Commit | Line | Data |
---|---|---|
5b497af4 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
224dfbd8 PM |
2 | /* |
3 | * Network node table | |
4 | * | |
5 | * SELinux must keep a mapping of network nodes to labels/SIDs. This | |
6 | * mapping is maintained as part of the normal policy but a fast cache is | |
7 | * needed to reduce the lookup overhead since most of these queries happen on | |
8 | * a per-packet basis. | |
9 | * | |
82c21bfa | 10 | * Author: Paul Moore <paul@paul-moore.com> |
224dfbd8 PM |
11 | * |
12 | * This code is heavily based on the "netif" concept originally developed by | |
13 | * James Morris <jmorris@redhat.com> | |
14 | * (see security/selinux/netif.c for more information) | |
224dfbd8 PM |
15 | */ |
16 | ||
17 | /* | |
18 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2007 | |
224dfbd8 PM |
19 | */ |
20 | ||
21 | #include <linux/types.h> | |
22 | #include <linux/rcupdate.h> | |
23 | #include <linux/list.h> | |
5a0e3ad6 | 24 | #include <linux/slab.h> |
224dfbd8 PM |
25 | #include <linux/spinlock.h> |
26 | #include <linux/in.h> | |
27 | #include <linux/in6.h> | |
28 | #include <linux/ip.h> | |
29 | #include <linux/ipv6.h> | |
30 | #include <net/ip.h> | |
31 | #include <net/ipv6.h> | |
224dfbd8 | 32 | |
a639e7ca | 33 | #include "netnode.h" |
224dfbd8 PM |
34 | #include "objsec.h" |
35 | ||
36 | #define SEL_NETNODE_HASH_SIZE 256 | |
37 | #define SEL_NETNODE_HASH_BKT_LIMIT 16 | |
38 | ||
a639e7ca PM |
39 | struct sel_netnode_bkt { |
40 | unsigned int size; | |
41 | struct list_head list; | |
42 | }; | |
43 | ||
224dfbd8 PM |
44 | struct sel_netnode { |
45 | struct netnode_security_struct nsec; | |
46 | ||
47 | struct list_head list; | |
48 | struct rcu_head rcu; | |
49 | }; | |
50 | ||
51 | /* NOTE: we are using a combined hash table for both IPv4 and IPv6, the reason | |
52 | * for this is that I suspect most users will not make heavy use of both | |
53 | * address families at the same time so one table will usually end up wasted, | |
54 | * if this becomes a problem we can always add a hash table for each address | |
55 | * family later */ | |
56 | ||
224dfbd8 | 57 | static DEFINE_SPINLOCK(sel_netnode_lock); |
a639e7ca | 58 | static struct sel_netnode_bkt sel_netnode_hash[SEL_NETNODE_HASH_SIZE]; |
224dfbd8 | 59 | |
224dfbd8 PM |
60 | /** |
61 | * sel_netnode_hashfn_ipv4 - IPv4 hashing function for the node table | |
62 | * @addr: IPv4 address | |
63 | * | |
64 | * Description: | |
65 | * This is the IPv4 hashing function for the node interface table, it returns | |
66 | * the bucket number for the given IP address. | |
67 | * | |
68 | */ | |
a639e7ca | 69 | static unsigned int sel_netnode_hashfn_ipv4(__be32 addr) |
224dfbd8 PM |
70 | { |
71 | /* at some point we should determine if the mismatch in byte order | |
72 | * affects the hash function dramatically */ | |
73 | return (addr & (SEL_NETNODE_HASH_SIZE - 1)); | |
74 | } | |
75 | ||
76 | /** | |
77 | * sel_netnode_hashfn_ipv6 - IPv6 hashing function for the node table | |
78 | * @addr: IPv6 address | |
79 | * | |
80 | * Description: | |
81 | * This is the IPv6 hashing function for the node interface table, it returns | |
82 | * the bucket number for the given IP address. | |
83 | * | |
84 | */ | |
a639e7ca | 85 | static unsigned int sel_netnode_hashfn_ipv6(const struct in6_addr *addr) |
224dfbd8 PM |
86 | { |
87 | /* just hash the least significant 32 bits to keep things fast (they | |
88 | * are the most likely to be different anyway), we can revisit this | |
89 | * later if needed */ | |
90 | return (addr->s6_addr32[3] & (SEL_NETNODE_HASH_SIZE - 1)); | |
91 | } | |
92 | ||
93 | /** | |
94 | * sel_netnode_find - Search for a node record | |
95 | * @addr: IP address | |
