1	// SPDX-License-Identifier: GPL-2.0-or-later
2	/*
3	* CIPSO - Commercial IP Security Option
4	*
5	* This is an implementation of the CIPSO 2.2 protocol as specified in
6	* draft-ietf-cipso-ipsecurity-01.txt with additional tag types as found in
7	* FIPS-188. While CIPSO never became a full IETF RFC standard many vendors
8	* have chosen to adopt the protocol and over the years it has become a
9	* de-facto standard for labeled networking.
10	*
11	* The CIPSO draft specification can be found in the kernel's Documentation
12	* directory as well as the following URL:
13	* https://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
14	* The FIPS-188 specification can be found at the following URL:
15	* https://www.itl.nist.gov/fipspubs/fip188.htm
16	*
17	* Author: Paul Moore <paul.moore@hp.com>
18	*/
19
20	/*
21	* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
22	*/
23
24	#include <linux/init.h>
25	#include <linux/types.h>
26	#include <linux/rcupdate.h>
27	#include <linux/list.h>
28	#include <linux/spinlock.h>
29	#include <linux/string.h>
30	#include <linux/jhash.h>
31	#include <linux/audit.h>
32	#include <linux/slab.h>
33	#include <net/ip.h>
34	#include <net/icmp.h>
35	#include <net/tcp.h>
36	#include <net/netlabel.h>
37	#include <net/cipso_ipv4.h>
38	#include <linux/atomic.h>
39	#include <linux/bug.h>
40	#include <asm/unaligned.h>
41
42	/* List of available DOI definitions */
43	/* XXX - This currently assumes a minimal number of different DOIs in use,
44	* if in practice there are a lot of different DOIs this list should
45	* probably be turned into a hash table or something similar so we
46	* can do quick lookups. */
47	static DEFINE_SPINLOCK(cipso_v4_doi_list_lock);
48	static LIST_HEAD(cipso_v4_doi_list);
49
50	/* Label mapping cache */
51	int cipso_v4_cache_enabled = 1;
52	int cipso_v4_cache_bucketsize = 10;
53	#define CIPSO_V4_CACHE_BUCKETBITS 7
54	#define CIPSO_V4_CACHE_BUCKETS (1 << CIPSO_V4_CACHE_BUCKETBITS)
55	#define CIPSO_V4_CACHE_REORDERLIMIT 10
56	struct cipso_v4_map_cache_bkt {
57	spinlock_t lock;
58	u32 size;
59	struct list_head list;
60	};
61
62	struct cipso_v4_map_cache_entry {
63	u32 hash;
64	unsigned char *key;
65	size_t key_len;
66
67	struct netlbl_lsm_cache *lsm_data;
68
69	u32 activity;
70	struct list_head list;
71	};
72
73	static struct cipso_v4_map_cache_bkt *cipso_v4_cache;
74
75	/* Restricted bitmap (tag #1) flags */
76	int cipso_v4_rbm_optfmt;
77	int cipso_v4_rbm_strictvalid = 1;
78
79	/*
80	* Protocol Constants
81	*/
82
83	/* Maximum size of the CIPSO IP option, derived from the fact that the maximum
84	* IPv4 header size is 60 bytes and the base IPv4 header is 20 bytes long. */
85	#define CIPSO_V4_OPT_LEN_MAX 40
86
87	/* Length of the base CIPSO option, this includes the option type (1 byte), the
88	* option length (1 byte), and the DOI (4 bytes). */
89	#define CIPSO_V4_HDR_LEN 6
90
91	/* Base length of the restrictive category bitmap tag (tag #1). */
92	#define CIPSO_V4_TAG_RBM_BLEN 4
93
94	/* Base length of the enumerated category tag (tag #2). */
95	#define CIPSO_V4_TAG_ENUM_BLEN 4
96
97	/* Base length of the ranged categories bitmap tag (tag #5). */
98	#define CIPSO_V4_TAG_RNG_BLEN 4
99	/* The maximum number of category ranges permitted in the ranged category tag
100	* (tag #5). You may note that the IETF draft states that the maximum number
101	* of category ranges is 7, but if the low end of the last category range is
102	* zero then it is possible to fit 8 category ranges because the zero should
103	* be omitted. */
104	#define CIPSO_V4_TAG_RNG_CAT_MAX 8
105
106	/* Base length of the local tag (non-standard tag).
107	* Tag definition (may change between kernel versions)
108	*
109	* 0 8 16 24 32
110	* +----------+----------+----------+----------+
111	* | 10000000 | 00000110 | 32-bit secid value |
112	* +----------+----------+----------+----------+
113	* | in (host byte order)|
114	* +----------+----------+
115	*
116	*/
117	#define CIPSO_V4_TAG_LOC_BLEN 6
118
119	/*
120	* Helper Functions
121	*/
122
123	/**
124	* cipso_v4_cache_entry_free - Frees a cache entry
125	* @entry: the entry to free
126	*
127	* Description:
128	* This function frees the memory associated with a cache entry including the
129	* LSM cache data if there are no longer any users, i.e. reference count == 0.
130	*
131	*/
132	static void cipso_v4_cache_entry_free(struct cipso_v4_map_cache_entry *entry)
133	{
134	if (entry->lsm_data)
135	netlbl_secattr_cache_free(cache: entry->lsm_data);
136	kfree(objp: entry->key);
137	kfree(objp: entry);
138	}
139
140	/**
141	* cipso_v4_map_cache_hash - Hashing function for the CIPSO cache
142	* @key: the hash key
143	* @key_len: the length of the key in bytes
144	*
145	* Description:
146	* The CIPSO tag hashing function. Returns a 32-bit hash value.
147	*
148	*/
149	static u32 cipso_v4_map_cache_hash(const unsigned char *key, u32 key_len)
150	{
151	return jhash(key, length: key_len, initval: 0);
152	}
153
154	/*
155	* Label Mapping Cache Functions
156	*/
157
158	/**
159	* cipso_v4_cache_init - Initialize the CIPSO cache
160	*
161	* Description:
162	* Initializes the CIPSO label mapping cache, this function should be called
163	* before any of the other functions defined in this file. Returns zero on
164	* success, negative values on error.
165	*
166	*/
167	static int __init cipso_v4_cache_init(void)
168	{
169	u32 iter;
170
171	cipso_v4_cache = kcalloc(CIPSO_V4_CACHE_BUCKETS,
172	size: sizeof(struct cipso_v4_map_cache_bkt),
173	GFP_KERNEL);
174	if (!cipso_v4_cache)
175	return -ENOMEM;
176
177	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
178	spin_lock_init(&cipso_v4_cache[iter].lock);
179	cipso_v4_cache[iter].size = 0;
180	INIT_LIST_HEAD(list: &cipso_v4_cache[iter].list);
181	}
182
183	return 0;
184	}
185
186	/**
187	* cipso_v4_cache_invalidate - Invalidates the current CIPSO cache
188	*
189	* Description:
190	* Invalidates and frees any entries in the CIPSO cache.
191	*
192	*/
193	void cipso_v4_cache_invalidate(void)
194	{
195	struct cipso_v4_map_cache_entry *entry, *tmp_entry;
196	u32 iter;
197
198	for (iter = 0; iter < CIPSO_V4_CACHE_BUCKETS; iter++) {
199	spin_lock_bh(lock: &cipso_v4_cache[iter].lock);
200	list_for_each_entry_safe(entry,
201	tmp_entry,
202	&cipso_v4_cache[iter].list, list) {
203	list_del(entry: &entry->list);
204	cipso_v4_cache_entry_free(entry);
205	}
206	cipso_v4_cache[iter].size = 0;
207	spin_unlock_bh(lock: &cipso_v4_cache[iter].lock);
208	}
209	}
210
211	/**
212	* cipso_v4_cache_check - Check the CIPSO cache for a label mapping
213	* @key: the buffer to check
214	* @key_len: buffer length in bytes
215	* @secattr: the security attribute struct to use
216	*
217	* Description:
218	* This function checks the cache to see if a label mapping already exists for
219	* the given key. If there is a match then the cache is adjusted and the
220	* @secattr struct is populated with the correct LSM security attributes. The
221	* cache is adjusted in the following manner if the entry is not already the
222	* first in the cache bucket:
223	*
224	* 1. The cache entry's activity counter is incremented
225	* 2. The previous (higher ranking) entry's activity counter is decremented
226	* 3. If the difference between the two activity counters is geater than
227	* CIPSO_V4_CACHE_REORDERLIMIT the two entries are swapped
228	*
229	* Returns zero on success, -ENOENT for a cache miss, and other negative values
230	* on error.
231	*
232	*/
233	static int cipso_v4_cache_check(const unsigned char *key,
234	u32 key_len,
235	struct netlbl_lsm_secattr *secattr)
236	{
237	u32 bkt;
238	struct cipso_v4_map_cache_entry *entry;
239	struct cipso_v4_map_cache_entry *prev_entry = NULL;
240	u32 hash;
241
242	if (!READ_ONCE(cipso_v4_cache_enabled))
243	return -ENOENT;
244
245	hash = cipso_v4_map_cache_hash(key, key_len);
246	bkt = hash & (CIPSO_V4_CACHE_BUCKETS - 1);
247	spin_lock_bh(lock: &cipso_v4_cache[bkt].lock);
248	list_for_each_entry(entry, &cipso_v4_cache[bkt].list, list) {
249	if (entry->hash == hash &&
250	entry->key_len == key_len &&
251	memcmp(p: entry->key, q: key, size: key_len) == 0) {
252	entry->activity += 1;
253	refcount_inc(r: &entry->lsm_data->refcount);
254	secattr->cache = entry->lsm_data;
255	secattr->flags |= NETLBL_SECATTR_CACHE;
256	secattr->type = NETLBL_NLTYPE_CIPSOV4;
257	if (!prev_entry) {
258	spin_unlock_bh(lock: &cipso_v4_cache[bkt].lock);
259	return 0;
260	}
261
262	if (prev_entry->activity > 0)
263	prev_entry->activity -= 1;
264	if (entry->activity > prev_entry->activity &&
265	entry->activity - prev_entry->activity >
266	CIPSO_V4_CACHE_REORDERLIMIT) {
267	__list_del(prev: entry->list.prev, next: entry->list.next);
268	__list_add(new: &entry->list,
269	prev: prev_entry->list.prev,
270	next: &prev_entry->list);
271	}
272
273	spin_unlock_bh(lock: &cipso_v4_cache[bkt].lock);
274	return 0;
275	}
276	prev_entry = entry;
277	}
278	spin_unlock_bh(lock: &cipso_v4_cache[bkt].lock);
279
280	return -ENOENT;
281	}
282
283	/**
284	* cipso_v4_cache_add - Add an entry to the CIPSO cache
285	* @cipso_ptr: pointer to CIPSO IP option
286	* @secattr: the packet's security attributes
287	*
288	* Description:
289	* Add a new entry into the CIPSO label mapping cache. Add the new entry to
290	* head of the cache bucket's list, if the cache bucket is out of room remove
291	* the last entry in the list first. It is important to note that there is
292	* currently no checking for duplicate keys. Returns zero on success,
293	* negative values on failure.
294	*
295	*/
296	int cipso_v4_cache_add(const unsigned char *cipso_ptr,
297	const struct netlbl_lsm_secattr *secattr)
298	{
299	int bkt_size = READ_ONCE(cipso_v4_cache_bucketsize);
300	int ret_val = -EPERM;
301	u32 bkt;
302	struct cipso_v4_map_cache_entry *entry = NULL;
303	struct cipso_v4_map_cache_entry *old_entry = NULL;
304	u32 cipso_ptr_len;
305
306	if (!READ_ONCE(cipso_v4_cache_enabled) || bkt_size <= 0)
307	return 0;
308
309	cipso_ptr_len = cipso_ptr[1];
310
311	entry = kzalloc(size: sizeof(*entry), GFP_ATOMIC);
312	if (!entry)
313	return -ENOMEM;
314	entry->key = kmemdup(p: cipso_ptr, size: cipso_ptr_len, GFP_ATOMIC);
315	if (!entry->key) {
316	ret_val = -ENOMEM;
317	goto cache_add_failure;
318	}
319	entry->key_len = cipso_ptr_len;
320	entry->hash = cipso_v4_map_cache_hash(key: cipso_ptr, key_len: cipso_ptr_len);
321	refcount_inc(r: &secattr->cache->refcount);
322	entry->lsm_data = secattr->cache;
323
324	bkt = entry->hash & (CIPSO_V4_CACHE_BUCKETS - 1);
325	spin_lock_bh(lock: &cipso_v4_cache[bkt].lock);
326	if (cipso_v4_cache[bkt].size < bkt_size) {
327	list_add(new: &entry->list, head: &cipso_v4_cache[bkt].list);
328	cipso_v4_cache[bkt].size += 1;
329	} else {
330	old_entry = list_entry(cipso_v4_cache[bkt].list.prev,
331	struct cipso_v4_map_cache_entry, list);
332	list_del(entry: &old_entry->list);
333	list_add(new: &entry->list, head: &cipso_v4_cache[bkt].list);
334	cipso_v4_cache_entry_free(entry: old_entry);
335	}
336	spin_unlock_bh(lock: &cipso_v4_cache[bkt].lock);
337
338	return 0;
339
340	cache_add_failure:
341	if (entry)
342	cipso_v4_cache_entry_free(entry);
343	return ret_val;
344	}
345
346	/*
347	* DOI List Functions
348	*/
349
350	/**
351	* cipso_v4_doi_search - Searches for a DOI definition
352	* @doi: the DOI to search for
353	*
354	* Description:
355	* Search the DOI definition list for a DOI definition with a DOI value that
356	* matches @doi. The caller is responsible for calling rcu_read_[un]lock().
357	* Returns a pointer to the DOI definition on success and NULL on failure.
358	*/
359	static struct cipso_v4_doi *cipso_v4_doi_search(u32 doi)
360	{
361	struct cipso_v4_doi *iter;
362
363	list_for_each_entry_rcu(iter, &cipso_v4_doi_list, list)
364	if (iter->doi == doi && refcount_read(r: &iter->refcount))
365	return iter;
366	return NULL;
367	}
368
369	/**
370	* cipso_v4_doi_add - Add a new DOI to the CIPSO protocol engine
371	* @doi_def: the DOI structure
372	* @audit_info: NetLabel audit information
373	*
374	* Description:
375	* The caller defines a new DOI for use by the CIPSO engine and calls this
376	* function to add it to the list of acceptable domains. The caller must
377	* ensure that the mapping table specified in @doi_def->map meets all of the
378	* requirements of the mapping type (see cipso_ipv4.h for details). Returns
379	* zero on success and non-zero on failure.
380	*
381	*/
382	int cipso_v4_doi_add(struct cipso_v4_doi *doi_def,
383	struct netlbl_audit *audit_info)
384	{
385	int ret_val = -EINVAL;
386	u32 iter;
387	u32 doi;
388	u32 doi_type;
389	struct audit_buffer *audit_buf;
390
391	doi = doi_def->doi;
392	doi_type = doi_def->type;
393
394	if (doi_def->doi == CIPSO_V4_DOI_UNKNOWN)
395	goto doi_add_return;
396	for (iter = 0; iter < CIPSO_V4_TAG_MAXCNT; iter++) {
397	switch (doi_def->tags[iter]) {
398	case CIPSO_V4_TAG_RBITMAP:
399	break;
400	case CIPSO_V4_TAG_RANGE:
401	case CIPSO_V4_TAG_ENUM:
402	if (doi_def->type != CIPSO_V4_MAP_PASS)
403	goto doi_add_return;
404	break;
405	case CIPSO_V4_TAG_LOCAL:
406	if (doi_def->type != CIPSO_V4_MAP_LOCAL)
407	goto doi_add_return;
408	break;
409	case CIPSO_V4_TAG_INVALID:
410	if (iter == 0)
411	goto doi_add_return;
412	break;
413	default:
414	goto doi_add_return;
415	}
416	}
417
418	refcount_set(r: &doi_def->refcount, n: 1);
419
420	spin_lock(lock: &cipso_v4_doi_list_lock);
421	if (cipso_v4_doi_search(doi: doi_def->doi)) {
422	spin_unlock(lock: &cipso_v4_doi_list_lock);
423	ret_val = -EEXIST;
424	goto doi_add_return;
425	}
426	list_add_tail_rcu(new: &doi_def->list, head: &cipso_v4_doi_list);
427	spin_unlock(lock: &cipso_v4_doi_list_lock);
428	ret_val = 0;
429
430	doi_add_return:
431	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_ADD, audit_info);
432	if (audit_buf) {
433	const char *type_str;
434	switch (doi_type) {
435	case CIPSO_V4_MAP_TRANS:
436	type_str = "trans";
437	break;
438	case CIPSO_V4_MAP_PASS:
439	type_str = "pass";
440	break;
441	case CIPSO_V4_MAP_LOCAL:
442	type_str = "local";
443	break;
444	default:
445	type_str = "(unknown)";
446	}
447	audit_log_format(ab: audit_buf,
448	fmt: " cipso_doi=%u cipso_type=%s res=%u",
449	doi, type_str, ret_val == 0 ? 1 : 0);
450	audit_log_end(ab: audit_buf);
451	}
452
453	return ret_val;
454	}
455
456	/**
457	* cipso_v4_doi_free - Frees a DOI definition
458	* @doi_def: the DOI definition
459	*
460	* Description:
461	* This function frees all of the memory associated with a DOI definition.
462	*
463	*/
464	void cipso_v4_doi_free(struct cipso_v4_doi *doi_def)
465	{
466	if (!doi_def)
467	return;
468
469	switch (doi_def->type) {
470	case CIPSO_V4_MAP_TRANS:
471	kfree(objp: doi_def->map.std->lvl.cipso);
472	kfree(objp: doi_def->map.std->lvl.local);
473	kfree(objp: doi_def->map.std->cat.cipso);
474	kfree(objp: doi_def->map.std->cat.local);
475	kfree(objp: doi_def->map.std);
476	break;
477	}
478	kfree(objp: doi_def);
479	}
480
481	/**
482	* cipso_v4_doi_free_rcu - Frees a DOI definition via the RCU pointer
483	* @entry: the entry's RCU field
484	*
485	* Description:
486	* This function is designed to be used as a callback to the call_rcu()
487	* function so that the memory allocated to the DOI definition can be released
488	* safely.
489	*
490	*/
491	static void cipso_v4_doi_free_rcu(struct rcu_head *entry)
492	{
493	struct cipso_v4_doi *doi_def;
494
495	doi_def = container_of(entry, struct cipso_v4_doi, rcu);
496	cipso_v4_doi_free(doi_def);
497	}
498
499	/**
500	* cipso_v4_doi_remove - Remove an existing DOI from the CIPSO protocol engine
501	* @doi: the DOI value
502	* @audit_info: NetLabel audit information
503	*
504	* Description:
505	* Removes a DOI definition from the CIPSO engine. The NetLabel routines will
506	* be called to release their own LSM domain mappings as well as our own
507	* domain list. Returns zero on success and negative values on failure.
508	*
509	*/
510	int cipso_v4_doi_remove(u32 doi, struct netlbl_audit *audit_info)
511	{
512	int ret_val;
513	struct cipso_v4_doi *doi_def;
514	struct audit_buffer *audit_buf;
515
516	spin_lock(lock: &cipso_v4_doi_list_lock);
517	doi_def = cipso_v4_doi_search(doi);
518	if (!doi_def) {
519	spin_unlock(lock: &cipso_v4_doi_list_lock);
520	ret_val = -ENOENT;
521	goto doi_remove_return;
522	}
523	list_del_rcu(entry: &doi_def->list);
524	spin_unlock(lock: &cipso_v4_doi_list_lock);
525
526	cipso_v4_doi_putdef(doi_def);
527	ret_val = 0;
528
529	doi_remove_return:
530	audit_buf = netlbl_audit_start(AUDIT_MAC_CIPSOV4_DEL, audit_info);
531	if (audit_buf) {
532	audit_log_format(ab: audit_buf,
533	fmt: " cipso_doi=%u res=%u",
534	doi, ret_val == 0 ? 1 : 0);
535	audit_log_end(ab: audit_buf);
536	}
537
538	return ret_val;
539	}
540
541	/**
542	* cipso_v4_doi_getdef - Returns a reference to a valid DOI definition
543	* @doi: the DOI value
544	*
545	* Description:
546	* Searches for a valid DOI definition and if one is found it is returned to
547	* the caller. Otherwise NULL is returned. The caller must ensure that
548	* rcu_read_lock() is held while accessing the returned definition and the DOI
549	* definition reference count is decremented when the caller is done.
550	*
551	*/
552	struct cipso_v4_doi *cipso_v4_doi_getdef(u32 doi)
553	{
554	struct cipso_v4_doi *doi_def;
555
556	rcu_read_lock();
557	doi_def = cipso_v4_doi_search(doi);
558	if (!doi_def)
559	goto doi_getdef_return;
560	if (!refcount_inc_not_zero(r: &doi_def->refcount))
561	doi_def = NULL;
562
563	doi_getdef_return:
564	rcu_read_unlock();
565	return doi_def;
566	}
567
568	/**
569	* cipso_v4_doi_putdef - Releases a reference for the given DOI definition
570	* @doi_def: the DOI definition
571	*
572	* Description:
573	* Releases a DOI definition reference obtained from cipso_v4_doi_getdef().
574	*
575	*/
576	void cipso_v4_doi_putdef(struct cipso_v4_doi *doi_def)
577	{
578	if (!doi_def)
579	return;
580
581	if (!refcount_dec_and_test(r: &doi_def->refcount))
582	return;
583
584	cipso_v4_cache_invalidate();
585	call_rcu(head: &doi_def->rcu, func: cipso_v4_doi_free_rcu);
586	}
587
588	/**
589	* cipso_v4_doi_walk - Iterate through the DOI definitions
590	* @skip_cnt: skip past this number of DOI definitions, updated
591	* @callback: callback for each DOI definition
592	* @cb_arg: argument for the callback function
593	*
594	* Description:
595	* Iterate over the DOI definition list, skipping the first @skip_cnt entries.
596	* For each entry call @callback, if @callback returns a negative value stop
597	* 'walking' through the list and return. Updates the value in @skip_cnt upon
598	* return. Returns zero on success, negative values on failure.
599	*
600	*/
601	int cipso_v4_doi_walk(u32 *skip_cnt,
602	int (*callback) (struct cipso_v4_doi *doi_def, void *arg),
603	void *cb_arg)
604	{
605	int ret_val = -ENOENT;
606	u32 doi_cnt = 0;
607	struct cipso_v4_doi *iter_doi;
608
609	rcu_read_lock();
610	list_for_each_entry_rcu(iter_doi, &cipso_v4_doi_list, list)
611	if (refcount_read(r: &iter_doi->refcount) > 0) {
612	if (doi_cnt++ < *skip_cnt)
613	continue;
614	ret_val = callback(iter_doi, cb_arg);
615	if (ret_val < 0) {
616	doi_cnt--;
617	goto doi_walk_return;
618	}
619	}
620
621	doi_walk_return:
622	rcu_read_unlock();
623	*skip_cnt = doi_cnt;
624	return ret_val;
625	}
626
627	/*
628	* Label Mapping Functions
629	*/
630
631	/**
632	* cipso_v4_map_lvl_valid - Checks to see if the given level is understood
633	* @doi_def: the DOI definition
634	* @level: the level to check
635	*
636	* Description:
637	* Checks the given level against the given DOI definition and returns a
638	* negative value if the level does not have a valid mapping and a zero value
639	* if the level is defined by the DOI.
640	*
641	*/
642	static int cipso_v4_map_lvl_valid(const struct cipso_v4_doi *doi_def, u8 level)
643	{
644	switch (doi_def->type) {
645	case CIPSO_V4_MAP_PASS:
646	return 0;
647	case CIPSO_V4_MAP_TRANS:
648	if ((level < doi_def->map.std->lvl.cipso_size) &&
649	(doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL))
650	return 0;
651	break;
652	}
653
654	return -EFAULT;
655	}
656
657	/**
658	* cipso_v4_map_lvl_hton - Perform a level mapping from the host to the network
659	* @doi_def: the DOI definition
660	* @host_lvl: the host MLS level
661	* @net_lvl: the network/CIPSO MLS level
662	*
663	* Description:
664	* Perform a label mapping to translate a local MLS level to the correct
665	* CIPSO level using the given DOI definition. Returns zero on success,
666	* negative values otherwise.
667	*
668	*/
669	static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
670	u32 host_lvl,
671	u32 *net_lvl)
672	{
673	switch (doi_def->type) {
674	case CIPSO_V4_MAP_PASS:
675	*net_lvl = host_lvl;
676	return 0;
677	case CIPSO_V4_MAP_TRANS:
678	if (host_lvl < doi_def->map.std->lvl.local_size &&
679	doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
680	*net_lvl = doi_def->map.std->lvl.local[host_lvl];
681	return 0;
682	}
683	return -EPERM;
684	}
685
686	return -EINVAL;
687	}
688
689	/**
690	* cipso_v4_map_lvl_ntoh - Perform a level mapping from the network to the host
691	* @doi_def: the DOI definition
692	* @net_lvl: the network/CIPSO MLS level
693	* @host_lvl: the host MLS level
694	*
695	* Description:
696	* Perform a label mapping to translate a CIPSO level to the correct local MLS
697	* level using the given DOI definition. Returns zero on success, negative
698	* values otherwise.
699	*
700	*/
701	static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
702	u32 net_lvl,
703	u32 *host_lvl)
704	{
705	struct cipso_v4_std_map_tbl *map_tbl;
706
707	switch (doi_def->type) {
708	case CIPSO_V4_MAP_PASS:
709	*host_lvl = net_lvl;
710	return 0;
711	case CIPSO_V4_MAP_TRANS:
712	map_tbl = doi_def->map.std;
713	if (net_lvl < map_tbl->lvl.cipso_size &&
714	map_tbl->lvl.cipso[net_lvl] < CIPSO_V4_INV_LVL) {
715	*host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
716	return 0;
717	}
718	return -EPERM;
719	}
720
721	return -EINVAL;
722	}
723
724	/**
725	* cipso_v4_map_cat_rbm_valid - Checks to see if the category bitmap is valid
726	* @doi_def: the DOI definition
727	* @bitmap: category bitmap
728	* @bitmap_len: bitmap length in bytes
729	*
730	* Description:
731	* Checks the given category bitmap against the given DOI definition and
732	* returns a negative value if any of the categories in the bitmap do not have
733	* a valid mapping and a zero value if all of the categories are valid.
734	*
735	*/
736	static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
737	const unsigned char *bitmap,
738	u32 bitmap_len)
739	{
740	int cat = -1;
741	u32 bitmap_len_bits = bitmap_len * 8;
742	u32 cipso_cat_size;
743	u32 *cipso_array;
744
745	switch (doi_def->type) {
746	case CIPSO_V4_MAP_PASS:
747	return 0;
748	case CIPSO_V4_MAP_TRANS:
749	cipso_cat_size = doi_def->map.std->cat.cipso_size;
750	cipso_array = doi_def->map.std->cat.cipso;
751	for (;;) {
752	cat = netlbl_bitmap_walk(bitmap,
753	bitmap_len: bitmap_len_bits,
754	offset: cat + 1,
755	state: 1);
756	if (cat < 0)
757	break;
758	if (cat >= cipso_cat_size ||
759	cipso_array[cat] >= CIPSO_V4_INV_CAT)
760	return -EFAULT;
761	}
762
763	if (cat == -1)
764	return 0;
765	break;
766	}
767
768	return -EFAULT;
769	}
770
771	/**
772	* cipso_v4_map_cat_rbm_hton - Perform a category mapping from host to network
773	* @doi_def: the DOI definition
774	* @secattr: the security attributes
775	* @net_cat: the zero'd out category bitmap in network/CIPSO format
776	* @net_cat_len: the length of the CIPSO bitmap in bytes
777	*
778	* Description:
779	* Perform a label mapping to translate a local MLS category bitmap to the
780	* correct CIPSO bitmap using the given DOI definition. Returns the minimum
781	* size in bytes of the network bitmap on success, negative values otherwise.
782	*
783	*/
784	static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
785	const struct netlbl_lsm_secattr *secattr,
786	unsigned char *net_cat,
787	u32 net_cat_len)
788	{
789	int host_spot = -1;
790	u32 net_spot = CIPSO_V4_INV_CAT;
791	u32 net_spot_max = 0;
792	u32 net_clen_bits = net_cat_len * 8;
793	u32 host_cat_size = 0;
794	u32 *host_cat_array = NULL;
795
796	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
797	host_cat_size = doi_def->map.std->cat.local_size;
798	host_cat_array = doi_def->map.std->cat.local;
799	}
800
801	for (;;) {
802	host_spot = netlbl_catmap_walk(catmap: secattr->attr.mls.cat,
803	offset: host_spot + 1);
804	if (host_spot < 0)
805	break;
806
807	switch (doi_def->type) {
808	case CIPSO_V4_MAP_PASS:
809	net_spot = host_spot;
810	break;
811	case CIPSO_V4_MAP_TRANS:
812	if (host_spot >= host_cat_size)
813	return -EPERM;
814	net_spot = host_cat_array[host_spot];
815	if (net_spot >= CIPSO_V4_INV_CAT)
816	return -EPERM;
817	break;
818	}
819	if (net_spot >= net_clen_bits)
820	return -ENOSPC;
821	netlbl_bitmap_setbit(bitmap: net_cat, bit: net_spot, state: 1);
822
823	if (net_spot > net_spot_max)
824	net_spot_max = net_spot;
825	}
826
827	if (++net_spot_max % 8)
828	return net_spot_max / 8 + 1;
829	return net_spot_max / 8;
830	}
831
832	/**
833	* cipso_v4_map_cat_rbm_ntoh - Perform a category mapping from network to host
834	* @doi_def: the DOI definition
835	* @net_cat: the category bitmap in network/CIPSO format
836	* @net_cat_len: the length of the CIPSO bitmap in bytes
837	* @secattr: the security attributes
838	*
839	* Description:
840	* Perform a label mapping to translate a CIPSO bitmap to the correct local
841	* MLS category bitmap using the given DOI definition. Returns zero on
842	* success, negative values on failure.
843	*
844	*/
845	static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
846	const unsigned char *net_cat,
847	u32 net_cat_len,
848	struct netlbl_lsm_secattr *secattr)
849	{
850	int ret_val;
851	int net_spot = -1;
852	u32 host_spot = CIPSO_V4_INV_CAT;
853	u32 net_clen_bits = net_cat_len * 8;
854	u32 net_cat_size = 0;
855	u32 *net_cat_array = NULL;
856
857	if (doi_def->type == CIPSO_V4_MAP_TRANS) {
858	net_cat_size = doi_def->map.std->cat.cipso_size;
859	net_cat_array = doi_def->map.std->cat.cipso;
860	}
861
862	for (;;) {
863	net_spot = netlbl_bitmap_walk(bitmap: net_cat,
864	bitmap_len: net_clen_bits,
865	offset: net_spot + 1,
866	state: 1);
867	if (net_spot < 0)
868	return 0;
869
870	switch (doi_def->type) {
871	case CIPSO_V4_MAP_PASS:
872	host_spot = net_spot;
873	break;
874	case CIPSO_V4_MAP_TRANS:
875	if (net_spot >= net_cat_size)
876	return -EPERM;
877	host_spot = net_cat_array[net_spot];
878	if (host_spot >= CIPSO_V4_INV_CAT)
879	return -EPERM;
880	break;
881	}
882	ret_val = netlbl_catmap_setbit(catmap: &secattr->attr.mls.cat,
883	bit: host_spot,
884	GFP_ATOMIC);
885	if (ret_val != 0)
886	return ret_val;
887	}
888
889	return -EINVAL;
890	}
891
892	/**
893	* cipso_v4_map_cat_enum_valid - Checks to see if the categories are valid
894	* @doi_def: the DOI definition
895	* @enumcat: category list
896	* @enumcat_len: length of the category list in bytes
897	*
898	* Description:
899	* Checks the given categories against the given DOI definition and returns a
900	* negative value if any of the categories do not have a valid mapping and a
901	* zero value if all of the categories are valid.
