1 /* 2 * NetLabel CALIPSO/IPv6 Support 3 * 4 * This file defines the CALIPSO/IPv6 functions for the NetLabel system. The 5 * NetLabel system manages static and dynamic label mappings for network 6 * protocols such as CIPSO and CALIPSO. 7 * 8 * Authors: Paul Moore <paul@paul-moore.com> 9 * Huw Davies <huw@codeweavers.com> 10 * 11 */ 12 13 /* (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015 15 * 16 * This program is free software; you can redistribute it and/or modify 17 * it under the terms of the GNU General Public License as published by 18 * the Free Software Foundation; either version 2 of the License, or 19 * (at your option) any later version. 20 * 21 * This program is distributed in the hope that it will be useful, 22 * but WITHOUT ANY WARRANTY; without even the implied warranty of 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 24 * the GNU General Public License for more details. 25 * 26 * You should have received a copy of the GNU General Public License 27 * along with this program; if not, see <http://www.gnu.org/licenses/>. 28 * 29 */ 30 31 #include <linux/types.h> 32 #include <linux/socket.h> 33 #include <linux/string.h> 34 #include <linux/skbuff.h> 35 #include <linux/audit.h> 36 #include <linux/slab.h> 37 #include <net/sock.h> 38 #include <net/netlink.h> 39 #include <net/genetlink.h> 40 #include <net/netlabel.h> 41 #include <net/calipso.h> 42 #include <linux/atomic.h> 43 44 #include "netlabel_user.h" 45 #include "netlabel_calipso.h" 46 #include "netlabel_mgmt.h" 47 #include "netlabel_domainhash.h" 48 49 /* Argument struct for calipso_doi_walk() */ 50 struct netlbl_calipso_doiwalk_arg { 51 struct netlink_callback *nl_cb; 52 struct sk_buff *skb; 53 u32 seq; 54 }; 55 56 /* Argument struct for netlbl_domhsh_walk() */ 57 struct netlbl_domhsh_walk_arg { 58 struct netlbl_audit *audit_info; 59 u32 doi; 60 }; 61 62 /* NetLabel Generic NETLINK CALIPSO family */ 63 static struct genl_family netlbl_calipso_gnl_family; 64 65 /* NetLabel Netlink attribute policy */ 66 static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = { 67 [NLBL_CALIPSO_A_DOI] = { .type = NLA_U32 }, 68 [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 }, 69 }; 70 71 /* NetLabel Command Handlers 72 */ 73 /** 74 * netlbl_calipso_add_pass - Adds a CALIPSO pass DOI definition 75 * @info: the Generic NETLINK info block 76 * @audit_info: NetLabel audit information 77 * 78 * Description: 79 * Create a new CALIPSO_MAP_PASS DOI definition based on the given ADD message 80 * and add it to the CALIPSO engine. Return zero on success and non-zero on 81 * error. 82 * 83 */ 84 static int netlbl_calipso_add_pass(struct genl_info *info, 85 struct netlbl_audit *audit_info) 86 { 87 int ret_val; 88 struct calipso_doi *doi_def = NULL; 89 90 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); 91 if (!doi_def) 92 return -ENOMEM; 93 doi_def->type = CALIPSO_MAP_PASS; 94 doi_def->doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]); 95 ret_val = calipso_doi_add(doi_def, audit_info); 96 if (ret_val != 0) 97 calipso_doi_free(doi_def); 98 99 return ret_val; 100 } 101 102 /** 103 * netlbl_calipso_add - Handle an ADD message 104 * @skb: the NETLINK buffer 105 * @info: the Generic NETLINK info block 106 * 107 * Description: 108 * Create a new DOI definition based on the given ADD message and add it to the 109 * CALIPSO engine. Returns zero on success, negative values on failure. 110 * 111 */ 112 static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info) 113 114 { 115 int ret_val = -EINVAL; 116 struct netlbl_audit audit_info; 117 118 if (!info->attrs[NLBL_CALIPSO_A_DOI] || 119 !info->attrs[NLBL_CALIPSO_A_MTYPE]) 120 return -EINVAL; 121 122 netlbl_netlink_auditinfo(skb, &audit_info); 123 switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) { 124 case CALIPSO_MAP_PASS: 125 ret_val = netlbl_calipso_add_pass(info, &audit_info); 126 break; 127 } 128 if (ret_val == 0) 129 atomic_inc(&netlabel_mgmt_protocount); 130 131 return ret_val; 132 } 133 134 /** 135 * netlbl_calipso_list - Handle a LIST message 136 * @skb: the NETLINK buffer 137 * @info: the Generic NETLINK info block 138 * 139 * Description: 140 * Process a user generated LIST message and respond accordingly. 141 * Returns zero on success and negative values on error. 142 * 143 */ 144 static int netlbl_calipso_list(struct sk_buff *skb, struct genl_info *info) 145 { 146 int ret_val; 147 struct sk_buff *ans_skb = NULL; 148 void *data; 149 u32 doi; 150 struct calipso_doi *doi_def; 151 152 if (!info->attrs[NLBL_CALIPSO_A_DOI]) { 153 ret_val = -EINVAL; 154 goto list_failure; 155 } 156 157 doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]); 158 159 doi_def = calipso_doi_getdef(doi); 160 if (!doi_def) { 161 ret_val = -EINVAL; 162 goto list_failure; 163 } 164 165 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 166 if (!ans_skb) { 167 ret_val = -ENOMEM; 168 goto list_failure_put; 169 } 170 data = genlmsg_put_reply(ans_skb, info, &netlbl_calipso_gnl_family, 171 0, NLBL_CALIPSO_C_LIST); 172 if (!data) { 173 ret_val = -ENOMEM; 174 goto list_failure_put; 175 } 176 177 ret_val = nla_put_u32(ans_skb, NLBL_CALIPSO_A_MTYPE, doi_def->type); 178 if (ret_val != 0) 179 goto list_failure_put; 180 181 calipso_doi_putdef(doi_def); 182 183 genlmsg_end(ans_skb, data); 184 return genlmsg_reply(ans_skb, info); 185 186 list_failure_put: 187 calipso_doi_putdef(doi_def); 188 list_failure: 189 kfree_skb(ans_skb); 190 return ret_val; 191 } 192 193 /** 194 * netlbl_calipso_listall_cb - calipso_doi_walk() callback for LISTALL 195 * @doi_def: the CALIPSO DOI definition 196 * @arg: the netlbl_calipso_doiwalk_arg structure 197 * 198 * Description: 199 * This function is designed to be used as a callback to the 200 * calipso_doi_walk() function for use in generating a response for a LISTALL 201 * message. Returns the size of the message on success, negative values on 202 * failure. 203 * 204 */ 205 static int netlbl_calipso_listall_cb(struct calipso_doi *doi_def, void *arg) 206 { 207 int ret_val = -ENOMEM; 208 struct netlbl_calipso_doiwalk_arg *cb_arg = arg; 209 void *data; 210 211 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, 212 cb_arg->seq, &netlbl_calipso_gnl_family, 213 NLM_F_MULTI, NLBL_CALIPSO_C_LISTALL); 214 if (!data) 215 goto listall_cb_failure; 216 217 ret_val = nla_put_u32(cb_arg->skb, NLBL_CALIPSO_A_DOI, doi_def->doi); 218 if (ret_val != 0) 219 goto listall_cb_failure; 220 ret_val = nla_put_u32(cb_arg->skb, 221 NLBL_CALIPSO_A_MTYPE, 222 doi_def->type); 223 if (ret_val != 0) 224 goto listall_cb_failure; 225 226 genlmsg_end(cb_arg->skb, data); 227 return 0; 228 229 listall_cb_failure: 230 genlmsg_cancel(cb_arg->skb, data); 231 return ret_val; 232 } 233 234 /** 235 * netlbl_calipso_listall - Handle a LISTALL message 236 * @skb: the NETLINK buffer 237 * @cb: the NETLINK callback 238 * 239 * Description: 240 * Process a user generated LISTALL message and respond accordingly. Returns 241 * zero on success and negative values on error. 242 * 243 */ 244 static int netlbl_calipso_listall(struct sk_buff *skb, 245 struct netlink_callback *cb) 246 { 247 struct netlbl_calipso_doiwalk_arg cb_arg; 248 u32 doi_skip = cb->args[0]; 249 250 cb_arg.nl_cb = cb; 251 cb_arg.skb = skb; 252 cb_arg.seq = cb->nlh->nlmsg_seq; 253 254 calipso_doi_walk(&doi_skip, netlbl_calipso_listall_cb, &cb_arg); 255 256 cb->args[0] = doi_skip; 257 return skb->len; 258 } 259 260 /** 261 * netlbl_calipso_remove_cb - netlbl_calipso_remove() callback for REMOVE 262 * @entry: LSM domain mapping entry 263 * @arg: the netlbl_domhsh_walk_arg structure 264 * 265 * Description: 266 * This function is intended for use by netlbl_calipso_remove() as the callback 267 * for the netlbl_domhsh_walk() function; it removes LSM domain map entries 268 * which are associated with the CALIPSO DOI specified in @arg. Returns zero on 269 * success, negative values on failure. 270 * 271 */ 272 static int netlbl_calipso_remove_cb(struct netlbl_dom_map *entry, void *arg) 273 { 274 struct netlbl_domhsh_walk_arg *cb_arg = arg; 275 276 if (entry->def.type == NETLBL_NLTYPE_CALIPSO && 277 entry->def.calipso->doi == cb_arg->doi) 278 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info); 279 280 return 0; 281 } 282 283 /** 284 * netlbl_calipso_remove - Handle a REMOVE message 285 * @skb: the NETLINK buffer 286 * @info: the Generic NETLINK info block 287 * 288 * Description: 289 * Process a user generated REMOVE message and respond accordingly. Returns 290 * zero on success, negative values on failure. 291 * 292 */ 293 static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info) 294 { 295 int ret_val = -EINVAL; 296 struct netlbl_domhsh_walk_arg cb_arg; 297 struct netlbl_audit audit_info; 298 u32 skip_bkt = 0; 299 u32 skip_chain = 0; 300 301 if (!info->attrs[NLBL_CALIPSO_A_DOI]) 302 return -EINVAL; 303 304 netlbl_netlink_auditinfo(skb, &audit_info); 305 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]); 306 cb_arg.audit_info = &audit_info; 307 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain, 308 netlbl_calipso_remove_cb, &cb_arg); 309 if (ret_val == 0 || ret_val == -ENOENT) { 310 ret_val = calipso_doi_remove(cb_arg.doi, &audit_info); 311 if (ret_val == 0) 312 atomic_dec(&netlabel_mgmt_protocount); 313 } 314 315 return ret_val; 316 } 317 318 /* NetLabel Generic NETLINK Command Definitions 319 */ 320 321 static const struct genl_ops netlbl_calipso_ops[] = { 322 { 323 .cmd = NLBL_CALIPSO_C_ADD, 324 .flags = GENL_ADMIN_PERM, 325 .policy = calipso_genl_policy, 326 .doit = netlbl_calipso_add, 327 .dumpit = NULL, 328 }, 329 { 330 .cmd = NLBL_CALIPSO_C_REMOVE, 331 .flags = GENL_ADMIN_PERM, 332 .policy = calipso_genl_policy, 333 .doit = netlbl_calipso_remove, 334 .dumpit = NULL, 335 }, 336 { 337 .cmd = NLBL_CALIPSO_C_LIST, 338 .flags = 0, 339 .policy = calipso_genl_policy, 340 .doit = netlbl_calipso_list, 341 .dumpit = NULL, 342 }, 343 { 344 .cmd = NLBL_CALIPSO_C_LISTALL, 345 .flags = 0, 346 .policy = calipso_genl_policy, 347 .doit = NULL, 348 .dumpit = netlbl_calipso_listall, 349 }, 350 }; 351 352 static struct genl_family netlbl_calipso_gnl_family __ro_after_init = { 353 .hdrsize = 0, 354 .name = NETLBL_NLTYPE_CALIPSO_NAME, 355 .version = NETLBL_PROTO_VERSION, 356 .maxattr = NLBL_CALIPSO_A_MAX, 357 .module = THIS_MODULE, 358 .ops = netlbl_calipso_ops, 359 .n_ops = ARRAY_SIZE(netlbl_calipso_ops), 360 }; 361 362 /* NetLabel Generic NETLINK Protocol Functions 363 */ 364 365 /** 366 * netlbl_calipso_genl_init - Register the CALIPSO NetLabel component 367 * 368 * Description: 369 * Register the CALIPSO packet NetLabel component with the Generic NETLINK 370 * mechanism. Returns zero on success, negative values on failure. 