/**************************************************************** * acm_simple_type_enforcement_hooks.c * * Copyright (C) 2005 IBM Corporation * * Author: * Reiner Sailer * * Contributors: * Stefan Berger * support for network order binary policies * * This program is free software; you can redistribute it and/or * modify it under the terms of the GNU General Public License as * published by the Free Software Foundation, version 2 of the * License. * * sHype Simple Type Enforcement for Xen * STE allows to control which domains can setup sharing * (eventchannels right now) with which other domains. Hooks * are defined and called throughout Xen when domains bind to * shared resources (setup eventchannels) and a domain is allowed * to setup sharing with another domain if and only if both domains * share at least on common type. * */ #include #include #include #include #include #include /* local cache structures for STE policy */ struct ste_binary_policy ste_bin_pol; static inline int have_common_type (ssidref_t ref1, ssidref_t ref2) { int i; for(i=0; i< ste_bin_pol.max_types; i++) if ( ste_bin_pol.ssidrefs[ref1*ste_bin_pol.max_types + i] && ste_bin_pol.ssidrefs[ref2*ste_bin_pol.max_types + i]) { printkd("%s: common type #%02x.\n", __func__, i); return 1; } return 0; } /* Helper function: return = (subj and obj share a common type) */ static int share_common_type(struct domain *subj, struct domain *obj) { ssidref_t ref_s, ref_o; int ret; if ((subj == NULL) || (obj == NULL) || (subj->ssid == NULL) || (obj->ssid == NULL)) return 0; read_lock(&acm_bin_pol_rwlock); /* lookup the policy-local ssids */ ref_s = ((struct ste_ssid *)(GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)subj->ssid)))->ste_ssidref; ref_o = ((struct ste_ssid *)(GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)obj->ssid)))->ste_ssidref; /* check whether subj and obj share a common ste type */ ret = have_common_type(ref_s, ref_o); read_unlock(&acm_bin_pol_rwlock); return ret; } /* * Initializing STE policy (will be filled by policy partition * using setpolicy command) */ int acm_init_ste_policy(void) { /* minimal startup policy; policy write-locked already */ ste_bin_pol.max_types = 1; ste_bin_pol.max_ssidrefs = 2; ste_bin_pol.ssidrefs = (domaintype_t *)xmalloc_array(domaintype_t, 2); memset(ste_bin_pol.ssidrefs, 0, 2); if (ste_bin_pol.ssidrefs == NULL) return ACM_INIT_SSID_ERROR; /* initialize state so that dom0 can start up and communicate with itself */ ste_bin_pol.ssidrefs[1] = 1; /* init stats */ atomic_set(&(ste_bin_pol.ec_eval_count), 0); atomic_set(&(ste_bin_pol.ec_denied_count), 0); atomic_set(&(ste_bin_pol.ec_cachehit_count), 0); atomic_set(&(ste_bin_pol.gt_eval_count), 0); atomic_set(&(ste_bin_pol.gt_denied_count), 0); atomic_set(&(ste_bin_pol.gt_cachehit_count), 0); return ACM_OK; } /* ste initialization function hooks */ static int ste_init_domain_ssid(void **ste_ssid, ssidref_t ssidref) { int i; struct ste_ssid *ste_ssidp = xmalloc(struct ste_ssid); traceprintk("%s.\n", __func__); if (ste_ssidp == NULL) return ACM_INIT_SSID_ERROR; /* get policy-local ssid reference */ ste_ssidp->ste_ssidref = GET_SSIDREF(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, ssidref); if ((ste_ssidp->ste_ssidref >= ste_bin_pol.max_ssidrefs) || (ste_ssidp->ste_ssidref == ACM_DEFAULT_LOCAL_SSID)) { printkd("%s: ERROR ste_ssidref (%x) undefined or unset (0).\n", __func__, ste_ssidp->ste_ssidref); xfree(ste_ssidp); return ACM_INIT_SSID_ERROR; } /* clean ste cache */ for (i=0; iste_cache[i].valid = ACM_STE_free; (*ste_ssid) = ste_ssidp; printkd("%s: determined ste_ssidref to %x.\n", __func__, ste_ssidp->ste_ssidref); return ACM_OK; } static void ste_free_domain_ssid(void *ste_ssid) { traceprintk("%s.\n", __func__); xfree(ste_ssid); return; } /* dump type enforcement cache; policy read-locked already */ static int ste_dump_policy(u8 *buf, u32 buf_size) { struct acm_ste_policy_buffer *ste_buf = (struct acm_ste_policy_buffer *)buf; int ret = 0; if (buf_size < sizeof(struct acm_ste_policy_buffer)) return -EINVAL; ste_buf->ste_max_types = htonl(ste_bin_pol.max_types); ste_buf->ste_max_ssidrefs = htonl(ste_bin_pol.max_ssidrefs); ste_buf->policy_code = htonl(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY); ste_buf->ste_ssid_offset = htonl(sizeof(struct acm_ste_policy_buffer)); ret = ntohl(ste_buf->ste_ssid_offset) + sizeof(domaintype_t)*ste_bin_pol.max_ssidrefs*ste_bin_pol.max_types; ret = (ret + 7) & ~7; if (buf_size < ret) return -EINVAL; /* now copy buffer over */ arrcpy(buf + ntohl(ste_buf->ste_ssid_offset), ste_bin_pol.ssidrefs, sizeof(domaintype_t), ste_bin_pol.max_ssidrefs*ste_bin_pol.max_types); return ret; } /* ste_init_state is called when a policy is changed to detect violations (return != 0). * from a security point of view, we simulate that all running domains are re-started and * all sharing decisions are replayed to detect violations or current sharing behavior * (right now: event_channels, future: also grant_tables) */ static int ste_init_state(struct acm_ste_policy_buffer *ste_buf, domaintype_t *ssidrefs) { int violation = 1; struct ste_ssid *ste_ssid, *ste_rssid; ssidref_t ste_ssidref, ste_rssidref; struct domain **pd, *rdom; domid_t rdomid; grant_entry_t sha_copy; int port, i; read_lock(&domlist_lock); /* go by domain? or directly by global? event/grant list */ /* go through all domains and adjust policy as if this domain was started now */ pd = &domain_list; for ( pd = &domain_list; *pd != NULL; pd = &(*pd)->next_in_list ) { ste_ssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(*pd)->ssid); ste_ssidref = ste_ssid->ste_ssidref; traceprintk("%s: validating policy for eventch domain %x (ste-Ref=%x).