902	*
903	*/
904	static int cipso_v4_map_cat_enum_valid(const struct cipso_v4_doi *doi_def,
905	const unsigned char *enumcat,
906	u32 enumcat_len)
907	{
908	u16 cat;
909	int cat_prev = -1;
910	u32 iter;
911
912	if (doi_def->type != CIPSO_V4_MAP_PASS || enumcat_len & 0x01)
913	return -EFAULT;
914
915	for (iter = 0; iter < enumcat_len; iter += 2) {
916	cat = get_unaligned_be16(p: &enumcat[iter]);
917	if (cat <= cat_prev)
918	return -EFAULT;
919	cat_prev = cat;
920	}
921
922	return 0;
923	}
924
925	/**
926	* cipso_v4_map_cat_enum_hton - Perform a category mapping from host to network
927	* @doi_def: the DOI definition
928	* @secattr: the security attributes
929	* @net_cat: the zero'd out category list in network/CIPSO format
930	* @net_cat_len: the length of the CIPSO category list in bytes
931	*
932	* Description:
933	* Perform a label mapping to translate a local MLS category bitmap to the
934	* correct CIPSO category list using the given DOI definition. Returns the
935	* size in bytes of the network category bitmap on success, negative values
936	* otherwise.
937	*
938	*/
939	static int cipso_v4_map_cat_enum_hton(const struct cipso_v4_doi *doi_def,
940	const struct netlbl_lsm_secattr *secattr,
941	unsigned char *net_cat,
942	u32 net_cat_len)
943	{
944	int cat = -1;
945	u32 cat_iter = 0;
946
947	for (;;) {
948	cat = netlbl_catmap_walk(catmap: secattr->attr.mls.cat, offset: cat + 1);
949	if (cat < 0)
950	break;
951	if ((cat_iter + 2) > net_cat_len)
952	return -ENOSPC;
953
954	*((__be16 *)&net_cat[cat_iter]) = htons(cat);
955	cat_iter += 2;
956	}
957
958	return cat_iter;
959	}
960
961	/**
962	* cipso_v4_map_cat_enum_ntoh - Perform a category mapping from network to host
963	* @doi_def: the DOI definition
964	* @net_cat: the category list in network/CIPSO format
965	* @net_cat_len: the length of the CIPSO bitmap in bytes
966	* @secattr: the security attributes
967	*
968	* Description:
969	* Perform a label mapping to translate a CIPSO category list to the correct
970	* local MLS category bitmap using the given DOI definition. Returns zero on
971	* success, negative values on failure.
972	*
973	*/
974	static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
975	const unsigned char *net_cat,
976	u32 net_cat_len,
977	struct netlbl_lsm_secattr *secattr)
978	{
979	int ret_val;
980	u32 iter;
981
982	for (iter = 0; iter < net_cat_len; iter += 2) {
983	ret_val = netlbl_catmap_setbit(catmap: &secattr->attr.mls.cat,
984	bit: get_unaligned_be16(p: &net_cat[iter]),
985	GFP_ATOMIC);
986	if (ret_val != 0)
987	return ret_val;
988	}
989
990	return 0;
991	}
992
993	/**
994	* cipso_v4_map_cat_rng_valid - Checks to see if the categories are valid
995	* @doi_def: the DOI definition
996	* @rngcat: category list
997	* @rngcat_len: length of the category list in bytes
998	*
999	* Description:
1000	* Checks the given categories against the given DOI definition and returns a
1001	* negative value if any of the categories do not have a valid mapping and a
1002	* zero value if all of the categories are valid.
1003	*
1004	*/
1005	static int cipso_v4_map_cat_rng_valid(const struct cipso_v4_doi *doi_def,
1006	const unsigned char *rngcat,
1007	u32 rngcat_len)
1008	{
1009	u16 cat_high;
1010	u16 cat_low;
1011	u32 cat_prev = CIPSO_V4_MAX_REM_CATS + 1;
1012	u32 iter;
1013
1014	if (doi_def->type != CIPSO_V4_MAP_PASS || rngcat_len & 0x01)
1015	return -EFAULT;
1016
1017	for (iter = 0; iter < rngcat_len; iter += 4) {
1018	cat_high = get_unaligned_be16(p: &rngcat[iter]);
1019	if ((iter + 4) <= rngcat_len)
1020	cat_low = get_unaligned_be16(p: &rngcat[iter + 2]);
1021	else
1022	cat_low = 0;
1023
1024	if (cat_high > cat_prev)
1025	return -EFAULT;
1026
1027	cat_prev = cat_low;
1028	}
1029
1030	return 0;
1031	}
1032
1033	/**
1034	* cipso_v4_map_cat_rng_hton - Perform a category mapping from host to network
1035	* @doi_def: the DOI definition
1036	* @secattr: the security attributes
1037	* @net_cat: the zero'd out category list in network/CIPSO format
1038	* @net_cat_len: the length of the CIPSO category list in bytes
1039	*
1040	* Description:
1041	* Perform a label mapping to translate a local MLS category bitmap to the
1042	* correct CIPSO category list using the given DOI definition. Returns the
1043	* size in bytes of the network category bitmap on success, negative values
1044	* otherwise.
1045	*
1046	*/
1047	static int cipso_v4_map_cat_rng_hton(const struct cipso_v4_doi *doi_def,
1048	const struct netlbl_lsm_secattr *secattr,
1049	unsigned char *net_cat,
1050	u32 net_cat_len)
1051	{
1052	int iter = -1;
1053	u16 array[CIPSO_V4_TAG_RNG_CAT_MAX * 2];
1054	u32 array_cnt = 0;
1055	u32 cat_size = 0;
1056
1057	/* make sure we don't overflow the 'array[]' variable */
1058	if (net_cat_len >
1059	(CIPSO_V4_OPT_LEN_MAX - CIPSO_V4_HDR_LEN - CIPSO_V4_TAG_RNG_BLEN))
1060	return -ENOSPC;
1061
1062	for (;;) {
1063	iter = netlbl_catmap_walk(catmap: secattr->attr.mls.cat, offset: iter + 1);
1064	if (iter < 0)
1065	break;
1066	cat_size += (iter == 0 ? 0 : sizeof(u16));
1067	if (cat_size > net_cat_len)
1068	return -ENOSPC;
1069	array[array_cnt++] = iter;
1070
1071	iter = netlbl_catmap_walkrng(catmap: secattr->attr.mls.cat, offset: iter);
1072	if (iter < 0)
1073	return -EFAULT;
1074	cat_size += sizeof(u16);
1075	if (cat_size > net_cat_len)
1076	return -ENOSPC;
1077	array[array_cnt++] = iter;
1078	}
1079
1080	for (iter = 0; array_cnt > 0;) {
1081	*((__be16 *)&net_cat[iter]) = htons(array[--array_cnt]);
1082	iter += 2;
1083	array_cnt--;
1084	if (array[array_cnt] != 0) {
1085	*((__be16 *)&net_cat[iter]) = htons(array[array_cnt]);
1086	iter += 2;
1087	}
1088	}
1089
1090	return cat_size;
1091	}
1092
1093	/**
1094	* cipso_v4_map_cat_rng_ntoh - Perform a category mapping from network to host
1095	* @doi_def: the DOI definition
1096	* @net_cat: the category list in network/CIPSO format
1097	* @net_cat_len: the length of the CIPSO bitmap in bytes
1098	* @secattr: the security attributes
1099	*
1100	* Description:
1101	* Perform a label mapping to translate a CIPSO category list to the correct
1102	* local MLS category bitmap using the given DOI definition. Returns zero on
1103	* success, negative values on failure.
1104	*
1105	*/
1106	static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
1107	const unsigned char *net_cat,
1108	u32 net_cat_len,
1109	struct netlbl_lsm_secattr *secattr)
1110	{
1111	int ret_val;
1112	u32 net_iter;
1113	u16 cat_low;
1114	u16 cat_high;
1115
1116	for (net_iter = 0; net_iter < net_cat_len; net_iter += 4) {
1117	cat_high = get_unaligned_be16(p: &net_cat[net_iter]);
1118	if ((net_iter + 4) <= net_cat_len)
1119	cat_low = get_unaligned_be16(p: &net_cat[net_iter + 2]);
1120	else
1121	cat_low = 0;
1122
1123	ret_val = netlbl_catmap_setrng(catmap: &secattr->attr.mls.cat,
1124	start: cat_low,
1125	end: cat_high,
1126	GFP_ATOMIC);
1127	if (ret_val != 0)
1128	return ret_val;
1129	}
1130
1131	return 0;
1132	}
1133
1134	/*
1135	* Protocol Handling Functions
1136	*/
1137
1138	/**
1139	* cipso_v4_gentag_hdr - Generate a CIPSO option header
1140	* @doi_def: the DOI definition
1141	* @len: the total tag length in bytes, not including this header
1142	* @buf: the CIPSO option buffer
1143	*
1144	* Description:
1145	* Write a CIPSO header into the beginning of @buffer.
1146	*
1147	*/
1148	static void cipso_v4_gentag_hdr(const struct cipso_v4_doi *doi_def,
1149	unsigned char *buf,
1150	u32 len)
1151	{
1152	buf[0] = IPOPT_CIPSO;
1153	buf[1] = CIPSO_V4_HDR_LEN + len;
1154	put_unaligned_be32(val: doi_def->doi, p: &buf[2]);
1155	}
1156
1157	/**
1158	* cipso_v4_gentag_rbm - Generate a CIPSO restricted bitmap tag (type #1)
1159	* @doi_def: the DOI definition
1160	* @secattr: the security attributes
1161	* @buffer: the option buffer
1162	* @buffer_len: length of buffer in bytes
1163	*
1164	* Description:
1165	* Generate a CIPSO option using the restricted bitmap tag, tag type #1. The
1166	* actual buffer length may be larger than the indicated size due to
1167	* translation between host and network category bitmaps. Returns the size of
1168	* the tag on success, negative values on failure.
