netlabel_calipso.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. * NetLabel CALIPSO/IPv6 Support
  4. *
  5. * This file defines the CALIPSO/IPv6 functions for the NetLabel system. The
  6. * NetLabel system manages static and dynamic label mappings for network
  7. * protocols such as CIPSO and CALIPSO.
  8. *
  9. * Authors: Paul Moore <paul@paul-moore.com>
  10. * Huw Davies <huw@codeweavers.com>
  11. */
  12. /* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  13. * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
  14. */
  15. #include <linux/types.h>
  16. #include <linux/socket.h>
  17. #include <linux/string.h>
  18. #include <linux/skbuff.h>
  19. #include <linux/audit.h>
  20. #include <linux/slab.h>
  21. #include <net/sock.h>
  22. #include <net/netlink.h>
  23. #include <net/genetlink.h>
  24. #include <net/netlabel.h>
  25. #include <net/calipso.h>
  26. #include <linux/atomic.h>
  27. #include "netlabel_user.h"
  28. #include "netlabel_calipso.h"
  29. #include "netlabel_mgmt.h"
  30. #include "netlabel_domainhash.h"
  31. /* Argument struct for calipso_doi_walk() */
  32. struct netlbl_calipso_doiwalk_arg {
  33. struct netlink_callback *nl_cb;
  34. struct sk_buff *skb;
  35. u32 seq;
  36. };
  37. /* Argument struct for netlbl_domhsh_walk() */
  38. struct netlbl_domhsh_walk_arg {
  39. struct netlbl_audit *audit_info;
  40. u32 doi;
  41. };
  42. /* NetLabel Generic NETLINK CALIPSO family */
  43. static struct genl_family netlbl_calipso_gnl_family;
  44. /* NetLabel Netlink attribute policy */
  45. static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
  46. [NLBL_CALIPSO_A_DOI] = { .type = NLA_U32 },
  47. [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
  48. };
  49. /* NetLabel Command Handlers
  50. */
  51. /**
  52. * netlbl_calipso_add_pass - Adds a CALIPSO pass DOI definition
  53. * @info: the Generic NETLINK info block
  54. * @audit_info: NetLabel audit information
  55. *
  56. * Description:
  57. * Create a new CALIPSO_MAP_PASS DOI definition based on the given ADD message
  58. * and add it to the CALIPSO engine. Return zero on success and non-zero on
  59. * error.
  60. *
  61. */
  62. static int netlbl_calipso_add_pass(struct genl_info *info,
  63. struct netlbl_audit *audit_info)
  64. {
  65. int ret_val;
  66. struct calipso_doi *doi_def = NULL;
  67. doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
  68. if (!doi_def)
  69. return -ENOMEM;
  70. doi_def->type = CALIPSO_MAP_PASS;
  71. doi_def->doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
  72. ret_val = calipso_doi_add(doi_def, audit_info);
  73. if (ret_val != 0)
  74. calipso_doi_free(doi_def);
  75. return ret_val;
  76. }
  77. /**
  78. * netlbl_calipso_add - Handle an ADD message
  79. * @skb: the NETLINK buffer
  80. * @info: the Generic NETLINK info block
  81. *
  82. * Description:
  83. * Create a new DOI definition based on the given ADD message and add it to the
  84. * CALIPSO engine. Returns zero on success, negative values on failure.
  85. *
  86. */
  87. static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
  88. {
  89. int ret_val = -EINVAL;
  90. struct netlbl_audit audit_info;
  91. if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
  92. !info->attrs[NLBL_CALIPSO_A_MTYPE])
  93. return -EINVAL;
  94. netlbl_netlink_auditinfo(skb, &audit_info);
  95. switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
  96. case CALIPSO_MAP_PASS:
  97. ret_val = netlbl_calipso_add_pass(info, &audit_info);
  98. break;
  99. }
  100. if (ret_val == 0)
  101. atomic_inc(&netlabel_mgmt_protocount);
  102. return ret_val;
  103. }
  104. /**
  105. * netlbl_calipso_list - Handle a LIST message
  106. * @skb: the NETLINK buffer
  107. * @info: the Generic NETLINK info block
  108. *
  109. * Description:
  110. * Process a user generated LIST message and respond accordingly.
  111. * Returns zero on success and negative values on error.
  112. *
  113. */
  114. static int netlbl_calipso_list(struct sk_buff *skb, struct genl_info *info)
  115. {
  116. int ret_val;
  117. struct sk_buff *ans_skb = NULL;
  118. void *data;
  119. u32 doi;
  120. struct calipso_doi *doi_def;
  121. if (!info->attrs[NLBL_CALIPSO_A_DOI]) {
  122. ret_val = -EINVAL;
  123. goto list_failure;
  124. }
  125. doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
  126. doi_def = calipso_doi_getdef(doi);
  127. if (!doi_def) {
  128. ret_val = -EINVAL;
  129. goto list_failure;
  130. }
  131. ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  132. if (!ans_skb) {
  133. ret_val = -ENOMEM;
  134. goto list_failure_put;
  135. }
  136. data = genlmsg_put_reply(ans_skb, info, &netlbl_calipso_gnl_family,
  137. 0, NLBL_CALIPSO_C_LIST);
  138. if (!data) {
  139. ret_val = -ENOMEM;
  140. goto list_failure_put;
  141. }
  142. ret_val = nla_put_u32(ans_skb, NLBL_CALIPSO_A_MTYPE, doi_def->type);
  143. if (ret_val != 0)
  144. goto list_failure_put;
  145. calipso_doi_putdef(doi_def);
  146. genlmsg_end(ans_skb, data);
  147. return genlmsg_reply(ans_skb, info);
  148. list_failure_put:
  149. calipso_doi_putdef(doi_def);
  150. list_failure:
  151. kfree_skb(ans_skb);
  152. return ret_val;
  153. }
  154. /**
  155. * netlbl_calipso_listall_cb - calipso_doi_walk() callback for LISTALL
  156. * @doi_def: the CALIPSO DOI definition
  157. * @arg: the netlbl_calipso_doiwalk_arg structure
  158. *
  159. * Description:
  160. * This function is designed to be used as a callback to the
  161. * calipso_doi_walk() function for use in generating a response for a LISTALL
  162. * message. Returns the size of the message on success, negative values on
  163. * failure.
  164. *
  165. */
  166. static int netlbl_calipso_listall_cb(struct calipso_doi *doi_def, void *arg)
  167. {
  168. int ret_val = -ENOMEM;
  169. struct netlbl_calipso_doiwalk_arg *cb_arg = arg;
  170. void *data;
  171. data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
  172. cb_arg->seq, &netlbl_calipso_gnl_family,
  173. NLM_F_MULTI, NLBL_CALIPSO_C_LISTALL);
  174. if (!data)
  175. goto listall_cb_failure;
  176. ret_val = nla_put_u32(cb_arg->skb, NLBL_CALIPSO_A_DOI, doi_def->doi);
  177. if (ret_val != 0)
  178. goto listall_cb_failure;
  179. ret_val = nla_put_u32(cb_arg->skb,
  180. NLBL_CALIPSO_A_MTYPE,
  181. doi_def->type);
  182. if (ret_val != 0)
  183. goto listall_cb_failure;
  184. genlmsg_end(cb_arg->skb, data);
  185. return 0;
  186. listall_cb_failure:
  187. genlmsg_cancel(cb_arg->skb, data);
  188. return ret_val;
  189. }
  190. /**
  191. * netlbl_calipso_listall - Handle a LISTALL message
  192. * @skb: the NETLINK buffer
  193. * @cb: the NETLINK callback
  194. *
  195. * Description:
  196. * Process a user generated LISTALL message and respond accordingly. Returns
  197. * zero on success and negative values on error.
  198. *
  199. */
  200. static int netlbl_calipso_listall(struct sk_buff *skb,
  201. struct netlink_callback *cb)
  202. {
  203. struct netlbl_calipso_doiwalk_arg cb_arg;
  204. u32 doi_skip = cb->args[0];
  205. cb_arg.nl_cb = cb;
  206. cb_arg.skb = skb;
  207. cb_arg.seq = cb->nlh->nlmsg_seq;
  208. calipso_doi_walk(&doi_skip, netlbl_calipso_listall_cb, &cb_arg);
  209. cb->args[0] = doi_skip;
  210. return skb->len;
  211. }
  212. /**
  213. * netlbl_calipso_remove_cb - netlbl_calipso_remove() callback for REMOVE
  214. * @entry: LSM domain mapping entry
  215. * @arg: the netlbl_domhsh_walk_arg structure
  216. *
  217. * Description:
  218. * This function is intended for use by netlbl_calipso_remove() as the callback
  219. * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
  220. * which are associated with the CALIPSO DOI specified in @arg. Returns zero on
  221. * success, negative values on failure.
  222. *
  223. */
  224. static int netlbl_calipso_remove_cb(struct netlbl_dom_map *entry, void *arg)
  225. {
  226. struct netlbl_domhsh_walk_arg *cb_arg = arg;
  227. if (entry->def.type == NETLBL_NLTYPE_CALIPSO &&
  228. entry->def.calipso->doi == cb_arg->doi)
  229. return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
  230. return 0;
  231. }
  232. /**
  233. * netlbl_calipso_remove - Handle a REMOVE message
  234. * @skb: the NETLINK buffer
  235. * @info: the Generic NETLINK info block
  236. *
  237. * Description:
  238. * Process a user generated REMOVE message and respond accordingly. Returns
  239. * zero on success, negative values on failure.
  240. *
  241. */
  242. static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info)
  243. {
  244. int ret_val = -EINVAL;
  245. struct netlbl_domhsh_walk_arg cb_arg;
  246. struct netlbl_audit audit_info;
  247. u32 skip_bkt = 0;
  248. u32 skip_chain = 0;
  249. if (!info->attrs[NLBL_CALIPSO_A_DOI])
  250. return -EINVAL;
  251. netlbl_netlink_auditinfo(skb, &audit_info);
  252. cb_arg.doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
  253. cb_arg.audit_info = &audit_info;
  254. ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
  255. netlbl_calipso_remove_cb, &cb_arg);
  256. if (ret_val == 0 || ret_val == -ENOENT) {
  257. ret_val = calipso_doi_remove(cb_arg.doi, &audit_info);
  258. if (ret_val == 0)
  259. atomic_dec(&netlabel_mgmt_protocount);
  260. }
  261. return ret_val;
  262. }
  263. /* NetLabel Generic NETLINK Command Definitions
  264. */
  265. static const struct genl_small_ops netlbl_calipso_ops[] = {
  266. {
  267. .cmd = NLBL_CALIPSO_C_ADD,
  268. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  269. .flags = GENL_ADMIN_PERM,
  270. .doit = netlbl_calipso_add,
  271. .dumpit = NULL,
  272. },
  273. {
  274. .cmd = NLBL_CALIPSO_C_REMOVE,
  275. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  276. .flags = GENL_ADMIN_PERM,
  277. .doit = netlbl_calipso_remove,
  278. .dumpit = NULL,
  279. },
  280. {
  281. .cmd = NLBL_CALIPSO_C_LIST,
  282. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  283. .flags = 0,
  284. .doit = netlbl_calipso_list,
  285. .dumpit = NULL,
  286. },
  287. {
  288. .cmd = NLBL_CALIPSO_C_LISTALL,
  289. .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
  290. .flags = 0,
  291. .doit = NULL,
  292. .dumpit = netlbl_calipso_listall,
  293. },
  294. };
  295. static struct genl_family netlbl_calipso_gnl_family __ro_after_init = {
  296. .hdrsize = 0,
  297. .name = NETLBL_NLTYPE_CALIPSO_NAME,
  298. .version = NETLBL_PROTO_VERSION,
  299. .maxattr = NLBL_CALIPSO_A_MAX,
  300. .policy = calipso_genl_policy,
  301. .module = THIS_MODULE,
  302. .small_ops = netlbl_calipso_ops,
  303. .n_small_ops = ARRAY_SIZE(netlbl_calipso_ops),
  304. };
  305. /* NetLabel Generic NETLINK Protocol Functions
  306. */
  307. /**
  308. * netlbl_calipso_genl_init - Register the CALIPSO NetLabel component
  309. *
  310. * Description:
  311. * Register the CALIPSO packet NetLabel component with the Generic NETLINK
  312. * mechanism. Returns zero on success, negative values on failure.
  313. *
  314. */
  315. int __init netlbl_calipso_genl_init(void)
  316. {
  317. return genl_register_family(&netlbl_calipso_gnl_family);
  318. }
  319. static const struct netlbl_calipso_ops *calipso_ops;
  320. /**
  321. * netlbl_calipso_ops_register - Register the CALIPSO operations
  322. *
  323. * Description:
  324. * Register the CALIPSO packet engine operations.
  325. *
  326. */
  327. const struct netlbl_calipso_ops *
  328. netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
  329. {
  330. return xchg(&calipso_ops, ops);
  331. }
  332. EXPORT_SYMBOL(netlbl_calipso_ops_register);
  333. static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
  334. {
  335. return READ_ONCE(calipso_ops);
  336. }
  337. /**
  338. * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
  339. * @doi_def: the DOI structure
  340. * @audit_info: NetLabel audit information
  341. *
  342. * Description:
  343. * The caller defines a new DOI for use by the CALIPSO engine and calls this
  344. * function to add it to the list of acceptable domains. The caller must
  345. * ensure that the mapping table specified in @doi_def->map meets all of the
  346. * requirements of the mapping type (see calipso.h for details). Returns
  347. * zero on success and non-zero on failure.
  348. *
  349. */
  350. int calipso_doi_add(struct calipso_doi *doi_def,
  351. struct netlbl_audit *audit_info)
  352. {
  353. int ret_val = -ENOMSG;
  354. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  355. if (ops)
  356. ret_val = ops->doi_add(doi_def, audit_info);
  357. return ret_val;
  358. }
  359. /**
  360. * calipso_doi_free - Frees a DOI definition
  361. * @doi_def: the DOI definition
  362. *
  363. * Description:
  364. * This function frees all of the memory associated with a DOI definition.
  365. *
  366. */
  367. void calipso_doi_free(struct calipso_doi *doi_def)
  368. {
  369. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  370. if (ops)
  371. ops->doi_free(doi_def);
  372. }
  373. /**
  374. * calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine
  375. * @doi: the DOI value
  376. * @audit_info: NetLabel audit information
  377. *
  378. * Description:
  379. * Removes a DOI definition from the CALIPSO engine. The NetLabel routines will
  380. * be called to release their own LSM domain mappings as well as our own
  381. * domain list. Returns zero on success and negative values on failure.
  382. *
  383. */
  384. int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info)
  385. {
  386. int ret_val = -ENOMSG;
  387. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  388. if (ops)
  389. ret_val = ops->doi_remove(doi, audit_info);
  390. return ret_val;
  391. }
  392. /**
  393. * calipso_doi_getdef - Returns a reference to a valid DOI definition
  394. * @doi: the DOI value
  395. *
  396. * Description:
  397. * Searches for a valid DOI definition and if one is found it is returned to
  398. * the caller. Otherwise NULL is returned. The caller must ensure that
  399. * calipso_doi_putdef() is called when the caller is done.
  400. *
  401. */
  402. struct calipso_doi *calipso_doi_getdef(u32 doi)
  403. {
  404. struct calipso_doi *ret_val = NULL;
  405. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  406. if (ops)
  407. ret_val = ops->doi_getdef(doi);
  408. return ret_val;
  409. }
  410. /**
  411. * calipso_doi_putdef - Releases a reference for the given DOI definition
  412. * @doi_def: the DOI definition
  413. *
  414. * Description:
  415. * Releases a DOI definition reference obtained from calipso_doi_getdef().
  416. *
  417. */
  418. void calipso_doi_putdef(struct calipso_doi *doi_def)
  419. {
  420. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  421. if (ops)
  422. ops->doi_putdef(doi_def);
  423. }
  424. /**
  425. * calipso_doi_walk - Iterate through the DOI definitions
  426. * @skip_cnt: skip past this number of DOI definitions, updated
  427. * @callback: callback for each DOI definition
  428. * @cb_arg: argument for the callback function
  429. *
  430. * Description:
  431. * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
  432. * For each entry call @callback, if @callback returns a negative value stop
  433. * 'walking' through the list and return. Updates the value in @skip_cnt upon
  434. * return. Returns zero on success, negative values on failure.
  435. *
  436. */
  437. int calipso_doi_walk(u32 *skip_cnt,
  438. int (*callback)(struct calipso_doi *doi_def, void *arg),
  439. void *cb_arg)
  440. {
  441. int ret_val = -ENOMSG;
  442. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  443. if (ops)
  444. ret_val = ops->doi_walk(skip_cnt, callback, cb_arg);
  445. return ret_val;
  446. }
  447. /**
  448. * calipso_sock_getattr - Get the security attributes from a sock
  449. * @sk: the sock
  450. * @secattr: the security attributes
  451. *
  452. * Description:
  453. * Query @sk to see if there is a CALIPSO option attached to the sock and if
  454. * there is return the CALIPSO security attributes in @secattr. This function
  455. * requires that @sk be locked, or privately held, but it does not do any
  456. * locking itself. Returns zero on success and negative values on failure.
  457. *
  458. */
  459. int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
  460. {
  461. int ret_val = -ENOMSG;
  462. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  463. if (ops)
  464. ret_val = ops->sock_getattr(sk, secattr);
  465. return ret_val;
  466. }
  467. /**
  468. * calipso_sock_setattr - Add a CALIPSO option to a socket
  469. * @sk: the socket
  470. * @doi_def: the CALIPSO DOI to use
  471. * @secattr: the specific security attributes of the socket
  472. *
  473. * Description:
  474. * Set the CALIPSO option on the given socket using the DOI definition and
  475. * security attributes passed to the function. This function requires
  476. * exclusive access to @sk, which means it either needs to be in the
  477. * process of being created or locked. Returns zero on success and negative
  478. * values on failure.
  479. *
  480. */
  481. int calipso_sock_setattr(struct sock *sk,
  482. const struct calipso_doi *doi_def,
  483. const struct netlbl_lsm_secattr *secattr)
  484. {
  485. int ret_val = -ENOMSG;
  486. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  487. if (ops)
  488. ret_val = ops->sock_setattr(sk, doi_def, secattr);
  489. return ret_val;
  490. }
  491. /**
  492. * calipso_sock_delattr - Delete the CALIPSO option from a socket
  493. * @sk: the socket
  494. *
  495. * Description:
  496. * Removes the CALIPSO option from a socket, if present.
  497. *
  498. */
  499. void calipso_sock_delattr(struct sock *sk)
  500. {
  501. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  502. if (ops)
  503. ops->sock_delattr(sk);
  504. }
  505. /**
  506. * calipso_req_setattr - Add a CALIPSO option to a connection request socket
  507. * @req: the connection request socket
  508. * @doi_def: the CALIPSO DOI to use
  509. * @secattr: the specific security attributes of the socket
  510. *
  511. * Description:
  512. * Set the CALIPSO option on the given socket using the DOI definition and
  513. * security attributes passed to the function. Returns zero on success and
  514. * negative values on failure.
  515. *
  516. */
  517. int calipso_req_setattr(struct request_sock *req,
  518. const struct calipso_doi *doi_def,
  519. const struct netlbl_lsm_secattr *secattr)
  520. {
  521. int ret_val = -ENOMSG;
  522. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  523. if (ops)
  524. ret_val = ops->req_setattr(req, doi_def, secattr);
  525. return ret_val;
  526. }
  527. /**
  528. * calipso_req_delattr - Delete the CALIPSO option from a request socket
  529. * @req: the request socket
  530. *
  531. * Description:
  532. * Removes the CALIPSO option from a request socket, if present.
  533. *
  534. */
  535. void calipso_req_delattr(struct request_sock *req)
  536. {
  537. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  538. if (ops)
  539. ops->req_delattr(req);
  540. }
  541. /**
  542. * calipso_optptr - Find the CALIPSO option in the packet
  543. * @skb: the packet
  544. *
  545. * Description:
  546. * Parse the packet's IP header looking for a CALIPSO option. Returns a pointer
  547. * to the start of the CALIPSO option on success, NULL if one if not found.
  548. *
  549. */
  550. unsigned char *calipso_optptr(const struct sk_buff *skb)
  551. {
  552. unsigned char *ret_val = NULL;
  553. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  554. if (ops)
  555. ret_val = ops->skbuff_optptr(skb);
  556. return ret_val;
  557. }
  558. /**
  559. * calipso_getattr - Get the security attributes from a memory block.
  560. * @calipso: the CALIPSO option
  561. * @secattr: the security attributes
  562. *
  563. * Description:
  564. * Inspect @calipso and return the security attributes in @secattr.
  565. * Returns zero on success and negative values on failure.
  566. *
  567. */
  568. int calipso_getattr(const unsigned char *calipso,
  569. struct netlbl_lsm_secattr *secattr)
  570. {
  571. int ret_val = -ENOMSG;
  572. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  573. if (ops)
  574. ret_val = ops->opt_getattr(calipso, secattr);
  575. return ret_val;
  576. }
  577. /**
  578. * calipso_skbuff_setattr - Set the CALIPSO option on a packet
  579. * @skb: the packet
  580. * @doi_def: the CALIPSO DOI to use
  581. * @secattr: the security attributes
  582. *
  583. * Description:
  584. * Set the CALIPSO option on the given packet based on the security attributes.
  585. * Returns a pointer to the IP header on success and NULL on failure.
  586. *
  587. */
  588. int calipso_skbuff_setattr(struct sk_buff *skb,
  589. const struct calipso_doi *doi_def,
  590. const struct netlbl_lsm_secattr *secattr)
  591. {
  592. int ret_val = -ENOMSG;
  593. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  594. if (ops)
  595. ret_val = ops->skbuff_setattr(skb, doi_def, secattr);
  596. return ret_val;
  597. }
  598. /**
  599. * calipso_skbuff_delattr - Delete any CALIPSO options from a packet
  600. * @skb: the packet
  601. *
  602. * Description:
  603. * Removes any and all CALIPSO options from the given packet. Returns zero on
  604. * success, negative values on failure.
  605. *
  606. */
  607. int calipso_skbuff_delattr(struct sk_buff *skb)
  608. {
  609. int ret_val = -ENOMSG;
  610. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  611. if (ops)
  612. ret_val = ops->skbuff_delattr(skb);
  613. return ret_val;
  614. }
  615. /**
  616. * calipso_cache_invalidate - Invalidates the current CALIPSO cache
  617. *
  618. * Description:
  619. * Invalidates and frees any entries in the CALIPSO cache. Returns zero on
  620. * success and negative values on failure.
  621. *
  622. */
  623. void calipso_cache_invalidate(void)
  624. {
  625. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  626. if (ops)
  627. ops->cache_invalidate();
  628. }
  629. /**
  630. * calipso_cache_add - Add an entry to the CALIPSO cache
  631. * @calipso_ptr: the CALIPSO option
  632. * @secattr: the packet's security attributes
  633. *
  634. * Description:
  635. * Add a new entry into the CALIPSO label mapping cache.
  636. * Returns zero on success, negative values on failure.
  637. *
  638. */
  639. int calipso_cache_add(const unsigned char *calipso_ptr,
  640. const struct netlbl_lsm_secattr *secattr)
  641. {
  642. int ret_val = -ENOMSG;
  643. const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
  644. if (ops)
  645. ret_val = ops->cache_add(calipso_ptr, secattr);
  646. return ret_val;
  647. }