]>
Commit | Line | Data |
---|---|---|
d15c345f PM |
1 | /* |
2 | * NetLabel Management Support | |
3 | * | |
4 | * This file defines the management functions for the NetLabel system. The | |
5 | * NetLabel system manages static and dynamic label mappings for network | |
6 | * protocols such as CIPSO and RIPSO. | |
7 | * | |
82c21bfa | 8 | * Author: Paul Moore <paul@paul-moore.com> |
d15c345f PM |
9 | * |
10 | */ | |
11 | ||
12 | /* | |
63c41688 | 13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 |
d15c345f PM |
14 | * |
15 | * This program is free software; you can redistribute it and/or modify | |
16 | * it under the terms of the GNU General Public License as published by | |
17 | * the Free Software Foundation; either version 2 of the License, or | |
18 | * (at your option) any later version. | |
19 | * | |
20 | * This program is distributed in the hope that it will be useful, | |
21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See | |
23 | * the GNU General Public License for more details. | |
24 | * | |
25 | * You should have received a copy of the GNU General Public License | |
d484ff15 | 26 | * along with this program; if not, see <http://www.gnu.org/licenses/>. |
d15c345f PM |
27 | * |
28 | */ | |
29 | ||
30 | #include <linux/types.h> | |
31 | #include <linux/socket.h> | |
32 | #include <linux/string.h> | |
33 | #include <linux/skbuff.h> | |
63c41688 PM |
34 | #include <linux/in.h> |
35 | #include <linux/in6.h> | |
5a0e3ad6 | 36 | #include <linux/slab.h> |
d15c345f PM |
37 | #include <net/sock.h> |
38 | #include <net/netlink.h> | |
39 | #include <net/genetlink.h> | |
63c41688 PM |
40 | #include <net/ip.h> |
41 | #include <net/ipv6.h> | |
d15c345f PM |
42 | #include <net/netlabel.h> |
43 | #include <net/cipso_ipv4.h> | |
dc7de73f | 44 | #include <net/calipso.h> |
60063497 | 45 | #include <linux/atomic.h> |
d15c345f | 46 | |
dc7de73f | 47 | #include "netlabel_calipso.h" |
d15c345f PM |
48 | #include "netlabel_domainhash.h" |
49 | #include "netlabel_user.h" | |
50 | #include "netlabel_mgmt.h" | |
51 | ||
c783f1ce PM |
52 | /* NetLabel configured protocol counter */ |
53 | atomic_t netlabel_mgmt_protocount = ATOMIC_INIT(0); | |
23bcdc1a | 54 | |
fd385855 PM |
55 | /* Argument struct for netlbl_domhsh_walk() */ |
56 | struct netlbl_domhsh_walk_arg { | |
57 | struct netlink_callback *nl_cb; | |
58 | struct sk_buff *skb; | |
59 | u32 seq; | |
60 | }; | |
61 | ||
d15c345f | 62 | /* NetLabel Generic NETLINK CIPSOv4 family */ |
489111e5 | 63 | static struct genl_family netlbl_mgmt_gnl_family; |
d15c345f | 64 | |
fd385855 | 65 | /* NetLabel Netlink attribute policy */ |
ef7c79ed | 66 | static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = { |
fd385855 PM |
67 | [NLBL_MGMT_A_DOMAIN] = { .type = NLA_NUL_STRING }, |
68 | [NLBL_MGMT_A_PROTOCOL] = { .type = NLA_U32 }, | |
69 | [NLBL_MGMT_A_VERSION] = { .type = NLA_U32 }, | |
70 | [NLBL_MGMT_A_CV4DOI] = { .type = NLA_U32 }, | |
8f18e675 | 71 | [NLBL_MGMT_A_FAMILY] = { .type = NLA_U16 }, |
dc7de73f | 72 | [NLBL_MGMT_A_CLPDOI] = { .type = NLA_U32 }, |
fd385855 | 73 | }; |
d15c345f PM |
74 | |
75 | /* | |
63c41688 | 76 | * Helper Functions |
d15c345f PM |
77 | */ |
78 | ||
79 | /** | |
80 | * netlbl_mgmt_add - Handle an ADD message | |
d15c345f | 81 | * @info: the Generic NETLINK info block |
63c41688 | 82 | * @audit_info: NetLabel audit information |
d15c345f PM |
83 | * |
84 | * Description: | |
63c41688 PM |
85 | * Helper function for the ADD and ADDDEF messages to add the domain mappings |
86 | * from the message to the hash table. See netlabel.h for a description of the | |
87 | * message format. Returns zero on success, negative values on failure. | |
d15c345f PM |
88 | * |
89 | */ | |
63c41688 PM |
90 | static int netlbl_mgmt_add_common(struct genl_info *info, |
91 | struct netlbl_audit *audit_info) | |
d15c345f PM |
92 | { |
93 | int ret_val = -EINVAL; | |
63c41688 PM |
94 | struct netlbl_domaddr_map *addrmap = NULL; |
95 | struct cipso_v4_doi *cipsov4 = NULL; | |
dc7de73f HD |
96 | #if IS_ENABLED(CONFIG_IPV6) |
97 | struct calipso_doi *calipso = NULL; | |
98 | #endif | |
d15c345f | 99 | u32 tmp_val; |
4de46d5e | 100 | struct netlbl_dom_map *entry = kzalloc(sizeof(*entry), GFP_KERNEL); |
95d4e6be | 101 | |
4de46d5e ME |
102 | if (!entry) |
103 | return -ENOMEM; | |
6a8b7f0c | 104 | entry->def.type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]); |
63c41688 PM |
105 | if (info->attrs[NLBL_MGMT_A_DOMAIN]) { |
106 | size_t tmp_size = nla_len(info->attrs[NLBL_MGMT_A_DOMAIN]); | |
107 | entry->domain = kmalloc(tmp_size, GFP_KERNEL); | |
108 | if (entry->domain == NULL) { | |
109 | ret_val = -ENOMEM; | |
4de46d5e | 110 | goto add_free_entry; |
63c41688 PM |
111 | } |
112 | nla_strlcpy(entry->domain, | |
113 | info->attrs[NLBL_MGMT_A_DOMAIN], tmp_size); | |
114 | } | |
115 | ||
6a8b7f0c | 116 | /* NOTE: internally we allow/use a entry->def.type value of |
63c41688 PM |
117 | * NETLBL_NLTYPE_ADDRSELECT but we don't currently allow users |
118 | * to pass that as a protocol value because we need to know the | |
119 | * "real" protocol */ | |
d15c345f | 120 | |
6a8b7f0c | 121 | switch (entry->def.type) { |
fd385855 | 122 | case NETLBL_NLTYPE_UNLABELED: |
8f18e675 HD |
123 | if (info->attrs[NLBL_MGMT_A_FAMILY]) |
124 | entry->family = | |
125 | nla_get_u16(info->attrs[NLBL_MGMT_A_FAMILY]); | |
126 | else | |
127 | entry->family = AF_UNSPEC; | |
fd385855 PM |
128 | break; |
129 | case NETLBL_NLTYPE_CIPSOV4: | |
130 | if (!info->attrs[NLBL_MGMT_A_CV4DOI]) | |
4de46d5e | 131 | goto add_free_domain; |
d15c345f | 132 | |
fd385855 | 133 | tmp_val = nla_get_u32(info->attrs[NLBL_MGMT_A_CV4DOI]); |
63c41688 PM |
134 | cipsov4 = cipso_v4_doi_getdef(tmp_val); |
135 | if (cipsov4 == NULL) | |
4de46d5e | 136 | goto add_free_domain; |
8f18e675 | 137 | entry->family = AF_INET; |
6a8b7f0c | 138 | entry->def.cipso = cipsov4; |
fd385855 | 139 | break; |
dc7de73f HD |
140 | #if IS_ENABLED(CONFIG_IPV6) |
141 | case NETLBL_NLTYPE_CALIPSO: | |
142 | if (!info->attrs[NLBL_MGMT_A_CLPDOI]) | |
143 | goto add_free_domain; | |
144 | ||
145 | tmp_val = nla_get_u32(info->attrs[NLBL_MGMT_A_CLPDOI]); | |
146 | calipso = calipso_doi_getdef(tmp_val); | |
147 | if (calipso == NULL) | |
148 | goto add_free_domain; | |
149 | entry->family = AF_INET6; | |
150 | entry->def.calipso = calipso; | |
151 | break; | |
152 | #endif /* IPv6 */ | |
fd385855 | 153 | default: |
4de46d5e | 154 | goto add_free_domain; |
d15c345f | 155 | } |
63c41688 | 156 | |
8f18e675 HD |
157 | if ((entry->family == AF_INET && info->attrs[NLBL_MGMT_A_IPV6ADDR]) || |
158 | (entry->family == AF_INET6 && info->attrs[NLBL_MGMT_A_IPV4ADDR])) | |
159 | goto add_doi_put_def; | |
160 | ||
63c41688 PM |
161 | if (info->attrs[NLBL_MGMT_A_IPV4ADDR]) { |
162 | struct in_addr *addr; | |
163 | struct in_addr *mask; | |
164 | struct netlbl_domaddr4_map *map; | |
165 | ||
166 | addrmap = kzalloc(sizeof(*addrmap), GFP_KERNEL); | |
167 | if (addrmap == NULL) { | |
168 | ret_val = -ENOMEM; | |
4de46d5e | 169 | goto add_doi_put_def; |
63c41688 PM |
170 | } |
171 | INIT_LIST_HEAD(&addrmap->list4); | |
172 | INIT_LIST_HEAD(&addrmap->list6); | |
173 | ||
174 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV4ADDR]) != | |
175 | sizeof(struct in_addr)) { | |
176 | ret_val = -EINVAL; | |
4de46d5e | 177 | goto add_free_addrmap; |
63c41688 PM |
178 | } |
179 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV4MASK]) != | |
180 | sizeof(struct in_addr)) { | |
181 | ret_val = -EINVAL; | |
4de46d5e | 182 | goto add_free_addrmap; |
63c41688 PM |
183 | } |
184 | addr = nla_data(info->attrs[NLBL_MGMT_A_IPV4ADDR]); | |
185 | mask = nla_data(info->attrs[NLBL_MGMT_A_IPV4MASK]); | |
186 | ||
187 | map = kzalloc(sizeof(*map), GFP_KERNEL); | |
188 | if (map == NULL) { | |
189 | ret_val = -ENOMEM; | |
4de46d5e | 190 | goto add_free_addrmap; |
63c41688 PM |
191 | } |
192 | map->list.addr = addr->s_addr & mask->s_addr; | |
193 | map->list.mask = mask->s_addr; | |
194 | map->list.valid = 1; | |
6a8b7f0c | 195 | map->def.type = entry->def.type; |
63c41688 | 196 | if (cipsov4) |
6a8b7f0c | 197 | map->def.cipso = cipsov4; |
