netlabel_cipso_v4.c 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785
  1. /*
  2. * NetLabel CIPSO/IPv4 Support
  3. *
  4. * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
  5. * NetLabel system manages static and dynamic label mappings for network
  6. * protocols such as CIPSO and RIPSO.
  7. *
  8. * Author: Paul Moore <paul.moore@hp.com>
  9. *
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  13. *
  14. * This program is free software; you can redistribute it and/or modify
  15. * it under the terms of the GNU General Public License as published by
  16. * the Free Software Foundation; either version 2 of the License, or
  17. * (at your option) any later version.
  18. *
  19. * This program is distributed in the hope that it will be useful,
  20. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
  22. * the GNU General Public License for more details.
  23. *
  24. * You should have received a copy of the GNU General Public License
  25. * along with this program; if not, write to the Free Software
  26. * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  27. *
  28. */
  29. #include <linux/types.h>
  30. #include <linux/socket.h>
  31. #include <linux/string.h>
  32. #include <linux/skbuff.h>
  33. #include <linux/audit.h>
  34. #include <net/sock.h>
  35. #include <net/netlink.h>
  36. #include <net/genetlink.h>
  37. #include <net/netlabel.h>
  38. #include <net/cipso_ipv4.h>
  39. #include "netlabel_user.h"
  40. #include "netlabel_cipso_v4.h"
  41. /* Argument struct for cipso_v4_doi_walk() */
  42. struct netlbl_cipsov4_doiwalk_arg {
  43. struct netlink_callback *nl_cb;
  44. struct sk_buff *skb;
  45. u32 seq;
  46. };
  47. /* NetLabel Generic NETLINK CIPSOv4 family */
  48. static struct genl_family netlbl_cipsov4_gnl_family = {
  49. .id = GENL_ID_GENERATE,
  50. .hdrsize = 0,
  51. .name = NETLBL_NLTYPE_CIPSOV4_NAME,
  52. .version = NETLBL_PROTO_VERSION,
  53. .maxattr = NLBL_CIPSOV4_A_MAX,
  54. };
  55. /* NetLabel Netlink attribute policy */
  56. static struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
  57. [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
  58. [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
  59. [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
  60. [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
  61. [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
  62. [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
  63. [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
  64. [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
  65. [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
  66. [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
  67. [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
  68. [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
  69. };
  70. /*
  71. * Helper Functions
  72. */
  73. /**
  74. * netlbl_cipsov4_doi_free - Frees a CIPSO V4 DOI definition
  75. * @entry: the entry's RCU field
  76. *
  77. * Description:
  78. * This function is designed to be used as a callback to the call_rcu()
  79. * function so that the memory allocated to the DOI definition can be released
  80. * safely.
  81. *
  82. */
  83. static void netlbl_cipsov4_doi_free(struct rcu_head *entry)
  84. {
  85. struct cipso_v4_doi *ptr;
  86. ptr = container_of(entry, struct cipso_v4_doi, rcu);
  87. switch (ptr->type) {
  88. case CIPSO_V4_MAP_STD:
  89. kfree(ptr->map.std->lvl.cipso);
  90. kfree(ptr->map.std->lvl.local);
  91. kfree(ptr->map.std->cat.cipso);
  92. kfree(ptr->map.std->cat.local);
  93. break;
  94. }
  95. kfree(ptr);
  96. }
  97. /**
  98. * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
  99. * @info: the Generic NETLINK info block
  100. * @doi_def: the CIPSO V4 DOI definition
  101. *
  102. * Description:
  103. * Parse the common sections of a ADD message and fill in the related values
  104. * in @doi_def. Returns zero on success, negative values on failure.
  105. *
  106. */
  107. static int netlbl_cipsov4_add_common(struct genl_info *info,
  108. struct cipso_v4_doi *doi_def)
  109. {
  110. struct nlattr *nla;
  111. int nla_rem;
  112. u32 iter = 0;
  113. doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
  114. if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST],
  115. NLBL_CIPSOV4_A_MAX,
  116. netlbl_cipsov4_genl_policy) != 0)
  117. return -EINVAL;
  118. nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
  119. if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
  120. if (iter >= CIPSO_V4_TAG_MAXCNT)
  121. return -EINVAL;
  122. doi_def->tags[iter++] = nla_get_u8(nla);
  123. }
  124. while (iter < CIPSO_V4_TAG_MAXCNT)
  125. doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
  126. return 0;
  127. }
  128. /*
  129. * NetLabel Command Handlers
  130. */
  131. /**
  132. * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
  133. * @info: the Generic NETLINK info block
  134. *
  135. * Description:
  136. * Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message
  137. * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
  138. * error.
