1/* 2 * NetLabel Domain Hash Table 3 * 4 * This file manages the domain hash table that NetLabel uses to determine 5 * which network labeling protocol to use for a given domain. The NetLabel 6 * system manages static and dynamic label mappings for network protocols such 7 * as CIPSO and RIPSO. 8 * 9 * Author: Paul Moore <paul@paul-moore.com> 10 * 11 */ 12 13/* 14 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 15 * 16 * This program is free software; you can redistribute it and/or modify 17 * it under the terms of the GNU General Public License as published by 18 * the Free Software Foundation; either version 2 of the License, or 19 * (at your option) any later version. 20 * 21 * This program is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 24 * the GNU General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 * 29 */ 30 31#include <linux/types.h> 32#include <linux/rculist.h> 33#include <linux/skbuff.h> 34#include <linux/spinlock.h> 35#include <linux/string.h> 36#include <linux/audit.h> 37#include <linux/slab.h> 38#include <net/netlabel.h> 39#include <net/cipso_ipv4.h> 40#include <asm/bug.h> 41 42#include "netlabel_mgmt.h" 43#include "netlabel_addrlist.h" 44#include "netlabel_domainhash.h" 45#include "netlabel_user.h" 46 47struct netlbl_domhsh_tbl { 48 struct list_head *tbl; 49 u32 size; 50}; 51 52/* Domain hash table */ 53/* updates should be so rare that having one spinlock for the entire hash table 54 * should be okay */ 55static DEFINE_SPINLOCK(netlbl_domhsh_lock); 56#define netlbl_domhsh_rcu_deref(p) \ 57 rcu_dereference_check(p, lockdep_is_held(&netlbl_domhsh_lock)) 58static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL; 59static struct netlbl_dom_map *netlbl_domhsh_def = NULL; 60 61/* 62 * Domain Hash Table Helper Functions 63 */ 64 65/** 66 * netlbl_domhsh_free_entry - Frees a domain hash table entry 67 * @entry: the entry's RCU field 68 * 69 * Description: 70 * This function is designed to be used as a callback to the call_rcu() 71 * function so that the memory allocated to a hash table entry can be released 72 * safely. 73 * 74 */ 75static void netlbl_domhsh_free_entry(struct rcu_head *entry) 76{ 77 struct netlbl_dom_map *ptr; 78 struct netlbl_af4list *iter4; 79 struct netlbl_af4list *tmp4; 80#if IS_ENABLED(CONFIG_IPV6) 81 struct netlbl_af6list *iter6; 82 struct netlbl_af6list *tmp6; 83#endif /* IPv6 */ 84 85 ptr = container_of(entry, struct netlbl_dom_map, rcu); 86 if (ptr->def.type == NETLBL_NLTYPE_ADDRSELECT) { 87 netlbl_af4list_foreach_safe(iter4, tmp4, 88 &ptr->def.addrsel->list4) { 89 netlbl_af4list_remove_entry(iter4); 90 kfree(netlbl_domhsh_addr4_entry(iter4)); 91 } 92#if IS_ENABLED(CONFIG_IPV6) 93 netlbl_af6list_foreach_safe(iter6, tmp6, 94 &ptr->def.addrsel->list6) { 95 netlbl_af6list_remove_entry(iter6); 96 kfree(netlbl_domhsh_addr6_entry(iter6)); 97 } 98#endif /* IPv6 */ 99 } 100 kfree(ptr->domain); 101 kfree(ptr); 102} 103 104/** 105 * netlbl_domhsh_hash - Hashing function for the domain hash table 106 * @domain: the domain name to hash 107 * 108 * Description: 109 * This is the hashing function for the domain hash table, it returns the 110 * correct bucket number for the domain. The caller is responsible for 111 * ensuring that the hash table is protected with either a RCU read lock or the 112 * hash table lock. 113 * 114 */ 115static u32 netlbl_domhsh_hash(const char *key) 116{ 117 u32 iter; 118 u32 val; 119 