2 * NetLabel Domain Hash Table
4 * This file manages the domain hash table that NetLabel uses to determine
5 * which network labeling protocol to use for a given domain. The NetLabel
6 * system manages static and dynamic label mappings for network protocols such
9 * Author: Paul Moore <paul.moore@hp.com>
14 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 2 of the License, or
19 * (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
24 * the GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, write to the Free Software
28 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
32 #include <linux/types.h>
33 #include <linux/rcupdate.h>
34 #include <linux/list.h>
35 #include <linux/skbuff.h>
36 #include <linux/spinlock.h>
37 #include <linux/string.h>
38 #include <net/netlabel.h>
39 #include <net/cipso_ipv4.h>
42 #include "netlabel_mgmt.h"
43 #include "netlabel_domainhash.h"
45 struct netlbl_domhsh_tbl
{
46 struct list_head
*tbl
;
50 /* Domain hash table */
51 /* XXX - updates should be so rare that having one spinlock for the entire
52 * hash table should be okay */
53 static DEFINE_SPINLOCK(netlbl_domhsh_lock
);
54 static struct netlbl_domhsh_tbl
*netlbl_domhsh
= NULL
;
56 /* Default domain mapping */
57 static DEFINE_SPINLOCK(netlbl_domhsh_def_lock
);
58 static struct netlbl_dom_map
*netlbl_domhsh_def
= NULL
;
61 * Domain Hash Table Helper Functions
65 * netlbl_domhsh_free_entry - Frees a domain hash table entry
66 * @entry: the entry's RCU field
69 * This function is designed to be used as a callback to the call_rcu()
70 * function so that the memory allocated to a hash table entry can be released
74 static void netlbl_domhsh_free_entry(struct rcu_head
*entry
)
76 struct netlbl_dom_map
*ptr
;
78 ptr
= container_of(entry
, struct netlbl_dom_map
, rcu
);
84 * netlbl_domhsh_hash - Hashing function for the domain hash table
85 * @domain: the domain name to hash
88 * This is the hashing function for the domain hash table, it returns the
89 * correct bucket number for the domain. The caller is responsibile for
90 * calling the rcu_read_[un]lock() functions.
93 static u32
netlbl_domhsh_hash(const char *key
)
99 /* This is taken (with slight modification) from
100 * security/selinux/ss/symtab.c:symhash() */
102 for (iter
= 0, val
= 0, len
= strlen(key
); iter
< len
; iter
++)
103 val
= (val
<< 4 | (val
>> (8 * sizeof(u32
) - 4))) ^ key
[iter
];
104 return val
& (rcu_dereference(netlbl_domhsh
)->size
- 1);
108 * netlbl_domhsh_search - Search for a domain entry
109 * @domain: the domain
110 * @def: return default if no match is found
113 * Searches the domain hash table and returns a pointer to the hash table
114 * entry if found, otherwise NULL is returned. If @def is non-zero and a
115 * match is not found in the domain hash table the default mapping is returned
116 * if it exists. The caller is responsibile for the rcu hash table locks
117 * (i.e. the caller much call rcu_read_[un]lock()).
120 static struct netlbl_dom_map
*netlbl_domhsh_search(const char *domain
, u32 def
)
123 struct netlbl_dom_map
*iter
;
125 if (domain
!= NULL
) {
126 bkt
= netlbl_domhsh_hash(domain
);
127 list_for_each_entry_rcu(iter
, &netlbl_domhsh
->tbl
[bkt
], list
)
128 if (iter
->valid
&& strcmp(iter
->domain
, domain
) == 0)
133 iter
= rcu_dereference(netlbl_domhsh_def
);
134 if (iter
!= NULL
&& iter
->valid
)
142 * Domain Hash Table Functions
146 * netlbl_domhsh_init - Init for the domain hash
147 * @size: the number of bits to use for the hash buckets
150 * Initializes the domain hash table, should be called only by
151 * netlbl_user_init() during initialization. Returns zero on success, non-zero
155 int netlbl_domhsh_init(u32 size
)
158 struct netlbl_domhsh_tbl
*hsh_tbl
;
163 hsh_tbl
= kmalloc(sizeof(*hsh_tbl
), GFP_KERNEL
);
166 hsh_tbl
->size
= 1 << size
;
167 hsh_tbl
->tbl
= kcalloc(hsh_tbl
->size
,
168 sizeof(struct list_head
),
170 if (hsh_tbl
->tbl
== NULL
) {
174 for (iter
= 0; iter
< hsh_tbl
->size
; iter
++)
175 INIT_LIST_HEAD(&hsh_tbl
->tbl
[iter
]);
178 spin_lock(&netlbl_domhsh_lock
);
179 rcu_assign_pointer(netlbl_domhsh
, hsh_tbl
);
180 spin_unlock(&netlbl_domhsh_lock
);
187 * netlbl_domhsh_add - Adds a entry to the domain hash table
188 * @entry: the entry to add
191 * Adds a new entry to the domain hash table and handles any updates to the
192 * lower level protocol handler (i.e. CIPSO). Returns zero on success,
193 * negative on failure.
196 int netlbl_domhsh_add(struct netlbl_dom_map
*entry
)
201 switch (entry
->type
) {
202 case NETLBL_NLTYPE_UNLABELED
:
205 case NETLBL_NLTYPE_CIPSOV4
:
206 ret_val
= cipso_v4_doi_domhsh_add(entry
->type_def
.cipsov4
,
216 INIT_RCU_HEAD(&entry
->rcu
);
220 if (entry
->domain
!= NULL
) {
221 bkt
= netlbl_domhsh_hash(entry
->domain
);
222 spin_lock(&netlbl_domhsh_lock
);
223 if (netlbl_domhsh_search(entry
->domain
, 0) == NULL
)
224 list_add_tail_rcu(&entry
->list
,
225 &netlbl_domhsh
->tbl
[bkt
]);
228 spin_unlock(&netlbl_domhsh_lock
);
229 } else if (entry
->domain
== NULL
) {
230 INIT_LIST_HEAD(&entry
->list
);
231 spin_lock(&netlbl_domhsh_def_lock
);
232 if (rcu_dereference(netlbl_domhsh_def
) == NULL
)
233 rcu_assign_pointer(netlbl_domhsh_def
, entry
);
236 spin_unlock(&netlbl_domhsh_def_lock
);
242 switch (entry
->type
) {
243 case NETLBL_NLTYPE_CIPSOV4
:
244 if (cipso_v4_doi_domhsh_remove(entry
->type_def
.cipsov4
,
255 * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
256 * @entry: the entry to add
259 * Adds a new default entry to the domain hash table and handles any updates
260 * to the lower level protocol handler (i.e. CIPSO). Returns zero on success,
261 * negative on failure.
264 int netlbl_domhsh_add_default(struct netlbl_dom_map
*entry
)
266 return netlbl_domhsh_add(entry
);
270 * netlbl_domhsh_remove - Removes an entry from the domain hash table
271 * @domain: the domain to remove
274 * Removes an entry from the domain hash table and handles any updates to the
275 * lower level protocol handler (i.e. CIPSO). Returns zero on success,
276 * negative on failure.
279 int netlbl_domhsh_remove(const char *domain
)
281 int ret_val
= -ENOENT
;
282 struct netlbl_dom_map
*entry
;
286 entry
= netlbl_domhsh_search(domain
, 0);
288 entry
= netlbl_domhsh_search(domain
, 1);
291 switch (entry
->type
) {
292 case NETLBL_NLTYPE_UNLABELED
:
294 case NETLBL_NLTYPE_CIPSOV4
:
295 ret_val
= cipso_v4_doi_domhsh_remove(entry
->type_def
.cipsov4
,
302 if (entry
!= rcu_dereference(netlbl_domhsh_def
)) {
303 spin_lock(&netlbl_domhsh_lock
);
306 list_del_rcu(&entry
->list
);
309 spin_unlock(&netlbl_domhsh_lock
);
311 spin_lock(&netlbl_domhsh_def_lock
);
314 rcu_assign_pointer(netlbl_domhsh_def
, NULL
);
317 spin_unlock(&netlbl_domhsh_def_lock
);
320 call_rcu(&entry
->rcu
, netlbl_domhsh_free_entry
);
328 * netlbl_domhsh_remove_default - Removes the default entry from the table
331 * Removes/resets the default entry for the domain hash table and handles any
332 * updates to the lower level protocol handler (i.e. CIPSO). Returns zero on
333 * success, non-zero on failure.
336 int netlbl_domhsh_remove_default(void)
338 return netlbl_domhsh_remove(NULL
);
342 * netlbl_domhsh_getentry - Get an entry from the domain hash table
343 * @domain: the domain name to search for
346 * Look through the domain hash table searching for an entry to match @domain,
347 * return a pointer to a copy of the entry or NULL. The caller is responsibile
348 * for ensuring that rcu_read_[un]lock() is called.
351 struct netlbl_dom_map
*netlbl_domhsh_getentry(const char *domain
)
353 return netlbl_domhsh_search(domain
, 1);
357 * netlbl_domhsh_dump - Dump the domain hash table into a sk_buff
360 * Dump the domain hash table into a buffer suitable for returning to an
361 * application in response to a NetLabel management DOMAIN message. This
362 * function may fail if another process is growing the hash table at the same
363 * time. The returned sk_buff has room at the front of the sk_buff for
364 * @headroom bytes. See netlabel.h for the DOMAIN message format. Returns a
365 * pointer to a sk_buff on success, NULL on error.