  139. *
  140. */
  141. static int netlbl_cipsov4_add_std(struct genl_info *info)
  142. {
  143. int ret_val = -EINVAL;
  144. struct cipso_v4_doi *doi_def = NULL;
  145. struct nlattr *nla_a;
  146. struct nlattr *nla_b;
  147. int nla_a_rem;
  148. int nla_b_rem;
  149. u32 iter;
  150. if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
  151. !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
  152. return -EINVAL;
  153. if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
  154. NLBL_CIPSOV4_A_MAX,
  155. netlbl_cipsov4_genl_policy) != 0)
  156. return -EINVAL;
  157. doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
  158. if (doi_def == NULL)
  159. return -ENOMEM;
  160. doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
  161. if (doi_def->map.std == NULL) {
  162. ret_val = -ENOMEM;
  163. goto add_std_failure;
  164. }
  165. doi_def->type = CIPSO_V4_MAP_STD;
  166. ret_val = netlbl_cipsov4_add_common(info, doi_def);
  167. if (ret_val != 0)
  168. goto add_std_failure;
  169. ret_val = -EINVAL;
  170. nla_for_each_nested(nla_a,
  171. info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
  172. nla_a_rem)
  173. if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSLVL) {
  174. if (nla_validate_nested(nla_a,
  175. NLBL_CIPSOV4_A_MAX,
  176. netlbl_cipsov4_genl_policy) != 0)
  177. goto add_std_failure;
  178. nla_for_each_nested(nla_b, nla_a, nla_b_rem)
  179. switch (nla_b->nla_type) {
  180. case NLBL_CIPSOV4_A_MLSLVLLOC:
  181. if (nla_get_u32(nla_b) >
  182. CIPSO_V4_MAX_LOC_LVLS)
  183. goto add_std_failure;
  184. if (nla_get_u32(nla_b) >=
  185. doi_def->map.std->lvl.local_size)
  186. doi_def->map.std->lvl.local_size =
  187. nla_get_u32(nla_b) + 1;
  188. break;
  189. case NLBL_CIPSOV4_A_MLSLVLREM:
  190. if (nla_get_u32(nla_b) >
  191. CIPSO_V4_MAX_REM_LVLS)
  192. goto add_std_failure;
  193. if (nla_get_u32(nla_b) >=
  194. doi_def->map.std->lvl.cipso_size)
  195. doi_def->map.std->lvl.cipso_size =
  196. nla_get_u32(nla_b) + 1;
  197. break;
  198. }
  199. }
  200. doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
  201. sizeof(u32),
  202. GFP_KERNEL);
  203. if (doi_def->map.std->lvl.local == NULL) {
  204. ret_val = -ENOMEM;
  205. goto add_std_failure;
  206. }
  207. doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
  208. sizeof(u32),
  209. GFP_KERNEL);
  210. if (doi_def->map.std->lvl.cipso == NULL) {
  211. ret_val = -ENOMEM;
  212. goto add_std_failure;
  213. }
  214. for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
  215. doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
  216. for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
  217. doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
  218. nla_for_each_nested(nla_a,
  219. info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
  220. nla_a_rem)
  221. if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSLVL) {
  222. struct nlattr *lvl_loc;
  223. struct nlattr *lvl_rem;
  224. lvl_loc = nla_find_nested(nla_a,
  225. NLBL_CIPSOV4_A_MLSLVLLOC);
  226. lvl_rem = nla_find_nested(nla_a,
  227. NLBL_CIPSOV4_A_MLSLVLREM);
  228. if (lvl_loc == NULL || lvl_rem == NULL)
  229. goto add_std_failure;
  230. doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
  231. nla_get_u32(lvl_rem);
  232. doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
  233. nla_get_u32(lvl_loc);
  234. }
  235. if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
  236. if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
  237. NLBL_CIPSOV4_A_MAX,
  238. netlbl_cipsov4_genl_policy) != 0)
  239. goto add_std_failure;
  240. nla_for_each_nested(nla_a,
  241. info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
  242. nla_a_rem)
  243. if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSCAT) {