u32 len; 120 121 /* This is taken (with slight modification) from 122 * security/selinux/ss/symtab.c:symhash() */ 123 124 for (iter = 0, val = 0, len = strlen(key); iter < len; iter++) 125 val = (val << 4 | (val >> (8 * sizeof(u32) - 4))) ^ key[iter]; 126 return val & (netlbl_domhsh_rcu_deref(netlbl_domhsh)->size - 1); 127} 128 129/** 130 * netlbl_domhsh_search - Search for a domain entry 131 * @domain: the domain 132 * 133 * Description: 134 * Searches the domain hash table and returns a pointer to the hash table 135 * entry if found, otherwise NULL is returned. The caller is responsible for 136 * ensuring that the hash table is protected with either a RCU read lock or the 137 * hash table lock. 138 * 139 */ 140static struct netlbl_dom_map *netlbl_domhsh_search(const char *domain) 141{ 142 u32 bkt; 143 struct list_head *bkt_list; 144 struct netlbl_dom_map *iter; 145 146 if (domain != NULL) { 147 bkt = netlbl_domhsh_hash(domain); 148 bkt_list = &netlbl_domhsh_rcu_deref(netlbl_domhsh)->tbl[bkt]; 149 list_for_each_entry_rcu(iter, bkt_list, list) 150 if (iter->valid && strcmp(iter->domain, domain) == 0) 151 return iter; 152 } 153 154 return NULL; 155} 156 157/** 158 * netlbl_domhsh_search_def - Search for a domain entry 159 * @domain: the domain 160 * @def: return default if no match is found 161 * 162 * Description: 163 * Searches the domain hash table and returns a pointer to the hash table 164 * entry if an exact match is found, if an exact match is not present in the 165 * hash table then the default entry is returned if valid otherwise NULL is 166 * returned. The caller is responsible ensuring that the hash table is 167 * protected with either a RCU read lock or the hash table lock. 168 * 169 */ 170static struct netlbl_dom_map *netlbl_domhsh_search_def(const char *domain) 171{ 172 struct netlbl_dom_map *entry; 173 174 entry = netlbl_domhsh_search(domain); 175 if (entry == NULL) { 176 entry = netlbl_domhsh_rcu_deref(netlbl_domhsh_def); 177 if (entry != NULL && !entry->valid) 178 entry = NULL; 179 } 180 181 return entry; 182} 183 184/** 185 * netlbl_domhsh_audit_add - Generate an audit entry for an add event 186 * @entry: the entry being added 187 * @addr4: the IPv4 address information 188 * @addr6: the IPv6 address information 189 * @result: the result code 190 * @audit_info: NetLabel audit information 191 * 192 * Description: 193 * Generate an audit record for adding a new NetLabel/LSM mapping entry with 194 * the given information. Caller is responsible for holding the necessary 195 * locks. 196 * 197 */ 198static void netlbl_domhsh_audit_add(struct netlbl_dom_map *entry, 199 struct netlbl_af4list *addr4, 200 struct netlbl_af6list *addr6, 201 int result, 202 struct netlbl_audit *audit_info) 203{ 204 struct audit_buffer *audit_buf; 205 struct cipso_v4_doi *cipsov4 = NULL; 206 u32 type; 207 208 audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info); 209 if (audit_buf != NULL) { 210 audit_log_format(audit_buf, " nlbl_domain=%s", 211 entry->domain ? entry->domain : "(default)"); 212 if (addr4 != NULL) { 213 struct netlbl_domaddr4_map *map4; 214 map4 = netlbl_domhsh_addr4_entry(addr4); 215 type = map4->def.type; 216 cipsov4 = map4->def.cipso; 217 netlbl_af4list_audit_addr(audit_buf, 0, NULL, 218 addr4->addr, addr4->mask); 219#if IS_ENABLED(CONFIG_IPV6) 220 } else if (addr6 != NULL) { 221 struct netlbl_domaddr6_map *map6; 222 map6 = netlbl_domhsh_addr6_entry(addr6); 