2 * CALIPSO - Common Architecture Label IPv6 Security Option
4 * This is an implementation of the CALIPSO protocol as specified in
7 * Authors: Paul Moore <paul.moore@hp.com>
8 * Huw Davies <huw@codeweavers.com>
12 /* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
13 * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
30 #include <linux/init.h>
31 #include <linux/types.h>
32 #include <linux/rcupdate.h>
33 #include <linux/list.h>
34 #include <linux/spinlock.h>
35 #include <linux/string.h>
36 #include <linux/jhash.h>
37 #include <linux/audit.h>
38 #include <linux/slab.h>
42 #include <net/netlabel.h>
43 #include <net/calipso.h>
44 #include <linux/atomic.h>
45 #include <linux/bug.h>
46 #include <asm/unaligned.h>
47 #include <linux/crc-ccitt.h>
49 /* Maximium size of the calipso option including
50 * the two-byte TLV header.
52 #define CALIPSO_OPT_LEN_MAX (2 + 252)
54 /* Size of the minimum calipso option including
55 * the two-byte TLV header.
57 #define CALIPSO_HDR_LEN (2 + 8)
59 /* Maximium size of the calipso option including
60 * the two-byte TLV header and upto 3 bytes of
61 * leading pad and 7 bytes of trailing pad.
63 #define CALIPSO_OPT_LEN_MAX_WITH_PAD (3 + CALIPSO_OPT_LEN_MAX + 7)
65 /* Maximium size of u32 aligned buffer required to hold calipso
66 * option. Max of 3 initial pad bytes starting from buffer + 3.
67 * i.e. the worst case is when the previous tlv finishes on 4n + 3.
69 #define CALIPSO_MAX_BUFFER (6 + CALIPSO_OPT_LEN_MAX)
71 /* List of available DOI definitions */
72 static DEFINE_SPINLOCK(calipso_doi_list_lock
);
73 static LIST_HEAD(calipso_doi_list
);
79 * calipso_doi_search - Searches for a DOI definition
80 * @doi: the DOI to search for
83 * Search the DOI definition list for a DOI definition with a DOI value that
84 * matches @doi. The caller is responsible for calling rcu_read_[un]lock().
85 * Returns a pointer to the DOI definition on success and NULL on failure.
87 static struct calipso_doi
*calipso_doi_search(u32 doi
)
89 struct calipso_doi
*iter
;
91 list_for_each_entry_rcu(iter
, &calipso_doi_list
, list
)
92 if (iter
->doi
== doi
&& atomic_read(&iter
->refcount
))
98 * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
99 * @doi_def: the DOI structure
100 * @audit_info: NetLabel audit information
103 * The caller defines a new DOI for use by the CALIPSO engine and calls this
104 * function to add it to the list of acceptable domains. The caller must
105 * ensure that the mapping table specified in @doi_def->map meets all of the
106 * requirements of the mapping type (see calipso.h for details). Returns
107 * zero on success and non-zero on failure.
110 static int calipso_doi_add(struct calipso_doi
*doi_def
,
111 struct netlbl_audit
*audit_info
)
113 int ret_val
= -EINVAL
;
116 struct audit_buffer
*audit_buf
;
119 doi_type
= doi_def
->type
;
121 if (doi_def
->doi
== CALIPSO_DOI_UNKNOWN
)
124 atomic_set(&doi_def
->refcount
, 1);
126 spin_lock(&calipso_doi_list_lock
);
127 if (calipso_doi_search(doi_def
->doi
)) {
128 spin_unlock(&calipso_doi_list_lock
);
132 list_add_tail_rcu(&doi_def
->list
, &calipso_doi_list
);
133 spin_unlock(&calipso_doi_list_lock
);
137 audit_buf
= netlbl_audit_start(AUDIT_MAC_CALIPSO_ADD
, audit_info
);
139 const char *type_str
;
142 case CALIPSO_MAP_PASS
:
146 type_str
= "(unknown)";
148 audit_log_format(audit_buf
,
149 " calipso_doi=%u calipso_type=%s res=%u",
150 doi
, type_str
, ret_val
== 0 ? 1 : 0);
151 audit_log_end(audit_buf
);
158 * calipso_doi_free - Frees a DOI definition
159 * @doi_def: the DOI definition
162 * This function frees all of the memory associated with a DOI definition.