63c41688 PM |
198 | |
199 | ret_val = netlbl_af4list_add(&map->list, &addrmap->list4); | |
200 | if (ret_val != 0) { | |
201 | kfree(map); | |
4de46d5e | 202 | goto add_free_addrmap; |
63c41688 PM |
203 | } |
204 | ||
8f18e675 | 205 | entry->family = AF_INET; |
6a8b7f0c PM |
206 | entry->def.type = NETLBL_NLTYPE_ADDRSELECT; |
207 | entry->def.addrsel = addrmap; | |
dfd56b8b | 208 | #if IS_ENABLED(CONFIG_IPV6) |
63c41688 PM |
209 | } else if (info->attrs[NLBL_MGMT_A_IPV6ADDR]) { |
210 | struct in6_addr *addr; | |
211 | struct in6_addr *mask; | |
212 | struct netlbl_domaddr6_map *map; | |
213 | ||
214 | addrmap = kzalloc(sizeof(*addrmap), GFP_KERNEL); | |
215 | if (addrmap == NULL) { | |
216 | ret_val = -ENOMEM; | |
4de46d5e | 217 | goto add_doi_put_def; |
63c41688 PM |
218 | } |
219 | INIT_LIST_HEAD(&addrmap->list4); | |
220 | INIT_LIST_HEAD(&addrmap->list6); | |
221 | ||
222 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV6ADDR]) != | |
223 | sizeof(struct in6_addr)) { | |
224 | ret_val = -EINVAL; | |
4de46d5e | 225 | goto add_free_addrmap; |
63c41688 PM |
226 | } |
227 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV6MASK]) != | |
228 | sizeof(struct in6_addr)) { | |
229 | ret_val = -EINVAL; | |
4de46d5e | 230 | goto add_free_addrmap; |
63c41688 PM |
231 | } |
232 | addr = nla_data(info->attrs[NLBL_MGMT_A_IPV6ADDR]); | |
233 | mask = nla_data(info->attrs[NLBL_MGMT_A_IPV6MASK]); | |
234 | ||
235 | map = kzalloc(sizeof(*map), GFP_KERNEL); | |
236 | if (map == NULL) { | |
237 | ret_val = -ENOMEM; | |
4de46d5e | 238 | goto add_free_addrmap; |
63c41688 | 239 | } |
4e3fd7a0 | 240 | map->list.addr = *addr; |
63c41688 PM |
241 | map->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; |
242 | map->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; | |
243 | map->list.addr.s6_addr32[2] &= mask->s6_addr32[2]; | |
244 | map->list.addr.s6_addr32[3] &= mask->s6_addr32[3]; | |
4e3fd7a0 | 245 | map->list.mask = *mask; |
63c41688 | 246 | map->list.valid = 1; |
6a8b7f0c | 247 | map->def.type = entry->def.type; |
dc7de73f HD |
248 | if (calipso) |
249 | map->def.calipso = calipso; | |
63c41688 PM |
250 | |
251 | ret_val = netlbl_af6list_add(&map->list, &addrmap->list6); | |
252 | if (ret_val != 0) { | |
253 | kfree(map); | |
4de46d5e | 254 | goto add_free_addrmap; |
63c41688 PM |
255 | } |
256 | ||
8f18e675 | 257 | entry->family = AF_INET6; |
6a8b7f0c PM |
258 | entry->def.type = NETLBL_NLTYPE_ADDRSELECT; |
259 | entry->def.addrsel = addrmap; | |
63c41688 PM |
260 | #endif /* IPv6 */ |
261 | } | |
262 | ||
263 | ret_val = netlbl_domhsh_add(entry, audit_info); | |
fd385855 | 264 | if (ret_val != 0) |
4de46d5e | 265 | goto add_free_addrmap; |
d15c345f | 266 | |
d15c345f PM |
267 | return 0; |
268 | ||
4de46d5e | 269 | add_free_addrmap: |
63c41688 | 270 | kfree(addrmap); |
4de46d5e ME |
271 | add_doi_put_def: |
272 | cipso_v4_doi_putdef(cipsov4); | |
dc7de73f HD |
273 | #if IS_ENABLED(CONFIG_IPV6) |
274 | calipso_doi_putdef(calipso); | |
275 | #endif | |
4de46d5e ME |
276 | add_free_domain: |
277 | kfree(entry->domain); | |
278 | add_free_entry: | |
d15c345f | 279 | kfree(entry); |
d15c345f PM |
280 | return ret_val; |
281 | } | |
282 | ||
63c41688 PM |
283 | /** |
284 | * netlbl_mgmt_listentry - List a NetLabel/LSM domain map entry | |
285 | * @skb: the NETLINK buffer | |
286 | * @entry: the map entry | |
287 | * | |
288 | * Description: | |
289 | * This function is a helper function used by the LISTALL and LISTDEF command | |
25985edc | 290 | * handlers. The caller is responsible for ensuring that the RCU read lock |
63c41688 PM |
291 | * is held. Returns zero on success, negative values on failure. |
292 | * | |
293 | */ | |
294 | static int netlbl_mgmt_listentry(struct sk_buff *skb, | |
295 | struct netlbl_dom_map *entry) | |
296 | { | |
f8a02479 | 297 | int ret_val = 0; |
63c41688 PM |
298 | struct nlattr *nla_a; |
299 | struct nlattr *nla_b; | |
300 | struct netlbl_af4list *iter4; | |
dfd56b8b | 301 | #if IS_ENABLED(CONFIG_IPV6) |
63c41688 PM |
302 | struct netlbl_af6list *iter6; |
