| 1 | // SPDX-License-Identifier: GPL-2.0-only | 
|---|
| 2 | /* | 
|---|
| 3 | * Network port table | 
|---|
| 4 | * | 
|---|
| 5 | * SELinux must keep a mapping of network ports to labels/SIDs.  This | 
|---|
| 6 | * mapping is maintained as part of the normal policy but a fast cache is | 
|---|
| 7 | * needed to reduce the lookup overhead. | 
|---|
| 8 | * | 
|---|
| 9 | * Author: Paul Moore <paul@paul-moore.com> | 
|---|
| 10 | * | 
|---|
| 11 | * This code is heavily based on the "netif" concept originally developed by | 
|---|
| 12 | * James Morris <jmorris@redhat.com> | 
|---|
| 13 | *   (see security/selinux/netif.c for more information) | 
|---|
| 14 | */ | 
|---|
| 15 |  | 
|---|
| 16 | /* | 
|---|
| 17 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2008 | 
|---|
| 18 | */ | 
|---|
| 19 |  | 
|---|
| 20 | #include <linux/types.h> | 
|---|
| 21 | #include <linux/rcupdate.h> | 
|---|
| 22 | #include <linux/list.h> | 
|---|
| 23 | #include <linux/slab.h> | 
|---|
| 24 | #include <linux/spinlock.h> | 
|---|
| 25 | #include <linux/in.h> | 
|---|
| 26 | #include <linux/in6.h> | 
|---|
| 27 | #include <linux/ip.h> | 
|---|
| 28 | #include <linux/ipv6.h> | 
|---|
| 29 | #include <net/ip.h> | 
|---|
| 30 | #include <net/ipv6.h> | 
|---|
| 31 |  | 
|---|
| 32 | #include "netport.h" | 
|---|
| 33 | #include "objsec.h" | 
|---|
| 34 |  | 
|---|
| 35 | #define SEL_NETPORT_HASH_SIZE       256 | 
|---|
| 36 | #define SEL_NETPORT_HASH_BKT_LIMIT   16 | 
|---|
| 37 |  | 
|---|
| 38 | struct sel_netport_bkt { | 
|---|
| 39 | int size; | 
|---|
| 40 | struct list_head list; | 
|---|
| 41 | }; | 
|---|
| 42 |  | 
|---|
| 43 | struct sel_netport { | 
|---|
| 44 | struct netport_security_struct psec; | 
|---|
| 45 |  | 
|---|
| 46 | struct list_head list; | 
|---|
| 47 | struct rcu_head rcu; | 
|---|
| 48 | }; | 
|---|
| 49 |  | 
|---|
| 50 | static DEFINE_SPINLOCK(sel_netport_lock); | 
|---|
| 51 | static struct sel_netport_bkt sel_netport_hash[SEL_NETPORT_HASH_SIZE]; | 
|---|
| 52 |  | 
|---|
| 53 | /** | 
|---|
| 54 | * sel_netport_hashfn - Hashing function for the port table | 
|---|
| 55 | * @pnum: port number | 
|---|
| 56 | * | 
|---|
| 57 | * Description: | 
|---|
| 58 | * This is the hashing function for the port table, it returns the bucket | 
|---|
| 59 | * number for the given port. | 
|---|
| 60 | * | 
|---|
| 61 | */ | 
|---|
| 62 | static unsigned int sel_netport_hashfn(u16 pnum) | 
|---|
| 63 | { | 
|---|
| 64 | return (pnum & (SEL_NETPORT_HASH_SIZE - 1)); | 
|---|
| 65 | } | 
|---|
| 66 |  | 
|---|
| 67 | /** | 
|---|
| 68 | * sel_netport_find - Search for a port record | 
|---|
| 69 | * @protocol: protocol | 
|---|
| 70 | * @pnum: port | 
|---|
| 71 | * | 
|---|
| 72 | * Description: | 
|---|
| 73 | * Search the network port table and return the matching record.  If an entry | 
|---|
| 74 | * can not be found in the table return NULL. | 
|---|
| 75 | * | 
|---|
| 76 | */ | 
|---|
| 77 | static struct sel_netport *sel_netport_find(u8 protocol, u16 pnum) | 
|---|
| 78 | { | 
|---|
| 79 | unsigned int idx; | 
|---|
| 80 | struct sel_netport *port; | 
|---|
| 81 |  | 
|---|
| 82 | idx = sel_netport_hashfn(pnum); | 
|---|
| 83 | list_for_each_entry_rcu(port, &sel_netport_hash[idx].list, list) | 
|---|
| 84 | if (port->psec.port == pnum && port->psec.protocol == protocol) | 
|---|
| 85 | return port; | 
|---|
| 86 |  | 
|---|
| 87 | return NULL; | 
|---|
| 88 | } | 
|---|
| 89 |  | 
|---|
| 90 | /** | 
|---|
| 91 | * sel_netport_insert - Insert a new port into the table | 
|---|
| 92 | * @port: the new port record | 
|---|
| 93 | * | 
|---|
| 94 | * Description: | 
|---|
| 95 | * Add a new port record to the network address hash table. | 
|---|
| 96 | * | 
|---|
| 97 | */ | 
|---|
| 98 | static void sel_netport_insert(struct sel_netport *port) | 
|---|
| 99 | { | 
|---|
| 100 | unsigned int idx; | 
|---|
| 101 |  | 
|---|
| 102 | /* we need to impose a limit on the growth of the hash table so check | 
|---|
| 103 | * this bucket to make sure it is within the specified bounds */ | 
|---|
| 104 | idx = sel_netport_hashfn(pnum: port->psec.port); | 
|---|
| 105 | list_add_rcu(new: &port->list, head: &sel_netport_hash[idx].list); | 
|---|
| 106 | if (sel_netport_hash[idx].size == SEL_NETPORT_HASH_BKT_LIMIT) { | 
|---|
| 107 | struct sel_netport *tail; | 
|---|
| 108 | tail = list_entry( | 
|---|
| 109 | rcu_dereference_protected( | 
|---|
| 110 | list_tail_rcu(&sel_netport_hash[idx].list), | 
|---|
| 111 | lockdep_is_held(&sel_netport_lock)), | 
|---|
| 112 | struct sel_netport, list); | 
|---|
| 113 | list_del_rcu(entry: &tail->list); | 
|---|
| 114 | kfree_rcu(tail, rcu); | 
|---|
| 115 | } else | 
|---|
| 116 | sel_netport_hash[idx].size++; | 
|---|
| 117 | } | 
|---|
| 118 |  | 
|---|
| 119 | /** | 
|---|
| 120 | * sel_netport_sid_slow - Lookup the SID of a network address using the policy | 
|---|
| 121 | * @protocol: protocol | 
|---|
| 122 | * @pnum: port | 
|---|
| 123 | * @sid: port SID | 
|---|
| 124 | * | 
|---|
| 125 | * Description: | 
|---|
| 126 | * This function determines the SID of a network port by querying the security | 
|---|
| 127 | * policy.  The result is added to the network port table to speedup future | 
|---|
| 128 | * queries.  Returns zero on success, negative values on failure. | 
|---|
| 129 | * | 
|---|
| 130 | */ | 
|---|
| 131 | static int sel_netport_sid_slow(u8 protocol, u16 pnum, u32 *sid) | 
|---|
| 132 | { | 
|---|
| 133 | int ret; | 
|---|
| 134 | struct sel_netport *port; | 
|---|
| 135 | struct sel_netport *new; | 
|---|
| 136 |  | 
|---|
| 137 | spin_lock_bh(lock: &sel_netport_lock); | 
|---|
| 138 | port = sel_netport_find(protocol, pnum); | 
|---|
| 139 | if (port != NULL) { | 
|---|
| 140 | *sid = port->psec.sid; | 
|---|
| 141 | spin_unlock_bh(lock: &sel_netport_lock); | 
|---|
| 142 | return 0; | 
|---|
| 143 | } | 
|---|
| 144 |  | 
|---|
| 145 | ret = security_port_sid(protocol, port: pnum, out_sid: sid); | 
|---|
| 146 | if (ret != 0) | 
|---|
| 147 | goto out; | 
|---|
| 148 |  | 
|---|
| 149 | /* If this memory allocation fails still return 0. The SID | 
|---|
| 150 | * is valid, it just won't be added to the cache. | 
|---|
| 151 | */ | 
|---|
| 152 | new = kmalloc(sizeof(*new), GFP_ATOMIC); | 
|---|
| 153 | if (new) { | 
|---|
| 154 | new->psec.port = pnum; | 
|---|
| 155 | new->psec.protocol = protocol; | 
|---|
| 156 | new->psec.sid = *sid; | 
|---|
| 157 | sel_netport_insert(port: new); | 
|---|
| 158 | } | 
|---|
| 159 |  | 
|---|
| 160 | out: | 
|---|
| 161 | spin_unlock_bh(lock: &sel_netport_lock); | 
|---|
| 162 | if (unlikely(ret)) | 
|---|
| 163 | pr_warn( "SELinux: failure in %s(), unable to determine network port label\n", | 
|---|
| 164 | __func__); | 
|---|
| 165 | return ret; | 
|---|
| 166 | } | 
|---|
| 167 |  | 
|---|
| 168 | /** | 
|---|
| 169 | * sel_netport_sid - Lookup the SID of a network port | 
|---|
| 170 | * @protocol: protocol | 
|---|
| 171 | * @pnum: port | 
|---|
| 172 | * @sid: port SID | 
|---|
| 173 | * | 
|---|
| 174 | * Description: | 
|---|
| 175 | * This function determines the SID of a network port using the fastest method | 
|---|
| 176 | * possible.  First the port table is queried, but if an entry can't be found | 
|---|
| 177 | * then the policy is queried and the result is added to the table to speedup | 
|---|
| 178 | * future queries.  Returns zero on success, negative values on failure. | 
|---|
| 179 | * | 
|---|
| 180 | */ | 
|---|
| 181 | int sel_netport_sid(u8 protocol, u16 pnum, u32 *sid) | 
|---|
| 182 | { | 
|---|
| 183 | struct sel_netport *port; | 
|---|
| 184 |  | 
|---|
| 185 | rcu_read_lock(); | 
|---|
| 186 | port = sel_netport_find(protocol, pnum); | 
|---|
| 187 | if (likely(port != NULL)) { | 
|---|
| 188 | *sid = port->psec.sid; | 
|---|
| 189 | rcu_read_unlock(); | 
|---|
| 190 | return 0; | 
|---|
| 191 | } | 
|---|
| 192 | rcu_read_unlock(); | 
|---|
| 193 |  | 
|---|
| 194 | return sel_netport_sid_slow(protocol, pnum, sid); | 
|---|
| 195 | } | 
|---|
| 196 |  | 
|---|
| 197 | /** | 
|---|
| 198 | * sel_netport_flush - Flush the entire network port table | 
|---|
| 199 | * | 
|---|
| 200 | * Description: | 
|---|
| 201 | * Remove all entries from the network address table. | 
|---|
| 202 | * | 
|---|
| 203 | */ | 
|---|
| 204 | void sel_netport_flush(void) | 
|---|
| 205 | { | 
|---|
| 206 | unsigned int idx; | 
|---|
| 207 | struct sel_netport *port, *port_tmp; | 
|---|
| 208 |  | 
|---|
| 209 | spin_lock_bh(lock: &sel_netport_lock); | 
|---|
| 210 | for (idx = 0; idx < SEL_NETPORT_HASH_SIZE; idx++) { | 
|---|
| 211 | list_for_each_entry_safe(port, port_tmp, | 
|---|
| 212 | &sel_netport_hash[idx].list, list) { | 
|---|
| 213 | list_del_rcu(entry: &port->list); | 
|---|
| 214 | kfree_rcu(port, rcu); | 
|---|
| 215 | } | 
|---|
| 216 | sel_netport_hash[idx].size = 0; | 
|---|
| 217 | } | 
|---|
| 218 | spin_unlock_bh(lock: &sel_netport_lock); | 
|---|
| 219 | } | 
|---|
| 220 |  | 
|---|
| 221 | static __init int sel_netport_init(void) | 
|---|
| 222 | { | 
|---|
| 223 | int iter; | 
|---|
| 224 |  | 
|---|
| 225 | if (!selinux_enabled_boot) | 
|---|
| 226 | return 0; | 
|---|
| 227 |  | 
|---|
| 228 | for (iter = 0; iter < SEL_NETPORT_HASH_SIZE; iter++) { | 
|---|
| 229 | INIT_LIST_HEAD(list: &sel_netport_hash[iter].list); | 
|---|
| 230 | sel_netport_hash[iter].size = 0; | 
|---|
| 231 | } | 
|---|
| 232 |  | 
|---|
| 233 | return 0; | 
|---|
| 234 | } | 
|---|
| 235 |  | 
|---|
| 236 | __initcall(sel_netport_init); | 
|---|
| 237 |  | 
|---|