1169	*
1170	*/
1171	static int cipso_v4_gentag_rbm(const struct cipso_v4_doi *doi_def,
1172	const struct netlbl_lsm_secattr *secattr,
1173	unsigned char *buffer,
1174	u32 buffer_len)
1175	{
1176	int ret_val;
1177	u32 tag_len;
1178	u32 level;
1179
1180	if ((secattr->flags & NETLBL_SECATTR_MLS_LVL) == 0)
1181	return -EPERM;
1182
1183	ret_val = cipso_v4_map_lvl_hton(doi_def,
1184	host_lvl: secattr->attr.mls.lvl,
1185	net_lvl: &level);
1186	if (ret_val != 0)
1187	return ret_val;
1188
1189	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1190	ret_val = cipso_v4_map_cat_rbm_hton(doi_def,
1191	secattr,
1192	net_cat: &buffer[4],
1193	net_cat_len: buffer_len - 4);
1194	if (ret_val < 0)
1195	return ret_val;
1196
1197	/* This will send packets using the "optimized" format when
1198	* possible as specified in section 3.4.2.6 of the
1199	* CIPSO draft. */
1200	if (READ_ONCE(cipso_v4_rbm_optfmt) && ret_val > 0 &&
1201	ret_val <= 10)
1202	tag_len = 14;
1203	else
1204	tag_len = 4 + ret_val;
1205	} else
1206	tag_len = 4;
1207
1208	buffer[0] = CIPSO_V4_TAG_RBITMAP;
1209	buffer[1] = tag_len;
1210	buffer[3] = level;
1211
1212	return tag_len;
1213	}
1214
1215	/**
1216	* cipso_v4_parsetag_rbm - Parse a CIPSO restricted bitmap tag
1217	* @doi_def: the DOI definition
1218	* @tag: the CIPSO tag
1219	* @secattr: the security attributes
1220	*
1221	* Description:
1222	* Parse a CIPSO restricted bitmap tag (tag type #1) and return the security
1223	* attributes in @secattr. Return zero on success, negatives values on
1224	* failure.
1225	*
1226	*/
1227	static int cipso_v4_parsetag_rbm(const struct cipso_v4_doi *doi_def,
1228	const unsigned char *tag,
1229	struct netlbl_lsm_secattr *secattr)
1230	{
1231	int ret_val;
1232	u8 tag_len = tag[1];
1233	u32 level;
1234
1235	ret_val = cipso_v4_map_lvl_ntoh(doi_def, net_lvl: tag[3], host_lvl: &level);
1236	if (ret_val != 0)
1237	return ret_val;
1238	secattr->attr.mls.lvl = level;
1239	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1240
1241	if (tag_len > 4) {
1242	ret_val = cipso_v4_map_cat_rbm_ntoh(doi_def,
1243	net_cat: &tag[4],
1244	net_cat_len: tag_len - 4,
1245	secattr);
1246	if (ret_val != 0) {
1247	netlbl_catmap_free(catmap: secattr->attr.mls.cat);
1248	return ret_val;
1249	}
1250
1251	if (secattr->attr.mls.cat)
1252	secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1253	}
1254
1255	return 0;
1256	}
1257
1258	/**
1259	* cipso_v4_gentag_enum - Generate a CIPSO enumerated tag (type #2)
1260	* @doi_def: the DOI definition
1261	* @secattr: the security attributes
1262	* @buffer: the option buffer
1263	* @buffer_len: length of buffer in bytes
1264	*
1265	* Description:
1266	* Generate a CIPSO option using the enumerated tag, tag type #2. Returns the
1267	* size of the tag on success, negative values on failure.
1268	*
1269	*/
1270	static int cipso_v4_gentag_enum(const struct cipso_v4_doi *doi_def,
1271	const struct netlbl_lsm_secattr *secattr,
1272	unsigned char *buffer,
1273	u32 buffer_len)
1274	{
1275	int ret_val;
1276	u32 tag_len;
1277	u32 level;
1278
1279	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1280	return -EPERM;
1281
1282	ret_val = cipso_v4_map_lvl_hton(doi_def,
1283	host_lvl: secattr->attr.mls.lvl,
1284	net_lvl: &level);
1285	if (ret_val != 0)
1286	return ret_val;
1287
1288	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1289	ret_val = cipso_v4_map_cat_enum_hton(doi_def,
1290	secattr,
1291	net_cat: &buffer[4],
1292	net_cat_len: buffer_len - 4);
1293	if (ret_val < 0)
1294	return ret_val;
1295
1296	tag_len = 4 + ret_val;
1297	} else
1298	tag_len = 4;
1299
1300	buffer[0] = CIPSO_V4_TAG_ENUM;
1301	buffer[1] = tag_len;
1302	buffer[3] = level;
1303
1304	return tag_len;
1305	}
1306
1307	/**
1308	* cipso_v4_parsetag_enum - Parse a CIPSO enumerated tag
1309	* @doi_def: the DOI definition
1310	* @tag: the CIPSO tag
1311	* @secattr: the security attributes
1312	*
1313	* Description:
1314	* Parse a CIPSO enumerated tag (tag type #2) and return the security
1315	* attributes in @secattr. Return zero on success, negatives values on
1316	* failure.
1317	*
1318	*/
1319	static int cipso_v4_parsetag_enum(const struct cipso_v4_doi *doi_def,
1320	const unsigned char *tag,
1321	struct netlbl_lsm_secattr *secattr)
1322	{
1323	int ret_val;
1324	u8 tag_len = tag[1];
1325	u32 level;
1326
1327	ret_val = cipso_v4_map_lvl_ntoh(doi_def, net_lvl: tag[3], host_lvl: &level);
1328	if (ret_val != 0)
1329	return ret_val;
1330	secattr->attr.mls.lvl = level;
1331	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1332
1333	if (tag_len > 4) {
1334	ret_val = cipso_v4_map_cat_enum_ntoh(doi_def,
1335	net_cat: &tag[4],
1336	net_cat_len: tag_len - 4,
1337	secattr);
1338	if (ret_val != 0) {
1339	netlbl_catmap_free(catmap: secattr->attr.mls.cat);
1340	return ret_val;
1341	}
1342
1343	secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1344	}
1345
1346	return 0;
1347	}
1348
1349	/**
1350	* cipso_v4_gentag_rng - Generate a CIPSO ranged tag (type #5)
1351	* @doi_def: the DOI definition
1352	* @secattr: the security attributes
1353	* @buffer: the option buffer
1354	* @buffer_len: length of buffer in bytes
1355	*
1356	* Description:
1357	* Generate a CIPSO option using the ranged tag, tag type #5. Returns the
1358	* size of the tag on success, negative values on failure.
1359	*
1360	*/
1361	static int cipso_v4_gentag_rng(const struct cipso_v4_doi *doi_def,
1362	const struct netlbl_lsm_secattr *secattr,
1363	unsigned char *buffer,
1364	u32 buffer_len)
1365	{
1366	int ret_val;
1367	u32 tag_len;
1368	u32 level;
1369
1370	if (!(secattr->flags & NETLBL_SECATTR_MLS_LVL))
1371	return -EPERM;
1372
1373	ret_val = cipso_v4_map_lvl_hton(doi_def,
1374	host_lvl: secattr->attr.mls.lvl,
1375	net_lvl: &level);
1376	if (ret_val != 0)
1377	return ret_val;
1378
1379	if (secattr->flags & NETLBL_SECATTR_MLS_CAT) {
1380	ret_val = cipso_v4_map_cat_rng_hton(doi_def,
1381	secattr,
1382	net_cat: &buffer[4],
1383	net_cat_len: buffer_len - 4);
1384	if (ret_val < 0)
1385	return ret_val;
1386
1387	tag_len = 4 + ret_val;
1388	} else
1389	tag_len = 4;
1390
1391	buffer[0] = CIPSO_V4_TAG_RANGE;
1392	buffer[1] = tag_len;
1393	buffer[3] = level;
1394
1395	return tag_len;
1396	}
1397
1398	/**
1399	* cipso_v4_parsetag_rng - Parse a CIPSO ranged tag
1400	* @doi_def: the DOI definition
1401	* @tag: the CIPSO tag
1402	* @secattr: the security attributes
1403	*
1404	* Description:
1405	* Parse a CIPSO ranged tag (tag type #5) and return the security attributes
1406	* in @secattr. Return zero on success, negatives values on failure.
1407	*
1408	*/
1409	static int cipso_v4_parsetag_rng(const struct cipso_v4_doi *doi_def,
1410	const unsigned char *tag,
1411	struct netlbl_lsm_secattr *secattr)
1412	{
1413	int ret_val;
1414	u8 tag_len = tag[1];
1415	u32 level;
1416
1417	ret_val = cipso_v4_map_lvl_ntoh(doi_def, net_lvl: tag[3], host_lvl: &level);
1418	if (ret_val != 0)
1419	return ret_val;
1420	secattr->attr.mls.lvl = level;
1421	secattr->flags |= NETLBL_SECATTR_MLS_LVL;
1422
1423	if (tag_len > 4) {
1424	ret_val = cipso_v4_map_cat_rng_ntoh(doi_def,
1425	net_cat: &tag[4],
1426	net_cat_len: tag_len - 4,
1427	secattr);
1428	if (ret_val != 0) {
1429	netlbl_catmap_free(catmap: secattr->attr.mls.cat);
1430	return ret_val;
1431	}
1432
1433	if (secattr->attr.mls.cat)
1434	secattr->flags |= NETLBL_SECATTR_MLS_CAT;
1435	}
1436
1437	return 0;
1438	}
1439
1440	/**
1441	* cipso_v4_gentag_loc - Generate a CIPSO local tag (non-standard)
1442	* @doi_def: the DOI definition
1443	* @secattr: the security attributes
1444	* @buffer: the option buffer
1445	* @buffer_len: length of buffer in bytes
1446	*
1447	* Description:
1448	* Generate a CIPSO option using the local tag. Returns the size of the tag
1449	* on success, negative values on failure.
1450	*
1451	*/
1452	static int cipso_v4_gentag_loc(const struct cipso_v4_doi *doi_def,
1453	const struct netlbl_lsm_secattr *secattr,
1454	unsigned char *buffer,
1455	u32 buffer_len)
1456	{
1457	if (!(secattr->flags & NETLBL_SECATTR_SECID))
1458	return -EPERM;
1459
1460	buffer[0] = CIPSO_V4_TAG_LOCAL;
1461	buffer[1] = CIPSO_V4_TAG_LOC_BLEN;
1462	*(u32 *)&buffer[2] = secattr->attr.secid;
1463
1464	return CIPSO_V4_TAG_LOC_BLEN;
1465	}
1466
1467	/**
1468	* cipso_v4_parsetag_loc - Parse a CIPSO local tag
1469	* @doi_def: the DOI definition
1470	* @tag: the CIPSO tag
1471	* @secattr: the security attributes
1472	*
1473	* Description:
1474	* Parse a CIPSO local tag and return the security attributes in @secattr.