303 | #endif | |
304 | ||
305 | if (entry->domain != NULL) { | |
306 | ret_val = nla_put_string(skb, | |
307 | NLBL_MGMT_A_DOMAIN, entry->domain); | |
308 | if (ret_val != 0) | |
309 | return ret_val; | |
310 | } | |
311 | ||
8f18e675 HD |
312 | ret_val = nla_put_u16(skb, NLBL_MGMT_A_FAMILY, entry->family); |
313 | if (ret_val != 0) | |
314 | return ret_val; | |
315 | ||
6a8b7f0c | 316 | switch (entry->def.type) { |
63c41688 PM |
317 | case NETLBL_NLTYPE_ADDRSELECT: |
318 | nla_a = nla_nest_start(skb, NLBL_MGMT_A_SELECTORLIST); | |
319 | if (nla_a == NULL) | |
320 | return -ENOMEM; | |
321 | ||
6a8b7f0c | 322 | netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) { |
63c41688 PM |
323 | struct netlbl_domaddr4_map *map4; |
324 | struct in_addr addr_struct; | |
325 | ||
326 | nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR); | |
327 | if (nla_b == NULL) | |
328 | return -ENOMEM; | |
329 | ||
330 | addr_struct.s_addr = iter4->addr; | |
930345ea JB |
331 | ret_val = nla_put_in_addr(skb, NLBL_MGMT_A_IPV4ADDR, |
332 | addr_struct.s_addr); | |
63c41688 PM |
333 | if (ret_val != 0) |
334 | return ret_val; | |
335 | addr_struct.s_addr = iter4->mask; | |
930345ea JB |
336 | ret_val = nla_put_in_addr(skb, NLBL_MGMT_A_IPV4MASK, |
337 | addr_struct.s_addr); | |
63c41688 PM |
338 | if (ret_val != 0) |
339 | return ret_val; | |
340 | map4 = netlbl_domhsh_addr4_entry(iter4); | |
341 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, | |
6a8b7f0c | 342 | map4->def.type); |
63c41688 PM |
343 | if (ret_val != 0) |
344 | return ret_val; | |
6a8b7f0c | 345 | switch (map4->def.type) { |
63c41688 PM |
346 | case NETLBL_NLTYPE_CIPSOV4: |
347 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI, | |
6a8b7f0c | 348 | map4->def.cipso->doi); |
63c41688 PM |
349 | if (ret_val != 0) |
350 | return ret_val; | |
351 | break; | |
352 | } | |
353 | ||
354 | nla_nest_end(skb, nla_b); | |
355 | } | |
dfd56b8b | 356 | #if IS_ENABLED(CONFIG_IPV6) |
6a8b7f0c | 357 | netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) { |
63c41688 PM |
358 | struct netlbl_domaddr6_map *map6; |
359 | ||
360 | nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR); | |
361 | if (nla_b == NULL) | |
362 | return -ENOMEM; | |
363 | ||
930345ea JB |
364 | ret_val = nla_put_in6_addr(skb, NLBL_MGMT_A_IPV6ADDR, |
365 | &iter6->addr); | |
63c41688 PM |
366 | if (ret_val != 0) |
367 | return ret_val; | |
930345ea JB |
368 | ret_val = nla_put_in6_addr(skb, NLBL_MGMT_A_IPV6MASK, |
369 | &iter6->mask); | |
63c41688 PM |
370 | if (ret_val != 0) |
371 | return ret_val; | |
372 | map6 = netlbl_domhsh_addr6_entry(iter6); | |
373 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, | |
6a8b7f0c | 374 | map6->def.type); |
63c41688 PM |
375 | if (ret_val != 0) |
376 | return ret_val; | |
377 | ||
dc7de73f HD |
378 | switch (map6->def.type) { |
379 | case NETLBL_NLTYPE_CALIPSO: | |
380 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_CLPDOI, | |
381 | map6->def.calipso->doi); | |
382 | if (ret_val != 0) | |
383 | return ret_val; | |
384 | break; | |
385 | } | |
386 | ||
63c41688 PM |
387 | nla_nest_end(skb, nla_b); |
388 | } | |
389 | #endif /* IPv6 */ | |
390 | ||
391 | nla_nest_end(skb, nla_a); | |
392 | break; | |
393 | case NETLBL_NLTYPE_UNLABELED: | |
dc7de73f HD |
394 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, |
395 | entry->def.type); | |
63c41688 PM |
396 | break; |
397 | case NETLBL_NLTYPE_CIPSOV4: | |
dc7de73f HD |
398 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, |
399 | entry->def.type); | |
63c41688 PM |
400 | if (ret_val != 0) |
401 | return ret_val; | |
402 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI, | |
6a8b7f0c | 403 | entry->def.cipso->doi); |
63c41688 | 404 | break; |
dc7de73f HD |
405 | case NETLBL_NLTYPE_CALIPSO: |
406 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, | |
407 | entry->def.type); | |
408 | if (ret_val != 0) | |
409 | return ret_val; | |
410 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_CLPDOI, | |
411 | entry->def.calipso->doi); | |
