linux-toradex.git/net/ipv4/cipso_ipv4.c, branch v2.6.20

NetLabel: add the ranged tag to the CIPSOv4 protocol

2006-12-03T05:31:38+00:00

Add support for the ranged tag (tag type #5) to the CIPSOv4 protocol.

The ranged tag allows for seven, or eight if zero is the lowest category,
category ranges to be specified in a CIPSO option.  Each range is specified by
two unsigned 16 bit fields, each with a maximum value of 65534.  The two values
specify the start and end of the category range; if the start of the category
range is zero then it is omitted.

See Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt for more details.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: add the enumerated tag to the CIPSOv4 protocol

2006-12-03T05:31:37+00:00

Add support for the enumerated tag (tag type #2) to the CIPSOv4 protocol.

The enumerated tag allows for 15 categories to be specified in a CIPSO option,
where each category is an unsigned 16 bit field with a maximum value of 65534.

See Documentation/netlabel/draft-ietf-cipso-ipsecurity-01.txt for more details.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: convert to an extensibile/sparse category bitmap

2006-12-03T05:31:36+00:00

The original NetLabel category bitmap was a straight char bitmap which worked
fine for the initial release as it only supported 240 bits due to limitations
in the CIPSO restricted bitmap tag (tag type 0x01).  This patch converts that
straight char bitmap into an extensibile/sparse bitmap in order to lay the
foundation for other CIPSO tag types and protocols.

This patch also has a nice side effect in that all of the security attributes
passed by NetLabel into the LSM are now in a format which is in the host's
native byte/bit ordering which makes the LSM specific code much simpler; look
at the changes in security/selinux/ss/ebitmap.c as an example.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

[CIPSO]: Missing annotation in cipso_ipv4 update.

2006-12-03T05:27:21+00:00

Signed-off-by: Al Viro 
Signed-off-by: David S. Miller

NetLabel: use cipso_v4_doi_search() for local CIPSOv4 functions

2006-12-03T05:24:12+00:00

The cipso_v4_doi_search() function behaves the same as cipso_v4_doi_getdef()
but is a local, static function so use it whenever possibile in the CIPSOv4
code base.

Signed-of-by: Paul Moore 

Signed-off-by: James Morris

NetLabel: return the correct error for translated CIPSOv4 tags

2006-12-03T05:24:11+00:00

The CIPSOv4 translated tag #1 mapping does not always return the correct error
code if the desired mapping does not exist; instead of returning -EPERM it
returns -ENOSPC indicating that the buffer is not large enough to hold the
translated value.  This was caused by failing to check a specific error
condition.  This patch fixes this so that unknown mappings return
-EPERM which is consistent with the rest of the related CIPSOv4 code.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: fixup the handling of CIPSOv4 tags to allow for multiple tag types

2006-12-03T05:24:10+00:00

While the original CIPSOv4 code had provisions for multiple tag types the
implementation was not as great as it could be, pushing a lot of non-tag
specific processing into the tag specific code blocks.  This patch fixes that
issue making it easier to support multiple tag types in the future.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: add tag verification when adding new CIPSOv4 DOI definitions

2006-12-03T05:24:09+00:00

Currently the CIPSOv4 engine does not do any sort of checking when a new DOI
definition is added.  The tags are still verified but only as a side effect of
normal NetLabel operation (packet processing, socket labeling, etc.) which
would cause application errors due to the faulty configuration.  This patch
adds tag checking when new DOI definition are added allowing us to catch these
configuration problems when they happen.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: check for a CIPSOv4 option before we do call into the CIPSOv4 layer

2006-12-03T05:24:08+00:00

Right now the NetLabel code always jumps into the CIPSOv4 layer to determine if
a CIPSO IP option is present.  However, we can do this check directly in the
NetLabel code by making use of the CIPSO_V4_OPTEXIST() macro which should save
us a function call in the common case of not having a CIPSOv4 option present.

Signed-off-by: Paul Moore 
Signed-off-by: James Morris

NetLabel: make netlbl_lsm_secattr struct easier/quicker to understand

2006-12-03T05:24:07+00:00

The existing netlbl_lsm_secattr struct required the LSM to check all of the
fields to determine if any security attributes were present resulting in a lot
of work in the common case of no attributes.  This patch adds a 'flags' field
which is used to indicate which attributes are present in the structure; this
should allow the LSM to do a quick comparison to determine if the structure
holds any security attributes.

Example:

 if (netlbl_lsm_secattr->flags)
	/* security attributes present */
 else
	/* NO security attributes present */

Signed-off-by: Paul Moore 
Signed-off-by: James Morris