NetLabel: add the enumerated tag to the CIPSOv4 protocol

Add support for the enumerated tag (tag type #2) to the CIPSOv4 protocol.

The enumerated tag allows for 15 categories to be specified in a CIPSO option,
where each category is an unsigned 16 bit field with a maximum value of 65534.

See Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt for more details.

Signed-off-by: Paul Moore <paul.moore@hp.com>
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 08144f8fc911918576d177f2a1d28b40c0b2653f..70858dccaca200ac10a2614a49ccd0d3e3842eb6 100644 (file)
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -459,6 +459,10 @@ int cipso_v4_doi_add(struct cipso_v4_doi *doi_def)
                        if (iter == 0)
                                return -EINVAL;
                        break;
+               case CIPSO_V4_TAG_ENUM:
+                       if (doi_def->type != CIPSO_V4_MAP_PASS)
+                               return -EINVAL;
+                       break;
                default:
                        return -EINVAL;
                }
@@ -940,6 +944,107 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
        return -EINVAL;
 }
 
+/**
+ * cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
+ * @doi_def: the DOI definition
+ * @enumcat: category list
+ * @enumcat_len: length of the category list in bytes
+ *
+ * Description:
+ * Checks the given categories against the given DOI definition and returns a
+ * negative value if any of the categories do not have a valid mapping and a
+ * zero value if all of the categories are valid.
+ *
+ */
+static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
+                                      const unsigned char *enumcat,
+                                      u32 enumcat_len)
+{
+       u16 cat;
+       int cat_prev = -1;
+       u32 iter;
+
+       if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
+               return -EFAULT;
+
+       for (iter = 0; iter < enumcat_len; iter += 2) {
+               cat = ntohs(*((__be16 *)&enumcat[iter]));
+               if (cat <= cat_prev)
+                       return -EFAULT;
+               cat_prev = cat;
+       }
+
+       return 0;
+}
+
+/**
+ * cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
+ * @doi_def: the DOI definition
+ * @secattr: the security attributes
+ * @net_cat: the zero'd out category list in network/CIPSO format
+ * @net_cat_len: the length of the CIPSO category list in bytes
+ *
+ * Description:
+ * Perform a label mapping to translate a local MLS category bitmap to the
+ * correct CIPSO category list using the given DOI definition.   Returns the
+ * size in bytes of the network category bitmap on success, negative values
+ * otherwise.
+ *
+ */
+static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
+                                     const struct netlbl_lsm_secattr *secattr,
+                                     unsigned char *net_cat,
+                                     u32 net_cat_len)
+{
+       int cat = -1;
+       u32 cat_iter = 0;
+
+       for (;;) {
+               cat = netlbl_secattr_catmap_walk(secattr->mls_cat, cat + 1);
+               if (cat < 0)
+                       break;
+               if ((cat_iter + 2) > net_cat_len)
+                       return -ENOSPC;
+
+               *((__be16 *)&net_cat[cat_iter]) = htons(cat);
+               cat_iter += 2;
+       }
+
+       return cat_iter;
+}
+
+/**
+ * cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
+ * @doi_def: the DOI definition
+ * @net_cat: the category list in network/CIPSO format
+ * @net_cat_len: the length of the CIPSO bitmap in bytes
+ * @secattr: the security attributes
+ *
+ * Description:
+ * Perform a label mapping to translate a CIPSO category list to the correct
+ * local MLS category bitmap using the given DOI definition.  Returns zero on
+ * success, negative values on failure.
+ *
+ */
+static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
+                                     const unsigned char *net_cat,
+                                     u32 net_cat_len,
+                                     struct netlbl_lsm_secattr *secattr)
+{
+       int ret_val;
+       u32 iter;
+
+       for (iter = 0; iter < net_cat_len; iter += 2) {
+               ret_val = netlbl_secattr_catmap_setbit(secattr->mls_cat,
+                                           ntohs(*((__be16 *)&net_cat[iter])),
+                                           GFP_ATOMIC);
+               if (ret_val != 0)
+                       return ret_val;
+       }
+
+       return 0;
+}
+
 /*
  * Protocol Handling Functions
  */
@@ -1067,6 +1172,99 @@ static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
        return 0;
 }
 
+/**
+ * cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
+ * @doi_def: the DOI definition
+ * @secattr: the security attributes
+ * @buffer: the option buffer
+ * @buffer_len: length of buffer in bytes
+ *
+ * Description:
+ * Generate a CIPSO option using the enumerated tag, tag type #2.  Returns the
+ * size of the tag on success, negative values on failure.
+ *
+ */
+static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
+                               const struct netlbl_lsm_secattr *secattr,
+                               unsigned char *buffer,
+                               u32 buffer_len)
+{
+       int ret_val;
+       u32 tag_len;
+       u32 level;
+
+       if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
+               return -EPERM;
+
+       ret_val = cipso_v4_map_lvl_hton(doi_def, secattr->mls_lvl, &level);
+       if (ret_val != 0)
+               return ret_val;
+
+       if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
+               ret_val = cipso_v4_map_cat_enum_hton(doi_def,
+                                                    secattr,
+                                                    &buffer[4],
+                                                    buffer_len - 4);
+               if (ret_val < 0)
+                       return ret_val;
+
+               tag_len = 4 + ret_val;
+       } else
+               tag_len = 4;
+
+       buffer[0] = 0x02;
+       buffer[1] = tag_len;
+       buffer[3] = level;
+
+       return tag_len;
+}
+
+/**
+ * cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
+ * @doi_def: the DOI definition
+ * @tag: the CIPSO tag
+ * @secattr: the security attributes
+ *
+ * Description:
+ * Parse a CIPSO enumerated tag (tag type #2) and return the security
+ * attributes in @secattr.  Return zero on success, negatives values on
+ * failure.
+ *
+ */
+static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
+                                 const unsigned char *tag,
+                                 struct netlbl_lsm_secattr *secattr)
+{
+       int ret_val;
+       u8 tag_len = tag[1];
+       u32 level;
+
+       ret_val = cipso_v4_map_lvl_ntoh(doi_def, tag[3], &level);
+       if (ret_val != 0)
+               return ret_val;
+       secattr->mls_lvl = level;
+       secattr->flags |= NETLBL_SECATTR_MLS_LVL;
+
+       if (tag_len > 4) {
+               secattr->mls_cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC);
+               if (secattr->mls_cat == NULL)
+                       return -ENOMEM;
+
+               ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
+                                                    &tag[4],
+                                                    tag_len - 4,
+                                                    secattr);
+               if (ret_val != 0) {
+                       netlbl_secattr_catmap_free(secattr->mls_cat);
+                       return ret_val;
+               }
+
+               secattr->flags |= NETLBL_SECATTR_MLS_CAT;
+       }
+
+       return 0;
+}
+
 /**
  * cipso_v4_validate - Validate a CIPSO option
  * @option: the start of the option, on error it is set to point to the error
@@ -1156,6 +1354,25 @@ int cipso_v4_validate(unsigned char **option)
                                }
                        }
                        break;
+               case CIPSO_V4_TAG_ENUM:
+                       if (tag_len < 4) {
+                               err_offset = opt_iter + 1;
+                               goto validate_return_locked;
+                       }
+
+                       if (cipso_v4_map_lvl_valid(doi_def,
+                                                  tag[3]) < 0) {
+                               err_offset = opt_iter + 3;
+                               goto validate_return_locked;
+                       }
+                       if (tag_len > 4 &&
+                           cipso_v4_map_cat_enum_valid(doi_def,
+                                                       &tag[4],
+                                                       tag_len - 4) < 0) {
+                               err_offset = opt_iter + 4;
+                               goto validate_return_locked;
+                       }
+                       break;
                default:
                        err_offset = opt_iter;
                        goto validate_return_locked;
@@ -1269,6 +1486,12 @@ int cipso_v4_socket_setattr(const struct socket *sock,
                                                   &buf[CIPSO_V4_HDR_LEN],
                                                   buf_len - CIPSO_V4_HDR_LEN);
                        break;
+               case CIPSO_V4_TAG_ENUM:
+                       ret_val = cipso_v4_gentag_enum(doi_def,
+                                                  secattr,
+                                                  &buf[CIPSO_V4_HDR_LEN],
+                                                  buf_len - CIPSO_V4_HDR_LEN);
+                       break;
                default:
                        ret_val = -EPERM;
                        goto socket_setattr_failure;
@@ -1365,6 +1588,11 @@ int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
                                                &cipso_ptr[6],
                                                secattr);
                break;
+       case CIPSO_V4_TAG_ENUM:
+               ret_val = cipso_v4_parsetag_enum(doi_def,
+                                                &cipso_ptr[6],
+                                                secattr);
+               break;
        }
        rcu_read_unlock();
 
@@ -1431,6 +1659,11 @@ int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
                                                &cipso_ptr[6],
                                                secattr);
                break;
+       case CIPSO_V4_TAG_ENUM:
+               ret_val = cipso_v4_parsetag_enum(doi_def,
+                                                &cipso_ptr[6],
+                                                secattr);
+               break;
        }
 
 skbuff_getattr_return: