1 | /* |
---|
2 | * Copyright (C) 2005 International Business Machines Corporation |
---|
3 | * Copyright (c) 2005 by Trusted Computer Solutions, Inc. |
---|
4 | * All rights reserved. |
---|
5 | * |
---|
6 | * Redistribution and use in source and binary forms, with or without |
---|
7 | * modification, are permitted provided that the following conditions |
---|
8 | * are met: |
---|
9 | * 1. Redistributions of source code must retain the above copyright |
---|
10 | * notice, this list of conditions and the following disclaimer. |
---|
11 | * 2. Redistributions in binary form must reproduce the above copyright |
---|
12 | * notice, this list of conditions and the following disclaimer in the |
---|
13 | * documentation and/or other materials provided with the distribution. |
---|
14 | * 3. Neither the name of the project nor the names of its contributors |
---|
15 | * may be used to endorse or promote products derived from this software |
---|
16 | * without specific prior written permission. |
---|
17 | * |
---|
18 | * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND |
---|
19 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
---|
20 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
---|
21 | * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE |
---|
22 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
---|
23 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
---|
24 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
---|
25 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
---|
26 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
---|
27 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
---|
28 | * SUCH DAMAGE. |
---|
29 | */ |
---|
30 | |
---|
31 | |
---|
32 | #include "config.h" |
---|
33 | |
---|
34 | #include <sys/types.h> |
---|
35 | |
---|
36 | #include <stdlib.h> |
---|
37 | #include <stdio.h> |
---|
38 | #include <string.h> |
---|
39 | |
---|
40 | #include <selinux/selinux.h> |
---|
41 | #include <selinux/flask.h> |
---|
42 | #include <selinux/av_permissions.h> |
---|
43 | #include <selinux/avc.h> |
---|
44 | #include <selinux/context.h> |
---|
45 | |
---|
46 | #include "var.h" |
---|
47 | #include "vmbuf.h" |
---|
48 | #include "misc.h" |
---|
49 | #include "plog.h" |
---|
50 | |
---|
51 | #include "isakmp_var.h" |
---|
52 | #include "isakmp.h" |
---|
53 | #include "ipsec_doi.h" |
---|
54 | #include "policy.h" |
---|
55 | #include "proposal.h" |
---|
56 | #include "strnames.h" |
---|
57 | #include "handler.h" |
---|
58 | |
---|
59 | /* |
---|
60 | * Get the security context information from SA. |
---|
61 | */ |
---|
62 | int |
---|
63 | get_security_context(sa, p) |
---|
64 | vchar_t *sa; |
---|
65 | struct policyindex *p; |
---|
66 | { |
---|
67 | int len = 0; |
---|
68 | int flag, type = 0; |
---|
69 | u_int16_t lorv; |
---|
70 | caddr_t bp; |
---|
71 | vchar_t *pbuf = NULL; |
---|
72 | vchar_t *tbuf = NULL; |
---|
73 | struct isakmp_parse_t *pa; |
---|
74 | struct isakmp_parse_t *ta; |
---|
75 | struct isakmp_pl_p *prop; |
---|
76 | struct isakmp_pl_t *trns; |
---|
77 | struct isakmp_data *d; |
---|
78 | struct ipsecdoi_sa_b *sab = (struct ipsecdoi_sa_b *)sa->v; |
---|
79 | |
---|
80 | /* check SA payload size */ |
---|
81 | if (sa->l < sizeof(*sab)) { |
---|
82 | plog(LLV_ERROR, LOCATION, NULL, |
---|
83 | "Invalid SA length = %zu.\n", sa->l); |
---|
84 | return -1; |
---|
85 | } |
---|
86 | |
---|
87 | bp = (caddr_t)(sab + 1); /* here bp points to first proposal payload */ |
---|
88 | len = sa->l - sizeof(*sab); |
---|
89 | |
---|
90 | pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_P, (struct isakmp_gen *)bp, len); |
---|
91 | if (pbuf == NULL) |
---|
92 | return -1; |
---|
93 | |
---|
94 | pa = (struct isakmp_parse_t *)pbuf->v; |
---|
95 | /* check the value of next payload */ |
---|
96 | if (pa->type != ISAKMP_NPTYPE_P) { |
---|
97 | plog(LLV_ERROR, LOCATION, NULL, |
---|
98 | "Invalid payload type=%u\n", pa->type); |
---|
99 | vfree(pbuf); |
---|
100 | return -1; |
---|
101 | } |
---|
102 | |
---|
103 | if (pa->len == 0) { |
---|
104 | plog(LLV_ERROR, LOCATION, NULL, |
---|
105 | "invalid proposal with length %d\n", pa->len); |
---|
106 | vfree(pbuf); |
---|
107 | return -1; |
---|
108 | } |
---|
109 | |
---|
110 | /* our first proposal */ |
---|
111 | prop = (struct isakmp_pl_p *)pa->ptr; |
---|
112 | |
---|
113 | /* now get transform */ |
---|
114 | bp = (caddr_t)prop + sizeof(struct isakmp_pl_p) + prop->spi_size; |
---|
115 | len = ntohs(prop->h.len) - |
---|
116 | (sizeof(struct isakmp_pl_p) + prop->spi_size); |
---|
117 | tbuf = isakmp_parsewoh(ISAKMP_NPTYPE_T, (struct isakmp_gen *)bp, len); |
---|
118 | if (tbuf == NULL) |
---|
119 | return -1; |
---|
120 | |
---|
121 | ta = (struct isakmp_parse_t *)tbuf->v; |
---|
122 | if (ta->type != ISAKMP_NPTYPE_T) { |
---|
123 | plog(LLV_ERROR, LOCATION, NULL, |
---|
124 | "Invalid payload type=%u\n", ta->type); |
---|
125 | return -1; |
---|
126 | } |
---|
127 | |
---|
128 | trns = (struct isakmp_pl_t *)ta->ptr; |
---|
129 | |
---|
130 | len = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t); |
---|
131 | d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t)); |
---|
132 | |
---|
133 | while (len > 0) { |
---|
134 | type = ntohs(d->type) & ~ISAKMP_GEN_MASK; |
---|
135 | flag = ntohs(d->type) & ISAKMP_GEN_MASK; |
---|
136 | lorv = ntohs(d->lorv); |
---|
137 | |
---|
138 | if (type != IPSECDOI_ATTR_SECCTX) { |
---|
139 | if (flag) { |
---|
140 | len -= sizeof(*d); |
---|
141 | d = (struct isakmp_data *)((char *)d |
---|
142 | + sizeof(*d)); |
---|
143 | } else { |
---|
144 | len -= (sizeof(*d) + lorv); |
---|
145 | d = (struct isakmp_data *)((caddr_t)d |
---|
146 | + sizeof(*d) + lorv); |
---|
147 | } |
---|
148 | } else { |
---|
149 | flag = ntohs(d->type & ISAKMP_GEN_MASK); |
---|
150 | if (flag) { |
---|
151 | plog(LLV_ERROR, LOCATION, NULL, |
---|
152 | "SECCTX must be in TLV.\n"); |
---|
153 | return -1; |
---|
154 | } |
---|
155 | memcpy(&p->sec_ctx, d + 1, lorv); |
---|
156 | p->sec_ctx.ctx_strlen = ntohs(p->sec_ctx.ctx_strlen); |
---|
157 | return 0; |
---|
158 | } |
---|
159 | } |
---|
160 | return 0; |
---|
161 | } |
---|
162 | |
---|
163 | void |
---|
164 | set_secctx_in_proposal(iph2, spidx) |
---|
165 | struct ph2handle *iph2; |
---|
166 | struct policyindex spidx; |
---|
167 | { |
---|
168 | iph2->proposal->sctx.ctx_doi = spidx.sec_ctx.ctx_doi; |
---|
169 | iph2->proposal->sctx.ctx_alg = spidx.sec_ctx.ctx_alg; |
---|
170 | iph2->proposal->sctx.ctx_strlen = spidx.sec_ctx.ctx_strlen; |
---|
171 | memcpy(iph2->proposal->sctx.ctx_str, spidx.sec_ctx.ctx_str, |