165 static void calipso_doi_free(struct calipso_doi
*doi_def
)
171 * calipso_doi_free_rcu - Frees a DOI definition via the RCU pointer
172 * @entry: the entry's RCU field
175 * This function is designed to be used as a callback to the call_rcu()
176 * function so that the memory allocated to the DOI definition can be released
180 static void calipso_doi_free_rcu(struct rcu_head
*entry
)
182 struct calipso_doi
*doi_def
;
184 doi_def
= container_of(entry
, struct calipso_doi
, rcu
);
185 calipso_doi_free(doi_def
);
189 * calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine
190 * @doi: the DOI value
191 * @audit_secid: the LSM secid to use in the audit message
194 * Removes a DOI definition from the CALIPSO engine. The NetLabel routines will
195 * be called to release their own LSM domain mappings as well as our own
196 * domain list. Returns zero on success and negative values on failure.
199 static int calipso_doi_remove(u32 doi
, struct netlbl_audit
*audit_info
)
202 struct calipso_doi
*doi_def
;
203 struct audit_buffer
*audit_buf
;
205 spin_lock(&calipso_doi_list_lock
);
206 doi_def
= calipso_doi_search(doi
);
208 spin_unlock(&calipso_doi_list_lock
);
210 goto doi_remove_return
;
212 if (!atomic_dec_and_test(&doi_def
->refcount
)) {
213 spin_unlock(&calipso_doi_list_lock
);
215 goto doi_remove_return
;
217 list_del_rcu(&doi_def
->list
);
218 spin_unlock(&calipso_doi_list_lock
);
220 call_rcu(&doi_def
->rcu
, calipso_doi_free_rcu
);
224 audit_buf
= netlbl_audit_start(AUDIT_MAC_CALIPSO_DEL
, audit_info
);
226 audit_log_format(audit_buf
,
227 " calipso_doi=%u res=%u",
228 doi
, ret_val
== 0 ? 1 : 0);
229 audit_log_end(audit_buf
);
236 * calipso_doi_getdef - Returns a reference to a valid DOI definition
237 * @doi: the DOI value
240 * Searches for a valid DOI definition and if one is found it is returned to
241 * the caller. Otherwise NULL is returned. The caller must ensure that
242 * calipso_doi_putdef() is called when the caller is done.
245 static struct calipso_doi
*calipso_doi_getdef(u32 doi
)
247 struct calipso_doi
*doi_def
;
250 doi_def
= calipso_doi_search(doi
);
252 goto doi_getdef_return
;
253 if (!atomic_inc_not_zero(&doi_def
->refcount
))
262 * calipso_doi_putdef - Releases a reference for the given DOI definition
263 * @doi_def: the DOI definition
266 * Releases a DOI definition reference obtained from calipso_doi_getdef().
269 static void calipso_doi_putdef(struct calipso_doi
*doi_def
)
274 if (!atomic_dec_and_test(&doi_def
->refcount
))
276 spin_lock(&calipso_doi_list_lock
);
277 list_del_rcu(&doi_def
->list
);
278 spin_unlock(&calipso_doi_list_lock
);
280 call_rcu(&doi_def
->rcu
, calipso_doi_free_rcu
);
284 * calipso_doi_walk - Iterate through the DOI definitions
285 * @skip_cnt: skip past this number of DOI definitions, updated
286 * @callback: callback for each DOI definition
287 * @cb_arg: argument for the callback function
290 * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
291 * For each entry call @callback, if @callback returns a negative value stop
292 * 'walking' through the list and return. Updates the value in @skip_cnt upon
293 * return. Returns zero on success, negative values on failure.
296 static int calipso_doi_walk(u32
*skip_cnt
,
297 int (*callback
)(struct calipso_doi
*doi_def
,
301 int ret_val
= -ENOENT
;
303 struct calipso_doi
*iter_doi
;
306 list_for_each_entry_rcu(iter_doi
, &calipso_doi_list
, list
)
307 if (atomic_read(&iter_doi
->refcount
) > 0) {
308 if (doi_cnt
++ < *skip_cnt
)
310 ret_val
= callback(iter_doi
, cb_arg
);
313 goto doi_walk_return
;
324 * calipso_validate - Validate a CALIPSO option
326 * @option: the start of the option
329 * This routine is called to validate a CALIPSO option.
330 * If the option is valid then %true is returned, otherwise
331 * %false is returned.
333 * The caller should have already checked that the length of the
334 * option (including the TLV header) is >= 10 and that the catmap
335 * length is consistent with the option length.
337 * We leave checks on the level and categories to the socket layer.
339 bool calipso_validate(const struct sk_buff
*skb
, const unsigned char *option
)
341 struct calipso_doi
*doi_def
;
343 u16 crc
, len
= option
[1] + 2;
344 static const u8 zero
[2];
346 /* The original CRC runs over the option including the TLV header
347 * with the CRC-16 field (at offset 8) zeroed out. */
348 crc
= crc_ccitt(0xffff, option
, 8);
349 crc
= crc_ccitt(crc
, zero
, sizeof(zero
));
351 crc
= crc_ccitt(crc
, option
+ 10, len
- 10);
353 if (option
[8] != (crc
& 0xff) || option
[9] != ((crc
>> 8) & 0xff))
357 doi_def
= calipso_doi_search(get_unaligned_be32(option
+ 2));
365 * calipso_map_cat_hton - Perform a category mapping from host to network
366 * @doi_def: the DOI definition
367 * @secattr: the security attributes
368 * @net_cat: the zero'd out category bitmap in network/CALIPSO format
369 * @net_cat_len: the length of the CALIPSO bitmap in bytes
372 * Perform a label mapping to translate a local MLS category bitmap to the
373 * correct CALIPSO bitmap using the given DOI definition. Returns the minimum
374 * size in bytes of the network bitmap on success, negative values otherwise.
377 static int calipso_map_cat_hton(const struct calipso_doi
*doi_def
,
378 const struct netlbl_lsm_secattr
*secattr
,
379 unsigned char *net_cat
,
383 u32 net_spot_max
= 0;
384 u32 net_clen_bits
= net_cat_len
* 8;
387 spot
= netlbl_catmap_walk(secattr
->attr
.mls
.cat
,
391 if (spot
>= net_clen_bits
)
393 netlbl_bitmap_setbit(net_cat
, spot
, 1);
395 if (spot
> net_spot_max
)
399 return (net_spot_max
/ 32 + 1) * 4;
403 * calipso_map_cat_ntoh - Perform a category mapping from network to host
404 * @doi_def: the DOI definition
405 * @net_cat: the category bitmap in network/CALIPSO format
406 * @net_cat_len: the length of the CALIPSO bitmap in bytes
407 * @secattr: the security attributes
410 * Perform a label mapping to translate a CALIPSO bitmap to the correct local
411 * MLS category bitmap using the given DOI definition. Returns zero on
412 * success, negative values on failure.
415 static int calipso_map_cat_ntoh(const struct calipso_doi
*doi_def
,
416 const unsigned char *net_cat
,
418 struct netlbl_lsm_secattr
*secattr
)
422 u32 net_clen_bits
= net_cat_len
* 8;
425 spot
= netlbl_bitmap_walk(net_cat
,
435 ret_val
= netlbl_catmap_setbit(&secattr
->attr
.mls
.cat
,
446 * calipso_pad_write - Writes pad bytes in TLV format
448 * @offset: offset from start of buffer to write padding
449 * @count: number of pad bytes to write
452 * Write @count bytes of TLV padding into @buffer starting at offset @offset.
453 * @count should be less than 8 - see RFC 4942.
456 static int calipso_pad_write(unsigned char *buf
, unsigned int offset
,
459 if (WARN_ON_ONCE(count
>= 8))
466 buf
[offset
] = IPV6_TLV_PAD1
;
469 buf
[offset
] = IPV6_TLV_PADN
;
470 buf
[offset
+ 1] = count
- 2;
472 memset(buf
+ offset
+ 2, 0, count
- 2);
479 * calipso_genopt - Generate a CALIPSO option
480 * @buf: the option buffer
481 * @start: offset from which to write
482 * @buf_len: the size of opt_buf
483 * @doi_def: the CALIPSO DOI to use
484 * @secattr: the security attributes
487 * Generate a CALIPSO option using the DOI definition and security attributes
488 * passed to the function. This also generates upto three bytes of leading
489 * padding that ensures that the option is 4n + 2 aligned. It returns the
490 * number of bytes written (including any initial padding).
492 static int calipso_genopt(unsigned char *buf
, u32 start
, u32 buf_len
,
493 const struct calipso_doi
*doi_def
,
494 const struct netlbl_lsm_secattr
*secattr
)
499 static const unsigned char padding
[4] = {2, 1, 0, 3};
500 unsigned char *calipso
;
502 /* CALIPSO has 4n + 2 alignment */
503 pad
= padding
[start
& 3];
504 if (buf_len
<= start
+ pad
+ CALIPSO_HDR_LEN
)
507 if ((secattr
->flags
& NETLBL_SECATTR_MLS_LVL
) == 0)
510 len
= CALIPSO_HDR_LEN
;
512 if (secattr
->flags
& NETLBL_SECATTR_MLS_CAT
) {
513 ret_val
= calipso_map_cat_hton(doi_def
,
515 buf
+ start
+ pad
+ len
,
516 buf_len
- start
- pad
- len
);
522 calipso_pad_write(buf
, start
, pad
);
523 calipso
= buf
+ start
+ pad
;
525 calipso
[0] = IPV6_TLV_CALIPSO
;
526 calipso
[1] = len
- 2;
527 *(__be32
*)(calipso
+ 2) = htonl(doi_def
->doi
);
528 calipso
[6] = (len
- CALIPSO_HDR_LEN
) / 4;
529 calipso
[7] = secattr
->attr
.mls
.lvl
,
530 crc
= ~crc_ccitt(0xffff, calipso
, len
);
531 calipso
[8] = crc
& 0xff;
532 calipso
[9] = (crc
>> 8) & 0xff;
536 /* Hop-by-hop hdr helper functions
540 * calipso_opt_update - Replaces socket's hop options with a new set
542 * @hop: new hop options
545 * Replaces @sk's hop options with @hop. @hop may be NULL to leave
546 * the socket with no hop options.
549 static int calipso_opt_update(struct sock
*sk
, struct ipv6_opt_hdr
*hop
)
551 struct ipv6_txoptions
*old
= txopt_get(inet6_sk(sk
)), *txopts
;
553 txopts
= ipv6_renew_options_kern(sk
, old
, IPV6_HOPOPTS
,
554 hop
, hop
? ipv6_optlen(hop
) : 0);
557 return PTR_ERR(txopts
);
559 txopts
= ipv6_update_options(sk
, txopts
);
561 atomic_sub(txopts
->tot_len
, &sk
->sk_omem_alloc
);
569 * calipso_tlv_len - Returns the length of the TLV
570 * @opt: the option header
571 * @offset: offset of the TLV within the header
574 * Returns the length of the TLV option at offset @offset within
575 * the option header @opt. Checks that the entire TLV fits inside
576 * the option header, returns a negative value if this is not the case.
578 static int calipso_tlv_len(struct ipv6_opt_hdr
*opt
, unsigned int offset
)
580 unsigned char *tlv
= (unsigned char *)opt
;
581 unsigned int opt_len
= ipv6_optlen(opt
), tlv_len
;
583 if (offset
< sizeof(*opt
) || offset
>= opt_len
)
585 if (tlv
[offset
] == IPV6_TLV_PAD1
)
587 if (offset
+ 1 >= opt_len
)
589 tlv_len
= tlv
[offset
+ 1] + 2;
590 if (offset
+ tlv_len
> opt_len
)
596 * calipso_opt_find - Finds the CALIPSO option in an IPv6 hop options header
597 * @hop: the hop options header
598 * @start: on return holds the offset of any leading padding
599 * @end: on return holds the offset of the first non-pad TLV after CALIPSO
602 * Finds the space occupied by a CALIPSO option (including any leading and
605 * If a CALIPSO option exists set @start and @end to the
606 * offsets within @hop of the start of padding before the first
607 * CALIPSO option and the end of padding after the first CALIPSO
608 * option. In this case the function returns 0.
610 * In the absence of a CALIPSO option, @start and @end will be
611 * set to the start and end of any trailing padding in the header.
