rcu_read_lock();
	node = sel_netnode_find(addr, family);
	if (node != NULL) {
		*sid = node->nsec.sid;
		rcu_read_unlock();
		return 0;
	}
	rcu_read_unlock();

	return sel_netnode_sid_slow(addr, family, sid);
}

/**
 * sel_netnode_flush - Flush the entire network address table
 *
 * Description:
 * Remove all entries from the network address table.
 *
 */
static void sel_netnode_flush(void)
{
300
301
	unsigned int idx;
	struct sel_netnode *node, *node_tmp;
302
303

	spin_lock_bh(&sel_netnode_lock);
304
305
306
307
308
309
310
311
	for (idx = 0; idx < SEL_NETNODE_HASH_SIZE; idx++) {
		list_for_each_entry_safe(node, node_tmp,
					 &sel_netnode_hash[idx].list, list) {
				list_del_rcu(&node->list);
				call_rcu(&node->rcu, sel_netnode_free);
		}
		sel_netnode_hash[idx].size = 0;
	}
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
	spin_unlock_bh(&sel_netnode_lock);
}

static int sel_netnode_avc_callback(u32 event, u32 ssid, u32 tsid,
				    u16 class, u32 perms, u32 *retained)
{
	if (event == AVC_CALLBACK_RESET) {
		sel_netnode_flush();
		synchronize_net();
	}
	return 0;
}

static __init int sel_netnode_init(void)
{
	int iter;
	int ret;

	if (!selinux_enabled)
		return 0;

333
334
335
336
	for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) {
		INIT_LIST_HEAD(&sel_netnode_hash[iter].list);
		sel_netnode_hash[iter].size = 0;
	}
337
338

	ret = avc_add_callback(sel_netnode_avc_callback, AVC_CALLBACK_RESET,
339
			       SECSID_NULL, SECSID_NULL, SECCLASS_NULL, 0);
340
341
342
343
344
345
346
	if (ret != 0)
		panic("avc_add_callback() failed, error %d\n", ret);

	return ret;
}

__initcall(sel_netnode_init);