---|
172 | spidx.sec_ctx.ctx_strlen); |
---|
173 | } |
---|
174 | |
---|
175 | |
---|
176 | /* |
---|
177 | * function: init_avc |
---|
178 | * description: function performs the steps necessary to initialize the |
---|
179 | * userspace avc. |
---|
180 | * input: void |
---|
181 | * return: 0 if avc was successfully initialized |
---|
182 | * 1 if the avc could not be initialized |
---|
183 | */ |
---|
184 | |
---|
185 | static int mls_ready = 0; |
---|
186 | |
---|
187 | void |
---|
188 | init_avc(void) |
---|
189 | { |
---|
190 | if (!is_selinux_mls_enabled()) { |
---|
191 | plog(LLV_ERROR, LOCATION, NULL, "racoon: MLS support is not" |
---|
192 | " enabled.\n"); |
---|
193 | return; |
---|
194 | } |
---|
195 | |
---|
196 | if (avc_init("racoon", NULL, NULL, NULL, NULL) == 0) |
---|
197 | mls_ready = 1; |
---|
198 | else |
---|
199 | plog(LLV_ERROR, LOCATION, NULL, |
---|
200 | "racoon: could not initialize avc.\n"); |
---|
201 | } |
---|
202 | |
---|
203 | /* |
---|
204 | * function: within_range |
---|
205 | * description: function determines if the specified sl is within the |
---|
206 | * configured range for a policy rule. |
---|
207 | * input: security_context *sl SL |
---|
208 | * char *range Range |
---|
209 | * return: 1 if the sl is within the range |
---|
210 | * 0 if the sl is not within the range or an error |
---|
211 | * occurred which prevented the determination |
---|
212 | */ |
---|
213 | |
---|
214 | int |
---|
215 | within_range(security_context_t sl, security_context_t range) |
---|
216 | { |
---|
217 | int rtn = 1; |
---|
218 | security_id_t slsid; |
---|
219 | security_id_t rangesid; |
---|
220 | struct av_decision avd; |
---|
221 | security_class_t tclass; |
---|
222 | access_vector_t av; |
---|
223 | |
---|
224 | if (!*range) /* This policy doesn't have security context */ |
---|
225 | return 1; |
---|
226 | |
---|
227 | if (!mls_ready) /* mls may not be enabled */ |
---|
228 | return 0; |
---|
229 | |
---|
230 | /* |
---|
231 | * Get the sids for the sl and range contexts |
---|
232 | */ |
---|
233 | rtn = avc_context_to_sid(sl, &slsid); |
---|
234 | if (rtn != 0) { |
---|
235 | plog(LLV_ERROR, LOCATION, NULL, |
---|
236 | "within_range: Unable to retrieve " |
---|
237 | "sid for sl context (%s).\n", sl); |
---|
238 | return 0; |
---|
239 | } |
---|
240 | rtn = avc_context_to_sid(range, &rangesid); |
---|
241 | if (rtn != 0) { |
---|
242 | plog(LLV_ERROR, LOCATION, NULL, |
---|
243 | "within_range: Unable to retrieve " |
---|
244 | "sid for range context (%s).\n", range); |
---|
245 | sidput(slsid); |
---|
246 | return 0; |
---|
247 | } |
---|
248 | |
---|
249 | /* |
---|
250 | * Straight up test between sl and range |
---|
251 | */ |
---|
252 | tclass = SECCLASS_ASSOCIATION; |
---|
253 | av = ASSOCIATION__POLMATCH; |
---|
254 | rtn = avc_has_perm(slsid, rangesid, tclass, av, NULL, &avd); |
---|
255 | if (rtn != 0) { |
---|
256 | plog(LLV_INFO, LOCATION, NULL, |
---|
257 | "within_range: The sl is not within range\n"); |
---|
258 | sidput(slsid); |
---|
259 | sidput(rangesid); |
---|
260 | return 0; |
---|
261 | } |
---|
262 | plog(LLV_DEBUG, LOCATION, NULL, |
---|
263 | "within_range: The sl (%s) is within range (%s)\n", sl, range); |
---|
264 | return 1; |
---|
265 | } |
---|