\n", __func__, (*pd)->domain_id, ste_ssidref); /* a) check for event channel conflicts */ for (port=0; port < NR_EVTCHN_BUCKETS; port++) { spin_lock(&(*pd)->evtchn_lock); if ((*pd)->evtchn[port] == NULL) { spin_unlock(&(*pd)->evtchn_lock); continue; } if ((*pd)->evtchn[port]->state == ECS_INTERDOMAIN) { rdom = (*pd)->evtchn[port]->u.interdomain.remote_dom; rdomid = rdom->domain_id; /* rdom now has remote domain */ ste_rssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(rdom->ssid)); ste_rssidref = ste_rssid->ste_ssidref; } else if ((*pd)->evtchn[port]->state == ECS_UNBOUND) { rdomid = (*pd)->evtchn[port]->u.unbound.remote_domid; if ((rdom = find_domain_by_id(rdomid)) == NULL) { printk("%s: Error finding domain to id %x!\n", __func__, rdomid); goto out; } /* rdom now has remote domain */ ste_rssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(rdom->ssid)); ste_rssidref = ste_rssid->ste_ssidref; put_domain(rdom); } else { spin_unlock(&(*pd)->evtchn_lock); continue; /* port unused */ } spin_unlock(&(*pd)->evtchn_lock); /* rdom now has remote domain */ ste_rssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(rdom->ssid)); ste_rssidref = ste_rssid->ste_ssidref; traceprintk("%s: eventch: domain %x (ssidref %x) --> domain %x (rssidref %x) used (port %x).\n", __func__, (*pd)->domain_id, ste_ssidref, rdom->domain_id, ste_rssidref, port); /* check whether on subj->ssid, obj->ssid share a common type*/ if (!have_common_type(ste_ssidref, ste_rssidref)) { printkd("%s: Policy violation in event channel domain %x -> domain %x.\n", __func__, (*pd)->domain_id, rdomid); goto out; } } /* b) check for grant table conflicts on shared pages */ if ((*pd)->grant_table->shared == NULL) { printkd("%s: Grant ... sharing for domain %x not setup!\n", __func__, (*pd)->domain_id); continue; } for ( i = 0; i < NR_GRANT_ENTRIES; i++ ) { sha_copy = (*pd)->grant_table->shared[i]; if ( sha_copy.flags ) { printkd("%s: grant dom (%hu) SHARED (%d) flags:(%hx) dom:(%hu) frame:(%lx)\n", __func__, (*pd)->domain_id, i, sha_copy.flags, sha_copy.domid, (unsigned long)sha_copy.frame); rdomid = sha_copy.domid; if ((rdom = find_domain_by_id(rdomid)) == NULL) { printkd("%s: domain not found ERROR!\n", __func__); goto out; }; /* rdom now has remote domain */ ste_rssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(rdom->ssid)); ste_rssidref = ste_rssid->ste_ssidref; put_domain(rdom); if (!have_common_type(ste_ssidref, ste_rssidref)) { printkd("%s: Policy violation in grant table sharing domain %x -> domain %x.\n", __func__, (*pd)->domain_id, rdomid); goto out; } } } } violation = 0; out: read_unlock(&domlist_lock); return violation; /* returning "violation != 0" means that existing sharing between domains would not * have been allowed if the new policy had been enforced before the sharing; for ste, * this means that there are at least 2 domains that have established sharing through * event-channels or grant-tables but these two domains don't have no longer a common * type in their typesets referenced by their ssidrefs */ } /* set new policy; policy write-locked already */ static int ste_set_policy(u8 *buf, u32 buf_size) { struct acm_ste_policy_buffer *ste_buf = (struct acm_ste_policy_buffer *)buf; void *ssidrefsbuf; struct ste_ssid *ste_ssid; struct domain **pd; int i; if (buf_size < sizeof(struct acm_ste_policy_buffer)) return -EINVAL; /* Convert endianess of policy */ ste_buf->policy_code = ntohl(ste_buf->policy_code); ste_buf->policy_version = ntohl(ste_buf->policy_version); ste_buf->ste_max_types = ntohl(ste_buf->ste_max_types); ste_buf->ste_max_ssidrefs = ntohl(ste_buf->ste_max_ssidrefs); ste_buf->ste_ssid_offset = ntohl(ste_buf->ste_ssid_offset); /* policy type and version checks */ if ((ste_buf->policy_code != ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY) || (ste_buf->policy_version != ACM_STE_VERSION)) return -EINVAL; /* 1. create and copy-in new ssidrefs buffer */ ssidrefsbuf = xmalloc_array(u8, sizeof(domaintype_t)*ste_buf->ste_max_types*ste_buf->ste_max_ssidrefs); if (ssidrefsbuf == NULL) { return -ENOMEM; } if (ste_buf->ste_ssid_offset + sizeof(domaintype_t) * ste_buf->ste_max_ssidrefs*ste_buf->ste_max_types > buf_size) goto error_free; arrcpy(ssidrefsbuf, buf + ste_buf->ste_ssid_offset, sizeof(domaintype_t), ste_buf->ste_max_ssidrefs*ste_buf->ste_max_types); /* 2. now re-calculate sharing decisions based on running domains; * this can fail if new policy is conflicting with sharing of running domains * now: reject violating new policy; future: adjust sharing through revoking sharing */ if (ste_init_state(ste_buf, (domaintype_t *)ssidrefsbuf)) { printk("%s: New policy conflicts with running domains. Policy load aborted.