From 78260f2d8fdeb05a9d53727ea64bf5b2d08d3349 Mon Sep 17 00:00:00 2001
From: Vit Mojzis <vmojzis@redhat.com>
Date: Fri, 20 Jul 2018 17:33:22 +0200
Subject: [PATCH] Add support for DCCP and SCTP protocols
Resolves: rhbz#1607273
---
libapol/include/apol/util.h | 12 ++++++------
libapol/src/util.c | 17 +++++++++++++++++
libapol/swig/apol.i | 3 +++
libqpol/include/qpol/portcon_query.h | 13 +++++++++++--
libqpol/src/policy_define.c | 10 ++++++++++
libqpol/src/policy_parse.y | 7 +++++++
libqpol/swig/qpol.i | 3 +++
python/setools/seinfo.c | 4 +++-
secmds/seinfo.c | 4 ++++
9 files changed, 64 insertions(+), 9 deletions(-)
diff --git a/libapol/include/apol/util.h b/libapol/include/apol/util.h
index 99db1685..3e370332 100644
--- a/libapol/include/apol/util.h
+++ b/libapol/include/apol/util.h
@@ -48,8 +48,8 @@ extern "C"
* Given a portcon protocol, return a read-only string that describes
* that protocol.
*
- * @param protocol Portcon protocol, one of IPPROTO_TCP or IPPROTO_UDP
- * from netinet/in.h.
+ * @param protocol Portcon protocol, one of IPPROTO_TCP, IPPROTO_UDP,
+ * IPPROTO_DCCP or IPPROTO_SCTP from netinet/in.h.
*
* @return A string that describes the protocol, or NULL if the
* protocol is invalid. <b>Do not free() this string.</b>
@@ -59,10 +59,10 @@ extern "C"
/**
* Given the name of a portcon protocol, return its numeric value.
*
- * @param protocol_str Portcon protocol, one of "tcp", "TCP", "udp", or "UDP".
- *
- * @return Numeric value for the protocol, one of IPPROTO_TCP or IPPROTO_UDP
- * from netinet/in.h. Upon error return 0.
+ * @param protocol_str Portcon protocol, one of "tcp", "TCP", "udp", "UDP",
+ * "dccp", "DCCP", "sctp" or "SCTP".
+ * @return Numeric value for the protocol, one of IPPROTO_TCP, IPPROTO_UDP,
+ * IPPROTO_DCCP or IPPROTO_SCTP from netinet/in.h. Upon error return 0.
*/
extern uint8_t apol_str_to_protocol(const char *protocol_str);
diff --git a/libapol/src/util.c b/libapol/src/util.c
index dd6d300d..fc38d9d5 100644
--- a/libapol/src/util.c
+++ b/libapol/src/util.c
@@ -42,6 +42,13 @@
#include <arpa/inet.h>
#include <netinet/in.h> /* needed for portcon's protocol */
+#ifndef IPPROTO_DCCP
+#define IPPROTO_DCCP 33
+#endif
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
+
/* use 8k line size */
#define APOL_LINE_SZ 8192
#define APOL_ENVIRON_VAR_NAME "APOL_INSTALL_DIR"
@@ -173,6 +180,10 @@ const char *apol_protocol_to_str(uint8_t protocol)
return "tcp";
case IPPROTO_UDP:
return "udp";
+ case IPPROTO_DCCP:
+ return "dccp";
+ case IPPROTO_SCTP:
+ return "sctp";
default:
errno = EPROTONOSUPPORT;
return NULL;
@@ -191,6 +202,12 @@ uint8_t apol_str_to_protocol(const char *protocol_str)
if (strcmp(protocol_str, "udp") == 0 || strcmp(protocol_str, "UDP") == 0) {
return IPPROTO_UDP;
}
+ if (strcmp(protocol_str, "dccp") == 0 || strcmp(protocol_str, "DCCP") == 0) {
+ return IPPROTO_DCCP;
+ }
+ if (strcmp(protocol_str, "sctp") == 0 || strcmp(protocol_str, "SCTP") == 0) {
+ return IPPROTO_SCTP;
+ }
errno = EPROTONOSUPPORT;
return 0;
}
diff --git a/libapol/swig/apol.i b/libapol/swig/apol.i
index 8a4a195f..6a650315 100644
--- a/libapol/swig/apol.i
+++ b/libapol/swig/apol.i
@@ -227,6 +227,9 @@ const char *libapol_get_version(void);
/* defines from netinet/in.h for ip protocols */
#define IPPROTO_TCP 6
#define IPPROTO_UDP 17
+#define IPPROTO_DCCP 33
+#define IPPROTO_SCTP 132
+
const char *apol_protocol_to_str(uint8_t protocol);
uint8_t apol_str_to_protocol(const char *protocol_str);
%newobject wrap_apol_str_to_internal_ip(char*);
diff --git a/libqpol/include/qpol/portcon_query.h b/libqpol/include/qpol/portcon_query.h
index 63210feb..72e8ce9e 100644
--- a/libqpol/include/qpol/portcon_query.h
+++ b/libqpol/include/qpol/portcon_query.h
@@ -37,6 +37,13 @@ extern "C"
#include <qpol/iterator.h>
#include <qpol/policy.h>
+#ifndef IPPROTO_DCCP
+#define IPPROTO_DCCP 33
+#endif
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
+
typedef struct qpol_portcon qpol_portcon_t;
/**
@@ -46,7 +53,8 @@ extern "C"
* @param high The high port of the range of ports; if searching for a
* single port, set high equal to low.
* @param protocol The protocol used in the portcon statement.
- * Value should be one of IPPROTO_TCP or IPPROTO_UDP from netinet/in.h
+ * Value should be one of IPPROTO_TCP, IPPROTO_UDP, IPPROTO_DCCP or
+ * IPPROTO_SCTP from netinet/in.h
* @param ocon Pointer in which to store the statement returned.
* The caller should not free this pointer.
* @return 0 on success and < 0 on failure; if the call fails,
@@ -73,7 +81,8 @@ extern "C"
* @param policy The policy associated with the portcon statement.
* @param ocon The portcon statement from which to get the protocol.
* @param protocol Pointer to set to the value of protocol.
- * Value will be one of IPPROTO_TCP or IPPROTO_UDP from netinet/in.h
+ * Value will be one of IPPROTO_TCP, IPPROTO_UDP, IPPROTO_DCCP or
+ * IPPROTO_SCTP from netinet/in.h
* @return 0 on success and < 0 on failure; if the call fails,
* errno will be set and *protocol will be 0;
*/
diff --git a/libqpol/src/policy_define.c b/libqpol/src/policy_define.c
index 15f70ba3..2c5d488b 100644
--- a/libqpol/src/policy_define.c
+++ b/libqpol/src/policy_define.c
@@ -63,6 +63,12 @@
#ifdef HAVE_SEPOL_ERRCODES
#include <sepol/errcodes.h>
#endif
+#ifndef IPPROTO_DCCP
+#define IPPROTO_DCCP 33
+#endif
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
#include "queue.h"
/* Required for SETools libqpol - Removed #include "checkpolicy.h"*/
@@ -4350,6 +4356,10 @@ int define_port_context(unsigned int low, unsigned int high)
protocol = IPPROTO_TCP;
} else if ((strcmp(id, "udp") == 0) || (strcmp(id, "UDP") == 0)) {
protocol = IPPROTO_UDP;
+ } else if ((strcmp(id, "dccp") == 0) || (strcmp(id, "DCCP") == 0)) {
+ protocol = IPPROTO_DCCP;
+ } else if ((strcmp(id, "sctp") == 0) || (strcmp(id, "SCTP") == 0)) {
+ protocol = IPPROTO_SCTP;
} else {
yyerror2("unrecognized protocol %s", id);
free(newc);
diff --git a/libqpol/src/policy_parse.y b/libqpol/src/policy_parse.y
index 357f3d8f..e07ff52c 100644
--- a/libqpol/src/policy_parse.y
+++ b/libqpol/src/policy_parse.y
@@ -52,6 +52,13 @@
#include <arpa/inet.h>
#include <stdlib.h>
+#ifndef IPPROTO_DCCP
+#define IPPROTO_DCCP 33
+#endif
+#ifndef IPPROTO_SCTP
+#define IPPROTO_SCTP 132
+#endif
+
#include <sepol/policydb/expand.h>
#include <sepol/policydb/policydb.h>
#include <sepol/policydb/services.h>
diff --git a/libqpol/swig/qpol.i b/libqpol/swig/qpol.i
index b604488a..9fbb8286 100644
--- a/libqpol/swig/qpol.i
+++ b/libqpol/swig/qpol.i
@@ -2005,6 +2005,9 @@ typedef struct qpol_nodecon {} qpol_nodecon_t;
/* from netinet/in.h */
#define IPPROTO_TCP 6
#define IPPROTO_UDP 17
+#define IPPROTO_DCCP 33
+#define IPPROTO_SCTP 132
+
typedef struct qpol_portcon {} qpol_portcon_t;
%extend qpol_portcon_t {
qpol_portcon(qpol_policy_t *p, uint16_t low, uint16_t high, uint8_t protocol) {
diff --git a/python/setools/seinfo.c b/python/setools/seinfo.c
index 211930a3..7c22f9e7 100644
--- a/python/setools/seinfo.c
+++ b/python/setools/seinfo.c
@@ -512,7 +512,9 @@ static PyObject* get_ports(const char *num, const apol_policy_t * policydb)
}
if ((ocon_proto != IPPROTO_TCP) &&
- (ocon_proto != IPPROTO_UDP))
+ (ocon_proto != IPPROTO_UDP) &&
+ (ocon_proto != IPPROTO_DCCP) &&
+ (ocon_proto != IPPROTO_SCTP))
goto cleanup;
if (qpol_portcon_get_context(q, portcon, &ctxt)) {
diff --git a/secmds/seinfo.c b/secmds/seinfo.c
index a9708907..3c71af57 100644
--- a/secmds/seinfo.c
+++ b/secmds/seinfo.c
@@ -1155,6 +1155,10 @@ static int print_portcon(FILE * fp, const char *num, const char *protocol, const
proto = IPPROTO_TCP;
else if (!strcmp(protocol, "udp"))
proto = IPPROTO_UDP;
+ else if (!strcmp(protocol, "dccp"))
+ proto = IPPROTO_DCCP;
+ else if (!strcmp(protocol, "sctp"))
+ proto = IPPROTO_SCTP;
else {
ERR(policydb, "Unable to get portcon by protocol: bad protocol %s.", protocol);
goto cleanup;
--
2.14.3