223 type = map6->def.type; 224 netlbl_af6list_audit_addr(audit_buf, 0, NULL, 225 &addr6->addr, &addr6->mask); 226#endif /* IPv6 */ 227 } else { 228 type = entry->def.type; 229 cipsov4 = entry->def.cipso; 230 } 231 switch (type) { 232 case NETLBL_NLTYPE_UNLABELED: 233 audit_log_format(audit_buf, " nlbl_protocol=unlbl"); 234 break; 235 case NETLBL_NLTYPE_CIPSOV4: 236 BUG_ON(cipsov4 == NULL); 237 audit_log_format(audit_buf, 238 " nlbl_protocol=cipsov4 cipso_doi=%u", 239 cipsov4->doi); 240 break; 241 } 242 audit_log_format(audit_buf, " res=%u", result == 0 ? 1 : 0); 243 audit_log_end(audit_buf); 244 } 245} 246 247/** 248 * netlbl_domhsh_validate - Validate a new domain mapping entry 249 * @entry: the entry to validate 250 * 251 * This function validates the new domain mapping entry to ensure that it is 252 * a valid entry. Returns zero on success, negative values on failure. 253 * 254 */ 255static int netlbl_domhsh_validate(const struct netlbl_dom_map *entry) 256{ 257 struct netlbl_af4list *iter4; 258 struct netlbl_domaddr4_map *map4; 259#if IS_ENABLED(CONFIG_IPV6) 260 struct netlbl_af6list *iter6; 261 struct netlbl_domaddr6_map *map6; 262#endif /* IPv6 */ 263 264 if (entry == NULL) 265 return -EINVAL; 266 267 switch (entry->def.type) { 268 case NETLBL_NLTYPE_UNLABELED: 269 if (entry->def.cipso != NULL || entry->def.addrsel != NULL) 270 return -EINVAL; 271 break; 272 case NETLBL_NLTYPE_CIPSOV4: 273 if (entry->def.cipso == NULL) 274 return -EINVAL; 275 break; 276 case NETLBL_NLTYPE_ADDRSELECT: 277 netlbl_af4list_foreach(iter4, &entry->def.addrsel->list4) { 278 map4 = netlbl_domhsh_addr4_entry(iter4); 279 switch (map4->def.type) { 280 case NETLBL_NLTYPE_UNLABELED: 281 if (map4->def.cipso != NULL) 282 return -EINVAL; 283 break; 284 case NETLBL_NLTYPE_CIPSOV4: 285 if (map4->def.cipso == NULL) 286 return -EINVAL; 287 break; 288 default: 289 return -EINVAL; 290 } 291 } 292#if IS_ENABLED(CONFIG_IPV6) 293 netlbl_af6list_foreach(iter6, &entry->def.addrsel->list6) { 294 map6 = netlbl_domhsh_addr6_entry(iter6); 295 switch (map6->def.type) { 296 case NETLBL_NLTYPE_UNLABELED: 297 break; 298 default: 299 return -EINVAL; 300 } 301 } 302#endif /* IPv6 */ 303 break; 304 default: 305 return -EINVAL; 306 } 307 308 return 0; 309} 310 311/* 312 * Domain Hash Table Functions 313 */ 314 315/** 316 * netlbl_domhsh_init - Init for the domain hash 317 * @size: the number of bits to use for the hash buckets 318 * 319 * Description: 320 * Initializes the domain hash table, should be called only by 321 * netlbl_user_init() during initialization. Returns zero on success, non-zero 322 * values on error. 323 * 324 */ 325int __init netlbl_domhsh_init(u32 size) 326{ 327 u32 iter; 328 struct netlbl_domhsh_tbl *hsh_tbl; 329 330 if (size == 0) 331 return -EINVAL; 332 333 hsh_tbl = kmalloc(sizeof(*hsh_tbl), GFP_KERNEL); 334 if (hsh_tbl == NULL) 335 return -ENOMEM; 336 hsh_tbl->size = 1 << size; 337 hsh_tbl->tbl = kcalloc(hsh_tbl->size, 338 sizeof(struct list_head), 339 GFP_KERNEL); 340 if (hsh_tbl->tbl == NULL) { 341 kfree(hsh_tbl); 342 return -ENOMEM; 343 } 344 for (iter = 0; iter < hsh_tbl->size; iter++) 345 INIT_LIST_HEAD(&hsh_tbl->tbl[iter]); 346 347 spin_lock(&netlbl_domhsh_lock); 348 rcu_assign_pointer(netlbl_domhsh, hsh_tbl); 349 spin_unlock(&netlbl_domhsh_lock); 350 351 return 0; 352} 353 354/** 355 * netlbl_domhsh_add - Adds a entry to the domain hash table 356 * @entry: the entry to add 357 * @audit_info: NetLabel audit information 358 * 359 * Description: 360 * Adds a new entry to the domain hash table and handles any updates to the 361 * lower level protocol handler (i.e. CIPSO). Returns zero on success, 362 * negative on failure. 