\n", __func__); goto error_free; /* new policy conflicts with sharing of running domains */ } /* 3. replace old policy (activate new policy) */ ste_bin_pol.max_types = ste_buf->ste_max_types; ste_bin_pol.max_ssidrefs = ste_buf->ste_max_ssidrefs; xfree(ste_bin_pol.ssidrefs); ste_bin_pol.ssidrefs = (domaintype_t *)ssidrefsbuf; /* clear all ste caches */ read_lock(&domlist_lock); pd = &domain_list; for ( pd = &domain_list; *pd != NULL; pd = &(*pd)->next_in_list ) { ste_ssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(*pd)->ssid); for (i=0; iste_cache[i].valid = ACM_STE_free; } read_unlock(&domlist_lock); return ACM_OK; error_free: printk("%s: ERROR setting policy.\n", __func__); xfree(ssidrefsbuf); return -EFAULT; } static int ste_dump_stats(u8 *buf, u16 buf_len) { struct acm_ste_stats_buffer stats; /* now send the hook counts to user space */ stats.ec_eval_count = htonl(atomic_read(&ste_bin_pol.ec_eval_count)); stats.gt_eval_count = htonl(atomic_read(&ste_bin_pol.gt_eval_count)); stats.ec_denied_count = htonl(atomic_read(&ste_bin_pol.ec_denied_count)); stats.gt_denied_count = htonl(atomic_read(&ste_bin_pol.gt_denied_count)); stats.ec_cachehit_count = htonl(atomic_read(&ste_bin_pol.ec_cachehit_count)); stats.gt_cachehit_count = htonl(atomic_read(&ste_bin_pol.gt_cachehit_count)); if (buf_len < sizeof(struct acm_ste_stats_buffer)) return -ENOMEM; memcpy(buf, &stats, sizeof(struct acm_ste_stats_buffer)); return sizeof(struct acm_ste_stats_buffer); } static int ste_dump_ssid_types(ssidref_t ssidref, u8 *buf, u16 len) { int i; /* fill in buffer */ if (ste_bin_pol.max_types > len) return -EFAULT; if (ssidref >= ste_bin_pol.max_ssidrefs) return -EFAULT; /* read types for chwall ssidref */ for(i=0; i< ste_bin_pol.max_types; i++) { if (ste_bin_pol.ssidrefs[ssidref * ste_bin_pol.max_types + i]) buf[i] = 1; else buf[i] = 0; } return ste_bin_pol.max_types; } /* we need to go through this before calling the hooks, * returns 1 == cache hit */ static int inline check_cache(struct domain *dom, domid_t rdom) { struct ste_ssid *ste_ssid; int i; printkd("checking cache: %x --> %x.\n", dom->domain_id, rdom); if (dom->ssid == NULL) return 0; ste_ssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(dom->ssid)); for(i=0; i< ACM_TE_CACHE_SIZE; i++) { if ((ste_ssid->ste_cache[i].valid == ACM_STE_valid) && (ste_ssid->ste_cache[i].id == rdom)) { printkd("cache hit (entry %x, id= %x!\n", i, ste_ssid->ste_cache[i].id); return 1; } } return 0; } /* we only get here if there is NO entry yet; no duplication check! */ static void inline cache_result(struct domain *subj, struct domain *obj) { struct ste_ssid *ste_ssid; int i; printkd("caching from doms: %x --> %x.\n", subj->domain_id, obj->domain_id); if (subj->ssid == NULL) return; ste_ssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, (struct acm_ssid_domain *)(subj)->ssid); for(i=0; i< ACM_TE_CACHE_SIZE; i++) if (ste_ssid->ste_cache[i].valid == ACM_STE_free) break; if (i< ACM_TE_CACHE_SIZE) { ste_ssid->ste_cache[i].valid = ACM_STE_valid; ste_ssid->ste_cache[i].id = obj->domain_id; } else printk ("Cache of dom %x is full!\n", subj->domain_id); } /* deletes entries for domain 'id' from all caches (re-use) */ static void inline clean_id_from_cache(domid_t id) { struct ste_ssid *ste_ssid; int i; struct domain **pd; struct acm_ssid_domain *ssid; printkd("deleting cache for dom %x.\n", id); read_lock(&domlist_lock); /* look through caches of all domains */ pd = &domain_list; for ( pd = &domain_list; *pd != NULL; pd = &(*pd)->next_in_list ) { ssid = (struct acm_ssid_domain *)((*pd)->ssid); if (ssid == NULL) continue; /* hanging domain structure, no ssid any more ... */ ste_ssid = GET_SSIDP(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, ssid); if (!ste_ssid) { printk("%s: deleting ID from cache ERROR (no ste_ssid)!\n", __func__); goto out; } for (i=0; iste_cache[i].valid == ACM_STE_valid) && (ste_ssid->ste_cache[i].id == id)) ste_ssid->ste_cache[i].valid = ACM_STE_free; } out: read_unlock(&domlist_lock); } /*************************** * Authorization functions **************************/ static int ste_pre_domain_create(void *subject_ssid, ssidref_t ssidref) { /* check for ssidref in range for policy */ ssidref_t ste_ssidref; traceprintk("%s.\n", __func__); read_lock(&acm_bin_pol_rwlock); ste_ssidref = GET_SSIDREF(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, ssidref); if (ste_ssidref == ACM_DEFAULT_LOCAL_SSID) { printk("%s: ERROR STE SSID is NOT SET but policy enforced.\n", __func__); read_unlock(&acm_bin_pol_rwlock); return ACM_ACCESS_DENIED; /* catching and indicating config error */ } if (ste_ssidref >= ste_bin_pol.max_ssidrefs) { printk("%s: ERROR ste_ssidref > max(%x).\n", __func__, ste_bin_pol.max_ssidrefs-1); read_unlock(&acm_bin_pol_rwlock); return ACM_ACCESS_DENIED; } read_unlock(&acm_bin_pol_rwlock); return ACM_ACCESS_PERMITTED; } static void ste_post_domain_destroy(void *subject_ssid, domid_t id) { /* clean all cache entries for destroyed domain (might be re-used) */ clean_id_from_cache(id); } /* -------- EVENTCHANNEL OPERATIONS -----------*/ static int ste_pre_eventchannel_unbound(domid_t id1, domid_t id2) { struct domain *subj, *obj; int ret; traceprintk("%s: dom%x-->dom%x.\n", __func__, (id1 == DOMID_SELF) ? current->domain->domain_id : id1, (id2 == DOMID_SELF) ? current->domain->domain_id : id2); if (id1 == DOMID_SELF) id1 = current->domain->domain_id; if (id2 == DOMID_SELF) id2 = current->domain->domain_id; subj = find_domain_by_id(id1); obj = find_domain_by_id(id2); if ((subj == NULL) || (obj == NULL)) { ret = ACM_ACCESS_DENIED; goto out; } /* cache check late */ if (check_cache(subj, obj->domain_id)) { atomic_inc(&ste_bin_pol.ec_cachehit_count); ret = ACM_ACCESS_PERMITTED; goto out; } atomic_inc(&ste_bin_pol.ec_eval_count); if (share_common_type(subj, obj)) { cache_result(subj, obj); ret = ACM_ACCESS_PERMITTED; } else { atomic_inc(&ste_bin_pol.ec_denied_count); ret = ACM_ACCESS_DENIED; } out: if (obj != NULL) put_domain(obj); if (subj != NULL) put_domain(subj); return ret; } static int ste_pre_eventchannel_interdomain(domid_t id) { struct domain *subj=NULL, *obj=NULL; int ret; traceprintk("%s: dom%x-->dom%x.\n", __func__, current->domain->domain_id, (id == DOMID_SELF) ? current->domain->domain_id : id); /* following is a bit longer but ensures that we * "put" only domains that we where "find"-ing */ if (id == DOMID_SELF) id = current->domain->domain_id; subj = current->domain; obj = find_domain_by_id(id); if (obj == NULL) { ret = ACM_ACCESS_DENIED; goto out; } /* cache check late, but evtchn is not on performance critical path */ if (check_cache(subj, obj->domain_id)) { atomic_inc(&ste_bin_pol.ec_cachehit_count); ret = ACM_ACCESS_PERMITTED; goto out; } atomic_inc(&ste_bin_pol.ec_eval_count); if (share_common_type(subj, obj)) { cache_result(subj, obj); ret = ACM_ACCESS_PERMITTED; } else { atomic_inc(&ste_bin_pol.ec_denied_count); ret = ACM_ACCESS_DENIED; } out: if (obj != NULL) put_domain(obj); return ret; } /* -------- SHARED MEMORY OPERATIONS -----------*/ static int ste_pre_grant_map_ref (domid_t id) { struct domain *obj, *subj; int ret; traceprintk("%s: dom%x-->dom%x.\n", __func__, current->domain->domain_id, id); if (check_cache(current->domain, id)) { atomic_inc(&ste_bin_pol.gt_cachehit_count); return ACM_ACCESS_PERMITTED; } atomic_inc(&ste_bin_pol.gt_eval_count); subj = current->domain; obj = find_domain_by_id(id); if (share_common_type(subj, obj)) { cache_result(subj, obj); ret = ACM_ACCESS_PERMITTED; } else { atomic_inc(&ste_bin_pol.gt_denied_count); printkd("%s: ACCESS DENIED!\n", __func__); ret = ACM_ACCESS_DENIED; } if (obj != NULL) put_domain(obj); return ret; } /* since setting up grant tables involves some implicit information flow from the creating domain to the domain that is setup, we check types in addition to the general authorization */ static int ste_pre_grant_setup (domid_t id) { struct domain *obj, *subj; int ret; traceprintk("%s: dom%x-->dom%x.\n", __func__, current->domain->domain_id, id); if (check_cache(current->domain, id)) { atomic_inc(&ste_bin_pol.gt_cachehit_count); return ACM_ACCESS_PERMITTED; } atomic_inc(&ste_bin_pol.gt_eval_count); /* a) check authorization (eventually use specific capabilities) */ if (!IS_PRIV(current->domain)) { printk("%s: Grant table management authorization denied ERROR!\n", __func__); return ACM_ACCESS_DENIED; } /* b) check types */ subj = current->domain; obj = find_domain_by_id(id); if (share_common_type(subj, obj)) { cache_result(subj, obj); ret = ACM_ACCESS_PERMITTED; } else { atomic_inc(&ste_bin_pol.gt_denied_count); ret = ACM_ACCESS_DENIED; } if (obj != NULL) put_domain(obj); return ret; } /* -------- DOMAIN-Requested Decision hooks -----------*/ static int ste_sharing(ssidref_t ssidref1, ssidref_t ssidref2) { if (have_common_type ( GET_SSIDREF(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, ssidref1), GET_SSIDREF(ACM_SIMPLE_TYPE_ENFORCEMENT_POLICY, ssidref2) )) return ACM_ACCESS_PERMITTED; else return ACM_ACCESS_DENIED; } /* now define the hook structure similarly to LSM */ struct acm_operations acm_simple_type_enforcement_ops = { /* policy management services */ .init_domain_ssid = ste_init_domain_ssid, .free_domain_ssid = ste_free_domain_ssid, .dump_binary_policy = ste_dump_policy, .set_binary_policy = ste_set_policy, .dump_statistics = ste_dump_stats, .dump_ssid_types = ste_dump_ssid_types, /* domain management control hooks */ .pre_domain_create = ste_pre_domain_create, .post_domain_create = NULL, .fail_domain_create = NULL, .post_domain_destroy = ste_post_domain_destroy, /* event channel control hooks */ .pre_eventchannel_unbound = ste_pre_eventchannel_unbound, .fail_eventchannel_unbound = NULL, .pre_eventchannel_interdomain = ste_pre_eventchannel_interdomain, .fail_eventchannel_interdomain = NULL, /* grant table control hooks */ .pre_grant_map_ref = ste_pre_grant_map_ref, .fail_grant_map_ref = NULL, .pre_grant_setup = ste_pre_grant_setup, .fail_grant_setup = NULL, .sharing = ste_sharing, }; /* * Local variables: * mode: C * c-set-style: "BSD" * c-basic-offset: 4 * tab-width: 4 * indent-tabs-mode: nil * End: */ a> 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 
/*
 * netlink/attr.h		Netlink Attributes
 *
 *	This library is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU Lesser General Public
 *	License as published by the Free Software Foundation version 2.1
 *	of the License.
 *
 * Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
 */

#ifndef NETLINK_ATTR_H_
#define NETLINK_ATTR_H_

#include <netlink/netlink.h>
#include <netlink/object.h>
#include <netlink/addr.h>
#include <netlink/data.h>
#include <netlink/msg.h>

#ifdef __cplusplus
extern "C" {
#endif

struct nl_msg;

/**
 * @name Basic Attribute Data Types
 * @{
 */

 /**
  * @ingroup attr
  * Basic attribute data types
  *
  * See \ref attr_datatypes for more details.
  */
enum {
	NLA_UNSPEC,	/**< Unspecified type, binary data chunk */
	NLA_U8,		/**< 8 bit integer */
	NLA_U16,	/**< 16 bit integer */
	NLA_U32,	/**< 32 bit integer */
	NLA_U64,	/**< 64 bit integer */
	NLA_STRING,	/**< NUL terminated character string */
	NLA_FLAG,	/**< Flag */
	NLA_MSECS,	/**< Micro seconds (64bit) */
	NLA_NESTED,	/**< Nested attributes */
	__NLA_TYPE_MAX,
};

#define NLA_TYPE_MAX (__NLA_TYPE_MAX - 1)

/** @} */

/**
 * @ingroup attr
 * Attribute validation policy.
 *
 * See \ref attr_datatypes for more details.
 */
struct nla_policy {
	/** Type of attribute or NLA_UNSPEC */
	uint16_t	type;

	/** Minimal length of payload required */
	uint16_t	minlen;

	/** Maximal length of payload allowed */
	uint16_t	maxlen;
};

/* Attribute parsing */
extern int		nla_ok(const struct nlattr *, int);
extern struct nlattr *	nla_next(const struct nlattr *, int *);
extern int		nla_parse(struct nlattr **, int, struct nlattr *,
				  int, struct nla_policy *);
extern int		nla_validate(struct nlattr *, int, int,
				     struct nla_policy *);
extern struct nlattr *	nla_find(struct nlattr *, int, int);

