Skip to content

Commit

Permalink
---
Browse files Browse the repository at this point in the history 
yaml
---
r: 41944
b: refs/heads/master
c: 654bbc2
h: refs/heads/master
v: v3
  • Loading branch information
Paul Moore authored and David S. Miller committed Dec 3, 2006
1 parent b6a4a88 commit ad060b5
Show file tree
Hide file tree
Showing 2 changed files with 234 additions and 1 deletion.
2 changes: 1 addition & 1 deletion [refs]
View file
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
---
refs/heads/master: 02752760359db6b00a3ffb1acfc13ef8d9eb1e3f
refs/heads/master: 654bbc2a2b87185630d05b79cc0db0e9364bb7e0
233 changes: 233 additions & 0 deletions trunk/net/ipv4/cipso_ipv4.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -459,6 +459,10 @@ int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
if (iter == 0)
return -EINVAL;
break;
case CIPSO_V4_TAG_ENUM:
if (doi_def->type != CIPSO_V4_MAP_PASS)
return -EINVAL;
break;
default:
return -EINVAL;
}
Expand Down Expand Up @@ -940,6 +944,107 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
return -EINVAL;
}

/**
* cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
* @doi_def: the DOI definition
* @enumcat: category list
* @enumcat_len: length of the category list in bytes
*
* Description:
* Checks the given categories against the given DOI definition and returns a
* negative value if any of the categories do not have a valid mapping and a
* zero value if all of the categories are valid.
*
*/
static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
const unsigned char *enumcat,
u32 enumcat_len)
{
u16 cat;
int cat_prev = -1;
u32 iter;

if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
return -EFAULT;

for (iter = 0; iter < enumcat_len; iter += 2) {
cat = ntohs(*((__be16 *)&enumcat[iter]));
if (cat <= cat_prev)
return -EFAULT;
cat_prev = cat;
}

return 0;
}

/**
* cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
* @doi_def: the DOI definition
* @secattr: the security attributes
* @net_cat: the zero'd out category list in network/CIPSO format
* @net_cat_len: the length of the CIPSO category list in bytes
*
* Description:
* Perform a label mapping to translate a local MLS category bitmap to the
* correct CIPSO category list using the given DOI definition. Returns the
* size in bytes of the network category bitmap on success, negative values
* otherwise.
*
*/
static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
const struct netlbl_lsm_secattr *secattr,
unsigned char *net_cat,
u32 net_cat_len)
{
int cat = -1;
u32 cat_iter = 0;

for (;;) {
cat = netlbl_secattr_catmap_walk(secattr->mls_cat, cat + 1);
if (cat < 0)
break;
if ((cat_iter + 2) > net_cat_len)
return -ENOSPC;

*((__be16 *)&net_cat[cat_iter]) = htons(cat);
cat_iter += 2;
}

return cat_iter;
}

/**
* cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
* @doi_def: the DOI definition
* @net_cat: the category list in network/CIPSO format
* @net_cat_len: the length of the CIPSO bitmap in bytes
* @secattr: the security attributes
*
* Description:
* Perform a label mapping to translate a CIPSO category list to the correct
* local MLS category bitmap using the given DOI definition. Returns zero on
* success, negative values on failure.
*
*/
static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
const unsigned char *net_cat,
u32 net_cat_len,
struct netlbl_lsm_secattr *secattr)
{
int ret_val;
u32 iter;

for (iter = 0; iter < net_cat_len; iter += 2) {
ret_val = netlbl_secattr_catmap_setbit(secattr->mls_cat,
ntohs(*((__be16 *)&net_cat[iter])),
GFP_ATOMIC);
if (ret_val != 0)
return ret_val;
}

return 0;
}

/*
* Protocol Handling Functions
*/
Expand Down Expand Up @@ -1067,6 +1172,99 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
return 0;
}

/**
* cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
* @doi_def: the DOI definition
* @secattr: the security attributes
* @buffer: the option buffer
* @buffer_len: length of buffer in bytes
*
* Description:
* Generate a CIPSO option using the enumerated tag, tag type #2. Returns the
* size of the tag on success, negative values on failure.
*
*/
static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
const struct netlbl_lsm_secattr *secattr,
unsigned char *buffer,
u32 buffer_len)
{
int ret_val;
u32 tag_len;
u32 level;

if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
return -EPERM;

ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
if (ret_val != 0)
return ret_val;

if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
ret_val = cipso_v4_map_cat_enum_hton(doi_def,
secattr,
&buffer[4],
buffer_len - 4);
if (ret_val < 0)
return ret_val;

tag_len = 4 + ret_val;
} else
tag_len = 4;

buffer[0] = 0x02;
buffer[1] = tag_len;
buffer[3] = level;

return tag_len;
}

/**
* cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
* @doi_def: the DOI definition
* @tag: the CIPSO tag
* @secattr: the security attributes
*
* Description:
* Parse a CIPSO enumerated tag (tag type #2) and return the security
* attributes in @secattr. Return zero on success, negatives values on
* failure.
*
*/
static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
const unsigned char *tag,
struct netlbl_lsm_secattr *secattr)
{
int ret_val;
u8 tag_len = tag[1];
u32 level;

ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
if (ret_val != 0)
return ret_val;
secattr->mls_lvl = level;
secattr->flags |= NETLBL_SECATTR_MLS_LVL;

if (tag_len > 4) {
secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
if (secattr->mls_cat == NULL)
return -ENOMEM;

ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
&tag[4],
tag_len - 4,
secattr);
if (ret_val != 0) {
netlbl_secattr_catmap_free(secattr->mls_cat);
return ret_val;
}

secattr->flags |= NETLBL_SECATTR_MLS_CAT;
}

return 0;
}

/**
* cipso_v4_validate - Validate a CIPSO option
* @option: the start of the option, on error it is set to point to the error
Expand Down Expand Up @@ -1156,6 +1354,25 @@ int cipso_v4_validate(unsigned char **option)
}
}
break;
case CIPSO_V4_TAG_ENUM:
if (tag_len < 4) {
err_offset = opt_iter + 1;
goto validate_return_locked;
}

if (cipso_v4_map_lvl_valid(doi_def,
tag[3]) < 0) {
err_offset = opt_iter + 3;
goto validate_return_locked;
}
if (tag_len > 4 &&
cipso_v4_map_cat_enum_valid(doi_def,
&tag[4],
tag_len - 4) < 0) {
err_offset = opt_iter + 4;
goto validate_return_locked;
}
break;
default:
err_offset = opt_iter;
goto validate_return_locked;
Expand Down Expand Up @@ -1269,6 +1486,12 @@ int cipso_v4_socket_setattr(const struct socket *sock,
&buf[CIPSO_V4_HDR_LEN],
buf_len - CIPSO_V4_HDR_LEN);
break;
case CIPSO_V4_TAG_ENUM:
ret_val = cipso_v4_gentag_enum(doi_def,
secattr,
&buf[CIPSO_V4_HDR_LEN],
buf_len - CIPSO_V4_HDR_LEN);
break;
default:
ret_val = -EPERM;
goto socket_setattr_failure;
Expand Down Expand Up @@ -1365,6 +1588,11 @@ int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
&cipso_ptr[6],
secattr);
break;
case CIPSO_V4_TAG_ENUM:
ret_val = cipso_v4_parsetag_enum(doi_def,
&cipso_ptr[6],
secattr);
break;
}
rcu_read_unlock();

Expand Down Expand Up @@ -1431,6 +1659,11 @@ int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
&cipso_ptr[6],
secattr);
break;
case CIPSO_V4_TAG_ENUM:
ret_val = cipso_v4_parsetag_enum(doi_def,
&cipso_ptr[6],
secattr);
break;
}

skbuff_getattr_return:
Expand Down

0 comments on commit ad060b5

Please sign in to comment.