363 * 364 */ 365int netlbl_domhsh_add(struct netlbl_dom_map *entry, 366 struct netlbl_audit *audit_info) 367{ 368 int ret_val = 0; 369 struct netlbl_dom_map *entry_old; 370 struct netlbl_af4list *iter4; 371 struct netlbl_af4list *tmp4; 372#if IS_ENABLED(CONFIG_IPV6) 373 struct netlbl_af6list *iter6; 374 struct netlbl_af6list *tmp6; 375#endif /* IPv6 */ 376 377 ret_val = netlbl_domhsh_validate(entry); 378 if (ret_val != 0) 379 return ret_val; 380 381 /* XXX - we can remove this RCU read lock as the spinlock protects the 382 * entire function, but before we do we need to fixup the 383 * netlbl_af[4,6]list RCU functions to do "the right thing" with 384 * respect to rcu_dereference() when only a spinlock is held. */ 385 rcu_read_lock(); 386 spin_lock(&netlbl_domhsh_lock); 387 if (entry->domain != NULL) 388 entry_old = netlbl_domhsh_search(entry->domain); 389 else 390 entry_old = netlbl_domhsh_search_def(entry->domain); 391 if (entry_old == NULL) { 392 entry->valid = 1; 393 394 if (entry->domain != NULL) { 395 u32 bkt = netlbl_domhsh_hash(entry->domain); 396 list_add_tail_rcu(&entry->list, 397 &rcu_dereference(netlbl_domhsh)->tbl[bkt]); 398 } else { 399 INIT_LIST_HEAD(&entry->list); 400 rcu_assign_pointer(netlbl_domhsh_def, entry); 401 } 402 403 if (entry->def.type == NETLBL_NLTYPE_ADDRSELECT) { 404 netlbl_af4list_foreach_rcu(iter4, 405 &entry->def.addrsel->list4) 406 netlbl_domhsh_audit_add(entry, iter4, NULL, 407 ret_val, audit_info); 408#if IS_ENABLED(CONFIG_IPV6) 409 netlbl_af6list_foreach_rcu(iter6, 410 &entry->def.addrsel->list6) 411 netlbl_domhsh_audit_add(entry, NULL, iter6, 412 ret_val, audit_info); 413#endif /* IPv6 */ 414 } else 415 netlbl_domhsh_audit_add(entry, NULL, NULL, 416 ret_val, audit_info); 417 } else if (entry_old->def.type == NETLBL_NLTYPE_ADDRSELECT && 418 entry->def.type == NETLBL_NLTYPE_ADDRSELECT) { 419 struct list_head *old_list4; 420 struct list_head *old_list6; 421 422 old_list4 = &entry_old->def.addrsel->list4; 423 old_list6 = &entry_old->def.addrsel->list6; 424 425 /* we only allow the addition of address selectors if all of 426 * the selectors do not exist in the existing domain map */ 427 netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) 428 if (netlbl_af4list_search_exact(iter4->addr, 429 iter4->mask, 430 old_list4)) { 431 ret_val = -EEXIST; 432 goto add_return; 433 } 434#if IS_ENABLED(CONFIG_IPV6) 435 netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) 436 if (netlbl_af6list_search_exact(&iter6->addr, 437 &iter6->mask, 438 old_list6)) { 439 ret_val = -EEXIST; 440 goto add_return; 441 } 442#endif /* IPv6 */ 443 444 netlbl_af4list_foreach_safe(iter4, tmp4, 445 &entry->def.addrsel->list4) { 446 netlbl_af4list_remove_entry(iter4); 447 iter4->valid = 1; 448 ret_val = netlbl_af4list_add(iter4, old_list4); 449 netlbl_domhsh_audit_add(entry_old, iter4, NULL, 450 ret_val, audit_info); 451 if (ret_val != 0) 452 goto add_return; 453 } 454#if IS_ENABLED(CONFIG_IPV6) 455 netlbl_af6list_foreach_safe(iter6, tmp6, 456 &entry->def.addrsel->list6) { 457 netlbl_af6list_remove_entry(iter6); 458 iter6->valid = 1; 459 ret_val = netlbl_af6list_add(iter6, old_list6); 460 netlbl_domhsh_audit_add(entry_old, NULL, iter6, 461 ret_val, audit_info); 462 if (ret_val != 0) 463 goto add_return; 464 } 465#endif /* IPv6 */ 466 } else 467 ret_val = -EINVAL; 468 469add_return: 470 spin_unlock(&netlbl_domhsh_lock); 471 rcu_read_unlock(); 472 return ret_val; 473} 474 475/** 476 * netlbl_domhsh_add_default - Adds the default entry to the domain hash table 477 * @entry: the entry to add 478 * @audit_info: NetLabel audit information 479 * 480 * Description: 481 * Adds a new default entry to the domain hash table and handles any updates 482 * to the lower level protocol handler (i.e. CIPSO). Returns zero on success, 483 * negative on failure. 484 * 485 */ 486int netlbl_domhsh_add_default(struct netlbl_dom_map *entry, 487 struct netlbl_audit *audit_info) 488{ 489 return netlbl_domhsh_add(entry, audit_info); 490} 491 492/** 493 * netlbl_domhsh_remove_entry - Removes a given entry from the domain table 494 * @entry: the entry to remove 495 * @audit_info: NetLabel audit information 496 * 497 * Description: 498 * Removes an entry from the domain hash table and handles any updates to the 499 * lower level protocol handler (i.e. CIPSO). Caller is responsible for 500 * ensuring that the RCU read lock is held. Returns zero on success, negative 501 * on failure. 502 * 503 */ 504int netlbl_domhsh_remove_entry(struct netlbl_dom_map *entry, 505 struct netlbl_audit *audit_info) 506{ 507 int ret_val = 0; 508 struct audit_buffer *audit_buf; 509 510 if (entry == NULL) 511 return -ENOENT; 512 513 spin_lock(&netlbl_domhsh_lock); 514 if (entry->valid) { 515 entry->valid = 0; 516 if (entry != rcu_dereference(netlbl_domhsh_def)) 517 list_del_rcu(&entry->list); 518 else 519 RCU_INIT_POINTER(netlbl_domhsh_def, NULL); 520 } else 521 ret_val = -ENOENT; 522 spin_unlock(&netlbl_domhsh_lock); 523 524 audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info); 525 if (audit_buf != NULL) { 526 audit_log_format(audit_buf, 527 " nlbl_domain=%s res=%u", 528 entry->domain ? entry->domain : "(default)", 529 ret_val == 0 ? 1 : 0); 530 audit_log_end(audit_buf); 531 } 532 533 if (ret_val == 0) { 534 struct netlbl_af4list *iter4; 535 struct netlbl_domaddr4_map *map4; 536 537 switch (entry->def.type) { 538 case NETLBL_NLTYPE_ADDRSELECT: 539 netlbl_af4list_foreach_rcu(iter4, 540 &entry->def.addrsel->list4) { 541 map4 = netlbl_domhsh_addr4_entry(iter4); 542 cipso_v4_doi_putdef(map4->def.cipso); 543 } 544 /* no need to check the IPv6 list since we currently 545 * support only unlabeled protocols for IPv6 */ 546 break; 547 case NETLBL_NLTYPE_CIPSOV4: 548 cipso_v4_doi_putdef(entry->def.cipso); 549 break; 550 } 551 call_rcu(&entry->rcu, netlbl_domhsh_free_entry); 552 } 553 554 return ret_val; 555} 556 557/** 558 * netlbl_domhsh_remove_af4 - Removes an address selector entry 559 * @domain: the domain 560 * @addr: IPv4 address 561 * @mask: IPv4 address mask 562 * @audit_info: NetLabel audit information 563 * 564 * Description: 565 * Removes an individual address selector from a domain mapping and potentially 566 * the entire mapping if it is empty. Returns zero on success, negative values 567 * on failure. 