forked from Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
369 lines
9.7 KiB
369 lines
9.7 KiB
// SPDX-License-Identifier: GPL-2.0-or-later |
|
/* |
|
* NetLabel Network Address Lists |
|
* |
|
* This file contains network address list functions used to manage ordered |
|
* lists of network addresses for use by the NetLabel subsystem. The NetLabel |
|
* system manages static and dynamic label mappings for network protocols such |
|
* as CIPSO and RIPSO. |
|
* |
|
* Author: Paul Moore <[email protected]> |
|
*/ |
|
|
|
/* |
|
* (c) Copyright Hewlett-Packard Development Company, L.P., 2008 |
|
*/ |
|
|
|
#include <linux/types.h> |
|
#include <linux/rcupdate.h> |
|
#include <linux/list.h> |
|
#include <linux/spinlock.h> |
|
#include <linux/in.h> |
|
#include <linux/in6.h> |
|
#include <linux/ip.h> |
|
#include <linux/ipv6.h> |
|
#include <net/ip.h> |
|
#include <net/ipv6.h> |
|
#include <linux/audit.h> |
|
|
|
#include "netlabel_addrlist.h" |
|
|
|
/* |
|
* Address List Functions |
|
*/ |
|
|
|
/** |
|
* netlbl_af4list_search - Search for a matching IPv4 address entry |
|
* @addr: IPv4 address |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Searches the IPv4 address list given by @head. If a matching address entry |
|
* is found it is returned, otherwise NULL is returned. The caller is |
|
* responsible for calling the rcu_read_[un]lock() functions. |
|
* |
|
*/ |
|
struct netlbl_af4list *netlbl_af4list_search(__be32 addr, |
|
struct list_head *head) |
|
{ |
|
struct netlbl_af4list *iter; |
|
|
|
list_for_each_entry_rcu(iter, head, list) |
|
if (iter->valid && (addr & iter->mask) == iter->addr) |
|
return iter; |
|
|
|
return NULL; |
|
} |
|
|
|
/** |
|
* netlbl_af4list_search_exact - Search for an exact IPv4 address entry |
|
* @addr: IPv4 address |
|
* @mask: IPv4 address mask |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Searches the IPv4 address list given by @head. If an exact match if found |
|
* it is returned, otherwise NULL is returned. The caller is responsible for |
|
* calling the rcu_read_[un]lock() functions. |
|
* |
|
*/ |
|
struct netlbl_af4list *netlbl_af4list_search_exact(__be32 addr, |
|
__be32 mask, |
|
struct list_head *head) |
|
{ |
|
struct netlbl_af4list *iter; |
|
|
|
list_for_each_entry_rcu(iter, head, list) |
|
if (iter->valid && iter->addr == addr && iter->mask == mask) |
|
return iter; |
|
|
|
return NULL; |
|
} |
|
|
|
|
|
#if IS_ENABLED(CONFIG_IPV6) |
|
/** |
|
* netlbl_af6list_search - Search for a matching IPv6 address entry |
|
* @addr: IPv6 address |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Searches the IPv6 address list given by @head. If a matching address entry |
|
* is found it is returned, otherwise NULL is returned. The caller is |
|
* responsible for calling the rcu_read_[un]lock() functions. |
|
* |
|
*/ |
|
struct netlbl_af6list *netlbl_af6list_search(const struct in6_addr *addr, |
|
struct list_head *head) |
|
{ |
|
struct netlbl_af6list *iter; |
|
|
|
list_for_each_entry_rcu(iter, head, list) |
|
if (iter->valid && |
|
ipv6_masked_addr_cmp(&iter->addr, &iter->mask, addr) == 0) |
|
return iter; |
|
|
|
return NULL; |
|
} |
|
|
|
/** |
|
* netlbl_af6list_search_exact - Search for an exact IPv6 address entry |
|
* @addr: IPv6 address |
|
* @mask: IPv6 address mask |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Searches the IPv6 address list given by @head. If an exact match if found |
|
* it is returned, otherwise NULL is returned. The caller is responsible for |
|
* calling the rcu_read_[un]lock() functions. |
|
* |
|
*/ |
|
struct netlbl_af6list *netlbl_af6list_search_exact(const struct in6_addr *addr, |
|
const struct in6_addr *mask, |
|
struct list_head *head) |
|
{ |
|
struct netlbl_af6list *iter; |
|
|
|
list_for_each_entry_rcu(iter, head, list) |
|
if (iter->valid && |
|
ipv6_addr_equal(&iter->addr, addr) && |
|
ipv6_addr_equal(&iter->mask, mask)) |
|
return iter; |
|
|
|
return NULL; |
|
} |
|
#endif /* IPv6 */ |
|
|
|
/** |
|
* netlbl_af4list_add - Add a new IPv4 address entry to a list |
|
* @entry: address entry |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Add a new address entry to the list pointed to by @head. On success zero is |
|
* returned, otherwise a negative value is returned. The caller is responsible |
|
* for calling the necessary locking functions. |
|
* |
|
*/ |
|
int netlbl_af4list_add(struct netlbl_af4list *entry, struct list_head *head) |
|
{ |
|
struct netlbl_af4list *iter; |
|
|
|
iter = netlbl_af4list_search(entry->addr, head); |
|
if (iter != NULL && |
|
iter->addr == entry->addr && iter->mask == entry->mask) |
|
return -EEXIST; |
|
|
|
/* in order to speed up address searches through the list (the common |
|
* case) we need to keep the list in order based on the size of the |
|
* address mask such that the entry with the widest mask (smallest |
|
* numerical value) appears first in the list */ |
|
list_for_each_entry_rcu(iter, head, list) |
|
if (iter->valid && |
|
ntohl(entry->mask) > ntohl(iter->mask)) { |
|
__list_add_rcu(&entry->list, |
|
iter->list.prev, |
|
&iter->list); |
|
return 0; |
|
} |
|
list_add_tail_rcu(&entry->list, head); |
|
return 0; |
|
} |
|
|
|
#if IS_ENABLED(CONFIG_IPV6) |
|
/** |
|
* netlbl_af6list_add - Add a new IPv6 address entry to a list |
|
* @entry: address entry |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Add a new address entry to the list pointed to by @head. On success zero is |
|
* returned, otherwise a negative value is returned. The caller is responsible |
|
* for calling the necessary locking functions. |
|
* |
|
*/ |
|
int netlbl_af6list_add(struct netlbl_af6list *entry, struct list_head *head) |
|
{ |
|
struct netlbl_af6list *iter; |
|
|
|
iter = netlbl_af6list_search(&entry->addr, head); |
|
if (iter != NULL && |
|
ipv6_addr_equal(&iter->addr, &entry->addr) && |
|
ipv6_addr_equal(&iter->mask, &entry->mask)) |
|
return -EEXIST; |
|
|
|
/* in order to speed up address searches through the list (the common |
|
* case) we need to keep the list in order based on the size of the |
|
* address mask such that the entry with the widest mask (smallest |
|
* numerical value) appears first in the list */ |
|
list_for_each_entry_rcu(iter, head, list) |
|
if (iter->valid && |
|
ipv6_addr_cmp(&entry->mask, &iter->mask) > 0) { |
|
__list_add_rcu(&entry->list, |
|
iter->list.prev, |
|
&iter->list); |
|
return 0; |
|
} |
|
list_add_tail_rcu(&entry->list, head); |
|
return 0; |
|
} |
|
#endif /* IPv6 */ |
|
|
|
/** |
|
* netlbl_af4list_remove_entry - Remove an IPv4 address entry |
|
* @entry: address entry |
|
* |
|
* Description: |
|
* Remove the specified IP address entry. The caller is responsible for |
|
* calling the necessary locking functions. |
|
* |
|
*/ |
|
void netlbl_af4list_remove_entry(struct netlbl_af4list *entry) |
|
{ |
|
entry->valid = 0; |
|
list_del_rcu(&entry->list); |
|
} |
|
|
|
/** |
|
* netlbl_af4list_remove - Remove an IPv4 address entry |
|
* @addr: IP address |
|
* @mask: IP address mask |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Remove an IP address entry from the list pointed to by @head. Returns the |
|
* entry on success, NULL on failure. The caller is responsible for calling |
|
* the necessary locking functions. |
|
* |
|
*/ |
|
struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask, |
|
struct list_head *head) |
|
{ |
|
struct netlbl_af4list *entry; |
|
|
|
entry = netlbl_af4list_search_exact(addr, mask, head); |
|
if (entry == NULL) |
|
return NULL; |
|
netlbl_af4list_remove_entry(entry); |
|
return entry; |
|
} |
|
|
|
#if IS_ENABLED(CONFIG_IPV6) |
|
/** |
|
* netlbl_af6list_remove_entry - Remove an IPv6 address entry |
|
* @entry: address entry |
|
* |
|
* Description: |
|
* Remove the specified IP address entry. The caller is responsible for |
|
* calling the necessary locking functions. |
|
* |
|
*/ |
|
void netlbl_af6list_remove_entry(struct netlbl_af6list *entry) |
|
{ |
|
entry->valid = 0; |
|
list_del_rcu(&entry->list); |
|
} |
|
|
|
/** |
|
* netlbl_af6list_remove - Remove an IPv6 address entry |
|
* @addr: IP address |
|
* @mask: IP address mask |
|
* @head: the list head |
|
* |
|
* Description: |
|
* Remove an IP address entry from the list pointed to by @head. Returns the |
|
* entry on success, NULL on failure. The caller is responsible for calling |
|
* the necessary locking functions. |
|
* |
|
*/ |
|
struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr, |
|
const struct in6_addr *mask, |
|
struct list_head *head) |
|
{ |
|
struct netlbl_af6list *entry; |
|
|
|
entry = netlbl_af6list_search_exact(addr, mask, head); |
|
if (entry == NULL) |
|
return NULL; |
|
netlbl_af6list_remove_entry(entry); |
|
return entry; |
|
} |
|
#endif /* IPv6 */ |
|
|
|
/* |
|
* Audit Helper Functions |
|
*/ |
|
|
|
#ifdef CONFIG_AUDIT |
|
/** |
|
* netlbl_af4list_audit_addr - Audit an IPv4 address |
|
* @audit_buf: audit buffer |
|
* @src: true if source address, false if destination |
|
* @dev: network interface |
|
* @addr: IP address |
|
* @mask: IP address mask |
|
* |
|
* Description: |
|
* Write the IPv4 address and address mask, if necessary, to @audit_buf. |
|
* |
|
*/ |
|
void netlbl_af4list_audit_addr(struct audit_buffer *audit_buf, |
|
int src, const char *dev, |
|
__be32 addr, __be32 mask) |
|
{ |
|
u32 mask_val = ntohl(mask); |
|
char *dir = (src ? "src" : "dst"); |
|
|
|
if (dev != NULL) |
|
audit_log_format(audit_buf, " netif=%s", dev); |
|
audit_log_format(audit_buf, " %s=%pI4", dir, &addr); |
|
if (mask_val != 0xffffffff) { |
|
u32 mask_len = 0; |
|
while (mask_val > 0) { |
|
mask_val <<= 1; |
|
mask_len++; |
|
} |
|
audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len); |
|
} |
|
} |
|
|
|
#if IS_ENABLED(CONFIG_IPV6) |
|
/** |
|
* netlbl_af6list_audit_addr - Audit an IPv6 address |
|
* @audit_buf: audit buffer |
|
* @src: true if source address, false if destination |
|
* @dev: network interface |
|
* @addr: IP address |
|
* @mask: IP address mask |
|
* |
|
* Description: |
|
* Write the IPv6 address and address mask, if necessary, to @audit_buf. |
|
* |
|
*/ |
|
void netlbl_af6list_audit_addr(struct audit_buffer *audit_buf, |
|
int src, |
|
const char *dev, |
|
const struct in6_addr *addr, |
|
const struct in6_addr *mask) |
|
{ |
|
char *dir = (src ? "src" : "dst"); |
|
|
|
if (dev != NULL) |
|
audit_log_format(audit_buf, " netif=%s", dev); |
|
audit_log_format(audit_buf, " %s=%pI6", dir, addr); |
|
if (ntohl(mask->s6_addr32[3]) != 0xffffffff) { |
|
u32 mask_len = 0; |
|
u32 mask_val; |
|
int iter = -1; |
|
while (ntohl(mask->s6_addr32[++iter]) == 0xffffffff) |
|
mask_len += 32; |
|
mask_val = ntohl(mask->s6_addr32[iter]); |
|
while (mask_val > 0) { |
|
mask_val <<= 1; |
|
mask_len++; |
|
} |
|
audit_log_format(audit_buf, " %s_prefixlen=%d", dir, mask_len); |
|
} |
|
} |
|
#endif /* IPv6 */ |
|
#endif /* CONFIG_AUDIT */
|
|
|