]>
Commit | Line | Data |
---|---|---|
96cb8e33 PM |
1 | /* |
2 | * NetLabel CIPSO/IPv4 Support | |
3 | * | |
4 | * This file defines the CIPSO/IPv4 functions for the NetLabel system. The | |
5 | * NetLabel system manages static and dynamic label mappings for network | |
6 | * protocols such as CIPSO and RIPSO. | |
7 | * | |
82c21bfa | 8 | * Author: Paul Moore <paul@paul-moore.com> |
96cb8e33 PM |
9 | * |
10 | */ | |
11 | ||
12 | /* | |
13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 | |
14 | * | |
15 | * This program is free software; you can redistribute it and/or modify | |
16 | * it under the terms of the GNU General Public License as published by | |
17 | * the Free Software Foundation; either version 2 of the License, or | |
18 | * (at your option) any later version. | |
19 | * | |
20 | * This program is distributed in the hope that it will be useful, | |
21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See | |
23 | * the GNU General Public License for more details. | |
24 | * | |
25 | * You should have received a copy of the GNU General Public License | |
d484ff15 | 26 | * along with this program; if not, see <http://www.gnu.org/licenses/>. |
96cb8e33 PM |
27 | * |
28 | */ | |
29 | ||
30 | #include <linux/types.h> | |
31 | #include <linux/socket.h> | |
32 | #include <linux/string.h> | |
33 | #include <linux/skbuff.h> | |
32f50cde | 34 | #include <linux/audit.h> |
5a0e3ad6 | 35 | #include <linux/slab.h> |
96cb8e33 PM |
36 | #include <net/sock.h> |
37 | #include <net/netlink.h> | |
38 | #include <net/genetlink.h> | |
39 | #include <net/netlabel.h> | |
40 | #include <net/cipso_ipv4.h> | |
60063497 | 41 | #include <linux/atomic.h> |
96cb8e33 PM |
42 | |
43 | #include "netlabel_user.h" | |
44 | #include "netlabel_cipso_v4.h" | |
23bcdc1a | 45 | #include "netlabel_mgmt.h" |
b1edeb10 | 46 | #include "netlabel_domainhash.h" |
96cb8e33 | 47 | |
fd385855 PM |
48 | /* Argument struct for cipso_v4_doi_walk() */ |
49 | struct netlbl_cipsov4_doiwalk_arg { | |
50 | struct netlink_callback *nl_cb; | |
51 | struct sk_buff *skb; | |
52 | u32 seq; | |
53 | }; | |
54 | ||
b1edeb10 PM |
55 | /* Argument struct for netlbl_domhsh_walk() */ |
56 | struct netlbl_domhsh_walk_arg { | |
57 | struct netlbl_audit *audit_info; | |
58 | u32 doi; | |
59 | }; | |
60 | ||
96cb8e33 | 61 | /* NetLabel Generic NETLINK CIPSOv4 family */ |
489111e5 | 62 | static struct genl_family netlbl_cipsov4_gnl_family; |
fd385855 | 63 | /* NetLabel Netlink attribute policy */ |
ef7c79ed | 64 | static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = { |
fd385855 PM |
65 | [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 }, |
66 | [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 }, | |
67 | [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 }, | |
68 | [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED }, | |
69 | [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 }, | |
70 | [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 }, | |
71 | [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED }, | |
72 | [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED }, | |
73 | [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 }, | |
74 | [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 }, | |
75 | [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED }, | |
76 | [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED }, | |
77 | }; | |
96cb8e33 PM |
78 | |
79 | /* | |
80 | * Helper Functions | |
81 | */ | |
82 | ||
fd385855 PM |
83 | /** |
84 | * netlbl_cipsov4_add_common - Parse the common sections of a ADD message | |
85 | * @info: the Generic NETLINK info block | |
86 | * @doi_def: the CIPSO V4 DOI definition | |
87 | * | |
88 | * Description: | |
89 | * Parse the common sections of a ADD message and fill in the related values | |