568 * 569 */ 570int netlbl_domhsh_remove_af4(const char *domain, 571 const struct in_addr *addr, 572 const struct in_addr *mask, 573 struct netlbl_audit *audit_info) 574{ 575 struct netlbl_dom_map *entry_map; 576 struct netlbl_af4list *entry_addr; 577 struct netlbl_af4list *iter4; 578#if IS_ENABLED(CONFIG_IPV6) 579 struct netlbl_af6list *iter6; 580#endif /* IPv6 */ 581 struct netlbl_domaddr4_map *entry; 582 583 rcu_read_lock(); 584 585 if (domain) 586 entry_map = netlbl_domhsh_search(domain); 587 else 588 entry_map = netlbl_domhsh_search_def(domain); 589 if (entry_map == NULL || 590 entry_map->def.type != NETLBL_NLTYPE_ADDRSELECT) 591 goto remove_af4_failure; 592 593 spin_lock(&netlbl_domhsh_lock); 594 entry_addr = netlbl_af4list_remove(addr->s_addr, mask->s_addr, 595 &entry_map->def.addrsel->list4); 596 spin_unlock(&netlbl_domhsh_lock); 597 598 if (entry_addr == NULL) 599 goto remove_af4_failure; 600 netlbl_af4list_foreach_rcu(iter4, &entry_map->def.addrsel->list4) 601 goto remove_af4_single_addr; 602#if IS_ENABLED(CONFIG_IPV6) 603 netlbl_af6list_foreach_rcu(iter6, &entry_map->def.addrsel->list6) 604 goto remove_af4_single_addr; 605#endif /* IPv6 */ 606 /* the domain mapping is empty so remove it from the mapping table */ 607 netlbl_domhsh_remove_entry(entry_map, audit_info); 608 609remove_af4_single_addr: 610 rcu_read_unlock(); 611 /* yick, we can't use call_rcu here because we don't have a rcu head 612 * pointer but hopefully this should be a rare case so the pause 613 * shouldn't be a problem */ 614 synchronize_rcu(); 615 entry = netlbl_domhsh_addr4_entry(entry_addr); 616 cipso_v4_doi_putdef(entry->def.cipso); 617 kfree(entry); 618 return 0; 619 620remove_af4_failure: 621 rcu_read_unlock(); 622 return -ENOENT; 623} 624 625/** 626 * netlbl_domhsh_remove - Removes an entry from the domain hash table 627 * @domain: the domain to remove 628 * @audit_info: NetLabel audit information 629 * 630 * Description: 631 * Removes an entry from the domain hash table and handles any updates to the 632 * lower level protocol handler (i.e. CIPSO). Returns zero on success, 633 * negative on failure. 634 * 635 */ 636int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info) 637{ 638 int ret_val; 639 struct netlbl_dom_map *entry; 640 641 rcu_read_lock(); 642 if (domain) 643 entry = netlbl_domhsh_search(domain); 644 else 645 entry = netlbl_domhsh_search_def(domain); 646 ret_val = netlbl_domhsh_remove_entry(entry, audit_info); 647 rcu_read_unlock(); 648 649 return ret_val; 650} 651 652/** 653 * netlbl_domhsh_remove_default - Removes the default entry from the table 654 * @audit_info: NetLabel audit information 655 * 656 * Description: 657 * Removes/resets the default entry for the domain hash table and handles any 658 * updates to the lower level protocol handler (i.e. CIPSO). Returns zero on 659 * success, non-zero on failure. 660 * 661 */ 662int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info) 663{ 664 return netlbl_domhsh_remove(NULL, audit_info); 665} 666 667/** 668 * netlbl_domhsh_getentry - Get an entry from the domain hash table 669 * @domain: the domain name to search for 670 * 671 * Description: 672 * Look through the domain hash table searching for an entry to match @domain, 673 * return a pointer to a copy of the entry or NULL. The caller is responsible 674 * for ensuring that rcu_read_[un]lock() is called. 675 * 676 */ 677struct netlbl_dom_map *netlbl_domhsh_getentry(const char *domain) 678{ 679 return netlbl_domhsh_search_def(domain); 680} 681 682/** 683 * netlbl_domhsh_getentry_af4 - Get an entry from the domain hash table 684 * @domain: the domain name to search for 685 * @addr: the IP address to search for 686 * 687 * Description: 688 * Look through the domain hash table searching for an entry to match @domain 689 * and @addr, return a pointer to a copy of the entry or NULL. The caller is 690 * responsible for ensuring that rcu_read_[un]lock() is called. 