  244. if (nla_validate_nested(nla_a,
  245. NLBL_CIPSOV4_A_MAX,
  246. netlbl_cipsov4_genl_policy) != 0)
  247. goto add_std_failure;
  248. nla_for_each_nested(nla_b, nla_a, nla_b_rem)
  249. switch (nla_b->nla_type) {
  250. case NLBL_CIPSOV4_A_MLSCATLOC:
  251. if (nla_get_u32(nla_b) >
  252. CIPSO_V4_MAX_LOC_CATS)
  253. goto add_std_failure;
  254. if (nla_get_u32(nla_b) >=
  255. doi_def->map.std->cat.local_size)
  256. doi_def->map.std->cat.local_size =
  257. nla_get_u32(nla_b) + 1;
  258. break;
  259. case NLBL_CIPSOV4_A_MLSCATREM:
  260. if (nla_get_u32(nla_b) >
  261. CIPSO_V4_MAX_REM_CATS)
  262. goto add_std_failure;
  263. if (nla_get_u32(nla_b) >=
  264. doi_def->map.std->cat.cipso_size)
  265. doi_def->map.std->cat.cipso_size =
  266. nla_get_u32(nla_b) + 1;
  267. break;
  268. }
  269. }
  270. doi_def->map.std->cat.local = kcalloc(
  271. doi_def->map.std->cat.local_size,
  272. sizeof(u32),
  273. GFP_KERNEL);
  274. if (doi_def->map.std->cat.local == NULL) {
  275. ret_val = -ENOMEM;
  276. goto add_std_failure;
  277. }
  278. doi_def->map.std->cat.cipso = kcalloc(
  279. doi_def->map.std->cat.cipso_size,
  280. sizeof(u32),
  281. GFP_KERNEL);
  282. if (doi_def->map.std->cat.cipso == NULL) {
  283. ret_val = -ENOMEM;
  284. goto add_std_failure;
  285. }
  286. for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
  287. doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
  288. for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
  289. doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
  290. nla_for_each_nested(nla_a,
  291. info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
  292. nla_a_rem)
  293. if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSCAT) {
  294. struct nlattr *cat_loc;
  295. struct nlattr *cat_rem;
  296. cat_loc = nla_find_nested(nla_a,
  297. NLBL_CIPSOV4_A_MLSCATLOC);
  298. cat_rem = nla_find_nested(nla_a,
  299. NLBL_CIPSOV4_A_MLSCATREM);
  300. if (cat_loc == NULL || cat_rem == NULL)
  301. goto add_std_failure;
  302. doi_def->map.std->cat.local[
  303. nla_get_u32(cat_loc)] =
  304. nla_get_u32(cat_rem);
  305. doi_def->map.std->cat.cipso[
  306. nla_get_u32(cat_rem)] =
  307. nla_get_u32(cat_loc);
  308. }
  309. }
  310. ret_val = cipso_v4_doi_add(doi_def);
  311. if (ret_val != 0)
  312. goto add_std_failure;
  313. return 0;
  314. add_std_failure:
  315. if (doi_def)
  316. netlbl_cipsov4_doi_free(&doi_def->rcu);
  317. return ret_val;
  318. }
  319. /**
  320. * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
  321. * @info: the Generic NETLINK info block
  322. *
  323. * Description:
  324. * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
  325. * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
  326. * error.
  327. *
  328. */
  329. static int netlbl_cipsov4_add_pass(struct genl_info *info)
  330. {
  331. int ret_val;
  332. struct cipso_v4_doi *doi_def = NULL;
  333. if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
  334. return -EINVAL;
  335. doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
  336. if (doi_def == NULL)
  337. return -ENOMEM;
  338. doi_def->type = CIPSO_V4_MAP_PASS;
  339. ret_val = netlbl_cipsov4_add_common(info, doi_def);
  340. if (ret_val != 0)
  341. goto add_pass_failure;
  342. ret_val = cipso_v4_doi_add(doi_def);
  343. if (ret_val != 0)
  344. goto add_pass_failure;
  345. return 0;
  346. add_pass_failure:
  347. netlbl_cipsov4_doi_free(&doi_def->rcu);
  348. return ret_val;
  349. }
  350. /**
  351. * netlbl_cipsov4_add - Handle an ADD message
  352. * @skb: the NETLINK buffer
  353. * @info: the Generic NETLINK info block
  354. *
  355. * Description:
  356. * Create a new DOI definition based on the given ADD message and add it to the
  357. * CIPSO V4 engine. Returns zero on success, negative values on failure.
  358. *
  359. */
  360. static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
  361. {
  362. int ret_val = -EINVAL;
  363. u32 type;
  364. u32 doi;
  365. const char *type_str = "(unknown)";
  366. struct audit_buffer *audit_buf;
  367. struct netlbl_audit audit_info;
  368. if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
  369. !info->attrs[NLBL_CIPSOV4_A_MTYPE])
  370. return -EINVAL;
  371. doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
  372. netlbl_netlink_auditinfo(skb, &audit_info);
  373. type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
  374. switch (type) {
  375. case CIPSO_V4_MAP_STD:
  376. type_str = "std";
  377. ret_val = netlbl_cipsov4_add_std(info);
  378. break;
  379. case CIPSO_V4_MAP_PASS:
  380. type_str = "pass";
  381. ret_val = netlbl_cipsov4_add_pass(info);
  382. break;
  383. }
  384. audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
  385. &audit_info);
  386. if (audit_buf != NULL) {
  387. audit_log_format(audit_buf,
  388. " cipso_doi=%u cipso_type=%s res=%u",
  389. doi,
  390. type_str,
  391. ret_val == 0 ? 1 : 0);
  392. audit_log_end(audit_buf);
  393. }
  394. return ret_val;
  395. }
  396. /**
  397. * netlbl_cipsov4_list - Handle a LIST message
  398. * @skb: the NETLINK buffer
  399. * @info: the Generic NETLINK info block
  400. *
  401. * Description:
  402. * Process a user generated LIST message and respond accordingly. While the
  403. * response message generated by the kernel is straightforward, determining
  404. * before hand the size of the buffer to allocate is not (we have to generate
  405. * the message to know the size). In order to keep this function sane what we
  406. * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
  407. * that size, if we fail then we restart with a larger buffer and try again.
  408. * We continue in this manner until we hit a limit of failed attempts then we
  409. * give up and just send an error message. Returns zero on success and
  410. * negative values on error.
  411. *
  412. */
  413. static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
  414. {
  415. int ret_val;
  416. struct sk_buff *ans_skb = NULL;
  417. u32 nlsze_mult = 1;
  418. void *data;
  419. u32 doi;
  420. struct nlattr *nla_a;
  421. struct nlattr *nla_b;
  422. struct cipso_v4_doi *doi_def;
  423. u32 iter;
  424. if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
  425. ret_val = -EINVAL;
  426. goto list_failure;
  427. }
  428. list_start:
  429. ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
  430. if (ans_skb == NULL) {
  431. ret_val = -ENOMEM;
  432. goto list_failure;
  433. }
  434. data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
  435. 0, NLBL_CIPSOV4_C_LIST);
  436. if (data == NULL) {
  437. ret_val = -ENOMEM;
  438. goto list_failure;
  439. }
  440. doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
  441. rcu_read_lock();
  442. doi_def = cipso_v4_doi_getdef(doi);
  443. if (doi_def == NULL) {
  444. ret_val = -EINVAL;
  445. goto list_failure;
  446. }
  447. ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
  448. if (ret_val != 0)
  449. goto list_failure_lock;
  450. nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST);
  451. if (nla_a == NULL) {
  452. ret_val = -ENOMEM;
  453. goto list_failure_lock;
  454. }
  455. for (iter = 0;
  456. iter < CIPSO_V4_TAG_MAXCNT &&
  457. doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
  458. iter++) {
  459. ret_val = nla_put_u8(ans_skb,
  460. NLBL_CIPSOV4_A_TAG,
  461. doi_def->tags[iter]);
  462. if (ret_val != 0)
  463. goto list_failure_lock;
  464. }
  465. nla_nest_end(ans_skb, nla_a);
  466. switch (doi_def->type) {
  467. case CIPSO_V4_MAP_STD:
  468. nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
  469. if (nla_a == NULL) {
  470. ret_val = -ENOMEM;
  471. goto list_failure_lock;
  472. }
  473. for (iter = 0;
  474. iter < doi_def->map.std->lvl.local_size;
  475. iter++) {
  476. if (doi_def->map.std->lvl.local[iter] ==
  477. CIPSO_V4_INV_LVL)
  478. continue;
  479. nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL);
  480. if (nla_b == NULL) {
  481. ret_val = -ENOMEM;
  482. goto list_retry;
  483. }
  484. ret_val = nla_put_u32(ans_skb,
  485. NLBL_CIPSOV4_A_MLSLVLLOC,
  486. iter);
  487. if (ret_val != 0)
  488. goto list_retry;
  489. ret_val = nla_put_u32(ans_skb,
  490. NLBL_CIPSOV4_A_MLSLVLREM,
  491. doi_def->map.std->lvl.local[iter]);
  492. if (ret_val != 0)
  493. goto list_retry;
  494. nla_nest_end(ans_skb, nla_b);
  495. }
  496. nla_nest_end(ans_skb, nla_a);
  497. nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST);
  498. if (nla_a == NULL) {
  499. ret_val = -ENOMEM;
  500. goto list_retry;
  501. }
  502. for (iter = 0;
  503. iter < doi_def->map.std->cat.local_size;
  504. iter++) {
  505. if (doi_def->map.std->cat.local[iter] ==
  506. CIPSO_V4_INV_CAT)
  507. continue;
  508. nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT);
  509. if (nla_b == NULL) {
  510. ret_val = -ENOMEM;
  511. goto list_retry;
  512. }
  513. ret_val = nla_put_u32(ans_skb,
  514. NLBL_CIPSOV4_A_MLSCATLOC,
  515. iter);
  516. if (ret_val != 0)
  517. goto list_retry;
  518. ret_val = nla_put_u32(ans_skb,
  519. NLBL_CIPSOV4_A_MLSCATREM,
  520. doi_def->map.std->cat.local[iter]);
  521. if (ret_val != 0)
  522. goto list_retry;
  523. nla_nest_end(ans_skb, nla_b);
  524. }
  525. nla_nest_end(ans_skb, nla_a);
  526. break;
  527. }
  528. rcu_read_unlock();
  529. genlmsg_end(ans_skb, data);
  530. ret_val = genlmsg_reply(ans_skb, info);
  531. if (ret_val != 0)
  532. goto list_failure;
  533. return 0;
  534. list_retry:
  535. /* XXX - this limit is a guesstimate */
  536. if (nlsze_mult < 4) {
  537. rcu_read_unlock();
  538. kfree_skb(ans_skb);
  539. nlsze_mult++;
  540. goto list_start;
  541. }
  542. list_failure_lock:
  543. rcu_read_unlock();
  544. list_failure:
  545. kfree_skb(ans_skb);
  546. return ret_val;
  547. }
  548. /**
  549. * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
  550. * @doi_def: the CIPSOv4 DOI definition
  551. * @arg: the netlbl_cipsov4_doiwalk_arg structure
  552. *
  553. * Description:
  554. * This function is designed to be used as a callback to the
  555. * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
  556. * message. Returns the size of the message on success, negative values on
  557. * failure.
  558. *
  559. */
  560. static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
  561. {
  562. int ret_val = -ENOMEM;
  563. struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
  564. void *data;
  565. data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
  566. cb_arg->seq, &netlbl_cipsov4_gnl_family,
  567. NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
  568. if (data == NULL)
  569. goto listall_cb_failure;
  570. ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
  571. if (ret_val != 0)
  572. goto listall_cb_failure;
  573. ret_val = nla_put_u32(cb_arg->skb,
  574. NLBL_CIPSOV4_A_MTYPE,
  575. doi_def->type);
  576. if (ret_val != 0)
  577. goto listall_cb_failure;
  578. return genlmsg_end(cb_arg->skb, data);
  579. listall_cb_failure:
  580. genlmsg_cancel(cb_arg->skb, data);
  581. return ret_val;
  582. }
  583. /**
  584. * netlbl_cipsov4_listall - Handle a LISTALL message
  585. * @skb: the NETLINK buffer
  586. * @cb: the NETLINK callback
  587. *
  588. * Description:
  589. * Process a user generated LISTALL message and respond accordingly. Returns
  590. * zero on success and negative values on error.
  591. *
  592. */
  593. static int netlbl_cipsov4_listall(struct sk_buff *skb,
  594. struct netlink_callback *cb)
  595. {
  596. struct netlbl_cipsov4_doiwalk_arg cb_arg;
  597. int doi_skip = cb->args[0];
  598. cb_arg.nl_cb = cb;
  599. cb_arg.skb = skb;
  600. cb_arg.seq = cb->nlh->nlmsg_seq;
  601. cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
  602. cb->args[0] = doi_skip;
  603. return skb->len;
  604. }
  605. /**
  606. * netlbl_cipsov4_remove - Handle a REMOVE message
  607. * @skb: the NETLINK buffer
  608. * @info: the Generic NETLINK info block
  609. *
  610. * Description:
  611. * Process a user generated REMOVE message and respond accordingly. Returns
  612. * zero on success, negative values on failure.
  613. *
  614. */
  615. static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
  616. {
  617. int ret_val = -EINVAL;
  618. u32 doi = 0;
  619. struct audit_buffer *audit_buf;
  620. struct netlbl_audit audit_info;
  621. if (!info->attrs[NLBL_CIPSOV4_A_DOI])
  622. return -EINVAL;
  623. doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
  624. netlbl_netlink_auditinfo(skb, &audit_info);
  625. ret_val = cipso_v4_doi_remove(doi,
  626. &audit_info,
  627. netlbl_cipsov4_doi_free);
  628. audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
  629. &audit_info);
  630. if (audit_buf != NULL) {
  631. audit_log_format(audit_buf,
  632. " cipso_doi=%u res=%u",
  633. doi,
  634. ret_val == 0 ? 1 : 0);
  635. audit_log_end(audit_buf);
  636. }
  637. return ret_val;
  638. }
  639. /*
  640. * NetLabel Generic NETLINK Command Definitions
  641. */
  642. static struct genl_ops netlbl_cipsov4_genl_c_add = {
  643. .cmd = NLBL_CIPSOV4_C_ADD,
  644. .flags = GENL_ADMIN_PERM,
  645. .policy = netlbl_cipsov4_genl_policy,
  646. .doit = netlbl_cipsov4_add,
  647. .dumpit = NULL,
  648. };
  649. static struct genl_ops netlbl_cipsov4_genl_c_remove = {
  650. .cmd = NLBL_CIPSOV4_C_REMOVE,
  651. .flags = GENL_ADMIN_PERM,
  652. .policy = netlbl_cipsov4_genl_policy,
  653. .doit = netlbl_cipsov4_remove,
  654. .dumpit = NULL,
  655. };
  656. static struct genl_ops netlbl_cipsov4_genl_c_list = {
  657. .cmd = NLBL_CIPSOV4_C_LIST,
  658. .flags = 0,
  659. .policy = netlbl_cipsov4_genl_policy,
  660. .doit = netlbl_cipsov4_list,
  661. .dumpit = NULL,
  662. };
  663. static struct genl_ops netlbl_cipsov4_genl_c_listall = {
  664. .cmd = NLBL_CIPSOV4_C_LISTALL,
  665. .flags = 0,
  666. .policy = netlbl_cipsov4_genl_policy,
  667. .doit = NULL,
  668. .dumpit = netlbl_cipsov4_listall,
  669. };
  670. /*
  671. * NetLabel Generic NETLINK Protocol Functions
  672. */
  673. /**
  674. * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
  675. *
  676. * Description:
  677. * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
  678. * mechanism. Returns zero on success, negative values on failure.
  679. *
  680. */
  681. int netlbl_cipsov4_genl_init(void)
  682. {
  683. int ret_val;
  684. ret_val = genl_register_family(&netlbl_cipsov4_gnl_family);
  685. if (ret_val != 0)
  686. return ret_val;
  687. ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
  688. &netlbl_cipsov4_genl_c_add);
  689. if (ret_val != 0)
  690. return ret_val;
  691. ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
  692. &netlbl_cipsov4_genl_c_remove);
  693. if (ret_val != 0)
  694. return ret_val;
  695. ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
  696. &netlbl_cipsov4_genl_c_list);
  697. if (ret_val != 0)
  698. return ret_val;
  699. ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
  700. &netlbl_cipsov4_genl_c_listall);
  701. if (ret_val != 0)
  702. return ret_val;
  703. return 0;
  704. }