90 | * in @doi_def. Returns zero on success, negative values on failure. | |
91 | * | |
92 | */ | |
93 | static int netlbl_cipsov4_add_common(struct genl_info *info, | |
94 | struct cipso_v4_doi *doi_def) | |
95 | { | |
96 | struct nlattr *nla; | |
97 | int nla_rem; | |
98 | u32 iter = 0; | |
99 | ||
100 | doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); | |
101 | ||
102 | if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST], | |
103 | NLBL_CIPSOV4_A_MAX, | |
fceb6435 | 104 | netlbl_cipsov4_genl_policy, NULL) != 0) |
fd385855 PM |
105 | return -EINVAL; |
106 | ||
107 | nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem) | |
8f4c1f9b | 108 | if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) { |
2a2f11c2 | 109 | if (iter >= CIPSO_V4_TAG_MAXCNT) |
fd385855 PM |
110 | return -EINVAL; |
111 | doi_def->tags[iter++] = nla_get_u8(nla); | |
112 | } | |
2a2f11c2 PM |
113 | while (iter < CIPSO_V4_TAG_MAXCNT) |
114 | doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID; | |
fd385855 PM |
115 | |
116 | return 0; | |
117 | } | |
96cb8e33 PM |
118 | |
119 | /* | |
120 | * NetLabel Command Handlers | |
121 | */ | |
122 | ||
123 | /** | |
124 | * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition | |
fd385855 | 125 | * @info: the Generic NETLINK info block |
6c2e8ac0 | 126 | * @audit_info: NetLabel audit information |
96cb8e33 PM |
127 | * |
128 | * Description: | |
15c45f7b PM |
129 | * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD |
130 | * message and add it to the CIPSO V4 engine. Return zero on success and | |
131 | * non-zero on error. | |
96cb8e33 PM |
132 | * |
133 | */ | |
6c2e8ac0 PM |
134 | static int netlbl_cipsov4_add_std(struct genl_info *info, |
135 | struct netlbl_audit *audit_info) | |
96cb8e33 PM |
136 | { |
137 | int ret_val = -EINVAL; | |
96cb8e33 | 138 | struct cipso_v4_doi *doi_def = NULL; |
fd385855 PM |
139 | struct nlattr *nla_a; |
140 | struct nlattr *nla_b; | |
141 | int nla_a_rem; | |
142 | int nla_b_rem; | |
caff5b6a | 143 | u32 iter; |
96cb8e33 | 144 | |
32f50cde | 145 | if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] || |
fd385855 PM |
146 | !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST]) |
147 | return -EINVAL; | |
148 | ||
149 | if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], | |
150 | NLBL_CIPSOV4_A_MAX, | |
fceb6435 | 151 | netlbl_cipsov4_genl_policy, NULL) != 0) |
fd385855 | 152 | return -EINVAL; |
96cb8e33 PM |
153 | |
154 | doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); | |
fd385855 PM |
155 | if (doi_def == NULL) |
156 | return -ENOMEM; | |
96cb8e33 PM |
157 | doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL); |
158 | if (doi_def->map.std == NULL) { | |
159 | ret_val = -ENOMEM; | |
160 | goto add_std_failure; | |
161 | } | |
15c45f7b | 162 | doi_def->type = CIPSO_V4_MAP_TRANS; |
96cb8e33 | 163 | |
fd385855 PM |
164 | ret_val = netlbl_cipsov4_add_common(info, doi_def); |
165 | if (ret_val != 0) | |
96cb8e33 | 166 | goto add_std_failure; |
1fd2a25b | 167 | ret_val = -EINVAL; |
96cb8e33 | 168 | |
fd385855 PM |
169 | nla_for_each_nested(nla_a, |
170 | info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], | |
171 | nla_a_rem) | |
8f4c1f9b | 172 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { |
fceb6435 JB |
173 | if (nla_validate_nested(nla_a, NLBL_CIPSOV4_A_MAX, |
174 | netlbl_cipsov4_genl_policy, | |
175 | NULL) != 0) | |
176 | goto add_std_failure; | |
fd385855 | 177 | nla_for_each_nested(nla_b, nla_a, nla_b_rem) |
8f4c1f9b | 178 | switch (nla_type(nla_b)) { |
fd385855 | 179 | case NLBL_CIPSOV4_A_MLSLVLLOC: |
1fd2a25b PM |
180 | if (nla_get_u32(nla_b) > |
181 | CIPSO_V4_MAX_LOC_LVLS) | |
182 | goto add_std_failure; | |
fd385855 PM |
183 | if (nla_get_u32(nla_b) >= |
184 | doi_def->map.std->lvl.local_size) | |
185 | doi_def->map.std->lvl.local_size = | |
186 | nla_get_u32(nla_b) + 1; | |
187 | break; | |
188 | case NLBL_CIPSOV4_A_MLSLVLREM: | |
1fd2a25b PM |
189 | if (nla_get_u32(nla_b) > |
190 | CIPSO_V4_MAX_REM_LVLS) | |
191 | goto add_std_failure; | |
fd385855 PM |
192 | if (nla_get_u32(nla_b) >= |
193 | doi_def->map.std->lvl.cipso_size) | |
194 | doi_def->map.std->lvl.cipso_size = | |
195 | nla_get_u32(nla_b) + 1; | |
196 | break; | |
197 | } | |
198 | } | |
96cb8e33 PM |
199 | doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, |
200 | sizeof(u32), | |
201 | GFP_KERNEL); | |
202 | if (doi_def->map.std->lvl.local == NULL) { | |
203 | ret_val = -ENOMEM; | |
204 | goto add_std_failure; | |
205 | } | |
96cb8e33 PM |
206 | doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, |
207 | sizeof(u32), | |
208 | GFP_KERNEL); | |
209 | if (doi_def->map.std->lvl.cipso == NULL) { | |
210 | ret_val = -ENOMEM; | |
211 | goto add_std_failure; | |
212 | } | |
caff5b6a PM |
213 | for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++) |
214 | doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL; | |
215 | for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++) | |
216 | doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL; | |
fd385855 PM |
217 | nla_for_each_nested(nla_a, |
218 | info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], | |
219 | nla_a_rem) | |
8f4c1f9b | 220 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { |
fd385855 PM |
221 | struct nlattr *lvl_loc; |
222 | struct nlattr *lvl_rem; | |
223 | ||
fd385855 PM |
224 | lvl_loc = nla_find_nested(nla_a, |
225 | NLBL_CIPSOV4_A_MLSLVLLOC); | |
226 | lvl_rem = nla_find_nested(nla_a, | |
227 | NLBL_CIPSOV4_A_MLSLVLREM); | |
228 | if (lvl_loc == NULL || lvl_rem == NULL) | |
229 | goto add_std_failure; | |
230 | doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] = | |
231 | nla_get_u32(lvl_rem); | |
232 | doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] = | |
233 | nla_get_u32(lvl_loc); | |
234 | } | |
96cb8e33 | 235 | |
fd385855 PM |
236 | if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) { |
237 | if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST], | |
238 | NLBL_CIPSOV4_A_MAX, | |
fceb6435 | 239 | netlbl_cipsov4_genl_policy, NULL) != 0) |
fd385855 PM |
240 | goto add_std_failure; |
241 | ||
242 | nla_for_each_nested(nla_a, | |
243 | info->attrs[NLBL_CIPSOV4_A_MLSCATLST], | |
244 | nla_a_rem) | |
8f4c1f9b | 245 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { |
fd385855 | 246 | if (nla_validate_nested(nla_a, |
fceb6435 JB |
247 | NLBL_CIPSOV4_A_MAX, |
248 | netlbl_cipsov4_genl_policy, | |
249 | NULL) != 0) | |
fd385855 PM |
250 | goto add_std_failure; |
251 | nla_for_each_nested(nla_b, nla_a, nla_b_rem) | |
8f4c1f9b | 252 | switch (nla_type(nla_b)) { |
fd385855 | 253 | case NLBL_CIPSOV4_A_MLSCATLOC: |
1fd2a25b PM |
254 | if (nla_get_u32(nla_b) > |
255 | CIPSO_V4_MAX_LOC_CATS) | |
256 | goto add_std_failure; | |
fd385855 PM |
257 | if (nla_get_u32(nla_b) >= |
258 | doi_def->map.std->cat.local_size) | |
259 | doi_def->map.std->cat.local_size = | |
260 | nla_get_u32(nla_b) + 1; | |
261 | break; | |
262 | case NLBL_CIPSOV4_A_MLSCATREM: | |
1fd2a25b PM |
263 | if (nla_get_u32(nla_b) > |
264 | CIPSO_V4_MAX_REM_CATS) | |
265 | goto add_std_failure; | |
fd385855 PM |
266 | if (nla_get_u32(nla_b) >= |
267 | doi_def->map.std->cat.cipso_size) | |
268 | doi_def->map.std->cat.cipso_size = | |
269 | nla_get_u32(nla_b) + 1; | |
270 | break; | |
271 | } | |
272 | } | |
fd385855 | 273 | doi_def->map.std->cat.local = kcalloc( |
e1a95265 | 274 | doi_def->map.std->cat.local_size, |
96cb8e33 PM |
275 | sizeof(u32), |
276 | GFP_KERNEL); | |
fd385855 PM |
277 | if (doi_def->map.std->cat.local == NULL) { |
278 | ret_val = -ENOMEM; | |
279 | goto add_std_failure; | |
280 | } | |
281 | doi_def->map.std->cat.cipso = kcalloc( | |
e1a95265 | 282 | doi_def->map.std->cat.cipso_size, |
96cb8e33 PM |
283 | sizeof(u32), |
284 | GFP_KERNEL); | |
fd385855 PM |
285 | if (doi_def->map.std->cat.cipso == NULL) { |
286 | ret_val = -ENOMEM; | |
96cb8e33 | 287 | goto add_std_failure; |
fd385855 | 288 | } |
caff5b6a PM |
289 | for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++) |
290 | doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT; | |
291 | for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++) | |
292 | doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT; | |
fd385855 PM |
293 | nla_for_each_nested(nla_a, |
294 | info->attrs[NLBL_CIPSOV4_A_MLSCATLST], | |
295 | nla_a_rem) | |
8f4c1f9b | 296 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { |
fd385855 PM |
297 | struct nlattr *cat_loc; |
298 | struct nlattr *cat_rem; | |
299 | ||
300 | cat_loc = nla_find_nested(nla_a, | |
301 | NLBL_CIPSOV4_A_MLSCATLOC); | |
302 | cat_rem = nla_find_nested(nla_a, | |
303 | NLBL_CIPSOV4_A_MLSCATREM); | |
304 | if (cat_loc == NULL || cat_rem == NULL) | |
305 | goto add_std_failure; | |
306 | doi_def->map.std->cat.local[ | |
e1a95265 | 307 | nla_get_u32(cat_loc)] = |
fd385855 PM |
308 | nla_get_u32(cat_rem); |
309 | doi_def->map.std->cat.cipso[ | |
e1a95265 | 310 | nla_get_u32(cat_rem)] = |
fd385855 PM |
311 | nla_get_u32(cat_loc); |
312 | } | |
96cb8e33 PM |
313 | } |
314 | ||
6c2e8ac0 | 315 | ret_val = cipso_v4_doi_add(doi_def, audit_info); |
96cb8e33 PM |
316 | if (ret_val != 0) |
317 | goto add_std_failure; | |
318 | return 0; | |
319 | ||
320 | add_std_failure: | |
7a11b1d3 | 321 | cipso_v4_doi_free(doi_def); |
96cb8e33 PM |
322 | return ret_val; |
323 | } | |
324 | ||
325 | /** | |
326 | * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition | |
fd385855 | 327 | * @info: the Generic NETLINK info block |
6c2e8ac0 | 328 | * @audit_info: NetLabel audit information |
96cb8e33 PM |
329 | * |
330 | * Description: | |
331 | * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message | |
332 | * and add it to the CIPSO V4 engine. Return zero on success and non-zero on | |
333 | * error. | |
334 | * | |
335 | */ | |
6c2e8ac0 PM |
336 | static int netlbl_cipsov4_add_pass(struct genl_info *info, |
337 | struct netlbl_audit *audit_info) | |
96cb8e33 | 338 | { |
fd385855 | 339 | int ret_val; |
96cb8e33 | 340 | struct cipso_v4_doi *doi_def = NULL; |
96cb8e33 | 341 | |
32f50cde | 342 | if (!info->attrs[NLBL_CIPSOV4_A_TAGLST]) |
fd385855 | 343 | return -EINVAL; |
96cb8e33 PM |
344 | |
345 | doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); | |
fd385855 PM |
346 | if (doi_def == NULL) |
347 | return -ENOMEM; | |
96cb8e33 PM |
348 | doi_def->type = CIPSO_V4_MAP_PASS; |
349 | ||
fd385855 PM |
350 | ret_val = netlbl_cipsov4_add_common(info, doi_def); |
351 | if (ret_val != 0) | |
352 | goto add_pass_failure; | |
96cb8e33 | 353 | |
6c2e8ac0 | 354 | ret_val = cipso_v4_doi_add(doi_def, audit_info); |
96cb8e33 PM |
355 | if (ret_val != 0) |
356 | goto add_pass_failure; | |
357 | return 0; | |
358 | ||
359 | add_pass_failure: | |
b1edeb10 | 360 | cipso_v4_doi_free(doi_def); |
96cb8e33 PM |
361 | return ret_val; |
362 | } | |
363 | ||
d91d4079 PM |
364 | /** |
365 | * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition | |
366 | * @info: the Generic NETLINK info block | |
6c2e8ac0 | 367 | * @audit_info: NetLabel audit information |
d91d4079 PM |
368 | * |
369 | * Description: | |
370 | * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD | |
371 | * message and add it to the CIPSO V4 engine. Return zero on success and | |
372 | * non-zero on error. | |
373 | * | |
374 | */ | |
6c2e8ac0 PM |
375 | static int netlbl_cipsov4_add_local(struct genl_info *info, |
376 | struct netlbl_audit *audit_info) | |
d91d4079 PM |
377 | { |
378 | int ret_val; | |
379 | struct cipso_v4_doi *doi_def = NULL; | |
380 | ||
381 | if (!info->attrs[NLBL_CIPSOV4_A_TAGLST]) | |
382 | return -EINVAL; | |
383 | ||
384 | doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); | |
385 | if (doi_def == NULL) | |
386 | return -ENOMEM; | |
387 | doi_def->type = CIPSO_V4_MAP_LOCAL; | |
388 | ||
389 | ret_val = netlbl_cipsov4_add_common(info, doi_def); | |
390 | if (ret_val != 0) | |
391 | goto add_local_failure; | |
392 | ||
6c2e8ac0 | 393 | ret_val = cipso_v4_doi_add(doi_def, audit_info); |
d91d4079 PM |
394 | if (ret_val != 0) |
395 | goto add_local_failure; | |
396 | return 0; | |
397 | ||
398 | add_local_failure: | |
399 | cipso_v4_doi_free(doi_def); | |
400 | return ret_val; | |
401 | } | |
402 | ||
96cb8e33 PM |
403 | /** |
404 | * netlbl_cipsov4_add - Handle an ADD message | |
405 | * @skb: the NETLINK buffer | |
406 | * @info: the Generic NETLINK info block | |
407 | * | |
408 | * Description: | |
409 | * Create a new DOI definition based on the given ADD message and add it to the | |
410 | * CIPSO V4 engine. Returns zero on success, negative values on failure. | |
411 | * | |
412 | */ | |
413 | static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) | |
414 | ||
415 | { | |
416 | int ret_val = -EINVAL; | |
95d4e6be | 417 | struct netlbl_audit audit_info; |
96cb8e33 | 418 | |
32f50cde PM |
419 | if (!info->attrs[NLBL_CIPSOV4_A_DOI] || |
420 | !info->attrs[NLBL_CIPSOV4_A_MTYPE]) | |
fd385855 | 421 | return -EINVAL; |
96cb8e33 | 422 | |
95d4e6be | 423 | netlbl_netlink_auditinfo(skb, &audit_info); |
6c2e8ac0 | 424 | switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) { |
15c45f7b | 425 | case CIPSO_V4_MAP_TRANS: |
6c2e8ac0 | 426 | ret_val = netlbl_cipsov4_add_std(info, &audit_info); |
96cb8e33 PM |
427 | break; |
428 | case CIPSO_V4_MAP_PASS: | |
6c2e8ac0 | 429 | ret_val = netlbl_cipsov4_add_pass(info, &audit_info); |
96cb8e33 | 430 | break; |
d91d4079 | 431 | case CIPSO_V4_MAP_LOCAL: |
6c2e8ac0 | 432 | ret_val = netlbl_cipsov4_add_local(info, &audit_info); |
d91d4079 | 433 | break; |
96cb8e33 | 434 | } |
23bcdc1a | 435 | if (ret_val == 0) |
c783f1ce | 436 | atomic_inc(&netlabel_mgmt_protocount); |
96cb8e33 | 437 | |
96cb8e33 PM |
438 | return ret_val; |
439 | } | |
440 | ||
441 | /** | |
442 | * netlbl_cipsov4_list - Handle a LIST message | |
443 | * @skb: the NETLINK buffer | |
444 | * @info: the Generic NETLINK info block | |
445 | * | |
446 | * Description: | |
fd385855 PM |
447 | * Process a user generated LIST message and respond accordingly. While the |
448 | * response message generated by the kernel is straightforward, determining | |
449 | * before hand the size of the buffer to allocate is not (we have to generate | |
450 | * the message to know the size). In order to keep this function sane what we | |
451 | * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in | |
452 | * that size, if we fail then we restart with a larger buffer and try again. | |
453 | * We continue in this manner until we hit a limit of failed attempts then we | |
454 | * give up and just send an error message. Returns zero on success and | |
455 | * negative values on error. | |
96cb8e33 PM |
456 | * |
457 | */ | |
458 | static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info) | |
459 | { | |
fd385855 PM |
460 | int ret_val; |
461 | struct sk_buff *ans_skb = NULL; | |
462 | u32 nlsze_mult = 1; | |
463 | void *data; | |
96cb8e33 | 464 | u32 doi; |
fd385855 PM |
465 | struct nlattr *nla_a; |
466 | struct nlattr *nla_b; | |
467 | struct cipso_v4_doi *doi_def; | |
468 | u32 iter; | |
96cb8e33 | 469 | |
fd385855 PM |
470 | if (!info->attrs[NLBL_CIPSOV4_A_DOI]) { |
471 | ret_val = -EINVAL; | |
96cb8e33 | 472 | goto list_failure; |
fd385855 | 473 | } |
96cb8e33 | 474 | |
fd385855 | 475 | list_start: |
339bf98f | 476 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL); |
96cb8e33 PM |
477 | if (ans_skb == NULL) { |
478 | ret_val = -ENOMEM; | |
479 | goto list_failure; | |
480 | } | |
17c157c8 TG |
481 | data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family, |
482 | 0, NLBL_CIPSOV4_C_LIST); | |
fd385855 PM |
483 | if (data == NULL) { |
484 | ret_val = -ENOMEM; | |
485 | goto list_failure; | |
486 | } | |
487 | ||
488 | doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); | |
489 | ||
490 | rcu_read_lock(); | |
491 | doi_def = cipso_v4_doi_getdef(doi); | |
492 | if (doi_def == NULL) { | |
493 | ret_val = -EINVAL; | |
56196701 | 494 | goto list_failure_lock; |
fd385855 PM |
495 | } |
496 | ||
497 | ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type); | |
498 | if (ret_val != 0) | |
499 | goto list_failure_lock; | |
500 | ||
ae0be8de | 501 | nla_a = nla_nest_start_noflag(ans_skb, NLBL_CIPSOV4_A_TAGLST); |
fd385855 PM |
502 | if (nla_a == NULL) { |
503 | ret_val = -ENOMEM; | |
504 | goto list_failure_lock; | |
505 | } | |
506 | for (iter = 0; | |
507 | iter < CIPSO_V4_TAG_MAXCNT && | |
508 | doi_def->tags[iter] != CIPSO_V4_TAG_INVALID; | |
509 | iter++) { | |
510 | ret_val = nla_put_u8(ans_skb, | |
511 | NLBL_CIPSOV4_A_TAG, | |
512 | doi_def->tags[iter]); | |
513 | if (ret_val != 0) | |
514 | goto list_failure_lock; | |
515 | } | |
516 | nla_nest_end(ans_skb, nla_a); | |
517 | ||
518 | switch (doi_def->type) { | |
15c45f7b | 519 | case CIPSO_V4_MAP_TRANS: |
ae0be8de MK |
520 | nla_a = nla_nest_start_noflag(ans_skb, |
521 | NLBL_CIPSOV4_A_MLSLVLLST); | |
fd385855 PM |
522 | if (nla_a == NULL) { |
523 | ret_val = -ENOMEM; | |
524 | goto list_failure_lock; | |
525 | } | |
526 | for (iter = 0; | |
527 | iter < doi_def->map.std->lvl.local_size; | |
528 | iter++) { | |
529 | if (doi_def->map.std->lvl.local[iter] == | |
530 | CIPSO_V4_INV_LVL) | |
531 | continue; | |
532 | ||
ae0be8de MK |
533 | nla_b = nla_nest_start_noflag(ans_skb, |
534 | NLBL_CIPSOV4_A_MLSLVL); | |
fd385855 PM |
535 | if (nla_b == NULL) { |
536 | ret_val = -ENOMEM; | |
537 | goto list_retry; | |
538 | } | |
539 | ret_val = nla_put_u32(ans_skb, | |
540 | NLBL_CIPSOV4_A_MLSLVLLOC, | |
541 | iter); | |
542 | if (ret_val != 0) | |
543 | goto list_retry; | |
544 | ret_val = nla_put_u32(ans_skb, | |
545 | NLBL_CIPSOV4_A_MLSLVLREM, | |
546 | doi_def->map.std->lvl.local[iter]); | |
547 | if (ret_val != 0) | |
548 | goto list_retry; | |
549 | nla_nest_end(ans_skb, nla_b); | |
550 | } | |
551 | nla_nest_end(ans_skb, nla_a); | |
552 | ||
ae0be8de MK |
553 | nla_a = nla_nest_start_noflag(ans_skb, |
554 | NLBL_CIPSOV4_A_MLSCATLST); | |
fd385855 PM |
555 | if (nla_a == NULL) { |
556 | ret_val = -ENOMEM; | |
557 | goto list_retry; | |
558 | } | |
559 | for (iter = 0; | |
560 | iter < doi_def->map.std->cat.local_size; | |
561 | iter++) { | |
562 | if (doi_def->map.std->cat.local[iter] == | |
563 | CIPSO_V4_INV_CAT) | |
564 | continue; | |
565 | ||
ae0be8de MK |
566 | nla_b = nla_nest_start_noflag(ans_skb, |
567 | NLBL_CIPSOV4_A_MLSCAT); | |
fd385855 PM |
568 | if (nla_b == NULL) { |
569 | ret_val = -ENOMEM; | |
570 | goto list_retry; | |
571 | } | |
572 | ret_val = nla_put_u32(ans_skb, | |
573 | NLBL_CIPSOV4_A_MLSCATLOC, | |
574 | iter); | |
575 | if (ret_val != 0) | |
576 | goto list_retry; | |
577 | ret_val = nla_put_u32(ans_skb, | |
578 | NLBL_CIPSOV4_A_MLSCATREM, | |
579 | doi_def->map.std->cat.local[iter]); | |
580 | if (ret_val != 0) | |
581 | goto list_retry; | |
582 | nla_nest_end(ans_skb, nla_b); | |
583 | } | |
584 | nla_nest_end(ans_skb, nla_a); | |
585 | ||
586 | break; | |
587 | } | |