612 * This is useful when appending a new option, as the caller may want
613 * to overwrite some of this padding. In this case the function will
616 static int calipso_opt_find(struct ipv6_opt_hdr
*hop
, unsigned int *start
,
619 int ret_val
= -ENOENT
, tlv_len
;
620 unsigned int opt_len
, offset
, offset_s
= 0, offset_e
= 0;
621 unsigned char *opt
= (unsigned char *)hop
;
623 opt_len
= ipv6_optlen(hop
);
624 offset
= sizeof(*hop
);
626 while (offset
< opt_len
) {
627 tlv_len
= calipso_tlv_len(hop
, offset
);
631 switch (opt
[offset
]) {
637 case IPV6_TLV_CALIPSO
:
652 *start
= offset_s
+ calipso_tlv_len(hop
, offset_s
);
654 *start
= sizeof(*hop
);
656 *end
= offset_e
+ calipso_tlv_len(hop
, offset_e
);
664 * calipso_opt_insert - Inserts a CALIPSO option into an IPv6 hop opt hdr
665 * @hop: the original hop options header
666 * @doi_def: the CALIPSO DOI to use
667 * @secattr: the specific security attributes of the socket
670 * Creates a new hop options header based on @hop with a
671 * CALIPSO option added to it. If @hop already contains a CALIPSO
672 * option this is overwritten, otherwise the new option is appended
673 * after any existing options. If @hop is NULL then the new header
674 * will contain just the CALIPSO option and any needed padding.
677 static struct ipv6_opt_hdr
*
678 calipso_opt_insert(struct ipv6_opt_hdr
*hop
,
679 const struct calipso_doi
*doi_def
,
680 const struct netlbl_lsm_secattr
*secattr
)
682 unsigned int start
, end
, buf_len
, pad
, hop_len
;
683 struct ipv6_opt_hdr
*new;
687 hop_len
= ipv6_optlen(hop
);
688 ret_val
= calipso_opt_find(hop
, &start
, &end
);
689 if (ret_val
&& ret_val
!= -ENOENT
)
690 return ERR_PTR(ret_val
);
693 start
= sizeof(*hop
);
697 buf_len
= hop_len
+ start
- end
+ CALIPSO_OPT_LEN_MAX_WITH_PAD
;
698 new = kzalloc(buf_len
, GFP_ATOMIC
);
700 return ERR_PTR(-ENOMEM
);
702 if (start
> sizeof(*hop
))
703 memcpy(new, hop
, start
);
704 ret_val
= calipso_genopt((unsigned char *)new, start
, buf_len
, doi_def
,
707 return ERR_PTR(ret_val
);
709 buf_len
= start
+ ret_val
;
710 /* At this point buf_len aligns to 4n, so (buf_len & 4) pads to 8n */
711 pad
= ((buf_len
& 4) + (end
& 7)) & 7;
712 calipso_pad_write((unsigned char *)new, buf_len
, pad
);
715 if (end
!= hop_len
) {
716 memcpy((char *)new + buf_len
, (char *)hop
+ end
, hop_len
- end
);
717 buf_len
+= hop_len
- end
;
720 new->hdrlen
= buf_len
/ 8 - 1;
726 * calipso_opt_del - Removes the CALIPSO option from an option header
727 * @hop: the original header
728 * @new: the new header
731 * Creates a new header based on @hop without any CALIPSO option. If @hop
732 * doesn't contain a CALIPSO option it returns -ENOENT. If @hop contains
733 * no other non-padding options, it returns zero with @new set to NULL.
734 * Otherwise it returns zero, creates a new header without the CALIPSO
735 * option (and removing as much padding as possible) and returns with
736 * @new set to that header.
739 static int calipso_opt_del(struct ipv6_opt_hdr
*hop
,
740 struct ipv6_opt_hdr
**new)
743 unsigned int start
, end
, delta
, pad
, hop_len
;
745 ret_val
= calipso_opt_find(hop
, &start
, &end
);
749 hop_len
= ipv6_optlen(hop
);
750 if (start
== sizeof(*hop
) && end
== hop_len
) {
751 /* There's no other option in the header so return NULL */
756 delta
= (end
- start
) & ~7;
757 *new = kzalloc(hop_len
- delta
, GFP_ATOMIC
);
761 memcpy(*new, hop
, start
);
762 (*new)->hdrlen
-= delta
/ 8;
763 pad
= (end
- start
) & 7;
764 calipso_pad_write((unsigned char *)*new, start
, pad
);
766 memcpy((char *)*new + start
+ pad
, (char *)hop
+ end
,
773 * calipso_opt_getattr - Get the security attributes from a memory block
774 * @calipso: the CALIPSO option
775 * @secattr: the security attributes
778 * Inspect @calipso and return the security attributes in @secattr.
779 * Returns zero on success and negative values on failure.