1475	* Return zero on success, negatives values on failure.
1476	*
1477	*/
1478	static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
1479	const unsigned char *tag,
1480	struct netlbl_lsm_secattr *secattr)
1481	{
1482	secattr->attr.secid = *(u32 *)&tag[2];
1483	secattr->flags |= NETLBL_SECATTR_SECID;
1484
1485	return 0;
1486	}
1487
1488	/**
1489	* cipso_v4_optptr - Find the CIPSO option in the packet
1490	* @skb: the packet
1491	*
1492	* Description:
1493	* Parse the packet's IP header looking for a CIPSO option. Returns a pointer
1494	* to the start of the CIPSO option on success, NULL if one is not found.
1495	*
1496	*/
1497	unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
1498	{
1499	const struct iphdr *iph = ip_hdr(skb);
1500	unsigned char *optptr = (unsigned char *)&(ip_hdr(skb)[1]);
1501	int optlen;
1502	int taglen;
1503
1504	for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) {
1505	switch (optptr[0]) {
1506	case IPOPT_END:
1507	return NULL;
1508	case IPOPT_NOOP:
1509	taglen = 1;
1510	break;
1511	default:
1512	taglen = optptr[1];
1513	}
1514	if (!taglen || taglen > optlen)
1515	return NULL;
1516	if (optptr[0] == IPOPT_CIPSO)
1517	return optptr;
1518
1519	optlen -= taglen;
1520	optptr += taglen;
1521	}
1522
1523	return NULL;
1524	}
1525
1526	/**
1527	* cipso_v4_validate - Validate a CIPSO option
1528	* @skb: the packet
1529	* @option: the start of the option, on error it is set to point to the error
1530	*
1531	* Description:
1532	* This routine is called to validate a CIPSO option, it checks all of the
1533	* fields to ensure that they are at least valid, see the draft snippet below
1534	* for details. If the option is valid then a zero value is returned and
1535	* the value of @option is unchanged. If the option is invalid then a
1536	* non-zero value is returned and @option is adjusted to point to the
1537	* offending portion of the option. From the IETF draft ...
1538	*
1539	* "If any field within the CIPSO options, such as the DOI identifier, is not
1540	* recognized the IP datagram is discarded and an ICMP 'parameter problem'
1541	* (type 12) is generated and returned. The ICMP code field is set to 'bad
1542	* parameter' (code 0) and the pointer is set to the start of the CIPSO field
1543	* that is unrecognized."
1544	*
1545	*/
1546	int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option)
1547	{
1548	unsigned char *opt = *option;
1549	unsigned char *tag;
1550	unsigned char opt_iter;
1551	unsigned char err_offset = 0;
1552	u8 opt_len;
1553	u8 tag_len;
1554	struct cipso_v4_doi *doi_def = NULL;
1555	u32 tag_iter;
1556
1557	/* caller already checks for length values that are too large */
1558	opt_len = opt[1];
1559	if (opt_len < 8) {
1560	err_offset = 1;
1561	goto validate_return;
1562	}
1563
1564	rcu_read_lock();
1565	doi_def = cipso_v4_doi_search(doi: get_unaligned_be32(p: &opt[2]));
1566	if (!doi_def) {
1567	err_offset = 2;
1568	goto validate_return_locked;
1569	}
1570
1571	opt_iter = CIPSO_V4_HDR_LEN;
1572	tag = opt + opt_iter;
1573	while (opt_iter < opt_len) {
1574	for (tag_iter = 0; doi_def->tags[tag_iter] != tag[0];)
1575	if (doi_def->tags[tag_iter] == CIPSO_V4_TAG_INVALID ||
1576	++tag_iter == CIPSO_V4_TAG_MAXCNT) {
1577	err_offset = opt_iter;
1578	goto validate_return_locked;
1579	}
1580
1581	if (opt_iter + 1 == opt_len) {
1582	err_offset = opt_iter;
1583	goto validate_return_locked;
1584	}
1585	tag_len = tag[1];
1586	if (tag_len > (opt_len - opt_iter)) {
1587	err_offset = opt_iter + 1;
1588	goto validate_return_locked;
1589	}
1590
1591	switch (tag[0]) {
1592	case CIPSO_V4_TAG_RBITMAP:
1593	if (tag_len < CIPSO_V4_TAG_RBM_BLEN) {
1594	err_offset = opt_iter + 1;
1595	goto validate_return_locked;
1596	}
1597
1598	/* We are already going to do all the verification
1599	* necessary at the socket layer so from our point of
1600	* view it is safe to turn these checks off (and less
1601	* work), however, the CIPSO draft says we should do
1602	* all the CIPSO validations here but it doesn't
1603	* really specify _exactly_ what we need to validate
1604	* ... so, just make it a sysctl tunable. */
1605	if (READ_ONCE(cipso_v4_rbm_strictvalid)) {
1606	if (cipso_v4_map_lvl_valid(doi_def,
1607	level: tag[3]) < 0) {
1608	err_offset = opt_iter + 3;
1609	goto validate_return_locked;
1610	}
1611	if (tag_len > CIPSO_V4_TAG_RBM_BLEN &&
1612	cipso_v4_map_cat_rbm_valid(doi_def,
1613	bitmap: &tag[4],
1614	bitmap_len: tag_len - 4) < 0) {
1615	err_offset = opt_iter + 4;
1616	goto validate_return_locked;
1617	}
1618	}
1619	break;
1620	case CIPSO_V4_TAG_ENUM:
1621	if (tag_len < CIPSO_V4_TAG_ENUM_BLEN) {
1622	err_offset = opt_iter + 1;
1623	goto validate_return_locked;
1624	}
1625
1626	if (cipso_v4_map_lvl_valid(doi_def,
1627	level: tag[3]) < 0) {
1628	err_offset = opt_iter + 3;
1629	goto validate_return_locked;
1630	}
1631	if (tag_len > CIPSO_V4_TAG_ENUM_BLEN &&
1632	cipso_v4_map_cat_enum_valid(doi_def,
1633	enumcat: &tag[4],
1634	enumcat_len: tag_len - 4) < 0) {
1635	err_offset = opt_iter + 4;
1636	goto validate_return_locked;
1637	}
1638	break;
1639	case CIPSO_V4_TAG_RANGE:
1640	if (tag_len < CIPSO_V4_TAG_RNG_BLEN) {
1641	err_offset = opt_iter + 1;
1642	goto validate_return_locked;
1643	}
1644
1645	if (cipso_v4_map_lvl_valid(doi_def,
1646	level: tag[3]) < 0) {
1647	err_offset = opt_iter + 3;
1648	goto validate_return_locked;
1649	}
1650	if (tag_len > CIPSO_V4_TAG_RNG_BLEN &&
1651	cipso_v4_map_cat_rng_valid(doi_def,
1652	rngcat: &tag[4],
1653	rngcat_len: tag_len - 4) < 0) {
1654	err_offset = opt_iter + 4;
1655	goto validate_return_locked;
1656	}
1657	break;
1658	case CIPSO_V4_TAG_LOCAL:
1659	/* This is a non-standard tag that we only allow for
1660	* local connections, so if the incoming interface is
1661	* not the loopback device drop the packet. Further,
1662	* there is no legitimate reason for setting this from
1663	* userspace so reject it if skb is NULL. */
1664	if (!skb || !(skb->dev->flags & IFF_LOOPBACK)) {
1665	err_offset = opt_iter;
1666	goto validate_return_locked;
1667	}
1668	if (tag_len != CIPSO_V4_TAG_LOC_BLEN) {
1669	err_offset = opt_iter + 1;
1670	goto validate_return_locked;
1671	}
1672	break;
1673	default:
1674	err_offset = opt_iter;
1675	goto validate_return_locked;
1676	}
1677
1678	tag += tag_len;
1679	opt_iter += tag_len;
1680	}
1681
1682	validate_return_locked:
1683	rcu_read_unlock();
1684	validate_return:
1685	*option = opt + err_offset;
1686	return err_offset;
1687	}
1688
1689	/**
1690	* cipso_v4_error - Send the correct response for a bad packet
1691	* @skb: the packet
1692	* @error: the error code
1693	* @gateway: CIPSO gateway flag
1694	*
1695	* Description:
1696	* Based on the error code given in @error, send an ICMP error message back to
1697	* the originating host. From the IETF draft ...
1698	*
1699	* "If the contents of the CIPSO [option] are valid but the security label is
1700	* outside of the configured host or port label range, the datagram is
1701	* discarded and an ICMP 'destination unreachable' (type 3) is generated and
1702	* returned. The code field of the ICMP is set to 'communication with
1703	* destination network administratively prohibited' (code 9) or to
1704	* 'communication with destination host administratively prohibited'
1705	* (code 10). The value of the code is dependent on whether the originator
1706	* of the ICMP message is acting as a CIPSO host or a CIPSO gateway. The
1707	* recipient of the ICMP message MUST be able to handle either value. The
1708	* same procedure is performed if a CIPSO [option] can not be added to an
1709	* IP packet because it is too large to fit in the IP options area."
1710	*
1711	* "If the error is triggered by receipt of an ICMP message, the message is
1712	* discarded and no response is permitted (consistent with general ICMP
1713	* processing rules)."
1714	*
1715	*/
1716	void cipso_v4_error(struct sk_buff *skb, int error, u32 gateway)
1717	{
1718	unsigned char optbuf[sizeof(struct ip_options) + 40];
1719	struct ip_options *opt = (struct ip_options *)optbuf;
1720	int res;
1721
1722	if (ip_hdr(skb)->protocol == IPPROTO_ICMP || error != -EACCES)
1723	return;
1724
1725	/*
1726	* We might be called above the IP layer,
1727	* so we can not use icmp_send and IPCB here.
1728	*/
1729
1730	memset(opt, 0, sizeof(struct ip_options));
1731	opt->optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
1732	rcu_read_lock();
1733	res = __ip_options_compile(net: dev_net(dev: skb->dev), opt, skb, NULL);
1734	rcu_read_unlock();
1735
1736	if (res)
1737	return;
1738
1739	if (gateway)
1740	__icmp_send(skb_in: skb, ICMP_DEST_UNREACH, ICMP_NET_ANO, info: 0, opt);
1741	else
1742	__icmp_send(skb_in: skb, ICMP_DEST_UNREACH, ICMP_HOST_ANO, info: 0, opt);
1743	}
1744
1745	/**
1746	* cipso_v4_genopt - Generate a CIPSO option
1747	* @buf: the option buffer
1748	* @buf_len: the size of opt_buf
1749	* @doi_def: the CIPSO DOI to use
1750	* @secattr: the security attributes
1751	*
1752	* Description:
1753	* Generate a CIPSO option using the DOI definition and security attributes
1754	* passed to the function. Returns the length of the option on success and
1755	* negative values on failure.
