1 /* 2 * NetLabel CIPSO/IPv4 Support 3 * 4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The 5 * NetLabel system manages static and dynamic label mappings for network 6 * protocols such as CIPSO and RIPSO. 7 * 8 * Author: Paul Moore <paul.moore@hp.com> 9 * 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License as published by 17 * the Free Software Foundation; either version 2 of the License, or 18 * (at your option) any later version. 19 * 20 * This program is distributed in the hope that it will be useful, 21 * but WITHOUT ANY WARRANTY; without even the implied warranty of 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See 23 * the GNU General Public License for more details. 24 * 25 * You should have received a copy of the GNU General Public License 26 * along with this program; if not, write to the Free Software 27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 28 * 29 */ 30 31 #include <linux/types.h> 32 #include <linux/socket.h> 33 #include <linux/string.h> 34 #include <linux/skbuff.h> 35 #include <linux/audit.h> 36 #include <linux/slab.h> 37 #include <net/sock.h> 38 #include <net/netlink.h> 39 #include <net/genetlink.h> 40 #include <net/netlabel.h> 41 #include <net/cipso_ipv4.h> 42 #include <asm/atomic.h> 43 44 #include "netlabel_user.h" 45 #include "netlabel_cipso_v4.h" 46 #include "netlabel_mgmt.h" 47 #include "netlabel_domainhash.h" 48 49 /* Argument struct for cipso_v4_doi_walk() */ 50 struct netlbl_cipsov4_doiwalk_arg { 51 struct netlink_callback *nl_cb; 52 struct sk_buff *skb; 53 u32 seq; 54 }; 55 56 /* Argument struct for netlbl_domhsh_walk() */ 57 struct netlbl_domhsh_walk_arg { 58 struct netlbl_audit *audit_info; 59 u32 doi; 60 }; 61 62 /* NetLabel Generic NETLINK CIPSOv4 family */ 63 static struct genl_family netlbl_cipsov4_gnl_family = { 64 .id = GENL_ID_GENERATE, 65 .hdrsize = 0, 66 .name = NETLBL_NLTYPE_CIPSOV4_NAME, 67 .version = NETLBL_PROTO_VERSION, 68 .maxattr = NLBL_CIPSOV4_A_MAX, 69 }; 70 71 /* NetLabel Netlink attribute policy */ 72 static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = { 73 [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 }, 74 [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 }, 75 [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 }, 76 [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED }, 77 [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 }, 78 [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 }, 79 [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED }, 80 [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED }, 81 [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 }, 82 [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 }, 83 [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED }, 84 [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED }, 85 }; 86 87 /* 88 * Helper Functions 89 */ 90 91 /** 92 * netlbl_cipsov4_add_common - Parse the common sections of a ADD message 93 * @info: the Generic NETLINK info block 94 * @doi_def: the CIPSO V4 DOI definition 95 * 96 * Description: 97 * Parse the common sections of a ADD message and fill in the related values 98 * in @doi_def. Returns zero on success, negative values on failure. 99 * 100 */ 101 static int netlbl_cipsov4_add_common(struct genl_info *info, 102 struct cipso_v4_doi *doi_def) 103 { 104 struct nlattr *nla; 105 int nla_rem; 106 u32 iter = 0; 107 108 doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); 109 110 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST], 111 NLBL_CIPSOV4_A_MAX, 112 netlbl_cipsov4_genl_policy) != 0) 113 return -EINVAL; 114 115 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem) 116 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) { 117 if (iter >= CIPSO_V4_TAG_MAXCNT) 118 return -EINVAL; 119 doi_def->tags[iter++] = nla_get_u8(nla); 120 } 121 while (iter < CIPSO_V4_TAG_MAXCNT) 122 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID; 123 124 return 0; 125 } 126 127 /* 128 * NetLabel Command Handlers 129 */ 130 131 /** 132 * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition 133 * @info: the Generic NETLINK info block 134 * @audit_info: NetLabel audit information 135 * 136 * Description: 137 * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD 138 * message and add it to the CIPSO V4 engine. Return zero on success and 139 * non-zero on error. 