96 | * @family: address family | |
97 | * | |
98 | * Description: | |
99 | * Search the network node table and return the record matching @addr. If an | |
100 | * entry can not be found in the table return NULL. | |
101 | * | |
102 | */ | |
103 | static struct sel_netnode *sel_netnode_find(const void *addr, u16 family) | |
104 | { | |
a639e7ca | 105 | unsigned int idx; |
224dfbd8 PM |
106 | struct sel_netnode *node; |
107 | ||
108 | switch (family) { | |
109 | case PF_INET: | |
73073d95 | 110 | idx = sel_netnode_hashfn_ipv4(*(const __be32 *)addr); |
224dfbd8 PM |
111 | break; |
112 | case PF_INET6: | |
113 | idx = sel_netnode_hashfn_ipv6(addr); | |
114 | break; | |
115 | default: | |
116 | BUG(); | |
a35c6c83 | 117 | return NULL; |
224dfbd8 PM |
118 | } |
119 | ||
a639e7ca | 120 | list_for_each_entry_rcu(node, &sel_netnode_hash[idx].list, list) |
224dfbd8 PM |
121 | if (node->nsec.family == family) |
122 | switch (family) { | |
123 | case PF_INET: | |
73073d95 | 124 | if (node->nsec.addr.ipv4 == *(const __be32 *)addr) |
224dfbd8 PM |
125 | return node; |
126 | break; | |
127 | case PF_INET6: | |
128 | if (ipv6_addr_equal(&node->nsec.addr.ipv6, | |
129 | addr)) | |
130 | return node; | |
131 | break; | |
132 | } | |
133 | ||
134 | return NULL; | |
135 | } | |
136 | ||
137 | /** | |
138 | * sel_netnode_insert - Insert a new node into the table | |
139 | * @node: the new node record | |
140 | * | |
141 | * Description: | |
a639e7ca | 142 | * Add a new node record to the network address hash table. |
224dfbd8 PM |
143 | * |
144 | */ | |
a639e7ca | 145 | static void sel_netnode_insert(struct sel_netnode *node) |
224dfbd8 | 146 | { |
a639e7ca | 147 | unsigned int idx; |
224dfbd8 PM |
148 | |
149 | switch (node->nsec.family) { | |
150 | case PF_INET: | |
151 | idx = sel_netnode_hashfn_ipv4(node->nsec.addr.ipv4); | |
152 | break; | |
153 | case PF_INET6: | |
154 | idx = sel_netnode_hashfn_ipv6(&node->nsec.addr.ipv6); | |
155 | break; | |
156 | default: | |
157 | BUG(); | |
b04eea88 | 158 | return; |
224dfbd8 | 159 | } |
a639e7ca | 160 | |
224dfbd8 PM |
161 | /* we need to impose a limit on the growth of the hash table so check |
162 | * this bucket to make sure it is within the specified bounds */ | |
a639e7ca PM |
163 | list_add_rcu(&node->list, &sel_netnode_hash[idx].list); |
164 | if (sel_netnode_hash[idx].size == SEL_NETNODE_HASH_BKT_LIMIT) { | |
165 | struct sel_netnode *tail; | |
166 | tail = list_entry( | |
0e326df0 PM |
167 | rcu_dereference_protected( |
168 | list_tail_rcu(&sel_netnode_hash[idx].list), | |
169 | lockdep_is_held(&sel_netnode_lock)), | |
a639e7ca PM |
170 | struct sel_netnode, list); |
171 | list_del_rcu(&tail->list); | |
9801c60e | 172 | kfree_rcu(tail, rcu); |
a639e7ca PM |
173 | } else |
174 | sel_netnode_hash[idx].size++; | |
224dfbd8 PM |
175 | } |
176 | ||
177 | /** | |
178 | * sel_netnode_sid_slow - Lookup the SID of a network address using the policy | |
179 | * @addr: the IP address | |
180 | * @family: the address family | |
181 | * @sid: node SID | |
182 | * | |
183 | * Description: | |
2c3d8dfe | 184 | * This function determines the SID of a network address by querying the |
224dfbd8 PM |
185 | * security policy. The result is added to the network address table to |
186 | * speedup future queries. Returns zero on success, negative values on | |
187 | * failure. | |
188 | * | |
189 | */ | |
190 | static int sel_netnode_sid_slow(void *addr, u16 family, u32 *sid) | |
191 | { | |
9b80c363 | 192 | int ret; |
224dfbd8 | 193 | struct sel_netnode *node; |
9b80c363 | 194 | struct sel_netnode *new; |
224dfbd8 PM |
195 | |
196 | spin_lock_bh(&sel_netnode_lock); | |
197 | node = sel_netnode_find(addr, family); | |