412 | break; | |
63c41688 PM |
413 | } |
414 | ||
415 | return ret_val; | |
416 | } | |
417 | ||
418 | /* | |
419 | * NetLabel Command Handlers | |
420 | */ | |
421 | ||
422 | /** | |
423 | * netlbl_mgmt_add - Handle an ADD message | |
424 | * @skb: the NETLINK buffer | |
425 | * @info: the Generic NETLINK info block | |
426 | * | |
427 | * Description: | |
428 | * Process a user generated ADD message and add the domains from the message | |
429 | * to the hash table. See netlabel.h for a description of the message format. | |
430 | * Returns zero on success, negative values on failure. | |
431 | * | |
432 | */ | |
433 | static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info) | |
434 | { | |
435 | struct netlbl_audit audit_info; | |
436 | ||
437 | if ((!info->attrs[NLBL_MGMT_A_DOMAIN]) || | |
438 | (!info->attrs[NLBL_MGMT_A_PROTOCOL]) || | |
439 | (info->attrs[NLBL_MGMT_A_IPV4ADDR] && | |
440 | info->attrs[NLBL_MGMT_A_IPV6ADDR]) || | |
441 | (info->attrs[NLBL_MGMT_A_IPV4MASK] && | |
442 | info->attrs[NLBL_MGMT_A_IPV6MASK]) || | |
443 | ((info->attrs[NLBL_MGMT_A_IPV4ADDR] != NULL) ^ | |
444 | (info->attrs[NLBL_MGMT_A_IPV4MASK] != NULL)) || | |
445 | ((info->attrs[NLBL_MGMT_A_IPV6ADDR] != NULL) ^ | |
446 | (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL))) | |
447 | return -EINVAL; | |
448 | ||
449 | netlbl_netlink_auditinfo(skb, &audit_info); | |
450 | ||
451 | return netlbl_mgmt_add_common(info, &audit_info); | |
452 | } | |
453 | ||
d15c345f PM |
454 | /** |
455 | * netlbl_mgmt_remove - Handle a REMOVE message | |
456 | * @skb: the NETLINK buffer | |
457 | * @info: the Generic NETLINK info block | |
458 | * | |
459 | * Description: | |
460 | * Process a user generated REMOVE message and remove the specified domain | |
461 | * mappings. Returns zero on success, negative values on failure. | |
462 | * | |
463 | */ | |
464 | static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info) | |
465 | { | |
fd385855 | 466 | char *domain; |
95d4e6be | 467 | struct netlbl_audit audit_info; |
d15c345f | 468 | |
fd385855 PM |
469 | if (!info->attrs[NLBL_MGMT_A_DOMAIN]) |
470 | return -EINVAL; | |
d15c345f | 471 | |
95d4e6be PM |
472 | netlbl_netlink_auditinfo(skb, &audit_info); |
473 | ||
fd385855 | 474 | domain = nla_data(info->attrs[NLBL_MGMT_A_DOMAIN]); |
8f18e675 | 475 | return netlbl_domhsh_remove(domain, AF_UNSPEC, &audit_info); |
fd385855 PM |
476 | } |
477 | ||
478 | /** | |
479 | * netlbl_mgmt_listall_cb - netlbl_domhsh_walk() callback for LISTALL | |
480 | * @entry: the domain mapping hash table entry | |
481 | * @arg: the netlbl_domhsh_walk_arg structure | |
482 | * | |
483 | * Description: | |
484 | * This function is designed to be used as a callback to the | |
485 | * netlbl_domhsh_walk() function for use in generating a response for a LISTALL | |
486 | * message. Returns the size of the message on success, negative values on | |
487 | * failure. | |
488 | * | |
489 | */ | |
490 | static int netlbl_mgmt_listall_cb(struct netlbl_dom_map *entry, void *arg) | |
491 | { | |
492 | int ret_val = -ENOMEM; | |
493 | struct netlbl_domhsh_walk_arg *cb_arg = arg; | |
494 | void *data; | |
495 | ||
15e47304 | 496 | data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, |
17c157c8 TG |
497 | cb_arg->seq, &netlbl_mgmt_gnl_family, |
498 | NLM_F_MULTI, NLBL_MGMT_C_LISTALL); | |
fd385855 PM |
499 | if (data == NULL) |
500 | goto listall_cb_failure; | |
501 | ||
63c41688 | 502 | ret_val = netlbl_mgmt_listentry(cb_arg->skb, entry); |
fd385855 PM |
503 | if (ret_val != 0) |
504 | goto listall_cb_failure; | |
d15c345f | 505 | |
fd385855 | 506 | cb_arg->seq++; |
053c095a JB |
507 | genlmsg_end(cb_arg->skb, data); |
508 | return 0; | |
d15c345f | 509 | |
fd385855 PM |
510 | listall_cb_failure: |
511 | genlmsg_cancel(cb_arg->skb, data); | |
d15c345f PM |
512 | return ret_val; |
513 | } | |
514 | ||
515 | /** | |
fd385855 | 516 | * netlbl_mgmt_listall - Handle a LISTALL message |
d15c345f | 517 | * @skb: the NETLINK buffer |
fd385855 | 518 | * @cb: the NETLINK callback |
d15c345f PM |
519 | * |
520 | * Description: | |
fd385855 PM |
521 | * Process a user generated LISTALL message and dumps the domain hash table in |
522 | * a form suitable for use in a kernel generated LISTALL message. Returns zero | |
523 | * on success, negative values on failure. | |
d15c345f PM |
524 | * |
525 | */ | |
fd385855 PM |
526 | static int netlbl_mgmt_listall(struct sk_buff *skb, |
527 | struct netlink_callback *cb) | |
d15c345f | 528 | { |
fd385855 PM |
529 | struct netlbl_domhsh_walk_arg cb_arg; |
530 | u32 skip_bkt = cb->args[0]; | |
531 | u32 skip_chain = cb->args[1]; | |
532 | ||
533 | cb_arg.nl_cb = cb; | |
534 | cb_arg.skb = skb; | |
535 | cb_arg.seq = cb->nlh->nlmsg_seq; | |
536 | ||
537 | netlbl_domhsh_walk(&skip_bkt, | |
538 | &skip_chain, | |
539 | netlbl_mgmt_listall_cb, | |
540 | &cb_arg); | |
541 | ||
542 | cb->args[0] = skip_bkt; | |
543 | cb->args[1] = skip_chain; | |
544 | return skb->len; | |
d15c345f PM |
545 | } |
546 | ||
547 | /** | |
548 | * netlbl_mgmt_adddef - Handle an ADDDEF message | |
549 | * @skb: the NETLINK buffer | |
550 | * @info: the Generic NETLINK info block | |
551 | * | |
552 | * Description: | |
553 | * Process a user generated ADDDEF message and respond accordingly. Returns | |
554 | * zero on success, negative values on failure. | |
555 | * | |
556 | */ | |
557 | static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info) | |
558 | { | |
95d4e6be | 559 | struct netlbl_audit audit_info; |
d15c345f | 560 | |
63c41688 PM |
561 | if ((!info->attrs[NLBL_MGMT_A_PROTOCOL]) || |
562 | (info->attrs[NLBL_MGMT_A_IPV4ADDR] && | |
563 | info->attrs[NLBL_MGMT_A_IPV6ADDR]) || | |
564 | (info->attrs[NLBL_MGMT_A_IPV4MASK] && | |
565 | info->attrs[NLBL_MGMT_A_IPV6MASK]) || | |
566 | ((info->attrs[NLBL_MGMT_A_IPV4ADDR] != NULL) ^ | |
567 | (info->attrs[NLBL_MGMT_A_IPV4MASK] != NULL)) || | |
568 | ((info->attrs[NLBL_MGMT_A_IPV6ADDR] != NULL) ^ | |
569 | (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL))) | |
570 | return -EINVAL; | |
d15c345f | 571 | |
95d4e6be PM |
572 | netlbl_netlink_auditinfo(skb, &audit_info); |
573 | ||
63c41688 | 574 | return netlbl_mgmt_add_common(info, &audit_info); |
d15c345f PM |
575 | } |
576 | ||
577 | /** | |
578 | * netlbl_mgmt_removedef - Handle a REMOVEDEF message | |
579 | * @skb: the NETLINK buffer | |
580 | * @info: the Generic NETLINK info block | |
581 | * | |
582 | * Description: | |
583 | * Process a user generated REMOVEDEF message and remove the default domain | |
584 | * mapping. Returns zero on success, negative values on failure. | |
585 | * | |
586 | */ | |
587 | static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info) | |
588 | { | |
95d4e6be PM |
589 | struct netlbl_audit audit_info; |
590 | ||
591 | netlbl_netlink_auditinfo(skb, &audit_info); | |
592 | ||
8f18e675 | 593 | return netlbl_domhsh_remove_default(AF_UNSPEC, &audit_info); |
d15c345f PM |
594 | } |
595 | ||
596 | /** | |
597 | * netlbl_mgmt_listdef - Handle a LISTDEF message | |
598 | * @skb: the NETLINK buffer | |
599 | * @info: the Generic NETLINK info block | |
600 | * | |
601 | * Description: | |
602 | * Process a user generated LISTDEF message and dumps the default domain | |
603 | * mapping in a form suitable for use in a kernel generated LISTDEF message. | |
604 | * Returns zero on success, negative values on failure. | |
605 | * | |
606 | */ | |
607 | static int netlbl_mgmt_listdef(struct sk_buff *skb, struct genl_info *info) | |
608 | { | |
609 | int ret_val = -ENOMEM; | |
fd385855 PM |
610 | struct sk_buff *ans_skb = NULL; |
611 | void *data; | |
612 | struct netlbl_dom_map *entry; | |
8f18e675 HD |
613 | u16 family; |
614 | ||
615 | if (info->attrs[NLBL_MGMT_A_FAMILY]) | |
616 | family = nla_get_u16(info->attrs[NLBL_MGMT_A_FAMILY]); | |
617 | else | |
618 | family = AF_INET; | |
d15c345f | 619 | |
339bf98f | 620 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
d15c345f | 621 | if (ans_skb == NULL) |
fd385855 | 622 | return -ENOMEM; |
17c157c8 TG |
623 | data = genlmsg_put_reply(ans_skb, info, &netlbl_mgmt_gnl_family, |
624 | 0, NLBL_MGMT_C_LISTDEF); | |
fd385855 | 625 | if (data == NULL) |
d15c345f | 626 | goto listdef_failure; |
d15c345f | 627 | |
fd385855 | 628 | rcu_read_lock(); |
8f18e675 | 629 | entry = netlbl_domhsh_getentry(NULL, family); |
fd385855 PM |
630 | if (entry == NULL) { |
631 | ret_val = -ENOENT; | |
632 | goto listdef_failure_lock; | |
633 | } | |
63c41688 | 634 | ret_val = netlbl_mgmt_listentry(ans_skb, entry); |
fd385855 | 635 | rcu_read_unlock(); |
63c41688 PM |
636 | if (ret_val != 0) |
637 | goto listdef_failure; | |
d15c345f | 638 | |
fd385855 | 639 | genlmsg_end(ans_skb, data); |
fe785bee | 640 | return genlmsg_reply(ans_skb, info); |
d15c345f | 641 | |
fd385855 PM |
642 | listdef_failure_lock: |
643 | rcu_read_unlock(); | |
d15c345f | 644 | listdef_failure: |
fd385855 | 645 | kfree_skb(ans_skb); |
d15c345f PM |
646 | return ret_val; |
647 | } | |
648 | ||
649 | /** | |
fd385855 PM |
650 | * netlbl_mgmt_protocols_cb - Write an individual PROTOCOL message response |
651 | * @skb: the skb to write to | |
fd385855 PM |
652 | * @cb: the NETLINK callback |
653 | * @protocol: the NetLabel protocol to use in the message | |
d15c345f PM |
654 | * |
655 | * Description: | |
fd385855 PM |
656 | * This function is to be used in conjunction with netlbl_mgmt_protocols() to |
657 | * answer a application's PROTOCOLS message. Returns the size of the message | |
658 | * on success, negative values on failure. | |
d15c345f PM |
659 | * |
660 | */ | |
fd385855 PM |
661 | static int netlbl_mgmt_protocols_cb(struct sk_buff *skb, |
662 | struct netlink_callback *cb, | |
663 | u32 protocol) | |
d15c345f PM |
664 | { |
665 | int ret_val = -ENOMEM; | |
fd385855 PM |
666 | void *data; |
667 | ||
15e47304 | 668 | data = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, |
17c157c8 TG |
669 | &netlbl_mgmt_gnl_family, NLM_F_MULTI, |
670 | NLBL_MGMT_C_PROTOCOLS); | |
fd385855 PM |
671 | if (data == NULL) |
672 | goto protocols_cb_failure; | |
673 | ||
674 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, protocol); | |
d15c345f | 675 | if (ret_val != 0) |
fd385855 | 676 | goto protocols_cb_failure; |
d15c345f | 677 | |
053c095a JB |
678 | genlmsg_end(skb, data); |
679 | return 0; | |
d15c345f | 680 | |
fd385855 PM |
681 | protocols_cb_failure: |
682 | genlmsg_cancel(skb, data); | |
d15c345f PM |
683 | return ret_val; |
684 | } | |
685 | ||
fd385855 PM |
686 | /** |
687 | * netlbl_mgmt_protocols - Handle a PROTOCOLS message | |
688 | * @skb: the NETLINK buffer | |
689 | * @cb: the NETLINK callback | |
690 | * | |
691 | * Description: | |
692 | * Process a user generated PROTOCOLS message and respond accordingly. | |
693 | * | |
694 | */ | |
695 | static int netlbl_mgmt_protocols(struct sk_buff *skb, | |
696 | struct netlink_callback *cb) | |
697 | { | |
698 | u32 protos_sent = cb->args[0]; | |
699 | ||
700 | if (protos_sent == 0) { | |
701 | if (netlbl_mgmt_protocols_cb(skb, | |
702 | cb, | |
703 | NETLBL_NLTYPE_UNLABELED) < 0) | |
704 | goto protocols_return; | |
705 | protos_sent++; | |
706 | } | |
707 | if (protos_sent == 1) { | |
708 | if (netlbl_mgmt_protocols_cb(skb, | |
709 | cb, | |
710 | NETLBL_NLTYPE_CIPSOV4) < 0) | |
711 | goto protocols_return; | |
712 | protos_sent++; | |
713 | } | |
cb72d382 HD |
714 | #if IS_ENABLED(CONFIG_IPV6) |
715 | if (protos_sent == 2) { | |
716 | if (netlbl_mgmt_protocols_cb(skb, | |
717 | cb, | |
718 | NETLBL_NLTYPE_CALIPSO) < 0) | |
719 | goto protocols_return; | |
720 | protos_sent++; | |
721 | } | |
722 | #endif | |
fd385855 PM |
723 | |
724 | protocols_return: | |
725 | cb->args[0] = protos_sent; | |
726 | return skb->len; | |
727 | } | |
728 | ||
d15c345f PM |
729 | /** |
730 | * netlbl_mgmt_version - Handle a VERSION message | |
731 | * @skb: the NETLINK buffer | |
732 | * @info: the Generic NETLINK info block | |
733 | * | |
734 | * Description: | |
735 | * Process a user generated VERSION message and respond accordingly. Returns | |
736 | * zero on success, negative values on failure. | |
737 | * | |
738 | */ | |