140 * 141 */ 142 static int netlbl_cipsov4_add_std(struct genl_info *info, 143 struct netlbl_audit *audit_info) 144 { 145 int ret_val = -EINVAL; 146 struct cipso_v4_doi *doi_def = NULL; 147 struct nlattr *nla_a; 148 struct nlattr *nla_b; 149 int nla_a_rem; 150 int nla_b_rem; 151 u32 iter; 152 153 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] || 154 !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST]) 155 return -EINVAL; 156 157 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], 158 NLBL_CIPSOV4_A_MAX, 159 netlbl_cipsov4_genl_policy) != 0) 160 return -EINVAL; 161 162 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); 163 if (doi_def == NULL) 164 return -ENOMEM; 165 doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL); 166 if (doi_def->map.std == NULL) { 167 ret_val = -ENOMEM; 168 goto add_std_failure; 169 } 170 doi_def->type = CIPSO_V4_MAP_TRANS; 171 172 ret_val = netlbl_cipsov4_add_common(info, doi_def); 173 if (ret_val != 0) 174 goto add_std_failure; 175 ret_val = -EINVAL; 176 177 nla_for_each_nested(nla_a, 178 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], 179 nla_a_rem) 180 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { 181 if (nla_validate_nested(nla_a, 182 NLBL_CIPSOV4_A_MAX, 183 netlbl_cipsov4_genl_policy) != 0) 184 goto add_std_failure; 185 nla_for_each_nested(nla_b, nla_a, nla_b_rem) 186 switch (nla_type(nla_b)) { 187 case NLBL_CIPSOV4_A_MLSLVLLOC: 188 if (nla_get_u32(nla_b) > 189 CIPSO_V4_MAX_LOC_LVLS) 190 goto add_std_failure; 191 if (nla_get_u32(nla_b) >= 192 doi_def->map.std->lvl.local_size) 193 doi_def->map.std->lvl.local_size = 194 nla_get_u32(nla_b) + 1; 195 break; 196 case NLBL_CIPSOV4_A_MLSLVLREM: 197 if (nla_get_u32(nla_b) > 198 CIPSO_V4_MAX_REM_LVLS) 199 goto add_std_failure; 200 if (nla_get_u32(nla_b) >= 201 doi_def->map.std->lvl.cipso_size) 202 doi_def->map.std->lvl.cipso_size = 203 nla_get_u32(nla_b) + 1; 204 break; 205 } 206 } 207 doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, 208 sizeof(u32), 209 GFP_KERNEL); 210 if (doi_def->map.std->lvl.local == NULL) { 211 ret_val = -ENOMEM; 212 goto add_std_failure; 213 } 214 doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, 215 sizeof(u32), 216 GFP_KERNEL); 217 if (doi_def->map.std->lvl.cipso == NULL) { 218 ret_val = -ENOMEM; 219 goto add_std_failure; 220 } 221 for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++) 222 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL; 223 for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++) 224 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL; 225 nla_for_each_nested(nla_a, 226 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], 227 nla_a_rem) 228 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { 229 struct nlattr *lvl_loc; 230 struct nlattr *lvl_rem; 231 232 lvl_loc = nla_find_nested(nla_a, 233 NLBL_CIPSOV4_A_MLSLVLLOC); 234 lvl_rem = nla_find_nested(nla_a, 235 NLBL_CIPSOV4_A_MLSLVLREM); 236 if (lvl_loc == NULL || lvl_rem == NULL) 237 goto add_std_failure; 238 doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] = 239 nla_get_u32(lvl_rem); 240 doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] = 241 nla_get_u32(lvl_loc); 242 } 243 244 if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) { 245 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST], 