198 | if (node != NULL) { | |
199 | *sid = node->nsec.sid; | |
a639e7ca PM |
200 | spin_unlock_bh(&sel_netnode_lock); |
201 | return 0; | |
224dfbd8 | 202 | } |
9b80c363 | 203 | |
224dfbd8 | 204 | new = kzalloc(sizeof(*new), GFP_ATOMIC); |
224dfbd8 PM |
205 | switch (family) { |
206 | case PF_INET: | |
e67b7985 | 207 | ret = security_node_sid(PF_INET, |
a639e7ca | 208 | addr, sizeof(struct in_addr), sid); |
9b80c363 PM |
209 | if (new) |
210 | new->nsec.addr.ipv4 = *(__be32 *)addr; | |
224dfbd8 PM |
211 | break; |
212 | case PF_INET6: | |
e67b7985 | 213 | ret = security_node_sid(PF_INET6, |
a639e7ca | 214 | addr, sizeof(struct in6_addr), sid); |
9b80c363 PM |
215 | if (new) |
216 | new->nsec.addr.ipv6 = *(struct in6_addr *)addr; | |
224dfbd8 PM |
217 | break; |
218 | default: | |
219 | BUG(); | |
b04eea88 | 220 | ret = -EINVAL; |
224dfbd8 | 221 | } |
9b80c363 PM |
222 | if (ret == 0 && new) { |
223 | new->nsec.family = family; | |
224 | new->nsec.sid = *sid; | |
225 | sel_netnode_insert(new); | |
226 | } else | |
227 | kfree(new); | |
224dfbd8 | 228 | |
224dfbd8 | 229 | spin_unlock_bh(&sel_netnode_lock); |
9b80c363 | 230 | if (unlikely(ret)) |
67b0b4e4 | 231 | pr_warn("SELinux: failure in %s(), unable to determine network node label\n", |
232 | __func__); | |
224dfbd8 PM |
233 | return ret; |
234 | } | |
235 | ||
236 | /** | |
237 | * sel_netnode_sid - Lookup the SID of a network address | |
238 | * @addr: the IP address | |
239 | * @family: the address family | |
240 | * @sid: node SID | |
241 | * | |
242 | * Description: | |
243 | * This function determines the SID of a network address using the fastest | |
244 | * method possible. First the address table is queried, but if an entry | |
245 | * can't be found then the policy is queried and the result is added to the | |
246 | * table to speedup future queries. Returns zero on success, negative values | |
247 | * on failure. | |
248 | * | |
249 | */ | |
250 | int sel_netnode_sid(void *addr, u16 family, u32 *sid) | |
251 | { | |
252 | struct sel_netnode *node; | |
253 | ||
254 | rcu_read_lock(); | |
255 | node = sel_netnode_find(addr, family); | |
256 | if (node != NULL) { | |
257 | *sid = node->nsec.sid; | |
258 | rcu_read_unlock(); | |
259 | return 0; | |
260 | } | |
261 | rcu_read_unlock(); | |
262 | ||
263 | return sel_netnode_sid_slow(addr, family, sid); | |
264 | } | |
265 | ||
266 | /** | |
267 | * sel_netnode_flush - Flush the entire network address table | |
268 | * | |
269 | * Description: | |
270 | * Remove all entries from the network address table. | |
271 | * | |
272 | */ | |
615e51fd | 273 | void sel_netnode_flush(void) |
224dfbd8 | 274 | { |
a639e7ca PM |
275 | unsigned int idx; |
276 | struct sel_netnode *node, *node_tmp; | |
224dfbd8 PM |
277 | |
278 | spin_lock_bh(&sel_netnode_lock); | |
a639e7ca PM |
279 | for (idx = 0; idx < SEL_NETNODE_HASH_SIZE; idx++) { |
280 | list_for_each_entry_safe(node, node_tmp, | |
281 | &sel_netnode_hash[idx].list, list) { | |
282 | list_del_rcu(&node->list); | |
9801c60e | 283 | kfree_rcu(node, rcu); |
a639e7ca PM |
284 | } |
285 | sel_netnode_hash[idx].size = 0; | |
286 | } | |
224dfbd8 PM |
287 | spin_unlock_bh(&sel_netnode_lock); |
288 | } | |
289 | ||
224dfbd8 PM |
290 | static __init int sel_netnode_init(void) |
291 | { | |
292 | int iter; | |
224dfbd8 | 293 | |
6c5a682e | 294 | if (!selinux_enabled_boot) |
224dfbd8 PM |
295 | return 0; |
296 | ||
a639e7ca PM |
297 | for (iter = 0; iter < SEL_NETNODE_HASH_SIZE; iter++) { |
298 | INIT_LIST_HEAD(&sel_netnode_hash[iter].list); | |
299 | sel_netnode_hash[iter].size = 0; | |
300 | } | |
224dfbd8 | 301 | |
942ba364 | 302 | return 0; |
224dfbd8 PM |
303 | } |
304 | ||
305 | __initcall(sel_netnode_init); |