net/netlabel/netlabel_domainhash.c

   1 /*
   2  * NetLabel Domain Hash Table
   3  *
   4  * This file manages the domain hash table that NetLabel uses to determine
   5  * which network labeling protocol to use for a given domain.  The NetLabel
   6  * system manages static and dynamic label mappings for network protocols such
   7  * as CIPSO and RIPSO.
   8  *
   9  * Author: Paul Moore <paul.moore@hp.com>
  10  *
  11  */
  12
  13 /*
  14  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  15  *
  16  * This program is free software;  you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License as published by
  18  * the Free Software Foundation; either version 2 of the License, or
  19  * (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  24  * the GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program;  if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  29  *
  30  */
  31
  32 #include <linux/types.h>
  33 #include <linux/rcupdate.h>
  34 #include <linux/list.h>
  35 #include <linux/skbuff.h>
  36 #include <linux/spinlock.h>
  37 #include <linux/string.h>
  38 #include <net/netlabel.h>
  39 #include <net/cipso_ipv4.h>
  40 #include <asm/bug.h>
  41
  42 #include "netlabel_mgmt.h"
  43 #include "netlabel_domainhash.h"
  44
  45 struct netlbl_domhsh_tbl {
  46         struct list_head *tbl;
  47         u32 size;
  48 };
  49
  50 /* Domain hash table */
  51 /* XXX - updates should be so rare that having one spinlock for the entire
  52  * hash table should be okay */
  53 static DEFINE_SPINLOCK(netlbl_domhsh_lock);
  54 static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
  55
  56 /* Default domain mapping */
  57 static DEFINE_SPINLOCK(netlbl_domhsh_def_lock);
  58 static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
  59
  60 /*
  61  * Domain Hash Table Helper Functions
  62  */
  63
  64 /**
  65  * netlbl_domhsh_free_entry - Frees a domain hash table entry
  66  * @entry: the entry's RCU field
  67  *
  68  * Description:
  69  * This function is designed to be used as a callback to the call_rcu()
  70  * function so that the memory allocated to a hash table entry can be released
  71  * safely.
  72  *
  73  */
  74 static void netlbl_domhsh_free_entry(struct rcu_head *entry)
  75 {
  76         struct netlbl_dom_map *ptr;
  77
  78         ptr = container_of(entry, struct netlbl_dom_map, rcu);
  79         kfree(ptr->domain);
  80         kfree(ptr);
  81 }
  82
  83 /**
  84  * netlbl_domhsh_hash - Hashing function for the domain hash table
  85  * @domain: the domain name to hash
  86  *
  87  * Description:
  88  * This is the hashing function for the domain hash table, it returns the
  89  * correct bucket number for the domain.  The caller is responsibile for
  90  * calling the rcu_read_[un]lock() functions.
  91  *
  92  */
  93 static u32 netlbl_domhsh_hash(const char *key)
  94 {
  95         u32 iter;
  96         u32 val;
  97         u32 len;
  98
  99         /* This is taken (with slight modification) from
 100          * security/selinux/ss/symtab.c:symhash() */
 101
 102         for (iter = 0, val = 0, len = strlen(key); iter < len; iter++)
 103                 val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];
 104         return val & (rcu_dereference(netlbl_domhsh)->size - 1);
 105 }
 106
 107 /**
 108  * netlbl_domhsh_search - Search for a domain entry
 109  * @domain: the domain
 110  * @def: return default if no match is found
 111  *
 112  * Description:
 113  * Searches the domain hash table and returns a pointer to the hash table
 114  * entry if found, otherwise NULL is returned.  If @def is non-zero and a
 115  * match is not found in the domain hash table the default mapping is returned
 116  * if it exists.  The caller is responsibile for the rcu hash table locks
 117  * (i.e. the caller much call rcu_read_[un]lock()).
 118  *
 119  */
 120 static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain, u32 def)
 121 {
 122         u32 bkt;
 123         struct netlbl_dom_map *iter;
 124
 125         if (domain != NULL) {
 126                 bkt = netlbl_domhsh_hash(domain);
 127                 list_for_each_entry_rcu(iter, &netlbl_domhsh->tbl[bkt], list)
 128                         if (iter->valid && strcmp(iter->domain, domain) == 0)
 129                                 return iter;
 130         }
 131
 132         if (def != 0) {
 133                 iter = rcu_dereference(netlbl_domhsh_def);
 134                 if (iter != NULL && iter->valid)
 135                         return iter;
 136         }
 137
 138         return NULL;
 139 }
 140
 141 /*
 142  * Domain Hash Table Functions
 143  */
 144
 145 /**
 146  * netlbl_domhsh_init - Init for the domain hash
 147  * @size: the number of bits to use for the hash buckets
 148  *
 149  * Description:
 150  * Initializes the domain hash table, should be called only by
 151  * netlbl_user_init() during initialization.  Returns zero on success, non-zero
 152  * values on error.
 153  *
 154  */
 155 int netlbl_domhsh_init(u32 size)
 156 {
 157         u32 iter;
 158         struct netlbl_domhsh_tbl *hsh_tbl;
 159
 160         if (size == 0)
 161                 return -EINVAL;
 162
 163         hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
 164         if (hsh_tbl == NULL)
 165                 return -ENOMEM;
 166         hsh_tbl->size = 1 << size;
 167         hsh_tbl->tbl = kcalloc(hsh_tbl->size,
 168                                sizeof(struct list_head),
 169                                GFP_KERNEL);
 170         if (hsh_tbl->tbl == NULL) {
 171                 kfree(hsh_tbl);
 172                 return -ENOMEM;
 173         }
 174         for (iter = 0; iter < hsh_tbl->size; iter++)
 175                 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
 176
 177         rcu_read_lock();
 178         spin_lock(&netlbl_domhsh_lock);
 179         rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
 180         spin_unlock(&netlbl_domhsh_lock);
 181         rcu_read_unlock();
 182
 183         return 0;
 184 }
 185
 186 /**
 187  * netlbl_domhsh_add - Adds a entry to the domain hash table
 188  * @entry: the entry to add
 189  *
 190  * Description:
 191  * Adds a new entry to the domain hash table and handles any updates to the
 192  * lower level protocol handler (i.e. CIPSO).  Returns zero on success,
 193  * negative on failure.
 194  *
 195  */
 196 int netlbl_domhsh_add(struct netlbl_dom_map *entry)
 197 {
 198         int ret_val;
 199         u32 bkt;
 200
 201         switch (entry->type) {
 202         case NETLBL_NLTYPE_UNLABELED:
 203                 ret_val = 0;
 204                 break;
 205         case NETLBL_NLTYPE_CIPSOV4:
 206                 ret_val = cipso_v4_doi_domhsh_add(entry->type_def.cipsov4,
 207                                                   entry->domain);
 208                 break;
 209         default:
 210                 return -EINVAL;
 211         }
 212         if (ret_val != 0)
 213                 return ret_val;
 214
 215         entry->valid = 1;
 216         INIT_RCU_HEAD(&entry->rcu);
 217
 218         ret_val = 0;
 219         rcu_read_lock();
 220         if (entry->domain != NULL) {
 221                 bkt = netlbl_domhsh_hash(entry->domain);
 222                 spin_lock(&netlbl_domhsh_lock);
 223                 if (netlbl_domhsh_search(entry->domain, 0) == NULL)
 224                         list_add_tail_rcu(&entry->list,
 225                                           &netlbl_domhsh->tbl[bkt]);
 226                 else
 227                         ret_val = -EEXIST;
 228                 spin_unlock(&netlbl_domhsh_lock);
 229         } else if (entry->domain == NULL) {
 230                 INIT_LIST_HEAD(&entry->list);
 231                 spin_lock(&netlbl_domhsh_def_lock);
 232                 if (rcu_dereference(netlbl_domhsh_def) == NULL)
 233                         rcu_assign_pointer(netlbl_domhsh_def, entry);
 234                 else
 235                         ret_val = -EEXIST;
 236                 spin_unlock(&netlbl_domhsh_def_lock);
 237         } else
 238                 ret_val = -EINVAL;
 239         rcu_read_unlock();
 240
 241         if (ret_val != 0) {
 242                 switch (entry->type) {
 243                 case NETLBL_NLTYPE_CIPSOV4:
 244                         if (cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
 245                                                        entry->domain) != 0)
 246                                 BUG();
 247                         break;
 248                 }
 249         }
 250
 251         return ret_val;
 252 }
 253
 254 /**
 255  * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
 256  * @entry: the entry to add
 257  *
 258  * Description:
 259  * Adds a new default entry to the domain hash table and handles any updates
 260  * to the lower level protocol handler (i.e. CIPSO).  Returns zero on success,
 261  * negative on failure.
 262  *
 263  */
 264 int netlbl_domhsh_add_default(struct netlbl_dom_map *entry)
 265 {
 266         return netlbl_domhsh_add(entry);
 267 }
 268
 269 /**
 270  * netlbl_domhsh_remove - Removes an entry from the domain hash table
 271  * @domain: the domain to remove
 272  *
 273  * Description:
 274  * Removes an entry from the domain hash table and handles any updates to the
 275  * lower level protocol handler (i.e. CIPSO).  Returns zero on success,
 276  * negative on failure.