/* Unspecific attribute */
extern struct nlattr *	nla_reserve(struct nl_msg *, int, int);
extern int		nla_put(struct nl_msg *, int, int, const void *);

/**
 * nlmsg_find_attr - find a specific attribute in a netlink message
 * @arg nlh		netlink message header
 * @arg hdrlen		length of familiy specific header
 * @arg attrtype	type of attribute to look for
 *
 * Returns the first attribute which matches the specified type.
 */
static inline struct nlattr *nlmsg_find_attr(struct nlmsghdr *nlh, int hdrlen, int attrtype)
{
	return nla_find(nlmsg_attrdata(nlh, hdrlen),
			nlmsg_attrlen(nlh, hdrlen), attrtype);
}


/**
 * Return size of attribute whithout padding.
 * @arg payload		Payload length of attribute.
 *
 * @code
 *    <-------- nla_attr_size(payload) --------->
 *   +------------------+- - -+- - - - - - - - - +- - -+
 *   | Attribute Header | Pad |     Payload      | Pad |
 *   +------------------+- - -+- - - - - - - - - +- - -+
 * @endcode
 *
 * @return Size of attribute in bytes without padding.
 */
static inline int nla_attr_size(int payload)
{
	return NLA_HDRLEN + payload;
}

/**
 * Return size of attribute including padding.
 * @arg payload		Payload length of attribute.
 *
 * @code
 *    <----------- nla_total_size(payload) ----------->
 *   +------------------+- - -+- - - - - - - - - +- - -+
 *   | Attribute Header | Pad |     Payload      | Pad |
 *   +------------------+- - -+- - - - - - - - - +- - -+
 * @endcode
 *
 * @return Size of attribute in bytes.
 */
static inline int nla_total_size(int payload)
{
	return NLA_ALIGN(nla_attr_size(payload));
}

/**
 * Return length of padding at the tail of the attribute.
 * @arg payload		Payload length of attribute.
 *
 * @code
 *   +------------------+- - -+- - - - - - - - - +- - -+
 *   | Attribute Header | Pad |     Payload      | Pad |
 *   +------------------+- - -+- - - - - - - - - +- - -+
 *                                                <--->  
 * @endcode
 *
 * @return Length of padding in bytes.
 */
static inline int nla_padlen(int payload)
{
	return nla_total_size(payload) - nla_attr_size(payload);
}

/**
 * Return type of the attribute.
 * @arg nla		Attribute.
 *
 * @return Type of attribute.
 */
static inline int nla_type(const struct nlattr *nla)
{
	return nla->nla_type & NLA_TYPE_MASK;
}

/**
 * Return pointer to the payload section.
 * @arg nla		Attribute.
 *
 * @return Pointer to start of payload section.
 */
static inline void *nla_data(const struct nlattr *nla)
{
	return (char *) nla + NLA_HDRLEN;
}

/**
 * Return length of the payload .
 * @arg nla		Attribute
 *
 * @return Length of payload in bytes.
 */
static inline int nla_len(const struct nlattr *nla)
{
	return nla->nla_len - NLA_HDRLEN;
}

/**
 * Copy attribute payload to another memory area.
 * @arg dest		Pointer to destination memory area.
 * @arg src		Attribute
 * @arg count		Number of bytes to copy at most.
 *
 * Note: The number of bytes copied is limited by the length of
 *       the attribute payload.
 *
 * @return The number of bytes copied to dest.
 */
static inline int nla_memcpy(void *dest, struct nlattr *src, int count)
{
	int minlen;

	if (!src)
		return 0;
	
	minlen = min_t(int, count, nla_len(src));
	memcpy(dest, nla_data(src), minlen);

	return minlen;
}


/**
 * Add abstract data as unspecific attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg data		Abstract data object.
 *
 * Equivalent to nla_put() except that the length of the payload is
 * derived from the abstract data object.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_data(struct nl_msg *msg, int attrtype, struct nl_data *data)
{
	return nla_put(msg, attrtype, nl_data_get_size(data),
		       nl_data_get(data));
}

/**
 * Add abstract address as unspecific attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg addr		Abstract address object.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_addr(struct nl_msg *msg, int attrtype, struct nl_addr *addr)
{
	return nla_put(msg, attrtype, nl_addr_get_len(addr),
		       nl_addr_get_binary_addr(addr));
}

/** @} */

/**
 * @name Integer Attributes
 */

/**
 * Add 8 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value to store as payload.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_u8(struct nl_msg *msg, int attrtype, uint8_t value)
{
	return nla_put(msg, attrtype, sizeof(uint8_t), &value);
}

/**
 * Return value of 8 bit integer attribute.
 * @arg nla		8 bit integer attribute
 *
 * @return Payload as 8 bit integer.
 */
static inline uint8_t nla_get_u8(struct nlattr *nla)
{
	return *(uint8_t *) nla_data(nla);
}

/**
 * Add 16 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value to store as payload.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_u16(struct nl_msg *msg, int attrtype, uint16_t value)
{
	return nla_put(msg, attrtype, sizeof(uint16_t), &value);
}

/**
 * Return payload of 16 bit integer attribute.
 * @arg nla		16 bit integer attribute
 *
 * @return Payload as 16 bit integer.
 */
static inline uint16_t nla_get_u16(struct nlattr *nla)
{
	return *(uint16_t *) nla_data(nla);
}

/**
 * Add 32 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value to store as payload.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_u32(struct nl_msg *msg, int attrtype, uint32_t value)
{
	return nla_put(msg, attrtype, sizeof(uint32_t), &value);
}

/**
 * Return payload of 32 bit integer attribute.
 * @arg nla		32 bit integer attribute.
 *
 * @return Payload as 32 bit integer.
 */
static inline uint32_t nla_get_u32(struct nlattr *nla)
{
	return *(uint32_t *) nla_data(nla);
}

/**
 * Add 64 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value to store as payload.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_u64(struct nl_msg *msg, int attrtype, uint64_t value)
{
	return nla_put(msg, attrtype, sizeof(uint64_t), &value);
}

/**
 * Return payload of u64 attribute
 * @arg nla		u64 netlink attribute
 *
 * @return Payload as 64 bit integer.
 */
static inline uint64_t nla_get_u64(struct nlattr *nla)
{
	uint64_t tmp;

	nla_memcpy(&tmp, nla, sizeof(tmp));

	return tmp;
}

/**
 * Add string attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg str		NUL terminated string.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_string(struct nl_msg *msg, int attrtype, const char *str)
{
	return nla_put(msg, attrtype, strlen(str) + 1, str);
}

/**
 * Return payload of string attribute.
 * @arg nla		String attribute.
 *
 * @return Pointer to attribute payload.
 */
static inline char *nla_get_string(struct nlattr *nla)
{
	return (char *) nla_data(nla);
}

static inline char *nla_strdup(struct nlattr *nla)
{
	return strdup(nla_get_string(nla));
}

/** @} */

/**
 * @name Flag Attribute
 */

/**
 * Add flag netlink attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_flag(struct nl_msg *msg, int attrtype)
{
	return nla_put(msg, attrtype, 0, NULL);
}

/**
 * Return true if flag attribute is set.
 * @arg nla		Flag netlink attribute.
 *
 * @return True if flag is set, otherwise false.
 */
static inline int nla_get_flag(struct nlattr *nla)
{
	return !!nla;
}

/** @} */

/**
 * @name Microseconds Attribute
 */

/**
 * Add a msecs netlink attribute to a netlink message
 * @arg n		netlink message
 * @arg attrtype	attribute type
 * @arg msecs 		number of msecs
 */
static inline int nla_put_msecs(struct nl_msg *n, int attrtype, unsigned long msecs)
{
	return nla_put_u64(n, attrtype, msecs);
}

/**
 * Return payload of msecs attribute
 * @arg nla		msecs netlink attribute
 *
 * @return the number of milliseconds.
 */
static inline unsigned long nla_get_msecs(struct nlattr *nla)
{
	return nla_get_u64(nla);
}

/**
 * Add nested attributes to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg nested		Message containing attributes to be nested.
 *
 * Takes the attributes found in the \a nested message and appends them
 * to the message \a msg nested in a container of the type \a attrtype.
 * The \a nested message may not have a family specific header.
 *
 * @see nla_put
 * @return 0 on success or a negative error code.
 */
static inline int nla_put_nested(struct nl_msg *msg, int attrtype, struct nl_msg *nested)
{
	return nla_put(msg, attrtype, nlmsg_len(nested->nm_nlh),
		       nlmsg_data(nested->nm_nlh));
}

/**
 * Start a new level of nested attributes.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type of container.
 *
 * @return Pointer to container attribute.
 */
static inline struct nlattr *nla_nest_start(struct nl_msg *msg, int attrtype)
{
	struct nlattr *start = (struct nlattr *) nlmsg_tail(msg->nm_nlh);

	if (nla_put(msg, attrtype, 0, NULL) < 0)
		return NULL;

	return start;
}

/**
 * Finalize nesting of attributes.
 * @arg msg		Netlink message.
 * @arg start		Container attribute as returned from nla_nest_start().
 *
 * Corrects the container attribute header to include the appeneded attributes.
 *
 * @return 0
 */
static inline int nla_nest_end(struct nl_msg *msg, struct nlattr *start)
{
	start->nla_len = (unsigned char *) nlmsg_tail(msg->nm_nlh) -
				(unsigned char *) start;
	return 0;
}

/**
 * Create attribute index based on nested attribute
 * @arg tb		Index array to be filled (maxtype+1 elements).
 * @arg maxtype		Maximum attribute type expected and accepted.
 * @arg nla		Nested Attribute.
 * @arg policy		Attribute validation policy.
 *
 * Feeds the stream of attributes nested into the specified attribute
 * to nla_parse().
 *
 * @see nla_parse
 * @return 0 on success or a negative error code.
 */
static inline int nla_parse_nested(struct nlattr *tb[], int maxtype, struct nlattr *nla,
		     struct nla_policy *policy)
{
	return nla_parse(tb, maxtype, (struct nlattr *)nla_data(nla), nla_len(nla), policy);
}

