You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
235 lines
8.0 KiB
235 lines
8.0 KiB
From 78260f2d8fdeb05a9d53727ea64bf5b2d08d3349 Mon Sep 17 00:00:00 2001 |
|
From: Vit Mojzis <vmojzis@redhat.com> |
|
Date: Fri, 20 Jul 2018 17:33:22 +0200 |
|
Subject: [PATCH] Add support for DCCP and SCTP protocols |
|
|
|
Resolves: rhbz#1607273 |
|
--- |
|
libapol/include/apol/util.h | 12 ++++++------ |
|
libapol/src/util.c | 17 +++++++++++++++++ |
|
libapol/swig/apol.i | 3 +++ |
|
libqpol/include/qpol/portcon_query.h | 13 +++++++++++-- |
|
libqpol/src/policy_define.c | 10 ++++++++++ |
|
libqpol/src/policy_parse.y | 7 +++++++ |
|
libqpol/swig/qpol.i | 3 +++ |
|
python/setools/seinfo.c | 4 +++- |
|
secmds/seinfo.c | 4 ++++ |
|
9 files changed, 64 insertions(+), 9 deletions(-) |
|
|
|
diff --git a/libapol/include/apol/util.h b/libapol/include/apol/util.h |
|
index 99db1685..3e370332 100644 |
|
--- a/libapol/include/apol/util.h |
|
+++ b/libapol/include/apol/util.h |
|
@@ -48,8 +48,8 @@ extern "C" |
|
* Given a portcon protocol, return a read-only string that describes |
|
* that protocol. |
|
* |
|
- * @param protocol Portcon protocol, one of IPPROTO_TCP or IPPROTO_UDP |
|
- * from netinet/in.h. |
|
+ * @param protocol Portcon protocol, one of IPPROTO_TCP, IPPROTO_UDP, |
|
+ * IPPROTO_DCCP or IPPROTO_SCTP from netinet/in.h. |
|
* |
|
* @return A string that describes the protocol, or NULL if the |
|
* protocol is invalid. <b>Do not free() this string.</b> |
|
@@ -59,10 +59,10 @@ extern "C" |
|
/** |
|
* Given the name of a portcon protocol, return its numeric value. |
|
* |
|
- * @param protocol_str Portcon protocol, one of "tcp", "TCP", "udp", or "UDP". |
|
- * |
|
- * @return Numeric value for the protocol, one of IPPROTO_TCP or IPPROTO_UDP |
|
- * from netinet/in.h. Upon error return 0. |
|
+ * @param protocol_str Portcon protocol, one of "tcp", "TCP", "udp", "UDP", |
|
+ * "dccp", "DCCP", "sctp" or "SCTP". |
|
+ * @return Numeric value for the protocol, one of IPPROTO_TCP, IPPROTO_UDP, |
|
+ * IPPROTO_DCCP or IPPROTO_SCTP from netinet/in.h. Upon error return 0. |
|
*/ |
|
extern uint8_t apol_str_to_protocol(const char *protocol_str); |
|
|
|
diff --git a/libapol/src/util.c b/libapol/src/util.c |
|
index dd6d300d..fc38d9d5 100644 |
|
--- a/libapol/src/util.c |
|
+++ b/libapol/src/util.c |
|
@@ -42,6 +42,13 @@ |
|
#include <arpa/inet.h> |
|
#include <netinet/in.h> /* needed for portcon's protocol */ |
|
|
|
+#ifndef IPPROTO_DCCP |
|
+#define IPPROTO_DCCP 33 |
|
+#endif |
|
+#ifndef IPPROTO_SCTP |
|
+#define IPPROTO_SCTP 132 |
|
+#endif |
|
+ |
|
/* use 8k line size */ |
|
#define APOL_LINE_SZ 8192 |
|
#define APOL_ENVIRON_VAR_NAME "APOL_INSTALL_DIR" |
|
@@ -173,6 +180,10 @@ const char *apol_protocol_to_str(uint8_t protocol) |
|
return "tcp"; |
|
case IPPROTO_UDP: |
|
return "udp"; |
|
+ case IPPROTO_DCCP: |
|
+ return "dccp"; |
|
+ case IPPROTO_SCTP: |
|
+ return "sctp"; |
|
default: |
|
errno = EPROTONOSUPPORT; |
|
return NULL; |
|
@@ -191,6 +202,12 @@ uint8_t apol_str_to_protocol(const char *protocol_str) |
|
if (strcmp(protocol_str, "udp") == 0 || strcmp(protocol_str, "UDP") == 0) { |
|
return IPPROTO_UDP; |
|
} |
|
+ if (strcmp(protocol_str, "dccp") == 0 || strcmp(protocol_str, "DCCP") == 0) { |
|
+ return IPPROTO_DCCP; |
|
+ } |
|
+ if (strcmp(protocol_str, "sctp") == 0 || strcmp(protocol_str, "SCTP") == 0) { |
|
+ return IPPROTO_SCTP; |
|
+ } |
|
errno = EPROTONOSUPPORT; |
|
return 0; |
|
} |
|
diff --git a/libapol/swig/apol.i b/libapol/swig/apol.i |
|
index 8a4a195f..6a650315 100644 |
|
--- a/libapol/swig/apol.i |
|
+++ b/libapol/swig/apol.i |
|
@@ -227,6 +227,9 @@ const char *libapol_get_version(void); |
|
/* defines from netinet/in.h for ip protocols */ |
|
#define IPPROTO_TCP 6 |
|
#define IPPROTO_UDP 17 |
|
+#define IPPROTO_DCCP 33 |
|
+#define IPPROTO_SCTP 132 |
|
+ |
|
const char *apol_protocol_to_str(uint8_t protocol); |
|
uint8_t apol_str_to_protocol(const char *protocol_str); |
|
%newobject wrap_apol_str_to_internal_ip(char*); |
|
diff --git a/libqpol/include/qpol/portcon_query.h b/libqpol/include/qpol/portcon_query.h |
|
index 63210feb..72e8ce9e 100644 |
|
--- a/libqpol/include/qpol/portcon_query.h |
|
+++ b/libqpol/include/qpol/portcon_query.h |
|
@@ -37,6 +37,13 @@ extern "C" |
|
#include <qpol/iterator.h> |
|
#include <qpol/policy.h> |
|
|
|
+#ifndef IPPROTO_DCCP |
|
+#define IPPROTO_DCCP 33 |
|
+#endif |
|
+#ifndef IPPROTO_SCTP |
|
+#define IPPROTO_SCTP 132 |
|
+#endif |
|
+ |
|
typedef struct qpol_portcon qpol_portcon_t; |
|
|
|
/** |
|
@@ -46,7 +53,8 @@ extern "C" |
|
* @param high The high port of the range of ports; if searching for a |
|
* single port, set high equal to low. |
|
* @param protocol The protocol used in the portcon statement. |
|
- * Value should be one of IPPROTO_TCP or IPPROTO_UDP from netinet/in.h |
|
+ * Value should be one of IPPROTO_TCP, IPPROTO_UDP, IPPROTO_DCCP or |
|
+ * IPPROTO_SCTP from netinet/in.h |
|
* @param ocon Pointer in which to store the statement returned. |
|
* The caller should not free this pointer. |
|
* @return 0 on success and < 0 on failure; if the call fails, |
|
@@ -73,7 +81,8 @@ extern "C" |
|
* @param policy The policy associated with the portcon statement. |
|
* @param ocon The portcon statement from which to get the protocol. |
|
* @param protocol Pointer to set to the value of protocol. |
|
- * Value will be one of IPPROTO_TCP or IPPROTO_UDP from netinet/in.h |
|
+ * Value will be one of IPPROTO_TCP, IPPROTO_UDP, IPPROTO_DCCP or |
|
+ * IPPROTO_SCTP from netinet/in.h |
|
* @return 0 on success and < 0 on failure; if the call fails, |
|
* errno will be set and *protocol will be 0; |
|
*/ |
|
diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c |
|
index 15f70ba3..2c5d488b 100644 |
|
--- a/libqpol/src/policy_define.c |
|
+++ b/libqpol/src/policy_define.c |
|
@@ -63,6 +63,12 @@ |
|
#ifdef HAVE_SEPOL_ERRCODES |
|
#include <sepol/errcodes.h> |
|
#endif |
|
+#ifndef IPPROTO_DCCP |
|
+#define IPPROTO_DCCP 33 |
|
+#endif |
|
+#ifndef IPPROTO_SCTP |
|
+#define IPPROTO_SCTP 132 |
|
+#endif |
|
|
|
#include "queue.h" |
|
/* Required for SETools libqpol - Removed #include "checkpolicy.h"*/ |
|
@@ -4350,6 +4356,10 @@ int define_port_context(unsigned int low, unsigned int high) |
|
protocol = IPPROTO_TCP; |
|
} else if ((strcmp(id, "udp") == 0) || (strcmp(id, "UDP") == 0)) { |
|
protocol = IPPROTO_UDP; |
|
+ } else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) { |
|
+ protocol = IPPROTO_DCCP; |
|
+ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) { |
|
+ protocol = IPPROTO_SCTP; |
|
} else { |
|
yyerror2("unrecognized protocol %s", id); |
|
free(newc); |
|
diff --git a/libqpol/src/policy_parse.y b/libqpol/src/policy_parse.y |
|
index 357f3d8f..e07ff52c 100644 |
|
--- a/libqpol/src/policy_parse.y |
|
+++ b/libqpol/src/policy_parse.y |
|
@@ -52,6 +52,13 @@ |
|
#include <arpa/inet.h> |
|
#include <stdlib.h> |
|
|
|
+#ifndef IPPROTO_DCCP |
|
+#define IPPROTO_DCCP 33 |
|
+#endif |
|
+#ifndef IPPROTO_SCTP |
|
+#define IPPROTO_SCTP 132 |
|
+#endif |
|
+ |
|
#include <sepol/policydb/expand.h> |
|
#include <sepol/policydb/policydb.h> |
|
#include <sepol/policydb/services.h> |
|
diff --git a/libqpol/swig/qpol.i b/libqpol/swig/qpol.i |
|
index b604488a..9fbb8286 100644 |
|
--- a/libqpol/swig/qpol.i |
|
+++ b/libqpol/swig/qpol.i |
|
@@ -2005,6 +2005,9 @@ typedef struct qpol_nodecon {} qpol_nodecon_t; |
|
/* from netinet/in.h */ |
|
#define IPPROTO_TCP 6 |
|
#define IPPROTO_UDP 17 |
|
+#define IPPROTO_DCCP 33 |
|
+#define IPPROTO_SCTP 132 |
|
+ |
|
typedef struct qpol_portcon {} qpol_portcon_t; |
|
%extend qpol_portcon_t { |
|
qpol_portcon(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) { |
|
diff --git a/python/setools/seinfo.c b/python/setools/seinfo.c |
|
index 211930a3..7c22f9e7 100644 |
|
--- a/python/setools/seinfo.c |
|
+++ b/python/setools/seinfo.c |
|
@@ -512,7 +512,9 @@ static PyObject* get_ports(const char *num, const apol_policy_t * policydb) |
|
} |
|
|
|
if ((ocon_proto != IPPROTO_TCP) && |
|
- (ocon_proto != IPPROTO_UDP)) |
|
+ (ocon_proto != IPPROTO_UDP) && |
|
+ (ocon_proto != IPPROTO_DCCP) && |
|
+ (ocon_proto != IPPROTO_SCTP)) |
|
goto cleanup; |
|
|
|
if (qpol_portcon_get_context(q, portcon, &ctxt)) { |
|
diff --git a/secmds/seinfo.c b/secmds/seinfo.c |
|
index a9708907..3c71af57 100644 |
|
--- a/secmds/seinfo.c |
|
+++ b/secmds/seinfo.c |
|
@@ -1155,6 +1155,10 @@ static int print_portcon(FILE * fp, const char *num, const char *protocol, const |
|
proto = IPPROTO_TCP; |
|
else if (!strcmp(protocol, "udp")) |
|
proto = IPPROTO_UDP; |
|
+ else if (!strcmp(protocol, "dccp")) |
|
+ proto = IPPROTO_DCCP; |
|
+ else if (!strcmp(protocol, "sctp")) |
|
+ proto = IPPROTO_SCTP; |
|
else { |
|
ERR(policydb, "Unable to get portcon by protocol: bad protocol %s.", protocol); |
|
goto cleanup; |
|
-- |
|
2.14.3 |
|
|
|
|