 277  *
 278  */
 279 int netlbl_domhsh_remove(const char *domain)
 280 {
 281         int ret_val = -ENOENT;
 282         struct netlbl_dom_map *entry;
 283
 284         rcu_read_lock();
 285         if (domain != NULL)
 286                 entry = netlbl_domhsh_search(domain, 0);
 287         else
 288                 entry = netlbl_domhsh_search(domain, 1);
 289         if (entry == NULL)
 290                 goto remove_return;
 291         switch (entry->type) {
 292         case NETLBL_NLTYPE_UNLABELED:
 293                 break;
 294         case NETLBL_NLTYPE_CIPSOV4:
 295                 ret_val = cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
 296                                                      entry->domain);
 297                 if (ret_val != 0)
 298                         goto remove_return;
 299                 break;
 300         }
 301         ret_val = 0;
 302         if (entry != rcu_dereference(netlbl_domhsh_def)) {
 303                 spin_lock(&netlbl_domhsh_lock);
 304                 if (entry->valid) {
 305                         entry->valid = 0;
 306                         list_del_rcu(&entry->list);
 307                 } else
 308                         ret_val = -ENOENT;
 309                 spin_unlock(&netlbl_domhsh_lock);
 310         } else {
 311                 spin_lock(&netlbl_domhsh_def_lock);
 312                 if (entry->valid) {
 313                         entry->valid = 0;
 314                         rcu_assign_pointer(netlbl_domhsh_def, NULL);
 315                 } else
 316                         ret_val = -ENOENT;
 317                 spin_unlock(&netlbl_domhsh_def_lock);
 318         }
 319         if (ret_val == 0)
 320                 call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
 321
 322 remove_return:
 323         rcu_read_unlock();
 324         return ret_val;
 325 }
 326
 327 /**
 328  * netlbl_domhsh_remove_default - Removes the default entry from the table
 329  *
 330  * Description:
 331  * Removes/resets the default entry for the domain hash table and handles any
 332  * updates to the lower level protocol handler (i.e. CIPSO).  Returns zero on
 333  * success, non-zero on failure.
 334  *
 335  */
 336 int netlbl_domhsh_remove_default(void)
 337 {
 338         return netlbl_domhsh_remove(NULL);
 339 }
 340
 341 /**
 342  * netlbl_domhsh_getentry - Get an entry from the domain hash table
 343  * @domain: the domain name to search for
 344  *
 345  * Description:
 346  * Look through the domain hash table searching for an entry to match @domain,
 347  * return a pointer to a copy of the entry or NULL.  The caller is responsibile
 348  * for ensuring that rcu_read_[un]lock() is called.
 349  *
 350  */
 351 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
 352 {
 353         return netlbl_domhsh_search(domain, 1);
 354 }
 355
 356 /**
 357  * netlbl_domhsh_walk - Iterate through the domain mapping hash table
 358  * @skip_bkt: the number of buckets to skip at the start
 359  * @skip_chain: the number of entries to skip in the first iterated bucket
 360  * @callback: callback for each entry
 361  * @cb_arg: argument for the callback function
 362  *
 363  * Description:
 364  * Interate over the domain mapping hash table, skipping the first @skip_bkt
 365  * buckets and @skip_chain entries.  For each entry in the table call
 366  * @callback, if @callback returns a negative value stop 'walking' through the
 367  * table and return.  Updates the values in @skip_bkt and @skip_chain on
 368  * return.  Returns zero on succcess, negative values on failure.
 369  *
 370  */
 371 int netlbl_domhsh_walk(u32 *skip_bkt,
 372                      u32 *skip_chain,
 373                      int (*callback) (struct netlbl_dom_map *entry, void *arg),
 374                      void *cb_arg)
 375 {
 376         int ret_val = -ENOENT;
 377         u32 iter_bkt;
 378         struct netlbl_dom_map *iter_entry;
 379         u32 chain_cnt = 0;
 380
 381         rcu_read_lock();
 382         for (iter_bkt = *skip_bkt;
 383              iter_bkt < rcu_dereference(netlbl_domhsh)->size;
 384              iter_bkt++, chain_cnt = 0) {
 385                 list_for_each_entry_rcu(iter_entry,
 386                                         &netlbl_domhsh->tbl[iter_bkt],
 387                                         list)
 388                         if (iter_entry->valid) {
 389                                 if (chain_cnt++ < *skip_chain)
 390                                         continue;
 391                                 ret_val = callback(iter_entry, cb_arg);
 392                                 if (ret_val < 0) {
 393                                         chain_cnt--;
 394                                         goto walk_return;
 395                                 }
 396                         }
 397         }
 398
 399 walk_return:
 400         rcu_read_unlock();
 401         *skip_bkt = iter_bkt;
 402         *skip_chain = chain_cnt;
 403         return ret_val;
 404 }