/**
 * Compare attribute payload with memory area.
 * @arg nla		Attribute.
 * @arg data		Memory area to compare to.
 * @arg size		Number of bytes to compare.
 *
 * @see memcmp(3)
 * @return An integer less than, equal to, or greater than zero.
 */
static inline int nla_memcmp(const struct nlattr *nla, const void *data, size_t size)
{
	int d = nla_len(nla) - size;

	if (d == 0)
		d = memcmp(nla_data(nla), data, size);

	return d;
}

/**
 * Compare string attribute payload with string
 * @arg nla		Attribute of type NLA_STRING.
 * @arg str		NUL terminated string.
 *
 * @see strcmp(3)
 * @return An integer less than, equal to, or greater than zero.
 */
static inline int nla_strcmp(const struct nlattr *nla, const char *str)
{
	int len = strlen(str) + 1;
	int d = nla_len(nla) - len;

	if (d == 0)
		d = memcmp(nla_data(nla), str, len);

	return d;
}

/**
 * Copy string attribute payload to a buffer.
 * @arg dst		Pointer to destination buffer.
 * @arg nla		Attribute of type NLA_STRING.
 * @arg dstsize		Size of destination buffer in bytes.
 *
 * Copies at most dstsize - 1 bytes to the destination buffer.
 * The result is always a valid NUL terminated string. Unlike
 * strlcpy the destination buffer is always padded out.
 *
 * @return The length of string attribute without the terminating NUL.
 */
static inline size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
{
	size_t srclen = (size_t)nla_len(nla);
	char *src = (char*)nla_data(nla);

	if (srclen > 0 && src[srclen - 1] == '\0')
		srclen--;

	if (dstsize > 0) {
		size_t len = (srclen >= dstsize) ? dstsize - 1 : srclen;

		memset(dst, 0, dstsize);
		memcpy(dst, src, len);
	}

	return srclen;
}


/**
 * @name Attribute Construction (Exception Based)
 * @{
 */

/**
 * @ingroup attr
 * Add unspecific attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg attrlen		Length of attribute payload.
 * @arg data		Head of attribute payload.
 */
#define NLA_PUT(msg, attrtype, attrlen, data) \
	do { \
		if (nla_put(msg, attrtype, attrlen, data) < 0) \
			goto nla_put_failure; \
	} while(0)

/**
 * @ingroup attr
 * Add atomic type attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg type		Atomic type.
 * @arg attrtype	Attribute type.
 * @arg value		Head of attribute payload.
 */
#define NLA_PUT_TYPE(msg, type, attrtype, value) \
	do { \
		type __tmp = value; \
		NLA_PUT(msg, attrtype, sizeof(type), &__tmp); \
	} while(0)

/**
 * Add 8 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value.
 */
#define NLA_PUT_U8(msg, attrtype, value) \
	NLA_PUT_TYPE(msg, uint8_t, attrtype, value)

/**
 * Add 16 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value.
 */
#define NLA_PUT_U16(msg, attrtype, value) \
	NLA_PUT_TYPE(msg, uint16_t, attrtype, value)

/**
 * Add 32 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value.
 */
#define NLA_PUT_U32(msg, attrtype, value) \
	NLA_PUT_TYPE(msg, uint32_t, attrtype, value)

/**
 * Add 64 bit integer attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		Numeric value.
 */
#define NLA_PUT_U64(msg, attrtype, value) \
	NLA_PUT_TYPE(msg, uint64_t, attrtype, value)

/**
 * Add string attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg value		NUL terminated character string.
 */
#define NLA_PUT_STRING(msg, attrtype, value) \
	NLA_PUT(msg, attrtype, strlen(value) + 1, value)

/**
 * Add flag attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 */
#define NLA_PUT_FLAG(msg, attrtype) \
	NLA_PUT(msg, attrtype, 0, NULL)

/**
 * Add msecs attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg msecs		Numeric value in micro seconds.
 */
#define NLA_PUT_MSECS(msg, attrtype, msecs) \
	NLA_PUT_U64(msg, attrtype, msecs)

/**
 * Add address attribute to netlink message.
 * @arg msg		Netlink message.
 * @arg attrtype	Attribute type.
 * @arg addr		Abstract address object.
 */
#define NLA_PUT_ADDR(msg, attrtype, addr) \
	NLA_PUT(msg, attrtype, nl_addr_get_len(addr), \
		nl_addr_get_binary_addr(addr))

/** @} */

/**
 * @name Iterators
 * @{
 */

/**
 * @ingroup attr
 * Iterate over a stream of attributes
 * @arg pos	loop counter, set to current attribute
 * @arg head	head of attribute stream
 * @arg len	length of attribute stream
 * @arg rem	initialized to len, holds bytes currently remaining in stream
 */
#define nla_for_each_attr(pos, head, len, rem) \
	for (pos = head, rem = len; \
	     nla_ok(pos, rem); \
	     pos = nla_next(pos, &(rem)))

/**
 * @ingroup attr
 * Iterate over a stream of nested attributes
 * @arg pos	loop counter, set to current attribute
 * @arg nla	attribute containing the nested attributes
 * @arg rem	initialized to len, holds bytes currently remaining in stream
 */
#define nla_for_each_nested(pos, nla, rem) \
	for (pos = (struct nlattr *)nla_data(nla), rem = nla_len(nla); \
	     nla_ok(pos, rem); \
	     pos = nla_next(pos, &(rem)))

/** @} */

#ifdef __cplusplus
}
#endif

#endif
generated by cgit v1.2.3 (git 2.25.1) at 2026-02-21 16:12:23 +0000