246 NLBL_CIPSOV4_A_MAX, 247 netlbl_cipsov4_genl_policy) != 0) 248 goto add_std_failure; 249 250 nla_for_each_nested(nla_a, 251 info->attrs[NLBL_CIPSOV4_A_MLSCATLST], 252 nla_a_rem) 253 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { 254 if (nla_validate_nested(nla_a, 255 NLBL_CIPSOV4_A_MAX, 256 netlbl_cipsov4_genl_policy) != 0) 257 goto add_std_failure; 258 nla_for_each_nested(nla_b, nla_a, nla_b_rem) 259 switch (nla_type(nla_b)) { 260 case NLBL_CIPSOV4_A_MLSCATLOC: 261 if (nla_get_u32(nla_b) > 262 CIPSO_V4_MAX_LOC_CATS) 263 goto add_std_failure; 264 if (nla_get_u32(nla_b) >= 265 doi_def->map.std->cat.local_size) 266 doi_def->map.std->cat.local_size = 267 nla_get_u32(nla_b) + 1; 268 break; 269 case NLBL_CIPSOV4_A_MLSCATREM: 270 if (nla_get_u32(nla_b) > 271 CIPSO_V4_MAX_REM_CATS) 272 goto add_std_failure; 273 if (nla_get_u32(nla_b) >= 274 doi_def->map.std->cat.cipso_size) 275 doi_def->map.std->cat.cipso_size = 276 nla_get_u32(nla_b) + 1; 277 break; 278 } 279 } 280 doi_def->map.std->cat.local = kcalloc( 281 doi_def->map.std->cat.local_size, 282 sizeof(u32), 283 GFP_KERNEL); 284 if (doi_def->map.std->cat.local == NULL) { 285 ret_val = -ENOMEM; 286 goto add_std_failure; 287 } 288 doi_def->map.std->cat.cipso = kcalloc( 289 doi_def->map.std->cat.cipso_size, 290 sizeof(u32), 291 GFP_KERNEL); 292 if (doi_def->map.std->cat.cipso == NULL) { 293 ret_val = -ENOMEM; 294 goto add_std_failure; 295 } 296 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++) 297 doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT; 298 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++) 299 doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT; 300 nla_for_each_nested(nla_a, 301 info->attrs[NLBL_CIPSOV4_A_MLSCATLST], 302 nla_a_rem) 303 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { 304 struct nlattr *cat_loc; 305 struct nlattr *cat_rem; 306 307 cat_loc = nla_find_nested(nla_a, 308 NLBL_CIPSOV4_A_MLSCATLOC); 309 cat_rem = nla_find_nested(nla_a, 310 NLBL_CIPSOV4_A_MLSCATREM); 311 if (cat_loc == NULL || cat_rem == NULL) 312 goto add_std_failure; 313 doi_def->map.std->cat.local[ 314 nla_get_u32(cat_loc)] = 315 nla_get_u32(cat_rem); 316 doi_def->map.std->cat.cipso[ 317 nla_get_u32(cat_rem)] = 318 nla_get_u32(cat_loc); 319 } 320 } 321 322 ret_val = cipso_v4_doi_add(doi_def, audit_info); 323 if (ret_val != 0) 324 goto add_std_failure; 325 return 0; 326 327 add_std_failure: 328 if (doi_def) 329 cipso_v4_doi_free(doi_def); 330 return ret_val; 331 } 332 333 /** 334 * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition 335 * @info: the Generic NETLINK info block 336 * @audit_info: NetLabel audit information 337 * 338 * Description: 339 * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message 340 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on 341 * error. 342 * 343 */ 344 static int netlbl_cipsov4_add_pass(struct genl_info *info, 345 struct netlbl_audit *audit_info) 346 { 347 int ret_val; 348 struct cipso_v4_doi *doi_def = NULL; 349 350 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST]) 351 return -EINVAL; 352 353 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); 354 if (doi_def == NULL) 355 return -ENOMEM; 356 doi_def->type = CIPSO_V4_MAP_PASS; 357 358 ret_val = netlbl_cipsov4_add_common(info, doi_def); 359 if (ret_val != 0) 360 goto add_pass_failure; 361 362 ret_val = cipso_v4_doi_add(doi_def, audit_info); 363 if (ret_val != 0) 364 goto add_pass_failure; 365 return 0; 366 367 add_pass_failure: 368 cipso_v4_doi_free(doi_def); 369 return ret_val; 370 } 371 372 /** 373 * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition 374 * @info: the Generic NETLINK info block 375 * @audit_info: NetLabel audit information 376 * 377 * Description: 378 * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD 379 * message and add it to the CIPSO V4 engine. Return zero on success and 380 * non-zero on error. 381 * 382 */ 383 static int netlbl_cipsov4_add_local(struct genl_info *info, 384 struct netlbl_audit *audit_info) 385 { 386 int ret_val; 387 struct cipso_v4_doi *doi_def = NULL; 388 389 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST]) 390 return -EINVAL; 391 392 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); 393 if (doi_def == NULL) 394 return -ENOMEM; 395 doi_def->type = CIPSO_V4_MAP_LOCAL; 396 397 ret_val = netlbl_cipsov4_add_common(info, doi_def); 398 if (ret_val != 0) 399 goto add_local_failure; 400 401 ret_val = cipso_v4_doi_add(doi_def, audit_info); 402 if (ret_val != 0) 403 goto add_local_failure; 404 return 0; 405 406 add_local_failure: 407 cipso_v4_doi_free(doi_def); 408 return ret_val; 409 } 410 411 /** 412 * netlbl_cipsov4_add - Handle an ADD message 413 * @skb: the NETLINK buffer 414 * @info: the Generic NETLINK info block 415 * 416 * Description: 417 * Create a new DOI definition based on the given ADD message and add it to the 418 * CIPSO V4 engine. Returns zero on success, negative values on failure. 419 * 420 */ 421 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) 422 423 { 424 int ret_val = -EINVAL; 425 const char *type_str = "(unknown)"; 426 struct netlbl_audit audit_info; 427 428 if (!info->attrs[NLBL_CIPSOV4_A_DOI] || 429 !info->attrs[NLBL_CIPSOV4_A_MTYPE]) 430 return -EINVAL; 431 432 netlbl_netlink_auditinfo(skb, &audit_info); 433 switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) { 434 case CIPSO_V4_MAP_TRANS: 435 type_str = "trans"; 436 ret_val = netlbl_cipsov4_add_std(info, &audit_info); 437 break; 438 case CIPSO_V4_MAP_PASS: 439 type_str = "pass"; 440 ret_val = netlbl_cipsov4_add_pass(info, &audit_info); 441 break; 442 case CIPSO_V4_MAP_LOCAL: 443 type_str = "local"; 444 ret_val = netlbl_cipsov4_add_local(info, &audit_info); 445 break; 446 } 447 if (ret_val == 0) 448 atomic_inc(&netlabel_mgmt_protocount); 449 450 return ret_val; 451 } 452 453 /** 454 * netlbl_cipsov4_list - Handle a LIST message 455 * @skb: the NETLINK buffer 456 * @info: the Generic NETLINK info block 457 * 458 * Description: 459 * Process a user generated LIST message and respond accordingly. While the 460 * response message generated by the kernel is straightforward, determining 461 * before hand the size of the buffer to allocate is not (we have to generate 462 * the message to know the size). In order to keep this function sane what we 463 * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in 464 * that size, if we fail then we restart with a larger buffer and try again. 465 * We continue in this manner until we hit a limit of failed attempts then we 466 * give up and just send an error message. Returns zero on success and 467 * negative values on error. 468 * 469 */ 470 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info) 471 { 472 int ret_val; 473 struct sk_buff *ans_skb = NULL; 474 u32 nlsze_mult = 1; 475 void *data; 476 u32 doi; 477 struct nlattr *nla_a; 478 struct nlattr *nla_b; 479 struct cipso_v4_doi *doi_def; 480 u32 iter; 481 482 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) { 483 ret_val = -EINVAL; 484 goto list_failure; 485 } 486 487 list_start: 488 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL); 489 if (ans_skb == NULL) { 490 ret_val = -ENOMEM; 491 goto list_failure; 492 } 493 data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family, 494 0, NLBL_CIPSOV4_C_LIST); 495 if (data == NULL) { 496 ret_val = -ENOMEM; 497 goto list_failure; 498 } 499 500 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); 501 502 rcu_read_lock(); 503 doi_def = cipso_v4_doi_getdef(doi); 504 if (doi_def == NULL) { 505 ret_val = -EINVAL; 506 goto list_failure_lock; 507 } 508 509 ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type); 510 if (ret_val != 0) 511 goto list_failure_lock; 512 513 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST); 514 if (nla_a == NULL) { 515 ret_val = -ENOMEM; 516 goto list_failure_lock; 517 } 518 for (iter = 0; 519 iter < CIPSO_V4_TAG_MAXCNT && 520 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID; 521 iter++) { 522 ret_val = nla_put_u8(ans_skb, 523 NLBL_CIPSOV4_A_TAG, 524 doi_def->tags[iter]); 525 if (ret_val != 0) 526 goto list_failure_lock; 527 } 528 nla_nest_end(ans_skb, nla_a); 529 530 switch (doi_def->type) { 531 case CIPSO_V4_MAP_TRANS: 532 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST); 533 if (nla_a == NULL) { 534 ret_val = -ENOMEM; 535 goto list_failure_lock; 536 } 537 for (iter = 0; 538 iter < doi_def->map.std->lvl.local_size; 539 iter++) { 540 if (doi_def->map.std->lvl.local[iter] == 541 CIPSO_V4_INV_LVL) 542 continue; 543 544 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL); 545 if (nla_b == NULL) { 546 ret_val = -ENOMEM; 547 goto list_retry; 548 } 549 ret_val = nla_put_u32(ans_skb, 550 NLBL_CIPSOV4_A_MLSLVLLOC, 551 iter); 552 if (ret_val != 0) 553 goto list_retry; 554 ret_val = nla_put_u32(ans_skb, 555 NLBL_CIPSOV4_A_MLSLVLREM, 556 doi_def->map.std->lvl.local[iter]); 557 if (ret_val != 0) 558 goto list_retry; 559 nla_nest_end(ans_skb, nla_b); 560 } 561 nla_nest_end(ans_skb, nla_a); 562 563 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST); 564 if (nla_a == NULL) { 565 ret_val = -ENOMEM; 566 goto list_retry; 567 } 568 for (iter = 0; 569 iter < doi_def->map.std->cat.local_size; 570 iter++) { 571 if (doi_def->map.std->cat.local[iter] == 572 CIPSO_V4_INV_CAT) 573 continue; 574 575 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT); 576 if (nla_b == NULL) { 577 ret_val = -ENOMEM; 578 goto list_retry; 579 } 580 ret_val = nla_put_u32(ans_skb, 581 NLBL_CIPSOV4_A_MLSCATLOC, 582 iter); 583 if (ret_val != 0) 584 goto list_retry; 585 ret_val = nla_put_u32(ans_skb, 586 NLBL_CIPSOV4_A_MLSCATREM, 587 doi_def->map.std->cat.local[iter]); 588 if (ret_val != 0) 589 goto list_retry; 590 nla_nest_end(ans_skb, nla_b); 591 } 592 nla_nest_end(ans_skb, nla_a); 593 594 break; 595 } 596 rcu_read_unlock(); 597 598 genlmsg_end(ans_skb, data); 599 return genlmsg_reply(ans_skb, info); 600 601 list_retry: 602 /* XXX - this limit is a guesstimate */ 603 if (nlsze_mult < 4) { 604 rcu_read_unlock(); 605 kfree_skb(ans_skb); 606 nlsze_mult *= 2; 607 goto list_start; 608 } 609 list_failure_lock: 610 rcu_read_unlock(); 611 list_failure: 612 kfree_skb(ans_skb); 613 return ret_val; 614 } 615 616 /** 617 * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL 618 * @doi_def: the CIPSOv4 DOI definition 619 * @arg: the netlbl_cipsov4_doiwalk_arg structure 620 * 621 * Description: 622 * This function is designed to be used as a callback to the 623 * cipso_v4_doi_walk() function for use in generating a response for a LISTALL 624 * message. Returns the size of the message on success, negative values on 625 * failure. 626 * 627 */ 628 static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg) 629 { 630 int ret_val = -ENOMEM; 631 struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg; 632 void *data; 633 634 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid, 635 cb_arg->seq, &netlbl_cipsov4_gnl_family, 636 NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL); 637 if (data == NULL) 638 goto listall_cb_failure; 639 640 ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi); 641 if (ret_val != 0) 642 goto listall_cb_failure; 643 ret_val = nla_put_u32(cb_arg->skb, 644 NLBL_CIPSOV4_A_MTYPE, 645 doi_def->type); 646 if (ret_val != 0) 647 goto listall_cb_failure; 648 649 return genlmsg_end(cb_arg->skb, data); 650 651 listall_cb_failure: 652 genlmsg_cancel(cb_arg->skb, data); 653 return ret_val; 654 } 655 656 /** 657 * netlbl_cipsov4_listall - Handle a LISTALL message 658 * @skb: the NETLINK buffer 659 * @cb: the NETLINK callback 660 * 661 * Description: 662 * Process a user generated LISTALL message and respond accordingly. Returns 663 * zero on success and negative values on error. 664 * 665 */ 666 static int netlbl_cipsov4_listall(struct sk_buff *skb, 667 struct netlink_callback *cb) 668 { 669 struct netlbl_cipsov4_doiwalk_arg cb_arg; 670 u32 doi_skip = cb->args[0]; 671 672 cb_arg.nl_cb = cb; 673 cb_arg.skb = skb; 674 cb_arg.seq = cb->nlh->nlmsg_seq; 675 676 cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg); 677 678 cb->args[0] = doi_skip; 679 return skb->len; 680 } 681 682 /** 683 * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE 684 * @entry: LSM domain mapping entry 685 * @arg: the netlbl_domhsh_walk_arg structure 686 * 687 * Description: 688 * This function is intended for use by netlbl_cipsov4_remove() as the callback 689 * for the netlbl_domhsh_walk() function; it removes LSM domain map entries 690 * which are associated with the CIPSO DOI specified in @arg. Returns zero on 691 * success, negative values on failure. 692 * 693 */ 694 static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg) 695 { 696 struct netlbl_domhsh_walk_arg *cb_arg = arg; 697 698 if (entry->type == NETLBL_NLTYPE_CIPSOV4 && 699 entry->type_def.cipsov4->doi == cb_arg->doi) 700 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info); 701 702 return 0; 703 } 704 705 /** 706 * netlbl_cipsov4_remove - Handle a REMOVE message 707 * @skb: the NETLINK buffer 708 * @info: the Generic NETLINK info block 709 * 710 * Description: 711 * Process a user generated REMOVE message and respond accordingly. Returns 712 * zero on success, negative values on failure. 713 * 714 */ 715 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info) 716 { 717 int ret_val = -EINVAL; 718 struct netlbl_domhsh_walk_arg cb_arg; 719 struct netlbl_audit audit_info; 720 u32 skip_bkt = 0; 721 u32 skip_chain = 0; 722 723 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) 724 return -EINVAL; 725 726 netlbl_netlink_auditinfo(skb, &audit_info); 727 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); 728 cb_arg.audit_info = &audit_info; 729 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain, 730 netlbl_cipsov4_remove_cb, &cb_arg); 731 if (ret_val == 0 || ret_val == -ENOENT) { 732 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info); 733 if (ret_val == 0) 734 atomic_dec(&netlabel_mgmt_protocount); 735 } 736 737 return ret_val; 738 } 739 740 /* 741 * NetLabel Generic NETLINK Command Definitions 742 */ 743 744 static struct genl_ops netlbl_cipsov4_ops[] = { 745 { 746 .cmd = NLBL_CIPSOV4_C_ADD, 747 .flags = GENL_ADMIN_PERM, 748 .policy = netlbl_cipsov4_genl_policy, 749 .doit = netlbl_cipsov4_add, 750 .dumpit = NULL, 751 }, 752 { 753 .cmd = NLBL_CIPSOV4_C_REMOVE, 754 .flags = GENL_ADMIN_PERM, 755 .policy = netlbl_cipsov4_genl_policy, 756 .doit = netlbl_cipsov4_remove, 757 .dumpit = NULL, 758 }, 759 { 760 .cmd = NLBL_CIPSOV4_C_LIST, 761 .flags = 0, 762 .policy = netlbl_cipsov4_genl_policy, 763 .doit = netlbl_cipsov4_list, 764 .dumpit = NULL, 765 }, 766 { 767 .cmd = NLBL_CIPSOV4_C_LISTALL, 768 .flags = 0, 769 .policy = netlbl_cipsov4_genl_policy, 770 .doit = NULL, 771 .dumpit = netlbl_cipsov4_listall, 772 }, 773 }; 774 775 /* 776 * NetLabel Generic NETLINK Protocol Functions 777 */ 778 779 /** 780 * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component 781 * 782 * Description: 783 * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK 784 * mechanism. Returns zero on success, negative values on failure. 785 * 786 */ 787 int __init netlbl_cipsov4_genl_init(void) 788 { 789 return genl_register_family_with_ops(&netlbl_cipsov4_gnl_family, 790 netlbl_cipsov4_ops, ARRAY_SIZE(netlbl_cipsov4_ops)); 791 } 792