691 * 692 */ 693struct netlbl_dommap_def *netlbl_domhsh_getentry_af4(const char *domain, 694 __be32 addr) 695{ 696 struct netlbl_dom_map *dom_iter; 697 struct netlbl_af4list *addr_iter; 698 699 dom_iter = netlbl_domhsh_search_def(domain); 700 if (dom_iter == NULL) 701 return NULL; 702 703 if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT) 704 return &dom_iter->def; 705 addr_iter = netlbl_af4list_search(addr, &dom_iter->def.addrsel->list4); 706 if (addr_iter == NULL) 707 return NULL; 708 return &(netlbl_domhsh_addr4_entry(addr_iter)->def); 709} 710 711#if IS_ENABLED(CONFIG_IPV6) 712/** 713 * netlbl_domhsh_getentry_af6 - Get an entry from the domain hash table 714 * @domain: the domain name to search for 715 * @addr: the IP address to search for 716 * 717 * Description: 718 * Look through the domain hash table searching for an entry to match @domain 719 * and @addr, return a pointer to a copy of the entry or NULL. The caller is 720 * responsible for ensuring that rcu_read_[un]lock() is called. 721 * 722 */ 723struct netlbl_dommap_def *netlbl_domhsh_getentry_af6(const char *domain, 724 const struct in6_addr *addr) 725{ 726 struct netlbl_dom_map *dom_iter; 727 struct netlbl_af6list *addr_iter; 728 729 dom_iter = netlbl_domhsh_search_def(domain); 730 if (dom_iter == NULL) 731 return NULL; 732 733 if (dom_iter->def.type != NETLBL_NLTYPE_ADDRSELECT) 734 return &dom_iter->def; 735 addr_iter = netlbl_af6list_search(addr, &dom_iter->def.addrsel->list6); 736 if (addr_iter == NULL) 737 return NULL; 738 return &(netlbl_domhsh_addr6_entry(addr_iter)->def); 739} 740#endif /* IPv6 */ 741 742/** 743 * netlbl_domhsh_walk - Iterate through the domain mapping hash table 744 * @skip_bkt: the number of buckets to skip at the start 745 * @skip_chain: the number of entries to skip in the first iterated bucket 746 * @callback: callback for each entry 747 * @cb_arg: argument for the callback function 748 * 749 * Description: 750 * Interate over the domain mapping hash table, skipping the first @skip_bkt 751 * buckets and @skip_chain entries. For each entry in the table call 752 * @callback, if @callback returns a negative value stop 'walking' through the 753 * table and return. Updates the values in @skip_bkt and @skip_chain on 754 * return. Returns zero on success, negative values on failure. 755 * 756 */ 757int netlbl_domhsh_walk(u32 *skip_bkt, 758 u32 *skip_chain, 759 int (*callback) (struct netlbl_dom_map *entry, void *arg), 760 void *cb_arg) 761{ 762 int ret_val = -ENOENT; 763 u32 iter_bkt; 764 struct list_head *iter_list; 765 struct netlbl_dom_map *iter_entry; 766 u32 chain_cnt = 0; 767 768 rcu_read_lock(); 769 for (iter_bkt = *skip_bkt; 770 iter_bkt < rcu_dereference(netlbl_domhsh)->size; 771 iter_bkt++, chain_cnt = 0) { 772 iter_list = &rcu_dereference(netlbl_domhsh)->tbl[iter_bkt]; 773 list_for_each_entry_rcu(iter_entry, iter_list, list) 774 if (iter_entry->valid) { 775 if (chain_cnt++ < *skip_chain) 776 continue; 777 ret_val = callback(iter_entry, cb_arg); 778 if (ret_val < 0) { 779 chain_cnt--; 780 goto walk_return; 781 } 782 } 783 } 784 785walk_return: 786 rcu_read_unlock(); 787 *skip_bkt = iter_bkt; 788 *skip_chain = chain_cnt; 789 return ret_val; 790} 791