net/netlabel/netlabel_domainhash.c

   1 /*
   2  * NetLabel Domain Hash Table
   3  *
   4  * This file manages the domain hash table that NetLabel uses to determine
   5  * which network labeling protocol to use for a given domain.  The NetLabel
   6  * system manages static and dynamic label mappings for network protocols such
   7  * as CIPSO and RIPSO.
   8  *
   9  * Author: Paul Moore <paul.moore@hp.com>
  10  *
  11  */
  12
  13 /*
  14  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  15  *
  16  * This program is free software;  you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License as published by
  18  * the Free Software Foundation; either version 2 of the License, or
  19  * (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  24  * the GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program;  if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  29  *
  30  */
  31
  32 #include <linux/types.h>
  33 #include <linux/rculist.h>
  34 #include <linux/skbuff.h>
  35 #include <linux/spinlock.h>
  36 #include <linux/string.h>
  37 #include <linux/audit.h>
  38 #include <net/netlabel.h>
  39 #include <net/cipso_ipv4.h>
  40 #include <asm/bug.h>
  41
  42 #include "netlabel_mgmt.h"
  43 #include "netlabel_domainhash.h"
  44 #include "netlabel_user.h"
  45
  46 struct netlbl_domhsh_tbl {
  47         struct list_head *tbl;
  48         u32 size;
  49 };
  50
  51 /* Domain hash table */
  52 /* XXX - updates should be so rare that having one spinlock for the entire
  53  * hash table should be okay */
  54 static DEFINE_SPINLOCK(netlbl_domhsh_lock);
  55 static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
  56 static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
  57
  58 /*
  59  * Domain Hash Table Helper Functions
  60  */
  61
  62 /**
  63  * netlbl_domhsh_free_entry - Frees a domain hash table entry
  64  * @entry: the entry's RCU field
  65  *
  66  * Description:
  67  * This function is designed to be used as a callback to the call_rcu()
  68  * function so that the memory allocated to a hash table entry can be released
  69  * safely.
  70  *
  71  */
  72 static void netlbl_domhsh_free_entry(struct rcu_head *entry)
  73 {
  74         struct netlbl_dom_map *ptr;
  75
  76         ptr = container_of(entry, struct netlbl_dom_map, rcu);
  77         kfree(ptr->domain);
  78         kfree(ptr);
  79 }
  80
  81 /**
  82  * netlbl_domhsh_hash - Hashing function for the domain hash table
  83  * @domain: the domain name to hash
  84  *
  85  * Description:
  86  * This is the hashing function for the domain hash table, it returns the
  87  * correct bucket number for the domain.  The caller is responsibile for
  88  * calling the rcu_read_[un]lock() functions.
  89  *
  90  */
  91 static u32 netlbl_domhsh_hash(const char *key)
  92 {
  93         u32 iter;
  94         u32 val;
  95         u32 len;
  96
  97         /* This is taken (with slight modification) from
  98          * security/selinux/ss/symtab.c:symhash() */
  99
 100         for (iter = 0, val = 0, len = strlen(key); iter < len; iter++)
 101                 val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];
 102         return val & (rcu_dereference(netlbl_domhsh)->size - 1);
 103 }
 104
 105 /**
 106  * netlbl_domhsh_search - Search for a domain entry
 107  * @domain: the domain
 108  *
 109  * Description:
 110  * Searches the domain hash table and returns a pointer to the hash table
 111  * entry if found, otherwise NULL is returned.  The caller is responsibile for
 112  * the rcu hash table locks (i.e. the caller much call rcu_read_[un]lock()).
 113  *
 114  */
 115 static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain)
 116 {
 117         u32 bkt;
 118         struct netlbl_dom_map *iter;
 119
 120         if (domain != NULL) {
 121                 bkt = netlbl_domhsh_hash(domain);
 122                 list_for_each_entry_rcu(iter,
 123                                      &rcu_dereference(netlbl_domhsh)->tbl[bkt],
 124                                      list)
 125                         if (iter->valid && strcmp(iter->domain, domain) == 0)
 126                                 return iter;
 127         }
 128
 129         return NULL;
 130 }
 131
 132 /**
 133  * netlbl_domhsh_search_def - Search for a domain entry
 134  * @domain: the domain
 135  * @def: return default if no match is found
 136  *
 137  * Description:
 138  * Searches the domain hash table and returns a pointer to the hash table
 139  * entry if an exact match is found, if an exact match is not present in the
 140  * hash table then the default entry is returned if valid otherwise NULL is
 141  * returned.  The caller is responsibile for the rcu hash table locks
 142  * (i.e. the caller much call rcu_read_[un]lock()).
 143  *
 144  */
 145 static struct netlbl_dom_map *netlbl_domhsh_search_def(const char *domain)
 146 {
 147         struct netlbl_dom_map *entry;
 148
 149         entry = netlbl_domhsh_search(domain);
 150         if (entry == NULL) {
 151                 entry = rcu_dereference(netlbl_domhsh_def);
 152                 if (entry != NULL && !entry->valid)
 153                         entry = NULL;
 154         }
 155
 156         return entry;
 157 }
 158
 159 /*
 160  * Domain Hash Table Functions
 161  */
 162
 163 /**
 164  * netlbl_domhsh_init - Init for the domain hash
 165  * @size: the number of bits to use for the hash buckets
 166  *
 167  * Description:
 168  * Initializes the domain hash table, should be called only by
 169  * netlbl_user_init() during initialization.  Returns zero on success, non-zero
 170  * values on error.