782 static int calipso_opt_getattr(const unsigned char *calipso
,
783 struct netlbl_lsm_secattr
*secattr
)
785 int ret_val
= -ENOMSG
;
786 u32 doi
, len
= calipso
[1], cat_len
= calipso
[6] * 4;
787 struct calipso_doi
*doi_def
;
789 if (cat_len
+ 8 > len
)
792 doi
= get_unaligned_be32(calipso
+ 2);
794 doi_def
= calipso_doi_search(doi
);
798 secattr
->attr
.mls
.lvl
= calipso
[7];
799 secattr
->flags
|= NETLBL_SECATTR_MLS_LVL
;
802 ret_val
= calipso_map_cat_ntoh(doi_def
,
807 netlbl_catmap_free(secattr
->attr
.mls
.cat
);
811 secattr
->flags
|= NETLBL_SECATTR_MLS_CAT
;
814 secattr
->type
= NETLBL_NLTYPE_CALIPSO
;
825 * calipso_sock_getattr - Get the security attributes from a sock
827 * @secattr: the security attributes
830 * Query @sk to see if there is a CALIPSO option attached to the sock and if
831 * there is return the CALIPSO security attributes in @secattr. This function
832 * requires that @sk be locked, or privately held, but it does not do any
833 * locking itself. Returns zero on success and negative values on failure.
836 static int calipso_sock_getattr(struct sock
*sk
,
837 struct netlbl_lsm_secattr
*secattr
)
839 struct ipv6_opt_hdr
*hop
;
840 int opt_len
, len
, ret_val
= -ENOMSG
, offset
;
842 struct ipv6_txoptions
*txopts
= txopt_get(inet6_sk(sk
));
844 if (!txopts
|| !txopts
->hopopt
)
847 hop
= txopts
->hopopt
;
848 opt
= (unsigned char *)hop
;
849 opt_len
= ipv6_optlen(hop
);
850 offset
= sizeof(*hop
);
851 while (offset
< opt_len
) {
852 len
= calipso_tlv_len(hop
, offset
);
857 switch (opt
[offset
]) {
858 case IPV6_TLV_CALIPSO
:
859 if (len
< CALIPSO_HDR_LEN
)
862 ret_val
= calipso_opt_getattr(&opt
[offset
],
876 * calipso_sock_setattr - Add a CALIPSO option to a socket
878 * @doi_def: the CALIPSO DOI to use
879 * @secattr: the specific security attributes of the socket
882 * Set the CALIPSO option on the given socket using the DOI definition and
883 * security attributes passed to the function. This function requires
884 * exclusive access to @sk, which means it either needs to be in the
885 * process of being created or locked. Returns zero on success and negative
889 static int calipso_sock_setattr(struct sock
*sk
,
890 const struct calipso_doi
*doi_def
,
891 const struct netlbl_lsm_secattr
*secattr
)
894 struct ipv6_opt_hdr
*old
, *new;
895 struct ipv6_txoptions
*txopts
= txopt_get(inet6_sk(sk
));
899 old
= txopts
->hopopt
;
901 new = calipso_opt_insert(old
, doi_def
, secattr
);
906 ret_val
= calipso_opt_update(sk
, new);
913 * calipso_sock_delattr - Delete the CALIPSO option from a socket
917 * Removes the CALIPSO option from a socket, if present.
920 static void calipso_sock_delattr(struct sock
*sk
)
922 struct ipv6_opt_hdr
*new_hop
;
923 struct ipv6_txoptions
*txopts
= txopt_get(inet6_sk(sk
));
925 if (!txopts
|| !txopts
->hopopt
)
928 if (calipso_opt_del(txopts
->hopopt
, &new_hop
))
931 calipso_opt_update(sk
, new_hop
);
938 /* request sock functions.
942 * calipso_req_setattr - Add a CALIPSO option to a connection request socket
943 * @req: the connection request socket
944 * @doi_def: the CALIPSO DOI to use
945 * @secattr: the specific security attributes of the socket
948 * Set the CALIPSO option on the given socket using the DOI definition and
949 * security attributes passed to the function. Returns zero on success and
950 * negative values on failure.
