Commit ceba1832 authored by Huw Davies's avatar Huw Davies Committed by Paul Moore

calipso: Set the calipso socket label to match the secattr.

CALIPSO is a hop-by-hop IPv6 option.  A lot of this patch is based on
the equivalent CISPO code.  The main difference is due to manipulating
the options in the hop-by-hop header.
Signed-off-by: default avatarHuw Davies <huw@codeweavers.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 3faa8f98
...@@ -319,6 +319,8 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space, ...@@ -319,6 +319,8 @@ struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb, bool ipv6_opt_accepted(const struct sock *sk, const struct sk_buff *skb,
const struct inet6_skb_parm *opt); const struct inet6_skb_parm *opt);
struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
struct ipv6_txoptions *opt);
static inline bool ipv6_accept_ra(struct inet6_dev *idev) static inline bool ipv6_accept_ra(struct inet6_dev *idev)
{ {
......
...@@ -226,6 +226,9 @@ struct netlbl_lsm_secattr { ...@@ -226,6 +226,9 @@ struct netlbl_lsm_secattr {
* @doi_getdef: returns a reference to a DOI * @doi_getdef: returns a reference to a DOI
* @doi_putdef: releases a reference of a DOI * @doi_putdef: releases a reference of a DOI
* @doi_walk: enumerate the DOI list * @doi_walk: enumerate the DOI list
* @sock_getattr: retrieve the socket's attr
* @sock_setattr: set the socket's attr
* @sock_delattr: remove the socket's attr
* *
* Description: * Description:
* This structure is filled out by the CALIPSO engine and passed * This structure is filled out by the CALIPSO engine and passed
...@@ -243,6 +246,12 @@ struct netlbl_calipso_ops { ...@@ -243,6 +246,12 @@ struct netlbl_calipso_ops {
int (*doi_walk)(u32 *skip_cnt, int (*doi_walk)(u32 *skip_cnt,
int (*callback)(struct calipso_doi *doi_def, void *arg), int (*callback)(struct calipso_doi *doi_def, void *arg),
void *cb_arg); void *cb_arg);
int (*sock_getattr)(struct sock *sk,
struct netlbl_lsm_secattr *secattr);
int (*sock_setattr)(struct sock *sk,
const struct calipso_doi *doi_def,
const struct netlbl_lsm_secattr *secattr);
void (*sock_delattr)(struct sock *sk);
}; };
/* /*
......
...@@ -143,6 +143,7 @@ struct in6_flowlabel_req { ...@@ -143,6 +143,7 @@ struct in6_flowlabel_req {
#define IPV6_TLV_PAD1 0 #define IPV6_TLV_PAD1 0
#define IPV6_TLV_PADN 1 #define IPV6_TLV_PADN 1
#define IPV6_TLV_ROUTERALERT 5 #define IPV6_TLV_ROUTERALERT 5
#define IPV6_TLV_CALIPSO 7 /* RFC 5570 */
#define IPV6_TLV_JUMBO 194 #define IPV6_TLV_JUMBO 194
#define IPV6_TLV_HAO 201 /* home address option */ #define IPV6_TLV_HAO 201 /* home address option */
......
This diff is collapsed.
...@@ -98,7 +98,6 @@ int ip6_ra_control(struct sock *sk, int sel) ...@@ -98,7 +98,6 @@ int ip6_ra_control(struct sock *sk, int sel)
return 0; return 0;
} }
static
struct ipv6_txoptions *ipv6_update_options(struct sock *sk, struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
struct ipv6_txoptions *opt) struct ipv6_txoptions *opt)
{ {
......
...@@ -5,6 +5,7 @@ ...@@ -5,6 +5,7 @@
config NETLABEL config NETLABEL
bool "NetLabel subsystem support" bool "NetLabel subsystem support"
depends on SECURITY depends on SECURITY
select CRC_CCITT if IPV6
default n default n
---help--- ---help---
NetLabel provides support for explicit network packet labeling NetLabel provides support for explicit network packet labeling
......
...@@ -514,3 +514,67 @@ int calipso_doi_walk(u32 *skip_cnt, ...@@ -514,3 +514,67 @@ int calipso_doi_walk(u32 *skip_cnt,
ret_val = ops->doi_walk(skip_cnt, callback, cb_arg); ret_val = ops->doi_walk(skip_cnt, callback, cb_arg);
return ret_val; return ret_val;
} }
/**
* calipso_sock_getattr - Get the security attributes from a sock
* @sk: the sock
* @secattr: the security attributes
*
* Description:
* Query @sk to see if there is a CALIPSO option attached to the sock and if
* there is return the CALIPSO security attributes in @secattr. This function
* requires that @sk be locked, or privately held, but it does not do any
* locking itself. Returns zero on success and negative values on failure.
*
*/
int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
{
int ret_val = -ENOMSG;
const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
if (ops)
ret_val = ops->sock_getattr(sk, secattr);
return ret_val;
}
/**
* calipso_sock_setattr - Add a CALIPSO option to a socket
* @sk: the socket
* @doi_def: the CALIPSO DOI to use
* @secattr: the specific security attributes of the socket
*
* Description:
* Set the CALIPSO option on the given socket using the DOI definition and
* security attributes passed to the function. This function requires
* exclusive access to @sk, which means it either needs to be in the
* process of being created or locked. Returns zero on success and negative
* values on failure.
*
*/
int calipso_sock_setattr(struct sock *sk,
const struct calipso_doi *doi_def,
const struct netlbl_lsm_secattr *secattr)
{
int ret_val = -ENOMSG;
const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
if (ops)
ret_val = ops->sock_setattr(sk, doi_def, secattr);
return ret_val;
}
/**
* calipso_sock_delattr - Delete the CALIPSO option from a socket
* @sk: the socket
*
* Description:
* Removes the CALIPSO option from a socket, if present.
*
*/
void calipso_sock_delattr(struct sock *sk)
{
const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
if (ops)
ops->sock_delattr(sk);
}
...@@ -128,5 +128,10 @@ void calipso_doi_putdef(struct calipso_doi *doi_def); ...@@ -128,5 +128,10 @@ void calipso_doi_putdef(struct calipso_doi *doi_def);
int calipso_doi_walk(u32 *skip_cnt, int calipso_doi_walk(u32 *skip_cnt,
int (*callback)(struct calipso_doi *doi_def, void *arg), int (*callback)(struct calipso_doi *doi_def, void *arg),
void *cb_arg); void *cb_arg);
int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
int calipso_sock_setattr(struct sock *sk,
const struct calipso_doi *doi_def,
const struct netlbl_lsm_secattr *secattr);
void calipso_sock_delattr(struct sock *sk);
#endif #endif
...@@ -37,12 +37,14 @@ ...@@ -37,12 +37,14 @@
#include <net/ipv6.h> #include <net/ipv6.h>
#include <net/netlabel.h> #include <net/netlabel.h>
#include <net/cipso_ipv4.h> #include <net/cipso_ipv4.h>
#include <net/calipso.h>
#include <asm/bug.h> #include <asm/bug.h>
#include <linux/atomic.h> #include <linux/atomic.h>
#include "netlabel_domainhash.h" #include "netlabel_domainhash.h"
#include "netlabel_unlabeled.h" #include "netlabel_unlabeled.h"
#include "netlabel_cipso_v4.h" #include "netlabel_cipso_v4.h"
#include "netlabel_calipso.h"
#include "netlabel_user.h" #include "netlabel_user.h"
#include "netlabel_mgmt.h" #include "netlabel_mgmt.h"
#include "netlabel_addrlist.h" #include "netlabel_addrlist.h"
...@@ -521,6 +523,7 @@ int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset) ...@@ -521,6 +523,7 @@ int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset)
return -ENOENT; return -ENOENT;
} }
EXPORT_SYMBOL(netlbl_catmap_walk);
/** /**
* netlbl_catmap_walkrng - Find the end of a string of set bits * netlbl_catmap_walkrng - Find the end of a string of set bits
...@@ -656,6 +659,7 @@ int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap, ...@@ -656,6 +659,7 @@ int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
return 0; return 0;
} }
EXPORT_SYMBOL(netlbl_catmap_setbit);
/** /**
* netlbl_catmap_setrng - Set a range of bits in a LSM secattr catmap * netlbl_catmap_setrng - Set a range of bits in a LSM secattr catmap
...@@ -870,10 +874,22 @@ int netlbl_sock_setattr(struct sock *sk, ...@@ -870,10 +874,22 @@ int netlbl_sock_setattr(struct sock *sk,
break; break;
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
case AF_INET6: case AF_INET6:
/* since we don't support any IPv6 labeling protocols right switch (dom_entry->def.type) {
* now we can optimize everything away until we do */ case NETLBL_NLTYPE_ADDRSELECT:
ret_val = -EDESTADDRREQ;
break;
case NETLBL_NLTYPE_CALIPSO:
ret_val = calipso_sock_setattr(sk,
dom_entry->def.calipso,
secattr);
break;
case NETLBL_NLTYPE_UNLABELED:
ret_val = 0; ret_val = 0;
break; break;
default:
ret_val = -ENOENT;
}
break;
#endif /* IPv6 */ #endif /* IPv6 */
default: default:
ret_val = -EPROTONOSUPPORT; ret_val = -EPROTONOSUPPORT;
...@@ -899,6 +915,11 @@ void netlbl_sock_delattr(struct sock *sk) ...@@ -899,6 +915,11 @@ void netlbl_sock_delattr(struct sock *sk)
case AF_INET: case AF_INET:
cipso_v4_sock_delattr(sk); cipso_v4_sock_delattr(sk);
break; break;
#if IS_ENABLED(CONFIG_IPV6)
case AF_INET6:
calipso_sock_delattr(sk);
break;
#endif /* IPv6 */
} }
} }
...@@ -925,7 +946,7 @@ int netlbl_sock_getattr(struct sock *sk, ...@@ -925,7 +946,7 @@ int netlbl_sock_getattr(struct sock *sk,
break; break;
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
case AF_INET6: case AF_INET6:
ret_val = -ENOMSG; ret_val = calipso_sock_getattr(sk, secattr);
break; break;
#endif /* IPv6 */ #endif /* IPv6 */
default: default:
...@@ -953,6 +974,9 @@ int netlbl_conn_setattr(struct sock *sk, ...@@ -953,6 +974,9 @@ int netlbl_conn_setattr(struct sock *sk,
{ {
int ret_val; int ret_val;
struct sockaddr_in *addr4; struct sockaddr_in *addr4;
#if IS_ENABLED(CONFIG_IPV6)
struct sockaddr_in6 *addr6;
#endif
struct netlbl_dommap_def *entry; struct netlbl_dommap_def *entry;
rcu_read_lock(); rcu_read_lock();
...@@ -973,7 +997,7 @@ int netlbl_conn_setattr(struct sock *sk, ...@@ -973,7 +997,7 @@ int netlbl_conn_setattr(struct sock *sk,
case NETLBL_NLTYPE_UNLABELED: case NETLBL_NLTYPE_UNLABELED:
/* just delete the protocols we support for right now /* just delete the protocols we support for right now
* but we could remove other protocols if needed */ * but we could remove other protocols if needed */
cipso_v4_sock_delattr(sk); netlbl_sock_delattr(sk);
ret_val = 0; ret_val = 0;
break; break;
default: default:
...@@ -982,10 +1006,28 @@ int netlbl_conn_setattr(struct sock *sk, ...@@ -982,10 +1006,28 @@ int netlbl_conn_setattr(struct sock *sk,
break; break;
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
case AF_INET6: case AF_INET6:
/* since we don't support any IPv6 labeling protocols right addr6 = (struct sockaddr_in6 *)addr;
* now we can optimize everything away until we do */ entry = netlbl_domhsh_getentry_af6(secattr->domain,
&addr6->sin6_addr);
if (entry == NULL) {
ret_val = -ENOENT;
goto conn_setattr_return;
}
switch (entry->type) {
case NETLBL_NLTYPE_CALIPSO:
ret_val = calipso_sock_setattr(sk,
entry->calipso, secattr);
break;
case NETLBL_NLTYPE_UNLABELED:
/* just delete the protocols we support for right now
* but we could remove other protocols if needed */
netlbl_sock_delattr(sk);
ret_val = 0; ret_val = 0;
break; break;
default:
ret_val = -ENOENT;
}
break;
#endif /* IPv6 */ #endif /* IPv6 */
default: default:
ret_val = -EPROTONOSUPPORT; ret_val = -EPROTONOSUPPORT;
......
...@@ -333,7 +333,7 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family) ...@@ -333,7 +333,7 @@ int selinux_netlbl_socket_post_create(struct sock *sk, u16 family)
struct sk_security_struct *sksec = sk->sk_security; struct sk_security_struct *sksec = sk->sk_security;
struct netlbl_lsm_secattr *secattr; struct netlbl_lsm_secattr *secattr;
if (family != PF_INET) if (family != PF_INET && family != PF_INET6)
return 0; return 0;
secattr = selinux_netlbl_sock_genattr(sk); secattr = selinux_netlbl_sock_genattr(sk);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment