オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.8.x/ccs-patch/security/ccsecurity/network.c

Diff of /trunk/1.8.x/ccs-patch/security/ccsecurity/network.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

trunk/ccs-patch/fs/tomoyo_network.c revision 111 by kumaneko, Wed Feb 28 11:45:08 2007 UTC trunk/1.5.x/ccs-patch/fs/tomoyo_network.c revision 652 by kumaneko, Mon Nov 5 07:48:31 2007 UTC
# Line 5  Line 5 
5   *   *
6   * Copyright (C) 2005-2007  NTT DATA CORPORATION   * Copyright (C) 2005-2007  NTT DATA CORPORATION
7   *   *
8   * Version: 1.3.2   2007/02/14   * Version: 1.5.2-pre   2007/10/19
9   *   *
10   * This file is applicable to both 2.4.30 and 2.6.11 and later.   * This file is applicable to both 2.4.30 and 2.6.11 and later.
11   * See README.ccs for ChangeLog.   * See README.ccs for ChangeLog.
# Line 20  Line 20 
20    
21  /*************************  VARIABLES  *************************/  /*************************  VARIABLES  *************************/
22    
23  extern struct semaphore domain_acl_lock;  extern struct mutex domain_acl_lock;
24    
25  /*************************  AUDIT FUNCTIONS  *************************/  /*************************  AUDIT FUNCTIONS  *************************/
26    
27  #ifdef CONFIG_TOMOYO_AUDIT  static int AuditNetworkLog(const bool is_ipv6, const char *operation, const u32 *address, const u16 port, const bool is_granted)
 static int AuditNetworkLog(const int is_ipv6, const char *operation, const u32 *address, const u16 port, const int is_granted)  
28  {  {
29          char *buf;          char *buf;
30          int len = 256;          int len = 256;
# Line 41  static int AuditNetworkLog(const int is_ Line 40  static int AuditNetworkLog(const int is_
40          snprintf(buf + strlen(buf), len - strlen(buf) - 1, " %u\n", port);          snprintf(buf + strlen(buf), len - strlen(buf) - 1, " %u\n", port);
41          return WriteAuditLog(buf, is_granted);          return WriteAuditLog(buf, is_granted);
42  }  }
 #else  
 static inline void AuditNetworkLog(const int is_ipv6, const char *operation, const u32 *address, const u16 port, const int is_granted) {}  
 #endif  
43    
44  /*************************  ADDRESS GROUP HANDLER  *************************/  /*************************  ADDRESS GROUP HANDLER  *************************/
45    
46  static ADDRESS_GROUP_ENTRY *group_list = NULL;  static struct address_group_entry *group_list = NULL;
47    
48  static int AddAddressGroupEntry(const char *group_name, const u8 is_ipv6, const u16 *min_address, const u16 *max_address, const int is_delete)  static int AddAddressGroupEntry(const char *group_name, const bool is_ipv6, const u16 *min_address, const u16 *max_address, const bool is_delete)
49  {  {
50          static DECLARE_MUTEX(lock);          static DEFINE_MUTEX(lock);
51          ADDRESS_GROUP_ENTRY *new_group, *group;          struct address_group_entry *new_group, *group;
52          ADDRESS_GROUP_MEMBER *new_member, *member;          struct address_group_member *new_member, *member;
53          const struct path_info *saved_group_name;          const struct path_info *saved_group_name;
54          int error = -ENOMEM;          int error = -ENOMEM;
55          if (!IsCorrectPath(group_name, 0, 0, 0, __FUNCTION__) || !group_name[0]) return -EINVAL;          if (!IsCorrectPath(group_name, 0, 0, 0, __FUNCTION__) || !group_name[0]) return -EINVAL;
56          if ((saved_group_name = SaveName(group_name)) == NULL) return -ENOMEM;          if ((saved_group_name = SaveName(group_name)) == NULL) return -ENOMEM;
57          down(&lock);          mutex_lock(&lock);
58          for (group = group_list; group; group = group->next) {          for (group = group_list; group; group = group->next) {
59                  if (saved_group_name != group->group_name) continue;                  if (saved_group_name != group->group_name) continue;
60                  for (member = group->first_member; member; member = member->next) {                  for (member = group->first_member; member; member = member->next) {
# Line 79  static int AddAddressGroupEntry(const ch Line 75  static int AddAddressGroupEntry(const ch
75                  goto out;                  goto out;
76          }          }
77          if (!group) {          if (!group) {
78                  if ((new_group = (ADDRESS_GROUP_ENTRY *) alloc_element(sizeof(ADDRESS_GROUP_ENTRY))) == NULL) goto out;                  if ((new_group = alloc_element(sizeof(*new_group))) == NULL) goto out;
79                  new_group->group_name = saved_group_name;                  new_group->group_name = saved_group_name;
80                  mb(); /* Instead of using spinlock. */                  mb(); /* Instead of using spinlock. */
81                  if ((group = group_list) != NULL) {                  if ((group = group_list) != NULL) {
# Line 89  static int AddAddressGroupEntry(const ch Line 85  static int AddAddressGroupEntry(const ch
85                  }                  }
86                  group = new_group;                  group = new_group;
87          }          }
88          if ((new_member = (ADDRESS_GROUP_MEMBER *) alloc_element(sizeof(ADDRESS_GROUP_MEMBER))) == NULL) goto out;          if ((new_member = alloc_element(sizeof(*new_member))) == NULL) goto out;
89          new_member->is_ipv6 = is_ipv6;          new_member->is_ipv6 = is_ipv6;
90          if (is_ipv6) {          if (is_ipv6) {
91                  memmove(new_member->min.ipv6, min_address, 16);                  memmove(new_member->min.ipv6, min_address, 16);
# Line 106  static int AddAddressGroupEntry(const ch Line 102  static int AddAddressGroupEntry(const ch
102          }          }
103          error = 0;          error = 0;
104   out:   out:
105          up(&lock);          mutex_unlock(&lock);
106          return error;          return error;
107  }  }
108    
109  int AddAddressGroupPolicy(char *data, const int is_delete)  int AddAddressGroupPolicy(char *data, const bool is_delete)
110  {  {
111          int count, is_ipv6;          int count, is_ipv6;
112          u16 min_address[8], max_address[8];          u16 min_address[8], max_address[8];
# Line 143  int AddAddressGroupPolicy(char *data, co Line 139  int AddAddressGroupPolicy(char *data, co
139          return AddAddressGroupEntry(data, is_ipv6, min_address, max_address, is_delete);          return AddAddressGroupEntry(data, is_ipv6, min_address, max_address, is_delete);
140  }  }
141    
142  static ADDRESS_GROUP_ENTRY *FindOrAssignNewAddressGroup(const char *group_name)  static struct address_group_entry *FindOrAssignNewAddressGroup(const char *group_name)
143  {  {
144          int i;          int i;
145          ADDRESS_GROUP_ENTRY *group;          struct address_group_entry *group;
146          for (i = 0; i <= 1; i++) {          for (i = 0; i <= 1; i++) {
147                  for (group = group_list; group; group = group->next) {                  for (group = group_list; group; group = group->next) {
148                          if (strcmp(group_name, group->group_name->name) == 0) return group;                          if (strcmp(group_name, group->group_name->name) == 0) return group;
# Line 160  static ADDRESS_GROUP_ENTRY *FindOrAssign Line 156  static ADDRESS_GROUP_ENTRY *FindOrAssign
156          return NULL;          return NULL;
157  }  }
158    
159  static int AddressMatchesToGroup(const u8 is_ipv6, const u32 *address, const ADDRESS_GROUP_ENTRY *group)  static int AddressMatchesToGroup(const bool is_ipv6, const u32 *address, const struct address_group_entry *group)
160  {  {
161          ADDRESS_GROUP_MEMBER *member;          struct address_group_member *member;
162          const u32 ip = ntohl(*address);          const u32 ip = ntohl(*address);
163          for (member = group->first_member; member; member = member->next) {          for (member = group->first_member; member; member = member->next) {
164                  if (member->is_deleted) continue;                  if (member->is_deleted) continue;
165                  if (member->is_ipv6) {                  if (member->is_ipv6) {
166                          if (memcmp(member->min.ipv6, address, 16) <= 0 && memcmp(address, member->max.ipv6, 16) <= 0) return 1;                          if (is_ipv6 && memcmp(member->min.ipv6, address, 16) <= 0 && memcmp(address, member->max.ipv6, 16) <= 0) return 1;
167                  } else {                  } else {
168                          if (member->min.ipv4 <= ip && ip <= member->max.ipv4) return 1;                          if (!is_ipv6 && member->min.ipv4 <= ip && ip <= member->max.ipv4) return 1;
169                  }                  }
170          }          }
171          return 0;          return 0;