368 struct sk_buff
*netlbl_domhsh_dump(size_t headroom
)
370 struct sk_buff
*skb
= NULL
;
374 struct netlbl_domhsh_tbl
*hsh_tbl
;
375 struct netlbl_dom_map
*list_iter
;
378 buf_len
= NETLBL_LEN_U32
;
380 hsh_tbl
= rcu_dereference(netlbl_domhsh
);
381 for (bkt_iter
= 0; bkt_iter
< hsh_tbl
->size
; bkt_iter
++)
382 list_for_each_entry_rcu(list_iter
,
383 &hsh_tbl
->tbl
[bkt_iter
], list
) {
384 buf_len
+= NETLBL_LEN_U32
+
385 nla_total_size(strlen(list_iter
->domain
) + 1);
386 switch (list_iter
->type
) {
387 case NETLBL_NLTYPE_UNLABELED
:
389 case NETLBL_NLTYPE_CIPSOV4
:
390 buf_len
+= 2 * NETLBL_LEN_U32
;
396 skb
= netlbl_netlink_alloc_skb(headroom
, buf_len
, GFP_ATOMIC
);
400 if (nla_put_u32(skb
, NLA_U32
, dom_cnt
) != 0)
402 buf_len
-= NETLBL_LEN_U32
;
403 hsh_tbl
= rcu_dereference(netlbl_domhsh
);
404 for (bkt_iter
= 0; bkt_iter
< hsh_tbl
->size
; bkt_iter
++)
405 list_for_each_entry_rcu(list_iter
,
406 &hsh_tbl
->tbl
[bkt_iter
], list
) {
407 tmp_len
= nla_total_size(strlen(list_iter
->domain
) +
409 if (buf_len
< NETLBL_LEN_U32
+ tmp_len
)
411 if (nla_put_string(skb
,
413 list_iter
->domain
) != 0)
415 if (nla_put_u32(skb
, NLA_U32
, list_iter
->type
) != 0)
417 buf_len
-= NETLBL_LEN_U32
+ tmp_len
;
418 switch (list_iter
->type
) {
419 case NETLBL_NLTYPE_UNLABELED
:
421 case NETLBL_NLTYPE_CIPSOV4
:
422 if (buf_len
< 2 * NETLBL_LEN_U32
)
426 list_iter
->type_def
.cipsov4
->type
) != 0)
430 list_iter
->type_def
.cipsov4
->doi
) != 0)
432 buf_len
-= 2 * NETLBL_LEN_U32
;
447 * netlbl_domhsh_dump_default - Dump the default domain mapping into a sk_buff
450 * Dump the default domain mapping into a buffer suitable for returning to an
451 * application in response to a NetLabel management DEFDOMAIN message. This
452 * function may fail if another process is changing the default domain mapping
453 * at the same time. The returned sk_buff has room at the front of the
454 * skb_buff for @headroom bytes. See netlabel.h for the DEFDOMAIN message
455 * format. Returns a pointer to a sk_buff on success, NULL on error.
458 struct sk_buff
*netlbl_domhsh_dump_default(size_t headroom
)
462 struct netlbl_dom_map
*entry
;
464 buf_len
= NETLBL_LEN_U32
;
466 entry
= rcu_dereference(netlbl_domhsh_def
);
468 switch (entry
->type
) {
469 case NETLBL_NLTYPE_UNLABELED
:
471 case NETLBL_NLTYPE_CIPSOV4
:
472 buf_len
+= 2 * NETLBL_LEN_U32
;
476 skb
= netlbl_netlink_alloc_skb(headroom
, buf_len
, GFP_ATOMIC
);
478 goto dump_default_failure
;
480 if (entry
!= rcu_dereference(netlbl_domhsh_def
))
481 goto dump_default_failure
;
483 if (nla_put_u32(skb
, NLA_U32
, entry
->type
) != 0)
484 goto dump_default_failure
;
485 buf_len
-= NETLBL_LEN_U32
;
486 switch (entry
->type
) {
487 case NETLBL_NLTYPE_UNLABELED
:
489 case NETLBL_NLTYPE_CIPSOV4
:
490 if (buf_len
< 2 * NETLBL_LEN_U32
)
491 goto dump_default_failure
;
494 entry
->type_def
.cipsov4
->type
) != 0)
495 goto dump_default_failure
;
498 entry
->type_def
.cipsov4
->doi
) != 0)
499 goto dump_default_failure
;
500 buf_len
-= 2 * NETLBL_LEN_U32
;
504 nla_put_u32(skb
, NLA_U32
, NETLBL_NLTYPE_NONE
);
509 dump_default_failure
: