NetLabel: add the enumerated tag to the CIPSOv4 protocol
Add support for the enumerated tag (tag type #2) to the CIPSOv4 protocol. The enumerated tag allows for 15 categories to be specified in a CIPSO option, where each category is an unsigned 16 bit field with a maximum value of 65534. See Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt for more details. Signed-off-by: Paul Moore <paul.moore@hp.com> Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
Paul Moore
David S. Miller
parent
0275276035
commit
654bbc2a2b
|
|
@ -459,6 +459,10 @@ int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
|
|||
if (iter == 0)
|
||||
return -EINVAL;
|
||||
break;
|
||||
case CIPSO_V4_TAG_ENUM:
|
||||
if (doi_def->type != CIPSO_V4_MAP_PASS)
|
||||
return -EINVAL;
|
||||
break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
|
|
@ -940,6 +944,107 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
|
|||
return -EINVAL;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
|
||||
* @doi_def: the DOI definition
|
||||
* @enumcat: category list
|
||||
* @enumcat_len: length of the category list in bytes
|
||||
*
|
||||
* Description:
|
||||
* Checks the given categories against the given DOI definition and returns a
|
||||
* negative value if any of the categories do not have a valid mapping and a
|
||||
* zero value if all of the categories are valid.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
|
||||
const unsigned char *enumcat,
|
||||
u32 enumcat_len)
|
||||
{
|
||||
u16 cat;
|
||||
int cat_prev = -1;
|
||||
u32 iter;
|
||||
|
||||
if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
|
||||
return -EFAULT;
|
||||
|
||||
for (iter = 0; iter < enumcat_len; iter += 2) {
|
||||
cat = ntohs(*((__be16 *)&enumcat[iter]));
|
||||
if (cat <= cat_prev)
|
||||
return -EFAULT;
|
||||
cat_prev = cat;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
|
||||
* @doi_def: the DOI definition
|
||||
* @secattr: the security attributes
|
||||
* @net_cat: the zero'd out category list in network/CIPSO format
|
||||
* @net_cat_len: the length of the CIPSO category list in bytes
|
||||
*
|
||||
* Description:
|
||||
* Perform a label mapping to translate a local MLS category bitmap to the
|
||||
* correct CIPSO category list using the given DOI definition. Returns the
|
||||
* size in bytes of the network category bitmap on success, negative values
|
||||
* otherwise.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
|
||||
const struct netlbl_lsm_secattr *secattr,
|
||||
unsigned char *net_cat,
|
||||
u32 net_cat_len)
|
||||
{
|
||||
int cat = -1;
|
||||
u32 cat_iter = 0;
|
||||
|
||||
for (;;) {
|
||||
cat = netlbl_secattr_catmap_walk(secattr->mls_cat, cat + 1);
|
||||
if (cat < 0)
|
||||
break;
|
||||
if ((cat_iter + 2) > net_cat_len)
|
||||
return -ENOSPC;
|
||||
|
||||
*((__be16 *)&net_cat[cat_iter]) = htons(cat);
|
||||
cat_iter += 2;
|
||||
}
|
||||
|
||||
return cat_iter;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
|
||||
* @doi_def: the DOI definition
|
||||
* @net_cat: the category list in network/CIPSO format
|
||||
* @net_cat_len: the length of the CIPSO bitmap in bytes
|
||||
* @secattr: the security attributes
|
||||
*
|
||||
* Description:
|
||||
* Perform a label mapping to translate a CIPSO category list to the correct
|
||||
* local MLS category bitmap using the given DOI definition. Returns zero on
|
||||
* success, negative values on failure.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
|
||||
const unsigned char *net_cat,
|
||||
u32 net_cat_len,
|
||||
struct netlbl_lsm_secattr *secattr)
|
||||
{
|
||||
int ret_val;
|
||||
u32 iter;
|
||||
|
||||
for (iter = 0; iter < net_cat_len; iter += 2) {
|
||||
ret_val = netlbl_secattr_catmap_setbit(secattr->mls_cat,
|
||||
ntohs(*((__be16 *)&net_cat[iter])),
|
||||
GFP_ATOMIC);
|
||||
if (ret_val != 0)
|
||||
return ret_val;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* Protocol Handling Functions
|
||||
*/
|
||||
|
|
@ -1067,6 +1172,99 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
|
|||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
|
||||
* @doi_def: the DOI definition
|
||||
* @secattr: the security attributes
|
||||
* @buffer: the option buffer
|
||||
* @buffer_len: length of buffer in bytes
|
||||
*
|
||||
* Description:
|
||||
* Generate a CIPSO option using the enumerated tag, tag type #2. Returns the
|
||||
* size of the tag on success, negative values on failure.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
|
||||
const struct netlbl_lsm_secattr *secattr,
|
||||
unsigned char *buffer,
|
||||
u32 buffer_len)
|
||||
{
|
||||
int ret_val;
|
||||
u32 tag_len;
|
||||
u32 level;
|
||||
|
||||
if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
|
||||
return -EPERM;
|
||||
|
||||
ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
|
||||
if (ret_val != 0)
|
||||
return ret_val;
|
||||
|
||||
if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
|
||||
ret_val = cipso_v4_map_cat_enum_hton(doi_def,
|
||||
secattr,
|
||||
&buffer[4],
|
||||
buffer_len - 4);
|
||||
if (ret_val < 0)
|
||||
return ret_val;
|
||||
|
||||
tag_len = 4 + ret_val;
|
||||
} else
|
||||
tag_len = 4;
|
||||
|
||||
buffer[0] = 0x02;
|
||||
buffer[1] = tag_len;
|
||||
buffer[3] = level;
|
||||
|
||||
return tag_len;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
|
||||
* @doi_def: the DOI definition
|
||||
* @tag: the CIPSO tag
|
||||
* @secattr: the security attributes
|
||||
*
|
||||
* Description:
|
||||
* Parse a CIPSO enumerated tag (tag type #2) and return the security
|
||||
* attributes in @secattr. Return zero on success, negatives values on
|
||||
* failure.
|
||||
*
|
||||
*/
|
||||
static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
|
||||
const unsigned char *tag,
|
||||
struct netlbl_lsm_secattr *secattr)
|
||||
{
|
||||
int ret_val;
|
||||
u8 tag_len = tag[1];
|
||||
u32 level;
|
||||
|
||||
ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
|
||||
if (ret_val != 0)
|
||||
return ret_val;
|
||||
secattr->mls_lvl = level;
|
||||
secattr->flags |= NETLBL_SECATTR_MLS_LVL;
|
||||
|
||||
if (tag_len > 4) {
|
||||
secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
|
||||
if (secattr->mls_cat == NULL)
|
||||
return -ENOMEM;
|
||||
|
||||
ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
|
||||
&tag[4],
|
||||
tag_len - 4,
|
||||
secattr);
|
||||
if (ret_val != 0) {
|
||||
netlbl_secattr_catmap_free(secattr->mls_cat);
|
||||
return ret_val;
|
||||
}
|
||||
|
||||
secattr->flags |= NETLBL_SECATTR_MLS_CAT;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* cipso_v4_validate - Validate a CIPSO option
|
||||
* @option: the start of the option, on error it is set to point to the error
|
||||
|
|
@ -1156,6 +1354,25 @@ int cipso_v4_validate(unsigned char **option)
|
|||
}
|
||||
}
|
||||
break;
|
||||
case CIPSO_V4_TAG_ENUM:
|
||||
if (tag_len < 4) {
|
||||
err_offset = opt_iter + 1;
|
||||
goto validate_return_locked;
|
||||
}
|
||||
|
||||
if (cipso_v4_map_lvl_valid(doi_def,
|
||||
tag[3]) < 0) {
|
||||
err_offset = opt_iter + 3;
|
||||
goto validate_return_locked;
|
||||
}
|
||||
if (tag_len > 4 &&
|
||||
cipso_v4_map_cat_enum_valid(doi_def,
|
||||
&tag[4],
|
||||
tag_len - 4) < 0) {
|
||||
err_offset = opt_iter + 4;
|
||||
goto validate_return_locked;
|
||||
}
|
||||
break;
|
||||
default:
|
||||
err_offset = opt_iter;
|
||||
goto validate_return_locked;
|
||||
|
|
@ -1269,6 +1486,12 @@ int cipso_v4_socket_setattr(const struct socket *sock,
|
|||
&buf[CIPSO_V4_HDR_LEN],
|
||||
buf_len - CIPSO_V4_HDR_LEN);
|
||||
break;
|
||||
case CIPSO_V4_TAG_ENUM:
|
||||
ret_val = cipso_v4_gentag_enum(doi_def,
|
||||
secattr,
|
||||
&buf[CIPSO_V4_HDR_LEN],
|
||||
buf_len - CIPSO_V4_HDR_LEN);
|
||||
break;
|
||||
default:
|
||||
ret_val = -EPERM;
|
||||
goto socket_setattr_failure;
|
||||
|
|
@ -1365,6 +1588,11 @@ int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
|
|||
&cipso_ptr[6],
|
||||
secattr);
|
||||
break;
|
||||
case CIPSO_V4_TAG_ENUM:
|
||||
ret_val = cipso_v4_parsetag_enum(doi_def,
|
||||
&cipso_ptr[6],
|
||||
secattr);
|
||||
break;
|
||||
}
|
||||
rcu_read_unlock();
|
||||
|
||||
|
|
@ -1431,6 +1659,11 @@ int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
|
|||
&cipso_ptr[6],
|
||||
secattr);
|
||||
break;
|
||||
case CIPSO_V4_TAG_ENUM:
|
||||
ret_val = cipso_v4_parsetag_enum(doi_def,
|
||||
&cipso_ptr[6],
|
||||
secattr);
|
||||
break;
|
||||
}
|
||||
|
||||
skbuff_getattr_return:
|
||||
|
|
|
|||
Loading…
Reference in New Issue