2 * NetLabel Domain Hash Table
4 * This file manages the domain hash table that NetLabel uses to determine
5 * which network labeling protocol to use for a given domain. The NetLabel
6 * system manages static and dynamic label mappings for network protocols such
9 * Author: Paul Moore <paul.moore@hp.com>
14 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 2 of the License, or
19 * (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
24 * the GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, write to the Free Software
28 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
32 #include <linux/types.h>
33 #include <linux/rcupdate.h>
34 #include <linux/list.h>
35 #include <linux/skbuff.h>
36 #include <linux/spinlock.h>
37 #include <linux/string.h>
38 #include <net/netlabel.h>
39 #include <net/cipso_ipv4.h>
42 #include "netlabel_mgmt.h"
43 #include "netlabel_domainhash.h"
45 struct netlbl_domhsh_tbl {
46 struct list_head *tbl;
50 /* Domain hash table */
51 /* XXX - updates should be so rare that having one spinlock for the entire
52 * hash table should be okay */
53 static DEFINE_SPINLOCK(netlbl_domhsh_lock);
54 static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
56 /* Default domain mapping */
57 static DEFINE_SPINLOCK(netlbl_domhsh_def_lock);
58 static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
61 * Domain Hash Table Helper Functions
65 * netlbl_domhsh_free_entry - Frees a domain hash table entry
66 * @entry: the entry's RCU field
69 * This function is designed to be used as a callback to the call_rcu()
70 * function so that the memory allocated to a hash table entry can be released
74 static void netlbl_domhsh_free_entry(struct rcu_head *entry)
76 struct netlbl_dom_map *ptr;
78 ptr = container_of(entry, struct netlbl_dom_map, rcu);
84 * netlbl_domhsh_hash - Hashing function for the domain hash table
85 * @domain: the domain name to hash
88 * This is the hashing function for the domain hash table, it returns the
89 * correct bucket number for the domain. The caller is responsibile for
90 * calling the rcu_read_[un]lock() functions.
93 static u32 netlbl_domhsh_hash(const char *key)
99 /* This is taken (with slight modification) from
100 * security/selinux/ss/symtab.c:symhash() */
102 for (iter = 0, val = 0, len = strlen(key); iter < len; iter++)
103 val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter];
104 return val & (rcu_dereference(netlbl_domhsh)->size - 1);
108 * netlbl_domhsh_search - Search for a domain entry
109 * @domain: the domain
110 * @def: return default if no match is found
113 * Searches the domain hash table and returns a pointer to the hash table
114 * entry if found, otherwise NULL is returned. If @def is non-zero and a
115 * match is not found in the domain hash table the default mapping is returned
116 * if it exists. The caller is responsibile for the rcu hash table locks
117 * (i.e. the caller much call rcu_read_[un]lock()).
120 static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain, u32 def)
123 struct netlbl_dom_map *iter;
125 if (domain != NULL) {
126 bkt = netlbl_domhsh_hash(domain);
127 list_for_each_entry_rcu(iter, &netlbl_domhsh->tbl[bkt], list)
128 if (iter->valid && strcmp(iter->domain, domain) == 0)
133 iter = rcu_dereference(netlbl_domhsh_def);
134 if (iter != NULL && iter->valid)
142 * Domain Hash Table Functions
146 * netlbl_domhsh_init - Init for the domain hash
147 * @size: the number of bits to use for the hash buckets
150 * Initializes the domain hash table, should be called only by
151 * netlbl_user_init() during initialization. Returns zero on success, non-zero
155 int netlbl_domhsh_init(u32 size)
158 struct netlbl_domhsh_tbl *hsh_tbl;
163 hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL);
166 hsh_tbl->size = 1 << size;
167 hsh_tbl->tbl = kcalloc(hsh_tbl->size,
168 sizeof(struct list_head),
170 if (hsh_tbl->tbl == NULL) {
174 for (iter = 0; iter < hsh_tbl->size; iter++)
175 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
178 spin_lock(&netlbl_domhsh_lock);
179 rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
180 spin_unlock(&netlbl_domhsh_lock);
187 * netlbl_domhsh_add - Adds a entry to the domain hash table
188 * @entry: the entry to add
191 * Adds a new entry to the domain hash table and handles any updates to the
192 * lower level protocol handler (i.e. CIPSO). Returns zero on success,
193 * negative on failure.
196 int netlbl_domhsh_add(struct netlbl_dom_map *entry)
201 switch (entry->type) {
202 case NETLBL_NLTYPE_UNLABELED:
205 case NETLBL_NLTYPE_CIPSOV4:
206 ret_val = cipso_v4_doi_domhsh_add(entry->type_def.cipsov4,
216 INIT_RCU_HEAD(&entry->rcu);
220 if (entry->domain != NULL) {
221 bkt = netlbl_domhsh_hash(entry->domain);
222 spin_lock(&netlbl_domhsh_lock);
223 if (netlbl_domhsh_search(entry->domain, 0) == NULL)
224 list_add_tail_rcu(&entry->list,
225 &netlbl_domhsh->tbl[bkt]);
228 spin_unlock(&netlbl_domhsh_lock);
229 } else if (entry->domain == NULL) {
230 INIT_LIST_HEAD(&entry->list);
231 spin_lock(&netlbl_domhsh_def_lock);
232 if (rcu_dereference(netlbl_domhsh_def) == NULL)
233 rcu_assign_pointer(netlbl_domhsh_def, entry);
236 spin_unlock(&netlbl_domhsh_def_lock);
242 switch (entry->type) {
243 case NETLBL_NLTYPE_CIPSOV4:
244 if (cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
255 * netlbl_domhsh_add_default - Adds the default entry to the domain hash table
256 * @entry: the entry to add
259 * Adds a new default entry to the domain hash table and handles any updates
260 * to the lower level protocol handler (i.e. CIPSO). Returns zero on success,
261 * negative on failure.
264 int netlbl_domhsh_add_default(struct netlbl_dom_map *entry)
266 return netlbl_domhsh_add(entry);
270 * netlbl_domhsh_remove - Removes an entry from the domain hash table
271 * @domain: the domain to remove
274 * Removes an entry from the domain hash table and handles any updates to the
275 * lower level protocol handler (i.e. CIPSO). Returns zero on success,
276 * negative on failure.
279 int netlbl_domhsh_remove(const char *domain)
281 int ret_val = -ENOENT;
282 struct netlbl_dom_map *entry;
286 entry = netlbl_domhsh_search(domain, 0);
288 entry = netlbl_domhsh_search(domain, 1);
291 switch (entry->type) {
292 case NETLBL_NLTYPE_UNLABELED:
294 case NETLBL_NLTYPE_CIPSOV4:
295 ret_val = cipso_v4_doi_domhsh_remove(entry->type_def.cipsov4,
302 if (entry != rcu_dereference(netlbl_domhsh_def)) {
303 spin_lock(&netlbl_domhsh_lock);
306 list_del_rcu(&entry->list);
309 spin_unlock(&netlbl_domhsh_lock);
311 spin_lock(&netlbl_domhsh_def_lock);
314 rcu_assign_pointer(netlbl_domhsh_def, NULL);
317 spin_unlock(&netlbl_domhsh_def_lock);
320 call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
328 * netlbl_domhsh_remove_default - Removes the default entry from the table
331 * Removes/resets the default entry for the domain hash table and handles any
332 * updates to the lower level protocol handler (i.e. CIPSO). Returns zero on
333 * success, non-zero on failure.
336 int netlbl_domhsh_remove_default(void)
338 return netlbl_domhsh_remove(NULL);
342 * netlbl_domhsh_getentry - Get an entry from the domain hash table
343 * @domain: the domain name to search for
346 * Look through the domain hash table searching for an entry to match @domain,
347 * return a pointer to a copy of the entry or NULL. The caller is responsibile
348 * for ensuring that rcu_read_[un]lock() is called.
351 struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain)
353 return netlbl_domhsh_search(domain, 1);
357 * netlbl_domhsh_dump - Dump the domain hash table into a sk_buff
360 * Dump the domain hash table into a buffer suitable for returning to an
361 * application in response to a NetLabel management DOMAIN message. This
362 * function may fail if another process is growing the hash table at the same
363 * time. The returned sk_buff has room at the front of the sk_buff for
364 * @headroom bytes. See netlabel.h for the DOMAIN message format. Returns a
365 * pointer to a sk_buff on success, NULL on error.
368 struct sk_buff *netlbl_domhsh_dump(size_t headroom)
370 struct sk_buff *skb = NULL;
374 struct netlbl_domhsh_tbl *hsh_tbl;
375 struct netlbl_dom_map *list_iter;
378 buf_len = NETLBL_LEN_U32;
380 hsh_tbl = rcu_dereference(netlbl_domhsh);
381 for (bkt_iter = 0; bkt_iter < hsh_tbl->size; bkt_iter++)
382 list_for_each_entry_rcu(list_iter,
383 &hsh_tbl->tbl[bkt_iter], list) {
384 buf_len += NETLBL_LEN_U32 +
385 nla_total_size(strlen(list_iter->domain) + 1);
386 switch (list_iter->type) {
387 case NETLBL_NLTYPE_UNLABELED:
389 case NETLBL_NLTYPE_CIPSOV4:
390 buf_len += 2 * NETLBL_LEN_U32;
396 skb = netlbl_netlink_alloc_skb(headroom, buf_len, GFP_ATOMIC);
400 if (nla_put_u32(skb, NLA_U32, dom_cnt) != 0)
402 buf_len -= NETLBL_LEN_U32;
403 hsh_tbl = rcu_dereference(netlbl_domhsh);
404 for (bkt_iter = 0; bkt_iter < hsh_tbl->size; bkt_iter++)
405 list_for_each_entry_rcu(list_iter,
406 &hsh_tbl->tbl[bkt_iter], list) {
407 tmp_len = nla_total_size(strlen(list_iter->domain) +
409 if (buf_len < NETLBL_LEN_U32 + tmp_len)
411 if (nla_put_string(skb,
413 list_iter->domain) != 0)
415 if (nla_put_u32(skb, NLA_U32, list_iter->type) != 0)
417 buf_len -= NETLBL_LEN_U32 + tmp_len;
418 switch (list_iter->type) {
419 case NETLBL_NLTYPE_UNLABELED:
421 case NETLBL_NLTYPE_CIPSOV4:
422 if (buf_len < 2 * NETLBL_LEN_U32)
426 list_iter->type_def.cipsov4->type) != 0)
430 list_iter->type_def.cipsov4->doi) != 0)
432 buf_len -= 2 * NETLBL_LEN_U32;
447 * netlbl_domhsh_dump_default - Dump the default domain mapping into a sk_buff
450 * Dump the default domain mapping into a buffer suitable for returning to an
451 * application in response to a NetLabel management DEFDOMAIN message. This
452 * function may fail if another process is changing the default domain mapping
453 * at the same time. The returned sk_buff has room at the front of the
454 * skb_buff for @headroom bytes. See netlabel.h for the DEFDOMAIN message
455 * format. Returns a pointer to a sk_buff on success, NULL on error.
458 struct sk_buff *netlbl_domhsh_dump_default(size_t headroom)
462 struct netlbl_dom_map *entry;
464 buf_len = NETLBL_LEN_U32;
466 entry = rcu_dereference(netlbl_domhsh_def);
468 switch (entry->type) {
469 case NETLBL_NLTYPE_UNLABELED:
471 case NETLBL_NLTYPE_CIPSOV4:
472 buf_len += 2 * NETLBL_LEN_U32;
476 skb = netlbl_netlink_alloc_skb(headroom, buf_len, GFP_ATOMIC);
478 goto dump_default_failure;
480 if (entry != rcu_dereference(netlbl_domhsh_def))
481 goto dump_default_failure;
483 if (nla_put_u32(skb, NLA_U32, entry->type) != 0)
484 goto dump_default_failure;
485 buf_len -= NETLBL_LEN_U32;
486 switch (entry->type) {
487 case NETLBL_NLTYPE_UNLABELED:
489 case NETLBL_NLTYPE_CIPSOV4:
490 if (buf_len < 2 * NETLBL_LEN_U32)
491 goto dump_default_failure;
494 entry->type_def.cipsov4->type) != 0)
495 goto dump_default_failure;
498 entry->type_def.cipsov4->doi) != 0)
499 goto dump_default_failure;
500 buf_len -= 2 * NETLBL_LEN_U32;
504 nla_put_u32(skb, NLA_U32, NETLBL_NLTYPE_NONE);
509 dump_default_failure: