forked from Minki/linux
NetLabel: add the ranged tag to the CIPSOv4 protocol
Add support for the ranged tag (tag type #5) to the CIPSOv4 protocol. The ranged tag allows for seven, or eight if zero is the lowest category, category ranges to be specified in a CIPSO option. Each range is specified by two unsigned 16 bit fields, each with a maximum value of 65534. The two values specify the start and end of the category range; if the start of the category range is zero then it is omitted. See Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt for more details. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Paul Moore
David S. Miller
parent
654bbc2a2b
commit
484b366932
@ -455,6 +455,10 @@ int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
|
||||
switch (doi_def->tags[iter]) {
|
||||
case CIPSO_V4_TAG_RBITMAP:
|
||||
break;
|
||||
case CIPSO_V4_TAG_RANGE:
|
||||
if (doi_def->type != CIPSO_V4_MAP_PASS)
|
||||
return -EINVAL;
|
||||
break;
|
||||
case CIPSO_V4_TAG_INVALID:
|
||||
if (iter == 0)
|
||||
return -EINVAL;
|
||||
@ -1045,6 +1049,148 @@ static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
|
||||
* @doi_def: the DOI definition
|
||||
* @rngcat: category list
|
||||
* @rngcat_len: length of the category list in bytes
|
||||
*
|
||||
* Description:
|
||||
* Checks the given categories against the given DOI definition and returns a
|
||||
* negative value if any of the categories do not have a valid mapping and a
|
||||
* zero value if all of the categories are valid.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
|
||||
const unsigned char *rngcat,
|
||||
u32 rngcat_len)
|
||||
{
|
||||
u16 cat_high;
|
||||
u16 cat_low;
|
||||
u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
|
||||
u32 iter;
|
||||
|
||||
if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
|
||||
return -EFAULT;
|
||||
|
||||
for (iter = 0; iter < rngcat_len; iter += 4) {
|
||||
cat_high = ntohs(*((__be16 *)&rngcat[iter]));
|
||||
if ((iter + 4) <= rngcat_len)
|
||||
cat_low = ntohs(*((__be16 *)&rngcat[iter + 2]));
|
||||
else
|
||||
cat_low = 0;
|
||||
|
||||
if (cat_high > cat_prev)
|
||||
return -EFAULT;
|
||||
|
||||
cat_prev = cat_low;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
|
||||
* @doi_def: the DOI definition
|
||||
* @secattr: the security attributes
|
||||
* @net_cat: the zero'd out category list in network/CIPSO format
|
||||
* @net_cat_len: the length of the CIPSO category list in bytes
|
||||
*
|
||||
* Description:
|
||||
* Perform a label mapping to translate a local MLS category bitmap to the
|
||||
* correct CIPSO category list using the given DOI definition. Returns the
|
||||
* size in bytes of the network category bitmap on success, negative values
|
||||
* otherwise.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
|
||||
const struct netlbl_lsm_secattr *secattr,
|
||||
unsigned char *net_cat,
|
||||
u32 net_cat_len)
|
||||
{
|
||||
/* The constant '16' is not random, it is the maximum number of
|
||||
* high/low category range pairs as permitted by the CIPSO draft based
|
||||
* on a maximum IPv4 header length of 60 bytes - the BUG_ON() assertion
|
||||
* does a sanity check to make sure we don't overflow the array. */
|
||||
int iter = -1;
|
||||
u16 array[16];
|
||||
u32 array_cnt = 0;
|
||||
u32 cat_size = 0;
|
||||
|
||||
BUG_ON(net_cat_len > 30);
|
||||
|
||||
for (;;) {
|
||||
iter = netlbl_secattr_catmap_walk(secattr->mls_cat, iter + 1);
|
||||
if (iter < 0)
|
||||
break;
|
||||
cat_size += (iter == 0 ? 0 : sizeof(u16));
|
||||
if (cat_size > net_cat_len)
|
||||
return -ENOSPC;
|
||||
array[array_cnt++] = iter;
|
||||
|
||||
iter = netlbl_secattr_catmap_walk_rng(secattr->mls_cat, iter);
|
||||
if (iter < 0)
|
||||
return -EFAULT;
|
||||
cat_size += sizeof(u16);
|
||||
if (cat_size > net_cat_len)
|
||||
return -ENOSPC;
|
||||
array[array_cnt++] = iter;
|
||||
}
|
||||
|
||||
for (iter = 0; array_cnt > 0;) {
|
||||
*((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
|
||||
iter += 2;
|
||||
array_cnt--;
|
||||
if (array[array_cnt] != 0) {
|
||||
*((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
|
||||
iter += 2;
|
||||
}
|
||||
}
|
||||
|
||||
return cat_size;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
|
||||
* @doi_def: the DOI definition
|
||||
* @net_cat: the category list in network/CIPSO format
|
||||
* @net_cat_len: the length of the CIPSO bitmap in bytes
|
||||
* @secattr: the security attributes
|
||||
*
|
||||
* Description:
|
||||
* Perform a label mapping to translate a CIPSO category list to the correct
|
||||
* local MLS category bitmap using the given DOI definition. Returns zero on
|
||||
* success, negative values on failure.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
|
||||
const unsigned char *net_cat,
|
||||
u32 net_cat_len,