1756	*
1757	*/
1758	static int cipso_v4_genopt(unsigned char *buf, u32 buf_len,
1759	const struct cipso_v4_doi *doi_def,
1760	const struct netlbl_lsm_secattr *secattr)
1761	{
1762	int ret_val;
1763	u32 iter;
1764
1765	if (buf_len <= CIPSO_V4_HDR_LEN)
1766	return -ENOSPC;
1767
1768	/* XXX - This code assumes only one tag per CIPSO option which isn't
1769	* really a good assumption to make but since we only support the MAC
1770	* tags right now it is a safe assumption. */
1771	iter = 0;
1772	do {
1773	memset(buf, 0, buf_len);
1774	switch (doi_def->tags[iter]) {
1775	case CIPSO_V4_TAG_RBITMAP:
1776	ret_val = cipso_v4_gentag_rbm(doi_def,
1777	secattr,
1778	buffer: &buf[CIPSO_V4_HDR_LEN],
1779	buffer_len: buf_len - CIPSO_V4_HDR_LEN);
1780	break;
1781	case CIPSO_V4_TAG_ENUM:
1782	ret_val = cipso_v4_gentag_enum(doi_def,
1783	secattr,
1784	buffer: &buf[CIPSO_V4_HDR_LEN],
1785	buffer_len: buf_len - CIPSO_V4_HDR_LEN);
1786	break;
1787	case CIPSO_V4_TAG_RANGE:
1788	ret_val = cipso_v4_gentag_rng(doi_def,
1789	secattr,
1790	buffer: &buf[CIPSO_V4_HDR_LEN],
1791	buffer_len: buf_len - CIPSO_V4_HDR_LEN);
1792	break;
1793	case CIPSO_V4_TAG_LOCAL:
1794	ret_val = cipso_v4_gentag_loc(doi_def,
1795	secattr,
1796	buffer: &buf[CIPSO_V4_HDR_LEN],
1797	buffer_len: buf_len - CIPSO_V4_HDR_LEN);
1798	break;
1799	default:
1800	return -EPERM;
1801	}
1802
1803	iter++;
1804	} while (ret_val < 0 &&
1805	iter < CIPSO_V4_TAG_MAXCNT &&
1806	doi_def->tags[iter] != CIPSO_V4_TAG_INVALID);
1807	if (ret_val < 0)
1808	return ret_val;
1809	cipso_v4_gentag_hdr(doi_def, buf, len: ret_val);
1810	return CIPSO_V4_HDR_LEN + ret_val;
1811	}
1812
1813	/**
1814	* cipso_v4_sock_setattr - Add a CIPSO option to a socket
1815	* @sk: the socket
1816	* @doi_def: the CIPSO DOI to use
1817	* @secattr: the specific security attributes of the socket
1818	*
1819	* Description:
1820	* Set the CIPSO option on the given socket using the DOI definition and
1821	* security attributes passed to the function. This function requires
1822	* exclusive access to @sk, which means it either needs to be in the
1823	* process of being created or locked. Returns zero on success and negative
1824	* values on failure.
1825	*
1826	*/
1827	int cipso_v4_sock_setattr(struct sock *sk,
1828	const struct cipso_v4_doi *doi_def,
1829	const struct netlbl_lsm_secattr *secattr)
1830	{
1831	int ret_val = -EPERM;
1832	unsigned char *buf = NULL;
1833	u32 buf_len;
1834	u32 opt_len;
1835	struct ip_options_rcu *old, *opt = NULL;
1836	struct inet_sock *sk_inet;
1837	struct inet_connection_sock *sk_conn;
1838
1839	/* In the case of sock_create_lite(), the sock->sk field is not
1840	* defined yet but it is not a problem as the only users of these
1841	* "lite" PF_INET sockets are functions which do an accept() call
1842	* afterwards so we will label the socket as part of the accept(). */
1843	if (!sk)
1844	return 0;
1845
1846	/* We allocate the maximum CIPSO option size here so we are probably
1847	* being a little wasteful, but it makes our life _much_ easier later
1848	* on and after all we are only talking about 40 bytes. */
1849	buf_len = CIPSO_V4_OPT_LEN_MAX;
1850	buf = kmalloc(size: buf_len, GFP_ATOMIC);
1851	if (!buf) {
1852	ret_val = -ENOMEM;
1853	goto socket_setattr_failure;
1854	}
1855
1856	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1857	if (ret_val < 0)
1858	goto socket_setattr_failure;
1859	buf_len = ret_val;
1860
1861	/* We can't use ip_options_get() directly because it makes a call to
1862	* ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1863	* we won't always have CAP_NET_RAW even though we _always_ want to
1864	* set the IPOPT_CIPSO option. */
1865	opt_len = (buf_len + 3) & ~3;
1866	opt = kzalloc(size: sizeof(*opt) + opt_len, GFP_ATOMIC);
1867	if (!opt) {
1868	ret_val = -ENOMEM;
1869	goto socket_setattr_failure;
1870	}
1871	memcpy(opt->opt.__data, buf, buf_len);
1872	opt->opt.optlen = opt_len;
1873	opt->opt.cipso = sizeof(struct iphdr);
1874	kfree(objp: buf);
1875	buf = NULL;
1876
1877	sk_inet = inet_sk(sk);
1878
1879	old = rcu_dereference_protected(sk_inet->inet_opt,
1880	lockdep_sock_is_held(sk));
1881	if (inet_test_bit(IS_ICSK, sk)) {
1882	sk_conn = inet_csk(sk);
1883	if (old)
1884	sk_conn->icsk_ext_hdr_len -= old->opt.optlen;
1885	sk_conn->icsk_ext_hdr_len += opt->opt.optlen;
1886	sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
1887	}
1888	rcu_assign_pointer(sk_inet->inet_opt, opt);
1889	if (old)
1890	kfree_rcu(old, rcu);
1891
1892	return 0;
1893
1894	socket_setattr_failure:
1895	kfree(objp: buf);
1896	kfree(objp: opt);
1897	return ret_val;
1898	}
1899
1900	/**
1901	* cipso_v4_req_setattr - Add a CIPSO option to a connection request socket
1902	* @req: the connection request socket
1903	* @doi_def: the CIPSO DOI to use
1904	* @secattr: the specific security attributes of the socket
1905	*
1906	* Description:
1907	* Set the CIPSO option on the given socket using the DOI definition and
1908	* security attributes passed to the function. Returns zero on success and
1909	* negative values on failure.
1910	*
1911	*/
1912	int cipso_v4_req_setattr(struct request_sock *req,
1913	const struct cipso_v4_doi *doi_def,
1914	const struct netlbl_lsm_secattr *secattr)
1915	{
1916	int ret_val = -EPERM;
1917	unsigned char *buf = NULL;
1918	u32 buf_len;
1919	u32 opt_len;
1920	struct ip_options_rcu *opt = NULL;
1921	struct inet_request_sock *req_inet;
1922
1923	/* We allocate the maximum CIPSO option size here so we are probably
1924	* being a little wasteful, but it makes our life _much_ easier later
1925	* on and after all we are only talking about 40 bytes. */
1926	buf_len = CIPSO_V4_OPT_LEN_MAX;
1927	buf = kmalloc(size: buf_len, GFP_ATOMIC);
1928	if (!buf) {
1929	ret_val = -ENOMEM;
1930	goto req_setattr_failure;
1931	}
1932
1933	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
1934	if (ret_val < 0)
1935	goto req_setattr_failure;
1936	buf_len = ret_val;
1937
1938	/* We can't use ip_options_get() directly because it makes a call to
1939	* ip_options_get_alloc() which allocates memory with GFP_KERNEL and
1940	* we won't always have CAP_NET_RAW even though we _always_ want to
1941	* set the IPOPT_CIPSO option. */
1942	opt_len = (buf_len + 3) & ~3;
1943	opt = kzalloc(size: sizeof(*opt) + opt_len, GFP_ATOMIC);
1944	if (!opt) {
1945	ret_val = -ENOMEM;
1946	goto req_setattr_failure;
1947	}
1948	memcpy(opt->opt.__data, buf, buf_len);
1949	opt->opt.optlen = opt_len;
1950	opt->opt.cipso = sizeof(struct iphdr);
1951	kfree(objp: buf);
1952	buf = NULL;
1953
1954	req_inet = inet_rsk(sk: req);
1955	opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt);
1956	if (opt)
1957	kfree_rcu(opt, rcu);
1958
1959	return 0;
1960
1961	req_setattr_failure:
1962	kfree(objp: buf);
1963	kfree(objp: opt);
1964	return ret_val;
1965	}
1966
1967	/**
1968	* cipso_v4_delopt - Delete the CIPSO option from a set of IP options
1969	* @opt_ptr: IP option pointer
1970	*
1971	* Description:
1972	* Deletes the CIPSO IP option from a set of IP options and makes the necessary
1973	* adjustments to the IP option structure. Returns zero on success, negative
1974	* values on failure.
1975	*
1976	*/
1977	static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr)
1978	{
1979	struct ip_options_rcu *opt = rcu_dereference_protected(*opt_ptr, 1);
1980	int hdr_delta = 0;
1981
1982	if (!opt || opt->opt.cipso == 0)
1983	return 0;
1984	if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) {
1985	u8 cipso_len;
1986	u8 cipso_off;
1987	unsigned char *cipso_ptr;
1988	int iter;
1989	int optlen_new;
1990
1991	cipso_off = opt->opt.cipso - sizeof(struct iphdr);
1992	cipso_ptr = &opt->opt.__data[cipso_off];
1993	cipso_len = cipso_ptr[1];
1994
1995	if (opt->opt.srr > opt->opt.cipso)
1996	opt->opt.srr -= cipso_len;
1997	if (opt->opt.rr > opt->opt.cipso)
1998	opt->opt.rr -= cipso_len;
1999	if (opt->opt.ts > opt->opt.cipso)
2000	opt->opt.ts -= cipso_len;
2001	if (opt->opt.router_alert > opt->opt.cipso)
2002	opt->opt.router_alert -= cipso_len;
2003	opt->opt.cipso = 0;
2004
2005	memmove(cipso_ptr, cipso_ptr + cipso_len,
2006	opt->opt.optlen - cipso_off - cipso_len);
2007
2008	/* determining the new total option length is tricky because of
2009	* the padding necessary, the only thing i can think to do at
2010	* this point is walk the options one-by-one, skipping the
2011	* padding at the end to determine the actual option size and
2012	* from there we can determine the new total option length */
2013	iter = 0;
2014	optlen_new = 0;
2015	while (iter < opt->opt.optlen)
2016	if (opt->opt.__data[iter] != IPOPT_NOP) {
2017	iter += opt->opt.__data[iter + 1];
2018	optlen_new = iter;
2019	} else
2020	iter++;
2021	hdr_delta = opt->opt.optlen;
2022	opt->opt.optlen = (optlen_new + 3) & ~3;
2023	hdr_delta -= opt->opt.optlen;
2024	} else {
2025	/* only the cipso option was present on the socket so we can
2026	* remove the entire option struct */
2027	*opt_ptr = NULL;
2028	hdr_delta = opt->opt.optlen;
2029	kfree_rcu(opt, rcu);
2030	}
2031
2032	return hdr_delta;
2033	}
2034
2035	/**
2036	* cipso_v4_sock_delattr - Delete the CIPSO option from a socket
2037	* @sk: the socket
2038	*
2039	* Description:
2040	* Removes the CIPSO option from a socket, if present.