 171  *
 172  */
 173 int __init netlbl_domhsh_init(u32 size)
 174 {
 175         u32 iter;
 176         struct netlbl_domhsh_tbl *hsh_tbl;
 177
 178         if (size == 0)
 179                 return -EINVAL;
 180
 181         hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
 182         if (hsh_tbl == NULL)
 183                 return -ENOMEM;
 184         hsh_tbl->size = 1 << size;
 185         hsh_tbl->tbl = kcalloc(hsh_tbl->size,
 186                                sizeof(struct list_head),
 187                                GFP_KERNEL);
 188         if (hsh_tbl->tbl == NULL) {
 189                 kfree(hsh_tbl);
 190                 return -ENOMEM;
 191         }
 192         for (iter = 0; iter < hsh_tbl->size; iter++)
 193                 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
 194
 195         spin_lock(&netlbl_domhsh_lock);
 196         rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
 197         spin_unlock(&netlbl_domhsh_lock);
 198
 199         return 0;
 200 }
 201
 202 /**
 203  * netlbl_domhsh_add - Adds a entry to the domain hash table
 204  * @entry: the entry to add
 205  * @audit_info: NetLabel audit information
 206  *
 207  * Description:
 208  * Adds a new entry to the domain hash table and handles any updates to the
 209  * lower level protocol handler (i.e. CIPSO).  Returns zero on success,
 210  * negative on failure.
 211  *
 212  */
 213 int netlbl_domhsh_add(struct netlbl_dom_map *entry,
 214                       struct netlbl_audit *audit_info)
 215 {
 216         int ret_val;
 217         u32 bkt;
 218         struct audit_buffer *audit_buf;
 219
 220         switch (entry->type) {
 221         case NETLBL_NLTYPE_UNLABELED:
 222                 ret_val = 0;
 223                 break;
 224         case NETLBL_NLTYPE_CIPSOV4:
 225                 ret_val = cipso_v4_doi_domhsh_add(entry->type_def.cipsov4,
 226                                                   entry->domain);
 227                 break;
 228         default:
 229                 return -EINVAL;
 230         }
 231         if (ret_val != 0)
 232                 return ret_val;
 233
 234         entry->valid = 1;
 235         INIT_RCU_HEAD(&entry->rcu);
 236
 237         rcu_read_lock();
 238         spin_lock(&netlbl_domhsh_lock);
 239         if (entry->domain != NULL) {
 240                 bkt = netlbl_domhsh_hash(entry->domain);
 241                 if (netlbl_domhsh_search(entry->domain) == NULL)
 242                         list_add_tail_rcu(&entry->list,
 243                                     &rcu_dereference(netlbl_domhsh)->tbl[bkt]);
 244                 else
 245                         ret_val = -EEXIST;
 246         } else {
 247                 INIT_LIST_HEAD(&entry->list);
 248                 if (rcu_dereference(netlbl_domhsh_def) == NULL)
 249                         rcu_assign_pointer(netlbl_domhsh_def, entry);
 250                 else
 251                         ret_val = -EEXIST;
 252         }
 253         spin_unlock(&netlbl_domhsh_lock);
 254         audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info);
 255         if (audit_buf != NULL) {
 256                 audit_log_format(audit_buf,
 257                                  " nlbl_domain=%s",
 258                                  entry->domain ? entry->domain : "(default)");
 259                 switch (entry->type) {
 260                 case NETLBL_NLTYPE_UNLABELED:
 261                         audit_log_format(audit_buf, " nlbl_protocol=unlbl");
 262                         break;
 263                 case NETLBL_NLTYPE_CIPSOV4:
 264                         audit_log_format(audit_buf,
 265                                          " nlbl_protocol=cipsov4 cipso_doi=%u",
 266                                          entry->type_def.cipsov4->doi);
 267                         break;
 268                 }
 269                 audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
 270                 audit_log_end(audit_buf);
 271         }
 272         rcu_read_unlock();
 273
 274         if (ret_val != 0) {
 275                 switch (entry->type) {
 276                 case NETLBL_NLTYPE_CIPSOV4:
 277                         if (cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
 278                                                        entry->domain) != 0)
 279                                 BUG();
 280                         break;
 281                 }
 282         }
 283
 284         return ret_val;
 285 }
 286
 287 /**
 288  * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
 289  * @entry: the entry to add
 290  * @audit_info: NetLabel audit information
 291  *
 292  * Description:
 293  * Adds a new default entry to the domain hash table and handles any updates
 294  * to the lower level protocol handler (i.e. CIPSO).  Returns zero on success,
 295  * negative on failure.
 296  *
 297  */
 298 int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,
 299                               struct netlbl_audit *audit_info)
 300 {
 301         return netlbl_domhsh_add(entry, audit_info);
 302 }
 303
 304 /**
 305  * netlbl_domhsh_remove - Removes an entry from the domain hash table
 306  * @domain: the domain to remove
 307  * @audit_info: NetLabel audit information
 308  *
 309  * Description:
 310  * Removes an entry from the domain hash table and handles any updates to the
 311  * lower level protocol handler (i.e. CIPSO).  Returns zero on success,
 312  * negative on failure.
 313  *
 314  */
 315 int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info)
 316 {
 317         int ret_val = -ENOENT;
 318         struct netlbl_dom_map *entry;
 319         struct audit_buffer *audit_buf;
 320
 321         rcu_read_lock();
 322         if (domain)
 323                 entry = netlbl_domhsh_search(domain);
 324         else
 325                 entry = netlbl_domhsh_search_def(domain);
 326         if (entry == NULL)
 327                 goto remove_return;
 328         switch (entry->type) {
 329         case NETLBL_NLTYPE_CIPSOV4:
 330                 cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
 331                                            entry->domain);
 332                 break;
 333         }
 334         spin_lock(&netlbl_domhsh_lock);
 335         if (entry->valid) {
 336                 entry->valid = 0;
 337                 if (entry != rcu_dereference(netlbl_domhsh_def))
 338                         list_del_rcu(&entry->list);
 339                 else
 340                         rcu_assign_pointer(netlbl_domhsh_def, NULL);
 341                 ret_val = 0;
 342         }
 343         spin_unlock(&netlbl_domhsh_lock);
 344
 345         audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
 346         if (audit_buf != NULL) {
 347                 audit_log_format(audit_buf,
 348                                  " nlbl_domain=%s res=%u",
 349                                  entry->domain ? entry->domain : "(default)",
 350                                  ret_val == 0 ? 1 : 0);
 351                 audit_log_end(audit_buf);
 352         }
 353
 354 remove_return:
 355         rcu_read_unlock();
 356         if (ret_val == 0)
 357                 call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
 358         return ret_val;
 359 }
 360
 361 /**
 362  * netlbl_domhsh_remove_default - Removes the default entry from the table
 363  * @audit_info: NetLabel audit information
 364  *
 365  * Description:
 366  * Removes/resets the default entry for the domain hash table and handles any
 367  * updates to the lower level protocol handler (i.e. CIPSO).  Returns zero on
 368  * success, non-zero on failure.
 369  *
 370  */
 371 int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info)
 372 {
 373         return netlbl_domhsh_remove(NULL, audit_info);
 374 }
 375
 376 /**
 377  * netlbl_domhsh_getentry - Get an entry from the domain hash table
 378  * @domain: the domain name to search for
 379  *
 380  * Description:
 381  * Look through the domain hash table searching for an entry to match @domain,
 382  * return a pointer to a copy of the entry or NULL.  The caller is responsibile
 383  * for ensuring that rcu_read_[un]lock() is called.
 384  *
 385  */
 386 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
 387 {
 388         return netlbl_domhsh_search_def(domain);
 389 }
 390
 391 /**
 392  * netlbl_domhsh_walk - Iterate through the domain mapping hash table
 393  * @skip_bkt: the number of buckets to skip at the start
 394  * @skip_chain: the number of entries to skip in the first iterated bucket
 395  * @callback: callback for each entry
 396  * @cb_arg: argument for the callback function
 397  *
 398  * Description:
 399  * Interate over the domain mapping hash table, skipping the first @skip_bkt
 400  * buckets and @skip_chain entries.  For each entry in the table call
 401  * @callback, if @callback returns a negative value stop 'walking' through the
 402  * table and return.  Updates the values in @skip_bkt and @skip_chain on
 403  * return.  Returns zero on succcess, negative values on failure.
 404  *
 405  */
 406 int netlbl_domhsh_walk(u32 *skip_bkt,
 407                      u32 *skip_chain,
 408                      int (*callback) (struct netlbl_dom_map *entry, void *arg),
 409                      void *cb_arg)
 410 {
 411         int ret_val = -ENOENT;
 412         u32 iter_bkt;
 413         struct netlbl_dom_map *iter_entry;
 414         u32 chain_cnt = 0;
 415
 416         rcu_read_lock();
 417         for (iter_bkt = *skip_bkt;
 418              iter_bkt < rcu_dereference(netlbl_domhsh)->size;
 419              iter_bkt++, chain_cnt = 0) {
 420                 list_for_each_entry_rcu(iter_entry,
 421                                 &rcu_dereference(netlbl_domhsh)->tbl[iter_bkt],
 422                                 list)
 423                         if (iter_entry->valid) {
 424                                 if (chain_cnt++ < *skip_chain)
 425                                         continue;
 426                                 ret_val = callback(iter_entry, cb_arg);
 427                                 if (ret_val < 0) {
 428                                         chain_cnt--;
 429                                         goto walk_return;
 430                                 }
 431                         }
 432         }
 433
 434 walk_return:
 435         rcu_read_unlock();
 436         *skip_bkt = iter_bkt;
 437         *skip_chain = chain_cnt;
 438         return ret_val;
 439 }