|
||||
struct netlbl_lsm_secattr *secattr)
|
||||
{
|
||||
int ret_val;
|
||||
u32 net_iter;
|
||||
u16 cat_low;
|
||||
u16 cat_high;
|
||||
|
||||
for(net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
|
||||
cat_high = ntohs(*((__be16 *)&net_cat[net_iter]));
|
||||
if ((net_iter + 4) <= net_cat_len)
|
||||
cat_low = ntohs(*((__be16 *)&net_cat[net_iter + 2]));
|
||||
else
|
||||
cat_low = 0;
|
||||
|
||||
ret_val = netlbl_secattr_catmap_setrng(secattr->mls_cat,
|
||||
cat_low,
|
||||
cat_high,
|
||||
GFP_ATOMIC);
|
||||
if (ret_val != 0)
|
||||
return ret_val;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Protocol Handling Functions
|
||||
*/
|
||||
@ -1265,6 +1411,98 @@ static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
|
||||
* @doi_def: the DOI definition
|
||||
* @secattr: the security attributes
|
||||
* @buffer: the option buffer
|
||||
* @buffer_len: length of buffer in bytes
|
||||
*
|
||||
* Description:
|
||||
* Generate a CIPSO option using the ranged tag, tag type #5. Returns the
|
||||
* size of the tag on success, negative values on failure.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
|
||||
const struct netlbl_lsm_secattr *secattr,
|
||||
unsigned char *buffer,
|
||||
u32 buffer_len)
|
||||
{
|
||||
int ret_val;
|
||||
u32 tag_len;
|
||||
u32 level;
|
||||
|
||||
if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
|
||||
return -EPERM;
|
||||
|
||||
ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
|
||||
if (ret_val != 0)
|
||||
return ret_val;
|
||||
|
||||
if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
|
||||
ret_val = cipso_v4_map_cat_rng_hton(doi_def,
|
||||
secattr,
|
||||
&buffer[4],
|
||||
buffer_len - 4);
|
||||
if (ret_val < 0)
|
||||
return ret_val;
|
||||
|
||||
tag_len = 4 + ret_val;
|
||||
} else
|
||||
tag_len = 4;
|
||||
|
||||
buffer[0] = 0x05;
|
||||
buffer[1] = tag_len;
|
||||
buffer[3] = level;
|
||||
|
||||
return tag_len;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
|
||||
* @doi_def: the DOI definition
|
||||
* @tag: the CIPSO tag
|
||||
* @secattr: the security attributes
|
||||
*
|
||||
* Description:
|
||||
* Parse a CIPSO ranged tag (tag type #5) and return the security attributes
|
||||
* in @secattr. Return zero on success, negatives values on failure.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
|
||||
const unsigned char *tag,
|
||||
struct netlbl_lsm_secattr *secattr)
|
||||
{
|
||||
int ret_val;
|
||||
u8 tag_len = tag[1];
|
||||
u32 level;
|
||||
|
||||
ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
|
||||
if (ret_val != 0)
|
||||
return ret_val;
|
||||
secattr->mls_lvl = level;
|
||||
secattr->flags |= NETLBL_SECATTR_MLS_LVL;
|
||||
|
||||
if (tag_len > 4) {
|
||||
secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
|
||||
if (secattr->mls_cat == NULL)
|
||||
return -ENOMEM;
|
||||
|
||||
ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
|
||||
&tag[4],
|
||||
tag_len - 4,
|
||||
secattr);
|
||||
if (ret_val != 0) {
|
||||
netlbl_secattr_catmap_free(secattr->mls_cat);
|
||||
return ret_val;
|
||||
}
|
||||
|
||||
secattr->flags |= NETLBL_SECATTR_MLS_CAT;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_validate - Validate a CIPSO option
|
||||
* @option: the start of the option, on error it is set to point to the error
|
||||
@ -1373,6 +1611,25 @@ int cipso_v4_validate(unsigned char **option)
|
||||
goto validate_return_locked;
|
||||
}
|
||||
break;
|
||||
case CIPSO_V4_TAG_RANGE:
|
||||
if (tag_len < 4) {
|
||||
err_offset = opt_iter + 1;
|
||||
goto validate_return_locked;
|
||||
}
|
||||
|
||||
if (cipso_v4_map_lvl_valid(doi_def,
|
||||
tag[3]) < 0) {
|
||||
err_offset = opt_iter + 3;
|
||||
goto validate_return_locked;
|
||||
}
|
||||
if (tag_len > 4 &&
|
||||
cipso_v4_map_cat_rng_valid(doi_def,
|
||||
&tag[4],
|
||||
tag_len - 4) < 0) {
|
||||
err_offset = opt_iter + 4;
|
||||
goto validate_return_locked;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
err_offset = opt_iter;
|
||||
goto validate_return_locked;
|
||||
@ -1492,6 +1749,12 @@ int cipso_v4_socket_setattr(const struct socket *sock,
|
||||
&buf[CIPSO_V4_HDR_LEN],
|
||||
buf_len - CIPSO_V4_HDR_LEN);
|
||||
break;
|
||||
case CIPSO_V4_TAG_RANGE:
|
||||
ret_val = cipso_v4_gentag_rng(doi_def,
|
||||
secattr,
|
||||
&buf[CIPSO_V4_HDR_LEN],
|
||||
buf_len - CIPSO_V4_HDR_LEN);
|
||||
break;
|
||||
default:
|
||||
ret_val = -EPERM;
|
||||
goto socket_setattr_failure;
|
||||
@ -1593,6 +1856,11 @@ int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
|
||||
&cipso_ptr[6],
|
||||
secattr);
|
||||
break;
|
||||
case CIPSO_V4_TAG_RANGE:
|
||||
ret_val = cipso_v4_parsetag_rng(doi_def,
|
||||
&cipso_ptr[6],
|
||||
secattr);
|
||||
break;
|
||||
}
|
||||
rcu_read_unlock();
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user