172  }  }
173    
174  int ReadAddressGroupPolicy(IO_BUFFER *head)  int ReadAddressGroupPolicy(struct io_buffer *head)
175  {  {
176          ADDRESS_GROUP_ENTRY *group = (ADDRESS_GROUP_ENTRY *) head->read_var1;          struct address_group_entry *group = head->read_var1;
177          ADDRESS_GROUP_MEMBER *member = (ADDRESS_GROUP_MEMBER *) head->read_var2;          struct address_group_member *member = head->read_var2;
178          if (!group) group = group_list;          if (!group) group = group_list;
179          while (group) {          while (group) {
180                  head->read_var1 = (struct domain_info *) group;                  head->read_var1 = group;
181                  if (!member) member = group->first_member;                  if (!member) member = group->first_member;
182                  while (member) {                  while (member) {
183                          head->read_var2 = (void *) member;                          head->read_var2 = member;
184                          if (!member->is_deleted) {                          if (!member->is_deleted) {
185                                  char buf[128];                                  char buf[128];
186                                  if (member->is_ipv6) {                                  if (member->is_ipv6) {
# Line 256  const char *network2keyword(const unsign Line 252  const char *network2keyword(const unsign
252          return keyword;          return keyword;
253  }  }
254    
255  static int AddNetworkEntry(const u8 operation, const u8 record_type, const struct address_group_entry *group, const u32 *min_address, const u32 *max_address, const u16 min_port, const u16 max_port, struct domain_info *domain, const u8 is_delete, const struct condition_list *condition)  static int AddNetworkEntry(const u8 operation, const u8 record_type, const struct address_group_entry *group, const u32 *min_address, const u32 *max_address, const u16 min_port, const u16 max_port, struct domain_info *domain, const struct condition_list *condition, const bool is_delete)
256  {  {
257          struct acl_info *ptr;          struct acl_info *ptr;
258          int error = -ENOMEM;          int error = -ENOMEM;
         const u8 type = TYPE_IP_NETWORK_ACL;  
         const u8 hash = operation;  
259          const u32 min_ip = ntohl(*min_address), max_ip = ntohl(*max_address); /* using host byte order to allow u32 comparison than memcmp().*/          const u32 min_ip = ntohl(*min_address), max_ip = ntohl(*max_address); /* using host byte order to allow u32 comparison than memcmp().*/
260          if (!domain) return -EINVAL;          if (!domain) return -EINVAL;
261          down(&domain_acl_lock);          mutex_lock(&domain_acl_lock);
262          if (!is_delete) {          if (!is_delete) {
263                  if ((ptr = domain->first_acl_ptr) == NULL) goto first_entry;                  if ((ptr = domain->first_acl_ptr) == NULL) goto first_entry;
264                  while (1) {                  while (1) {
265                          IP_NETWORK_ACL_RECORD *new_ptr;                          struct ip_network_acl_record *new_ptr = (struct ip_network_acl_record *) ptr;
266                          if (ptr->type == type && ptr->u.b[0] == hash && ptr->cond == condition && ((IP_NETWORK_ACL_RECORD *) ptr)->min_port == min_port && max_port == ((IP_NETWORK_ACL_RECORD *) ptr)->max_port) {                          if (ptr->type == TYPE_IP_NETWORK_ACL && new_ptr->operation_type == operation && new_ptr->record_type == record_type && ptr->cond == condition && new_ptr->min_port == min_port && max_port == new_ptr->max_port) {
267                                  if (record_type == IP_RECORD_TYPE_ADDRESS_GROUP) {                                  if (record_type == IP_RECORD_TYPE_ADDRESS_GROUP) {
268                                          if (((IP_NETWORK_ACL_RECORD *) ptr)->u.group == group) {                                          if (new_ptr->u.group == group) {
269                                                  ptr->is_deleted = 0;                                                  ptr->is_deleted = 0;
270                                                  /* Found. Nothing to do. */                                                  /* Found. Nothing to do. */
271                                                  error = 0;                                                  error = 0;
272                                                  break;                                                  break;
273                                          }                                          }
274                                  } else if (record_type == IP_RECORD_TYPE_IPv4) {                                  } else if (record_type == IP_RECORD_TYPE_IPv4) {
275                                          if (((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv4.min == min_ip && max_ip == ((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv4.max) {                                          if (new_ptr->u.ipv4.min == min_ip && max_ip == new_ptr->u.ipv4.max) {
276                                                  ptr->is_deleted = 0;                                                  ptr->is_deleted = 0;
277                                                  /* Found. Nothing to do. */                                                  /* Found. Nothing to do. */
278                                                  error = 0;                                                  error = 0;
279                                                  break;                                                  break;
280                                          }                                          }
281                                  } else if (record_type == IP_RECORD_TYPE_IPv6) {                                  } else if (record_type == IP_RECORD_TYPE_IPv6) {
282                                          if (memcmp(((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv6.min, min_address, 16) == 0 && memcmp(max_address, ((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv6.max, 16) == 0) {                                          if (memcmp(new_ptr->u.ipv6.min, min_address, 16) == 0 && memcmp(max_address, new_ptr->u.ipv6.max, 16) == 0) {
283                                                  ptr->is_deleted = 0;                                                  ptr->is_deleted = 0;
284                                                  /* Found. Nothing to do. */                                                  /* Found. Nothing to do. */
285                                                  error = 0;                                                  error = 0;
# Line 299  static int AddNetworkEntry(const u8 oper Line 293  static int AddNetworkEntry(const u8 oper
293                          }                          }
294                  first_entry: ;                  first_entry: ;
295                          /* Not found. Append it to the tail. */                          /* Not found. Append it to the tail. */
296                          if ((new_ptr = (IP_NETWORK_ACL_RECORD *) alloc_element(sizeof(IP_NETWORK_ACL_RECORD))) == NULL) break;                          if ((new_ptr = alloc_element(sizeof(*new_ptr))) == NULL) break;
297                          new_ptr->head.type = type;                          new_ptr->head.type = TYPE_IP_NETWORK_ACL;
298                          new_ptr->head.u.b[0] = hash;                          new_ptr->operation_type = operation;
299                          new_ptr->head.u.b[1] = record_type;                          new_ptr->record_type = record_type;
300                          new_ptr->head.cond = condition;                          new_ptr->head.cond = condition;
301                          if (record_type == IP_RECORD_TYPE_ADDRESS_GROUP) {                          if (record_type == IP_RECORD_TYPE_ADDRESS_GROUP) {
302                                  new_ptr->u.group = group;                                  new_ptr->u.group = group;
303                          } else if (record_type == IP_RECORD_TYPE_IPv4) {                          } else if (record_type == IP_RECORD_TYPE_IPv4) {
304                                  new_ptr->u.ipv4.min = min_ip;                                  new_ptr->u.ipv4.min = min_ip;
305                                  new_ptr->u.ipv4.max = max_ip;                                  new_ptr->u.ipv4.max = max_ip;
306                          } else if (record_type == IP_RECORD_TYPE_IPv6) {                          } else {
307                                  memmove(new_ptr->u.ipv6.min, min_address, 16);                                  memmove(new_ptr->u.ipv6.min, min_address, 16);
308                                  memmove(new_ptr->u.ipv6.max, max_address, 16);                                  memmove(new_ptr->u.ipv6.max, max_address, 16);
309                          }                          }
# Line 321  static int AddNetworkEntry(const u8 oper Line 315  static int AddNetworkEntry(const u8 oper
315          } else {          } else {
316                  error = -ENOENT;                  error = -ENOENT;
317                  for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {                  for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {
318                          if (ptr->type != type || ptr->is_deleted || ptr->u.b[0] != hash || ptr->u.b[1] != record_type || ptr->cond != condition || ((IP_NETWORK_ACL_RECORD *) ptr)->min_port != min_port || ((IP_NETWORK_ACL_RECORD *) ptr)->max_port != max_port) continue;                          struct ip_network_acl_record *ptr2 = (struct ip_network_acl_record *) ptr;
319                            if (ptr->type != TYPE_IP_NETWORK_ACL || ptr->is_deleted || ptr2->operation_type != operation || ptr2->record_type != record_type || ptr->cond != condition || ptr2->min_port != min_port || ptr2->max_port != max_port) continue;
320                          if (record_type == IP_RECORD_TYPE_ADDRESS_GROUP) {                          if (record_type == IP_RECORD_TYPE_ADDRESS_GROUP) {
321                                  if (((IP_NETWORK_ACL_RECORD *) ptr)->u.group != group) continue;                                  if (ptr2->u.group != group) continue;
322                          } else if (record_type == IP_RECORD_TYPE_IPv4) {                          } else if (record_type == IP_RECORD_TYPE_IPv4) {
323                                  if (((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv4.min != min_ip || max_ip != ((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv4.max) continue;                                  if (ptr2->u.ipv4.min != min_ip || max_ip != ptr2->u.ipv4.max) continue;
324                          } else if (record_type == IP_RECORD_TYPE_IPv6) {                          } else if (record_type == IP_RECORD_TYPE_IPv6) {
325                                  if (memcmp(((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv6.min, min_address, 16) || memcmp(max_address, ((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv6.max, 16)) continue;                                  if (memcmp(ptr2->u.ipv6.min, min_address, 16) || memcmp(max_address, ptr2->u.ipv6.max, 16)) continue;
326                          }                          }
327                          error = DelDomainACL(ptr);                          error = DelDomainACL(ptr);
328                          break;                          break;
329                  }                  }
330          }          }
331          up(&domain_acl_lock);          mutex_unlock(&domain_acl_lock);
332          return error;          return error;
333  }  }
334    
335  static int CheckNetworkEntry(const int is_ipv6, const int operation, const u32 *address, const u16 port)  static int CheckNetworkEntry(const bool is_ipv6, const int operation, const u32 *address, const u16 port)
336  {  {
337          struct domain_info * const domain = current->domain_info;          struct domain_info * const domain = current->domain_info;
338          struct acl_info *ptr;          struct acl_info *ptr;
339          const char *keyword = network2keyword(operation);          const char *keyword = network2keyword(operation);
340          const u8 type = TYPE_IP_NETWORK_ACL;          const bool is_enforce = CheckCCSEnforce(CCS_TOMOYO_MAC_FOR_NETWORK);
         const u8 hash = operation;  
         const int is_enforce = CheckCCSEnforce(CCS_TOMOYO_MAC_FOR_NETWORK);  
341          const u32 ip = ntohl(*address); /* using host byte order to allow u32 comparison than memcmp().*/          const u32 ip = ntohl(*address); /* using host byte order to allow u32 comparison than memcmp().*/
342          if (!CheckCCSFlags(CCS_TOMOYO_MAC_FOR_NETWORK)) return 0;          if (!CheckCCSFlags(CCS_TOMOYO_MAC_FOR_NETWORK)) return 0;
343          for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {          for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {
344                  if (ptr->type != type || ptr->is_deleted || ptr->u.b[0] != hash || port < ((IP_NETWORK_ACL_RECORD *) ptr)->min_port || ((IP_NETWORK_ACL_RECORD *) ptr)->max_port < port || CheckCondition(ptr->cond, NULL)) continue;                  struct ip_network_acl_record *ptr2 = (struct ip_network_acl_record *) ptr;
345                  if (ptr->u.b[1] == IP_RECORD_TYPE_ADDRESS_GROUP) {                  if (ptr->type != TYPE_IP_NETWORK_ACL || ptr->is_deleted || ptr2->operation_type != operation || port < ptr2->min_port || ptr2->max_port < port || CheckCondition(ptr->cond, NULL)) continue;
346                          if (AddressMatchesToGroup(is_ipv6, address, ((IP_NETWORK_ACL_RECORD *) ptr)->u.group)) break;                  if (ptr2->record_type == IP_RECORD_TYPE_ADDRESS_GROUP) {
347                  } else if (ptr->u.b[1] == IP_RECORD_TYPE_IPv4) {                          if (AddressMatchesToGroup(is_ipv6, address, ptr2->u.group)) break;
348                          if (!is_ipv6 && ((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv4.min <= ip && ip <= ((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv4.max) break;                  } else if (ptr2->record_type == IP_RECORD_TYPE_IPv4) {
349                            if (!is_ipv6 && ptr2->u.ipv4.min <= ip && ip <= ptr2->u.ipv4.max) break;
350                  } else {                  } else {
351                          if (is_ipv6 && memcmp(((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv6.min, address, 16) <= 0 && memcmp(address, ((IP_NETWORK_ACL_RECORD *) ptr)->u.ipv6.max, 16) <= 0) break;                          if (is_ipv6 && memcmp(ptr2->u.ipv6.min, address, 16) <= 0 && memcmp(address, ptr2->u.ipv6.max, 16) <= 0) break;
352                  }                  }
353          }          }
354          if (ptr) {          if (ptr) {
# Line 379  static int CheckNetworkEntry(const int i Line 373  static int CheckNetworkEntry(const int i
373                  }                  }
374                  return CheckSupervisor("%s\n" KEYWORD_ALLOW_NETWORK "%s %u.%u.%u.%u %u\n", domain->domainname->name, keyword, HIPQUAD(ip), port);                  return CheckSupervisor("%s\n" KEYWORD_ALLOW_NETWORK "%s %u.%u.%u.%u %u\n", domain->domainname->name, keyword, HIPQUAD(ip), port);
375          }          }
376          if (CheckCCSAccept(CCS_TOMOYO_MAC_FOR_NETWORK)) AddNetworkEntry(operation, is_ipv6 ? IP_RECORD_TYPE_IPv6: IP_RECORD_TYPE_IPv4, NULL, address, address, port, port, domain, 0, NULL);          if (CheckCCSAccept(CCS_TOMOYO_MAC_FOR_NETWORK, domain)) AddNetworkEntry(operation, is_ipv6 ? IP_RECORD_TYPE_IPv6 : IP_RECORD_TYPE_IPv4, NULL, address, address, port, port, domain, NULL, 0);
377          return 0;          return 0;
378  }  }
379    
380  int AddNetworkPolicy(char *data, struct domain_info *domain, const int is_delete)  int AddNetworkPolicy(char *data, struct domain_info *domain, const struct condition_list *condition, const bool is_delete)
381  {  {
382          u8 sock_type, operation, record_type;          u8 sock_type, operation, record_type;
383          u16 min_address[8], max_address[8];          u16 min_address[8], max_address[8];
# Line 391  int AddNetworkPolicy(char *data, struct Line 385  int AddNetworkPolicy(char *data, struct
385          u16 min_port, max_port;          u16 min_port, max_port;
386          int count;          int count;
387          char *cp1 = NULL, *cp2 = NULL;          char *cp1 = NULL, *cp2 = NULL;
         const struct condition_list *condition = NULL;  
         cp1 = FindConditionPart(data);  
         if (cp1 && (condition = FindOrAssignNewCondition(cp1)) == NULL) goto out;  
388          if ((cp1 = strchr(data, ' ')) == NULL) goto out; cp1++;          if ((cp1 = strchr(data, ' ')) == NULL) goto out; cp1++;
389          if (strncmp(data, "TCP ", 4) == 0) sock_type = SOCK_STREAM;          if (strncmp(data, "TCP ", 4) == 0) sock_type = SOCK_STREAM;
390          else if (strncmp(data, "UDP ", 4) == 0) sock_type = SOCK_DGRAM;          else if (strncmp(data, "UDP ", 4) == 0) sock_type = SOCK_DGRAM;
# Line 441  int AddNetworkPolicy(char *data, struct Line 432  int AddNetworkPolicy(char *data, struct
432          if (strchr(cp1, ' ')) goto out;          if (strchr(cp1, ' ')) goto out;
433          if ((count = sscanf(cp1, "%hu-%hu", &min_port, &max_port)) == 1 || count == 2) {          if ((count = sscanf(cp1, "%hu-%hu", &min_port, &max_port)) == 1 || count == 2) {
434                  if (count == 1) max_port = min_port;                  if (count == 1) max_port = min_port;
435                  return AddNetworkEntry(operation, record_type, group, (u32 *) min_address, (u32 *) max_address, min_port, max_port, domain, is_delete, condition);                  return AddNetworkEntry(operation, record_type, group, (u32 *) min_address, (u32 *) max_address, min_port, max_port, domain, condition, is_delete);
436          }          }
437   out: ;   out: ;
438          return -EINVAL;          return -EINVAL;
439  }  }
440    
441  int CheckNetworkListenACL(const int is_ipv6, const u8 *address, const u16 port)  int CheckNetworkListenACL(const _Bool is_ipv6, const u8 *address, const u16 port)
442  {  {
443          return CheckNetworkEntry(is_ipv6, NETWORK_ACL_TCP_LISTEN, (const u32 *) address, ntohs(port));          return CheckNetworkEntry(is_ipv6, NETWORK_ACL_TCP_LISTEN, (const u32 *) address, ntohs(port));
444  }  }
445    EXPORT_SYMBOL(CheckNetworkListenACL);
446    
447  int CheckNetworkConnectACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port)  int CheckNetworkConnectACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port)
448  {  {
449          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_STREAM ? NETWORK_ACL_TCP_CONNECT : (sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_CONNECT : NETWORK_ACL_RAW_CONNECT), (const u32 *) address, ntohs(port));          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_STREAM ? NETWORK_ACL_TCP_CONNECT : (sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_CONNECT : NETWORK_ACL_RAW_CONNECT), (const u32 *) address, ntohs(port));
450  }  }
451    EXPORT_SYMBOL(CheckNetworkConnectACL);
452    
453  int CheckNetworkBindACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port)  int CheckNetworkBindACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port)
454  {  {
455          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_STREAM ? NETWORK_ACL_TCP_BIND : (sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_BIND : NETWORK_ACL_RAW_BIND), (const u32 *) address, ntohs(port));          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_STREAM ? NETWORK_ACL_TCP_BIND : (sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_BIND : NETWORK_ACL_RAW_BIND), (const u32 *) address, ntohs(port));
456  }  }
457    EXPORT_SYMBOL(CheckNetworkBindACL);
458    
459  int CheckNetworkAcceptACL(const int is_ipv6, const u8 *address, const u16 port)  int CheckNetworkAcceptACL(const _Bool is_ipv6, const u8 *address, const u16 port)
460  {  {
461          return CheckNetworkEntry(is_ipv6, NETWORK_ACL_TCP_ACCEPT, (const u32 *) address, ntohs(port));          return CheckNetworkEntry(is_ipv6, NETWORK_ACL_TCP_ACCEPT, (const u32 *) address, ntohs(port));
462  }  }
463    EXPORT_SYMBOL(CheckNetworkAcceptACL);
464    
465  int CheckNetworkSendMsgACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port)  int CheckNetworkSendMsgACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port)
466  {  {
467          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_CONNECT : NETWORK_ACL_RAW_CONNECT, (const u32 *) address, ntohs(port));          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_CONNECT : NETWORK_ACL_RAW_CONNECT, (const u32 *) address, ntohs(port));
468  }  }
469    EXPORT_SYMBOL(CheckNetworkSendMsgACL);
470    
471  int CheckNetworkRecvMsgACL(const int is_ipv6, const int sock_type, const u8 *address, const u16 port)  int CheckNetworkRecvMsgACL(const _Bool is_ipv6, const int sock_type, const u8 *address, const u16 port)
472  {  {
473          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_CONNECT : NETWORK_ACL_RAW_CONNECT, (const u32 *) address, ntohs(port));          return CheckNetworkEntry(is_ipv6, sock_type == SOCK_DGRAM ? NETWORK_ACL_UDP_CONNECT : NETWORK_ACL_RAW_CONNECT, (const u32 *) address, ntohs(port));
474  }  }
   
 EXPORT_SYMBOL(CheckNetworkListenACL);  
 EXPORT_SYMBOL(CheckNetworkConnectACL);  
 EXPORT_SYMBOL(CheckNetworkBindACL);  
 EXPORT_SYMBOL(CheckNetworkAcceptACL);  
 EXPORT_SYMBOL(CheckNetworkSendMsgACL);  
475  EXPORT_SYMBOL(CheckNetworkRecvMsgACL);  EXPORT_SYMBOL(CheckNetworkRecvMsgACL);
476    
477  /***** TOMOYO Linux end. *****/  /***** TOMOYO Linux end. *****/
Legend:
Removed from v.111  
changed lines
  Added in v.652
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