953 static int calipso_req_setattr(struct request_sock
*req
,
954 const struct calipso_doi
*doi_def
,
955 const struct netlbl_lsm_secattr
*secattr
)
957 struct ipv6_txoptions
*txopts
;
958 struct inet_request_sock
*req_inet
= inet_rsk(req
);
959 struct ipv6_opt_hdr
*old
, *new;
960 struct sock
*sk
= sk_to_full_sk(req_to_sk(req
));
962 if (req_inet
->ipv6_opt
&& req_inet
->ipv6_opt
->hopopt
)
963 old
= req_inet
->ipv6_opt
->hopopt
;
967 new = calipso_opt_insert(old
, doi_def
, secattr
);
971 txopts
= ipv6_renew_options_kern(sk
, req_inet
->ipv6_opt
, IPV6_HOPOPTS
,
972 new, new ? ipv6_optlen(new) : 0);
977 return PTR_ERR(txopts
);
979 txopts
= xchg(&req_inet
->ipv6_opt
, txopts
);
981 atomic_sub(txopts
->tot_len
, &sk
->sk_omem_alloc
);
989 * calipso_req_delattr - Delete the CALIPSO option from a request socket
990 * @reg: the request socket
993 * Removes the CALIPSO option from a request socket, if present.
996 static void calipso_req_delattr(struct request_sock
*req
)
998 struct inet_request_sock
*req_inet
= inet_rsk(req
);
999 struct ipv6_opt_hdr
*new;
1000 struct ipv6_txoptions
*txopts
;
1001 struct sock
*sk
= sk_to_full_sk(req_to_sk(req
));
1003 if (!req_inet
->ipv6_opt
|| !req_inet
->ipv6_opt
->hopopt
)
1006 if (calipso_opt_del(req_inet
->ipv6_opt
->hopopt
, &new))
1007 return; /* Nothing to do */
1009 txopts
= ipv6_renew_options_kern(sk
, req_inet
->ipv6_opt
, IPV6_HOPOPTS
,
1010 new, new ? ipv6_optlen(new) : 0);
1012 if (!IS_ERR(txopts
)) {
1013 txopts
= xchg(&req_inet
->ipv6_opt
, txopts
);
1015 atomic_sub(txopts
->tot_len
, &sk
->sk_omem_alloc
);
1022 /* skbuff functions.
1026 * calipso_skbuff_optptr - Find the CALIPSO option in the packet
1030 * Parse the packet's IP header looking for a CALIPSO option. Returns a pointer
1031 * to the start of the CALIPSO option on success, NULL if one if not found.
1034 static unsigned char *calipso_skbuff_optptr(const struct sk_buff
*skb
)
1036 const struct ipv6hdr
*ip6_hdr
= ipv6_hdr(skb
);
1039 if (ip6_hdr
->nexthdr
!= NEXTHDR_HOP
)
1042 offset
= ipv6_find_tlv(skb
, sizeof(*ip6_hdr
), IPV6_TLV_CALIPSO
);
1044 return (unsigned char *)ip6_hdr
+ offset
;
1050 * calipso_skbuff_setattr - Set the CALIPSO option on a packet
1052 * @doi_def: the CALIPSO DOI to use
1053 * @secattr: the security attributes
1056 * Set the CALIPSO option on the given packet based on the security attributes.
1057 * Returns a pointer to the IP header on success and NULL on failure.
1060 static int calipso_skbuff_setattr(struct sk_buff
*skb
,
1061 const struct calipso_doi
*doi_def
,
1062 const struct netlbl_lsm_secattr
*secattr
)
1065 struct ipv6hdr
*ip6_hdr
;
1066 struct ipv6_opt_hdr
*hop
;
1067 unsigned char buf
[CALIPSO_MAX_BUFFER
];
1068 int len_delta
, new_end
, pad
;
1069 unsigned int start
, end
;
1071 ip6_hdr
= ipv6_hdr(skb
);
1072 if (ip6_hdr
->nexthdr
== NEXTHDR_HOP
) {
1073 hop
= (struct ipv6_opt_hdr
*)(ip6_hdr
+ 1);
1074 ret_val
= calipso_opt_find(hop
, &start
, &end
);
1075 if (ret_val
&& ret_val
!= -ENOENT
)
1082 memset(buf
, 0, sizeof(buf
));
1083 ret_val
= calipso_genopt(buf
, start
& 3, sizeof(buf
), doi_def
, secattr
);
1087 new_end
= start
+ ret_val
;