371 * 372 */ 373 int __init netlbl_calipso_genl_init(void) 374 { 375 return genl_register_family(&netlbl_calipso_gnl_family); 376 } 377 378 static const struct netlbl_calipso_ops *calipso_ops; 379 380 /** 381 * netlbl_calipso_ops_register - Register the CALIPSO operations 382 * 383 * Description: 384 * Register the CALIPSO packet engine operations. 385 * 386 */ 387 const struct netlbl_calipso_ops * 388 netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops) 389 { 390 return xchg(&calipso_ops, ops); 391 } 392 EXPORT_SYMBOL(netlbl_calipso_ops_register); 393 394 static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void) 395 { 396 return ACCESS_ONCE(calipso_ops); 397 } 398 399 /** 400 * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine 401 * @doi_def: the DOI structure 402 * @audit_info: NetLabel audit information 403 * 404 * Description: 405 * The caller defines a new DOI for use by the CALIPSO engine and calls this 406 * function to add it to the list of acceptable domains. The caller must 407 * ensure that the mapping table specified in @doi_def->map meets all of the 408 * requirements of the mapping type (see calipso.h for details). Returns 409 * zero on success and non-zero on failure. 410 * 411 */ 412 int calipso_doi_add(struct calipso_doi *doi_def, 413 struct netlbl_audit *audit_info) 414 { 415 int ret_val = -ENOMSG; 416 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 417 418 if (ops) 419 ret_val = ops->doi_add(doi_def, audit_info); 420 return ret_val; 421 } 422 423 /** 424 * calipso_doi_free - Frees a DOI definition 425 * @doi_def: the DOI definition 426 * 427 * Description: 428 * This function frees all of the memory associated with a DOI definition. 429 * 430 */ 431 void calipso_doi_free(struct calipso_doi *doi_def) 432 { 433 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 434 435 if (ops) 436 ops->doi_free(doi_def); 437 } 438 439 /** 440 * calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine 441 * @doi: the DOI value 442 * @audit_secid: the LSM secid to use in the audit message 443 * 444 * Description: 445 * Removes a DOI definition from the CALIPSO engine. The NetLabel routines will 446 * be called to release their own LSM domain mappings as well as our own 447 * domain list. Returns zero on success and negative values on failure. 448 * 449 */ 450 int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info) 451 { 452 int ret_val = -ENOMSG; 453 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 454 455 if (ops) 456 ret_val = ops->doi_remove(doi, audit_info); 457 return ret_val; 458 } 459 460 /** 461 * calipso_doi_getdef - Returns a reference to a valid DOI definition 462 * @doi: the DOI value 463 * 464 * Description: 465 * Searches for a valid DOI definition and if one is found it is returned to 466 * the caller. Otherwise NULL is returned. The caller must ensure that 467 * calipso_doi_putdef() is called when the caller is done. 468 * 469 */ 470 struct calipso_doi *calipso_doi_getdef(u32 doi) 471 { 472 struct calipso_doi *ret_val = NULL; 473 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 474 475 if (ops) 476 ret_val = ops->doi_getdef(doi); 477 return ret_val; 478 } 479 480 /** 481 * calipso_doi_putdef - Releases a reference for the given DOI definition 482 * @doi_def: the DOI definition 483 * 484 * Description: 485 * Releases a DOI definition reference obtained from calipso_doi_getdef(). 486 * 487 */ 488 void calipso_doi_putdef(struct calipso_doi *doi_def) 489 { 490 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 491 492 if (ops) 493 ops->doi_putdef(doi_def); 494 } 495 496 /** 497 * calipso_doi_walk - Iterate through the DOI definitions 498 * @skip_cnt: skip past this number of DOI definitions, updated 499 * @callback: callback for each DOI definition 500 * @cb_arg: argument for the callback function 501 * 502 * Description: 503 * Iterate over the DOI definition list, skipping the first @skip_cnt entries. 504 * For each entry call @callback, if @callback returns a negative value stop 505 * 'walking' through the list and return. Updates the value in @skip_cnt upon 506 * return. Returns zero on success, negative values on failure. 507 * 508 */ 509 int calipso_doi_walk(u32 *skip_cnt, 510 int (*callback)(struct calipso_doi *doi_def, void *arg), 511 void *cb_arg) 512 { 513 int ret_val = -ENOMSG; 514 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 515 516 if (ops) 517 ret_val = ops->doi_walk(skip_cnt, callback, cb_arg); 518 return ret_val; 519 } 520 521 /** 522 * calipso_sock_getattr - Get the security attributes from a sock 523 * @sk: the sock 524 * @secattr: the security attributes 525 * 526 * Description: 527 * Query @sk to see if there is a CALIPSO option attached to the sock and if 528 * there is return the CALIPSO security attributes in @secattr. This function 529 * requires that @sk be locked, or privately held, but it does not do any 530 * locking itself. Returns zero on success and negative values on failure. 531 * 532 */ 533 int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr) 534 { 535 int ret_val = -ENOMSG; 536 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 537 538 if (ops) 539 ret_val = ops->sock_getattr(sk, secattr); 540 return ret_val; 541 } 542 543 /** 544 * calipso_sock_setattr - Add a CALIPSO option to a socket 545 * @sk: the socket 546 * @doi_def: the CALIPSO DOI to use 547 * @secattr: the specific security attributes of the socket 548 * 549 * Description: 550 * Set the CALIPSO option on the given socket using the DOI definition and 551 * security attributes passed to the function. This function requires 552 * exclusive access to @sk, which means it either needs to be in the 553 * process of being created or locked. Returns zero on success and negative 554 * values on failure. 555 * 556 */ 557 int calipso_sock_setattr(struct sock *sk, 558 const struct calipso_doi *doi_def, 559 const struct netlbl_lsm_secattr *secattr) 560 { 561 int ret_val = -ENOMSG; 562 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 563 564 if (ops) 565 ret_val = ops->sock_setattr(sk, doi_def, secattr); 566 return ret_val; 567 } 568 569 /** 570 * calipso_sock_delattr - Delete the CALIPSO option from a socket 571 * @sk: the socket 572 * 573 * Description: 574 * Removes the CALIPSO option from a socket, if present. 575 * 576 */ 577 void calipso_sock_delattr(struct sock *sk) 578 { 579 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 580 581 if (ops) 582 ops->sock_delattr(sk); 583 } 584 585 /** 586 * calipso_req_setattr - Add a CALIPSO option to a connection request socket 587 * @req: the connection request socket 588 * @doi_def: the CALIPSO DOI to use 589 * @secattr: the specific security attributes of the socket 590 * 591 * Description: 592 * Set the CALIPSO option on the given socket using the DOI definition and 593 * security attributes passed to the function. Returns zero on success and 594 * negative values on failure. 595 * 596 */ 597 int calipso_req_setattr(struct request_sock *req, 598 const struct calipso_doi *doi_def, 599 const struct netlbl_lsm_secattr *secattr) 600 { 601 int ret_val = -ENOMSG; 602 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 603 604 if (ops) 605 ret_val = ops->req_setattr(req, doi_def, secattr); 606 return ret_val; 607 } 608 609 /** 610 * calipso_req_delattr - Delete the CALIPSO option from a request socket 611 * @reg: the request socket 612 * 613 * Description: 614 * Removes the CALIPSO option from a request socket, if present. 615 * 616 */ 617 void calipso_req_delattr(struct request_sock *req) 618 { 619 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 620 621 if (ops) 622 ops->req_delattr(req); 623 } 624 625 /** 626 * calipso_optptr - Find the CALIPSO option in the packet 627 * @skb: the packet 628 * 629 * Description: 630 * Parse the packet's IP header looking for a CALIPSO option. Returns a pointer 631 * to the start of the CALIPSO option on success, NULL if one if not found. 632 * 633 */ 634 unsigned char *calipso_optptr(const struct sk_buff *skb) 635 { 636 unsigned char *ret_val = NULL; 637 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 638 639 if (ops) 640 ret_val = ops->skbuff_optptr(skb); 641 return ret_val; 642 } 643 644 /** 645 * calipso_getattr - Get the security attributes from a memory block. 646 * @calipso: the CALIPSO option 647 * @secattr: the security attributes 648 * 649 * Description: 650 * Inspect @calipso and return the security attributes in @secattr. 651 * Returns zero on success and negative values on failure. 652 * 653 */ 654 int calipso_getattr(const unsigned char *calipso, 655 struct netlbl_lsm_secattr *secattr) 656 { 657 int ret_val = -ENOMSG; 658 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 659 660 if (ops) 661 ret_val = ops->opt_getattr(calipso, secattr); 662 return ret_val; 663 } 664 665 /** 666 * calipso_skbuff_setattr - Set the CALIPSO option on a packet 667 * @skb: the packet 668 * @doi_def: the CALIPSO DOI to use 669 * @secattr: the security attributes 670 * 671 * Description: 672 * Set the CALIPSO option on the given packet based on the security attributes. 673 * Returns a pointer to the IP header on success and NULL on failure. 674 * 675 */ 676 int calipso_skbuff_setattr(struct sk_buff *skb, 677 const struct calipso_doi *doi_def, 678 const struct netlbl_lsm_secattr *secattr) 679 { 680 int ret_val = -ENOMSG; 681 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 682 683 if (ops) 684 ret_val = ops->skbuff_setattr(skb, doi_def, secattr); 685 return ret_val; 686 } 687 688 /** 689 * calipso_skbuff_delattr - Delete any CALIPSO options from a packet 690 * @skb: the packet 691 * 692 * Description: 693 * Removes any and all CALIPSO options from the given packet. Returns zero on 694 * success, negative values on failure. 695 * 696 */ 697 int calipso_skbuff_delattr(struct sk_buff *skb) 698 { 699 int ret_val = -ENOMSG; 700 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 701 702 if (ops) 703 ret_val = ops->skbuff_delattr(skb); 704 return ret_val; 705 } 706 707 /** 708 * calipso_cache_invalidate - Invalidates the current CALIPSO cache 709 * 710 * Description: 711 * Invalidates and frees any entries in the CALIPSO cache. Returns zero on 712 * success and negative values on failure. 713 * 714 */ 715 void calipso_cache_invalidate(void) 716 { 717 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 718 719 if (ops) 720 ops->cache_invalidate(); 721 } 722 723 /** 724 * calipso_cache_add - Add an entry to the CALIPSO cache 725 * @calipso_ptr: the CALIPSO option 726 * @secattr: the packet's security attributes 727 * 728 * Description: 729 * Add a new entry into the CALIPSO label mapping cache. 730 * Returns zero on success, negative values on failure. 731 * 732 */ 733 int calipso_cache_add(const unsigned char *calipso_ptr, 734 const struct netlbl_lsm_secattr *secattr) 735 736 { 737 int ret_val = -ENOMSG; 738 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get(); 739 740 if (ops) 741 ret_val = ops->cache_add(calipso_ptr, secattr); 742 return ret_val; 743 } 744