588 | rcu_read_unlock(); | |
96cb8e33 | 589 | |
fd385855 | 590 | genlmsg_end(ans_skb, data); |
fe785bee | 591 | return genlmsg_reply(ans_skb, info); |
96cb8e33 | 592 | |
fd385855 PM |
593 | list_retry: |
594 | /* XXX - this limit is a guesstimate */ | |
595 | if (nlsze_mult < 4) { | |
596 | rcu_read_unlock(); | |
597 | kfree_skb(ans_skb); | |
83aa2e96 | 598 | nlsze_mult *= 2; |
fd385855 PM |
599 | goto list_start; |
600 | } | |
601 | list_failure_lock: | |
602 | rcu_read_unlock(); | |
96cb8e33 | 603 | list_failure: |
fd385855 PM |
604 | kfree_skb(ans_skb); |
605 | return ret_val; | |
606 | } | |
607 | ||
608 | /** | |
609 | * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL | |
610 | * @doi_def: the CIPSOv4 DOI definition | |
611 | * @arg: the netlbl_cipsov4_doiwalk_arg structure | |
612 | * | |
613 | * Description: | |
614 | * This function is designed to be used as a callback to the | |
615 | * cipso_v4_doi_walk() function for use in generating a response for a LISTALL | |
616 | * message. Returns the size of the message on success, negative values on | |
617 | * failure. | |
618 | * | |
619 | */ | |
620 | static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg) | |
621 | { | |
622 | int ret_val = -ENOMEM; | |
623 | struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg; | |
624 | void *data; | |
625 | ||
15e47304 | 626 | data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, |
17c157c8 TG |
627 | cb_arg->seq, &netlbl_cipsov4_gnl_family, |
628 | NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL); | |
fd385855 PM |
629 | if (data == NULL) |
630 | goto listall_cb_failure; | |
631 | ||
632 | ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi); | |
633 | if (ret_val != 0) | |
634 | goto listall_cb_failure; | |
635 | ret_val = nla_put_u32(cb_arg->skb, | |
636 | NLBL_CIPSOV4_A_MTYPE, | |
637 | doi_def->type); | |
638 | if (ret_val != 0) | |
639 | goto listall_cb_failure; | |
640 | ||
053c095a JB |
641 | genlmsg_end(cb_arg->skb, data); |
642 | return 0; | |
fd385855 PM |
643 | |
644 | listall_cb_failure: | |
645 | genlmsg_cancel(cb_arg->skb, data); | |
96cb8e33 PM |
646 | return ret_val; |
647 | } | |
648 | ||
649 | /** | |
650 | * netlbl_cipsov4_listall - Handle a LISTALL message | |
651 | * @skb: the NETLINK buffer | |
fd385855 | 652 | * @cb: the NETLINK callback |
96cb8e33 PM |
653 | * |
654 | * Description: | |
655 | * Process a user generated LISTALL message and respond accordingly. Returns | |
656 | * zero on success and negative values on error. | |
657 | * | |
658 | */ | |
fd385855 PM |
659 | static int netlbl_cipsov4_listall(struct sk_buff *skb, |
660 | struct netlink_callback *cb) | |
96cb8e33 | 661 | { |
fd385855 | 662 | struct netlbl_cipsov4_doiwalk_arg cb_arg; |
56196701 | 663 | u32 doi_skip = cb->args[0]; |
96cb8e33 | 664 | |
fd385855 PM |
665 | cb_arg.nl_cb = cb; |
666 | cb_arg.skb = skb; | |
667 | cb_arg.seq = cb->nlh->nlmsg_seq; | |
96cb8e33 | 668 | |
fd385855 | 669 | cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg); |
96cb8e33 | 670 | |
fd385855 PM |
671 | cb->args[0] = doi_skip; |
672 | return skb->len; | |
96cb8e33 PM |
673 | } |
674 | ||
b1edeb10 PM |
675 | /** |
676 | * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE | |
677 | * @entry: LSM domain mapping entry | |
678 | * @arg: the netlbl_domhsh_walk_arg structure | |
679 | * | |
680 | * Description: | |
681 | * This function is intended for use by netlbl_cipsov4_remove() as the callback | |
682 | * for the netlbl_domhsh_walk() function; it removes LSM domain map entries | |
683 | * which are associated with the CIPSO DOI specified in @arg. Returns zero on | |
684 | * success, negative values on failure. | |
685 | * | |
686 | */ | |
687 | static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg) | |
688 | { | |
689 | struct netlbl_domhsh_walk_arg *cb_arg = arg; | |
690 | ||
6a8b7f0c PM |
691 | if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 && |
692 | entry->def.cipso->doi == cb_arg->doi) | |
b1edeb10 PM |
693 | return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info); |
694 | ||
695 | return 0; | |
696 | } | |
697 | ||
96cb8e33 PM |
698 | /** |
699 | * netlbl_cipsov4_remove - Handle a REMOVE message | |
700 | * @skb: the NETLINK buffer | |
701 | * @info: the Generic NETLINK info block | |
702 | * | |
703 | * Description: | |
704 | * Process a user generated REMOVE message and respond accordingly. Returns | |
705 | * zero on success, negative values on failure. | |
706 | * | |
707 | */ | |
708 | static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info) | |
709 | { | |
fd385855 | 710 | int ret_val = -EINVAL; |
b1edeb10 | 711 | struct netlbl_domhsh_walk_arg cb_arg; |
95d4e6be | 712 | struct netlbl_audit audit_info; |
b1edeb10 PM |
713 | u32 skip_bkt = 0; |
714 | u32 skip_chain = 0; | |
96cb8e33 | 715 | |
95d4e6be PM |
716 | if (!info->attrs[NLBL_CIPSOV4_A_DOI]) |
717 | return -EINVAL; | |
32f50cde | 718 | |
95d4e6be | 719 | netlbl_netlink_auditinfo(skb, &audit_info); |
6c2e8ac0 | 720 | cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); |
b1edeb10 PM |
721 | cb_arg.audit_info = &audit_info; |
722 | ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain, | |
723 | netlbl_cipsov4_remove_cb, &cb_arg); | |
724 | if (ret_val == 0 || ret_val == -ENOENT) { | |
6c2e8ac0 | 725 | ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info); |
b1edeb10 PM |
726 | if (ret_val == 0) |
727 | atomic_dec(&netlabel_mgmt_protocount); | |
728 | } | |
95d4e6be | 729 | |
96cb8e33 PM |
730 | return ret_val; |
731 | } | |
732 | ||
733 | /* | |
734 | * NetLabel Generic NETLINK Command Definitions | |
735 | */ | |
736 | ||
4534de83 | 737 | static const struct genl_ops netlbl_cipsov4_ops[] = { |
227c43c3 | 738 | { |
96cb8e33 | 739 | .cmd = NLBL_CIPSOV4_C_ADD, |
fd385855 | 740 | .flags = GENL_ADMIN_PERM, |
96cb8e33 PM |
741 | .doit = netlbl_cipsov4_add, |
742 | .dumpit = NULL, | |
227c43c3 PE |
743 | }, |
744 | { | |
96cb8e33 | 745 | .cmd = NLBL_CIPSOV4_C_REMOVE, |
fd385855 | 746 | .flags = GENL_ADMIN_PERM, |
96cb8e33 PM |
747 | .doit = netlbl_cipsov4_remove, |
748 | .dumpit = NULL, | |
227c43c3 PE |
749 | }, |
750 | { | |
96cb8e33 PM |
751 | .cmd = NLBL_CIPSOV4_C_LIST, |
752 | .flags = 0, | |
753 | .doit = netlbl_cipsov4_list, | |
754 | .dumpit = NULL, | |
227c43c3 PE |
755 | }, |
756 | { | |
96cb8e33 PM |
757 | .cmd = NLBL_CIPSOV4_C_LISTALL, |
758 | .flags = 0, | |
fd385855 PM |
759 | .doit = NULL, |
760 | .dumpit = netlbl_cipsov4_listall, | |
227c43c3 | 761 | }, |
96cb8e33 PM |
762 | }; |
763 | ||
56989f6d | 764 | static struct genl_family netlbl_cipsov4_gnl_family __ro_after_init = { |
489111e5 JB |
765 | .hdrsize = 0, |
766 | .name = NETLBL_NLTYPE_CIPSOV4_NAME, | |
767 | .version = NETLBL_PROTO_VERSION, | |
768 | .maxattr = NLBL_CIPSOV4_A_MAX, | |
3b0f31f2 | 769 | .policy = netlbl_cipsov4_genl_policy, |
489111e5 JB |
770 | .module = THIS_MODULE, |
771 | .ops = netlbl_cipsov4_ops, | |
772 | .n_ops = ARRAY_SIZE(netlbl_cipsov4_ops), | |
773 | }; | |
774 | ||
96cb8e33 PM |
775 | /* |
776 | * NetLabel Generic NETLINK Protocol Functions | |
777 | */ | |
778 | ||
779 | /** | |
780 | * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component | |
781 | * | |
782 | * Description: | |
783 | * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK | |
784 | * mechanism. Returns zero on success, negative values on failure. | |
785 | * | |
786 | */ | |
05705e4e | 787 | int __init netlbl_cipsov4_genl_init(void) |
96cb8e33 | 788 | { |
489111e5 | 789 | return genl_register_family(&netlbl_cipsov4_gnl_family); |
96cb8e33 | 790 | } |