2041	*
2042	*/
2043	void cipso_v4_sock_delattr(struct sock *sk)
2044	{
2045	struct inet_sock *sk_inet;
2046	int hdr_delta;
2047
2048	sk_inet = inet_sk(sk);
2049
2050	hdr_delta = cipso_v4_delopt(opt_ptr: &sk_inet->inet_opt);
2051	if (inet_test_bit(IS_ICSK, sk) && hdr_delta > 0) {
2052	struct inet_connection_sock *sk_conn = inet_csk(sk);
2053	sk_conn->icsk_ext_hdr_len -= hdr_delta;
2054	sk_conn->icsk_sync_mss(sk, sk_conn->icsk_pmtu_cookie);
2055	}
2056	}
2057
2058	/**
2059	* cipso_v4_req_delattr - Delete the CIPSO option from a request socket
2060	* @req: the request socket
2061	*
2062	* Description:
2063	* Removes the CIPSO option from a request socket, if present.
2064	*
2065	*/
2066	void cipso_v4_req_delattr(struct request_sock *req)
2067	{
2068	cipso_v4_delopt(opt_ptr: &inet_rsk(sk: req)->ireq_opt);
2069	}
2070
2071	/**
2072	* cipso_v4_getattr - Helper function for the cipso_v4_*_getattr functions
2073	* @cipso: the CIPSO v4 option
2074	* @secattr: the security attributes
2075	*
2076	* Description:
2077	* Inspect @cipso and return the security attributes in @secattr. Returns zero
2078	* on success and negative values on failure.
2079	*
2080	*/
2081	int cipso_v4_getattr(const unsigned char *cipso,
2082	struct netlbl_lsm_secattr *secattr)
2083	{
2084	int ret_val = -ENOMSG;
2085	u32 doi;
2086	struct cipso_v4_doi *doi_def;
2087
2088	if (cipso_v4_cache_check(key: cipso, key_len: cipso[1], secattr) == 0)
2089	return 0;
2090
2091	doi = get_unaligned_be32(p: &cipso[2]);
2092	rcu_read_lock();
2093	doi_def = cipso_v4_doi_search(doi);
2094	if (!doi_def)
2095	goto getattr_return;
2096	/* XXX - This code assumes only one tag per CIPSO option which isn't
2097	* really a good assumption to make but since we only support the MAC
2098	* tags right now it is a safe assumption. */
2099	switch (cipso[6]) {
2100	case CIPSO_V4_TAG_RBITMAP:
2101	ret_val = cipso_v4_parsetag_rbm(doi_def, tag: &cipso[6], secattr);
2102	break;
2103	case CIPSO_V4_TAG_ENUM:
2104	ret_val = cipso_v4_parsetag_enum(doi_def, tag: &cipso[6], secattr);
2105	break;
2106	case CIPSO_V4_TAG_RANGE:
2107	ret_val = cipso_v4_parsetag_rng(doi_def, tag: &cipso[6], secattr);
2108	break;
2109	case CIPSO_V4_TAG_LOCAL:
2110	ret_val = cipso_v4_parsetag_loc(doi_def, tag: &cipso[6], secattr);
2111	break;
2112	}
2113	if (ret_val == 0)
2114	secattr->type = NETLBL_NLTYPE_CIPSOV4;
2115
2116	getattr_return:
2117	rcu_read_unlock();
2118	return ret_val;
2119	}
2120
2121	/**
2122	* cipso_v4_sock_getattr - Get the security attributes from a sock
2123	* @sk: the sock
2124	* @secattr: the security attributes
2125	*
2126	* Description:
2127	* Query @sk to see if there is a CIPSO option attached to the sock and if
2128	* there is return the CIPSO security attributes in @secattr. This function
2129	* requires that @sk be locked, or privately held, but it does not do any
2130	* locking itself. Returns zero on success and negative values on failure.
2131	*
2132	*/
2133	int cipso_v4_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
2134	{
2135	struct ip_options_rcu *opt;
2136	int res = -ENOMSG;
2137
2138	rcu_read_lock();
2139	opt = rcu_dereference(inet_sk(sk)->inet_opt);
2140	if (opt && opt->opt.cipso)
2141	res = cipso_v4_getattr(cipso: opt->opt.__data +
2142	opt->opt.cipso -
2143	sizeof(struct iphdr),
2144	secattr);
2145	rcu_read_unlock();
2146	return res;
2147	}
2148
2149	/**
2150	* cipso_v4_skbuff_setattr - Set the CIPSO option on a packet
2151	* @skb: the packet
2152	* @doi_def: the DOI structure
2153	* @secattr: the security attributes
2154	*
2155	* Description:
2156	* Set the CIPSO option on the given packet based on the security attributes.
2157	* Returns a pointer to the IP header on success and NULL on failure.
2158	*
2159	*/
2160	int cipso_v4_skbuff_setattr(struct sk_buff *skb,
2161	const struct cipso_v4_doi *doi_def,
2162	const struct netlbl_lsm_secattr *secattr)
2163	{
2164	int ret_val;
2165	struct iphdr *iph;
2166	struct ip_options *opt = &IPCB(skb)->opt;
2167	unsigned char buf[CIPSO_V4_OPT_LEN_MAX];
2168	u32 buf_len = CIPSO_V4_OPT_LEN_MAX;
2169	u32 opt_len;
2170	int len_delta;
2171
2172	ret_val = cipso_v4_genopt(buf, buf_len, doi_def, secattr);
2173	if (ret_val < 0)
2174	return ret_val;
2175	buf_len = ret_val;
2176	opt_len = (buf_len + 3) & ~3;
2177
2178	/* we overwrite any existing options to ensure that we have enough
2179	* room for the CIPSO option, the reason is that we _need_ to guarantee
2180	* that the security label is applied to the packet - we do the same
2181	* thing when using the socket options and it hasn't caused a problem,
2182	* if we need to we can always revisit this choice later */
2183
2184	len_delta = opt_len - opt->optlen;
2185	/* if we don't ensure enough headroom we could panic on the skb_push()
2186	* call below so make sure we have enough, we are also "mangling" the
2187	* packet so we should probably do a copy-on-write call anyway */
2188	ret_val = skb_cow(skb, headroom: skb_headroom(skb) + len_delta);
2189	if (ret_val < 0)
2190	return ret_val;
2191
2192	if (len_delta > 0) {
2193	/* we assume that the header + opt->optlen have already been
2194	* "pushed" in ip_options_build() or similar */
2195	iph = ip_hdr(skb);
2196	skb_push(skb, len: len_delta);
2197	memmove((char *)iph - len_delta, iph, iph->ihl << 2);
2198	skb_reset_network_header(skb);
2199	iph = ip_hdr(skb);
2200	} else if (len_delta < 0) {
2201	iph = ip_hdr(skb);
2202	memset(iph + 1, IPOPT_NOP, opt->optlen);
2203	} else
2204	iph = ip_hdr(skb);
2205
2206	if (opt->optlen > 0)
2207	memset(opt, 0, sizeof(*opt));
2208	opt->optlen = opt_len;
2209	opt->cipso = sizeof(struct iphdr);
2210	opt->is_changed = 1;
2211
2212	/* we have to do the following because we are being called from a
2213	* netfilter hook which means the packet already has had the header
2214	* fields populated and the checksum calculated - yes this means we
2215	* are doing more work than needed but we do it to keep the core
2216	* stack clean and tidy */
2217	memcpy(iph + 1, buf, buf_len);
2218	if (opt_len > buf_len)
2219	memset((char *)(iph + 1) + buf_len, 0, opt_len - buf_len);
2220	if (len_delta != 0) {
2221	iph->ihl = 5 + (opt_len >> 2);
2222	iph_set_totlen(iph, len: skb->len);
2223	}
2224	ip_send_check(ip: iph);
2225
2226	return 0;
2227	}
2228
2229	/**
2230	* cipso_v4_skbuff_delattr - Delete any CIPSO options from a packet
2231	* @skb: the packet
2232	*
2233	* Description:
2234	* Removes any and all CIPSO options from the given packet. Returns zero on
2235	* success, negative values on failure.
2236	*
2237	*/
2238	int cipso_v4_skbuff_delattr(struct sk_buff *skb)
2239	{
2240	int ret_val;
2241	struct iphdr *iph;
2242	struct ip_options *opt = &IPCB(skb)->opt;
2243	unsigned char *cipso_ptr;
2244
2245	if (opt->cipso == 0)
2246	return 0;
2247
2248	/* since we are changing the packet we should make a copy */
2249	ret_val = skb_cow(skb, headroom: skb_headroom(skb));
2250	if (ret_val < 0)
2251	return ret_val;
2252
2253	/* the easiest thing to do is just replace the cipso option with noop
2254	* options since we don't change the size of the packet, although we
2255	* still need to recalculate the checksum */
2256
2257	iph = ip_hdr(skb);
2258	cipso_ptr = (unsigned char *)iph + opt->cipso;
2259	memset(cipso_ptr, IPOPT_NOOP, cipso_ptr[1]);
2260	opt->cipso = 0;
2261	opt->is_changed = 1;
2262
2263	ip_send_check(ip: iph);
2264
2265	return 0;
2266	}
2267
2268	/*
2269	* Setup Functions
2270	*/
2271
2272	/**
2273	* cipso_v4_init - Initialize the CIPSO module
2274	*
2275	* Description:
2276	* Initialize the CIPSO module and prepare it for use. Returns zero on success
2277	* and negative values on failure.
2278	*
2279	*/
2280	static int __init cipso_v4_init(void)
2281	{
2282	int ret_val;
2283
2284	ret_val = cipso_v4_cache_init();
2285	if (ret_val != 0)
2286	panic(fmt: "Failed to initialize the CIPSO/IPv4 cache (%d)\n",
2287	ret_val);
2288
2289	return 0;
2290	}
2291
2292	subsys_initcall(cipso_v4_init);
2293