1088 /* At this point new_end aligns to 4n, so (new_end & 4) pads to 8n */
1089 pad
= ((new_end
& 4) + (end
& 7)) & 7;
1090 len_delta
= new_end
- (int)end
+ pad
;
1091 ret_val
= skb_cow(skb
, skb_headroom(skb
) + len_delta
);
1097 skb_push(skb
, len_delta
);
1099 skb_pull(skb
, -len_delta
);
1100 memmove((char *)ip6_hdr
- len_delta
, ip6_hdr
,
1101 sizeof(*ip6_hdr
) + start
);
1102 skb_reset_network_header(skb
);
1103 ip6_hdr
= ipv6_hdr(skb
);
1106 hop
= (struct ipv6_opt_hdr
*)(ip6_hdr
+ 1);
1108 struct ipv6_opt_hdr
*new_hop
= (struct ipv6_opt_hdr
*)buf
;
1110 new_hop
->nexthdr
= ip6_hdr
->nexthdr
;
1111 new_hop
->hdrlen
= len_delta
/ 8 - 1;
1112 ip6_hdr
->nexthdr
= NEXTHDR_HOP
;
1114 hop
->hdrlen
+= len_delta
/ 8;
1116 memcpy((char *)hop
+ start
, buf
+ (start
& 3), new_end
- start
);
1117 calipso_pad_write((unsigned char *)hop
, new_end
, pad
);
1123 * calipso_skbuff_delattr - Delete any CALIPSO options from a packet
1127 * Removes any and all CALIPSO options from the given packet. Returns zero on
1128 * success, negative values on failure.
1131 static int calipso_skbuff_delattr(struct sk_buff
*skb
)
1134 struct ipv6hdr
*ip6_hdr
;
1135 struct ipv6_opt_hdr
*old_hop
;
1136 u32 old_hop_len
, start
= 0, end
= 0, delta
, size
, pad
;
1138 if (!calipso_skbuff_optptr(skb
))
1141 /* since we are changing the packet we should make a copy */
1142 ret_val
= skb_cow(skb
, skb_headroom(skb
));
1146 ip6_hdr
= ipv6_hdr(skb
);
1147 old_hop
= (struct ipv6_opt_hdr
*)(ip6_hdr
+ 1);
1148 old_hop_len
= ipv6_optlen(old_hop
);
1150 ret_val
= calipso_opt_find(old_hop
, &start
, &end
);
1154 if (start
== sizeof(*old_hop
) && end
== old_hop_len
) {
1155 /* There's no other option in the header so we delete
1156 * the whole thing. */
1157 delta
= old_hop_len
;
1158 size
= sizeof(*ip6_hdr
);
1159 ip6_hdr
->nexthdr
= old_hop
->nexthdr
;
1161 delta
= (end
- start
) & ~7;
1163 old_hop
->hdrlen
-= delta
/ 8;
1164 pad
= (end
- start
) & 7;
1165 size
= sizeof(*ip6_hdr
) + start
+ pad
;
1166 calipso_pad_write((unsigned char *)old_hop
, start
, pad
);
1170 skb_pull(skb
, delta
);
1171 memmove((char *)ip6_hdr
+ delta
, ip6_hdr
, size
);
1172 skb_reset_network_header(skb
);
1178 static const struct netlbl_calipso_ops ops
= {
1179 .doi_add
= calipso_doi_add
,
1180 .doi_free
= calipso_doi_free
,
1181 .doi_remove
= calipso_doi_remove
,
1182 .doi_getdef
= calipso_doi_getdef
,
1183 .doi_putdef
= calipso_doi_putdef
,
1184 .doi_walk
= calipso_doi_walk
,
1185 .sock_getattr
= calipso_sock_getattr
,
1186 .sock_setattr
= calipso_sock_setattr
,
1187 .sock_delattr
= calipso_sock_delattr
,
1188 .req_setattr
= calipso_req_setattr
,
1189 .req_delattr
= calipso_req_delattr
,
1190 .opt_getattr
= calipso_opt_getattr
,
1191 .skbuff_optptr
= calipso_skbuff_optptr
,
1192 .skbuff_setattr
= calipso_skbuff_setattr
,
1193 .skbuff_delattr
= calipso_skbuff_delattr
,
1197 * calipso_init - Initialize the CALIPSO module
1200 * Initialize the CALIPSO module and prepare it for use. Returns zero on
1201 * success and negative values on failure.
1204 int __init
calipso_init(void)
1206 netlbl_calipso_ops_register(&ops
);
1210 void calipso_exit(void)
1212 netlbl_calipso_ops_register(NULL
);