739 | static int netlbl_mgmt_version(struct sk_buff *skb, struct genl_info *info) | |
740 | { | |
741 | int ret_val = -ENOMEM; | |
742 | struct sk_buff *ans_skb = NULL; | |
fd385855 | 743 | void *data; |
d15c345f | 744 | |
339bf98f | 745 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
d15c345f | 746 | if (ans_skb == NULL) |
fd385855 | 747 | return -ENOMEM; |
17c157c8 TG |
748 | data = genlmsg_put_reply(ans_skb, info, &netlbl_mgmt_gnl_family, |
749 | 0, NLBL_MGMT_C_VERSION); | |
fd385855 | 750 | if (data == NULL) |
d15c345f PM |
751 | goto version_failure; |
752 | ||
fd385855 PM |
753 | ret_val = nla_put_u32(ans_skb, |
754 | NLBL_MGMT_A_VERSION, | |
755 | NETLBL_PROTO_VERSION); | |
d15c345f PM |
756 | if (ret_val != 0) |
757 | goto version_failure; | |
758 | ||
fd385855 | 759 | genlmsg_end(ans_skb, data); |
fe785bee | 760 | return genlmsg_reply(ans_skb, info); |
d15c345f PM |
761 | |
762 | version_failure: | |
763 | kfree_skb(ans_skb); | |
d15c345f PM |
764 | return ret_val; |
765 | } | |
766 | ||
767 | ||
768 | /* | |
769 | * NetLabel Generic NETLINK Command Definitions | |
770 | */ | |
771 | ||
4534de83 | 772 | static const struct genl_ops netlbl_mgmt_genl_ops[] = { |
227c43c3 | 773 | { |
d15c345f | 774 | .cmd = NLBL_MGMT_C_ADD, |
fd385855 PM |
775 | .flags = GENL_ADMIN_PERM, |
776 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
777 | .doit = netlbl_mgmt_add, |
778 | .dumpit = NULL, | |
227c43c3 PE |
779 | }, |
780 | { | |
d15c345f | 781 | .cmd = NLBL_MGMT_C_REMOVE, |
fd385855 PM |
782 | .flags = GENL_ADMIN_PERM, |
783 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
784 | .doit = netlbl_mgmt_remove, |
785 | .dumpit = NULL, | |
227c43c3 PE |
786 | }, |
787 | { | |
fd385855 | 788 | .cmd = NLBL_MGMT_C_LISTALL, |
d15c345f | 789 | .flags = 0, |
fd385855 PM |
790 | .policy = netlbl_mgmt_genl_policy, |
791 | .doit = NULL, | |
792 | .dumpit = netlbl_mgmt_listall, | |
227c43c3 PE |
793 | }, |
794 | { | |
d15c345f | 795 | .cmd = NLBL_MGMT_C_ADDDEF, |
fd385855 PM |
796 | .flags = GENL_ADMIN_PERM, |
797 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
798 | .doit = netlbl_mgmt_adddef, |
799 | .dumpit = NULL, | |
227c43c3 PE |
800 | }, |
801 | { | |
d15c345f | 802 | .cmd = NLBL_MGMT_C_REMOVEDEF, |
fd385855 PM |
803 | .flags = GENL_ADMIN_PERM, |
804 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
805 | .doit = netlbl_mgmt_removedef, |
806 | .dumpit = NULL, | |
227c43c3 PE |
807 | }, |
808 | { | |
d15c345f PM |
809 | .cmd = NLBL_MGMT_C_LISTDEF, |
810 | .flags = 0, | |
fd385855 | 811 | .policy = netlbl_mgmt_genl_policy, |
d15c345f PM |
812 | .doit = netlbl_mgmt_listdef, |
813 | .dumpit = NULL, | |
227c43c3 PE |
814 | }, |
815 | { | |
fd385855 | 816 | .cmd = NLBL_MGMT_C_PROTOCOLS, |
d15c345f | 817 | .flags = 0, |
fd385855 PM |
818 | .policy = netlbl_mgmt_genl_policy, |
819 | .doit = NULL, | |
820 | .dumpit = netlbl_mgmt_protocols, | |
227c43c3 PE |
821 | }, |
822 | { | |
d15c345f PM |
823 | .cmd = NLBL_MGMT_C_VERSION, |
824 | .flags = 0, | |
fd385855 | 825 | .policy = netlbl_mgmt_genl_policy, |
d15c345f PM |
826 | .doit = netlbl_mgmt_version, |
827 | .dumpit = NULL, | |
227c43c3 | 828 | }, |
d15c345f PM |
829 | }; |
830 | ||
56989f6d | 831 | static struct genl_family netlbl_mgmt_gnl_family __ro_after_init = { |
489111e5 JB |
832 | .hdrsize = 0, |
833 | .name = NETLBL_NLTYPE_MGMT_NAME, | |
834 | .version = NETLBL_PROTO_VERSION, | |
835 | .maxattr = NLBL_MGMT_A_MAX, | |
836 | .module = THIS_MODULE, | |
837 | .ops = netlbl_mgmt_genl_ops, | |
838 | .n_ops = ARRAY_SIZE(netlbl_mgmt_genl_ops), | |
839 | }; | |
840 | ||
d15c345f PM |
841 | /* |
842 | * NetLabel Generic NETLINK Protocol Functions | |
843 | */ | |
844 | ||
845 | /** | |
846 | * netlbl_mgmt_genl_init - Register the NetLabel management component | |
847 | * | |
848 | * Description: | |
849 | * Register the NetLabel management component with the Generic NETLINK | |
850 | * mechanism. Returns zero on success, negative values on failure. | |
851 | * | |
852 | */ | |
05705e4e | 853 | int __init netlbl_mgmt_genl_init(void) |
d15c345f | 854 | { |
489111e5 | 855 | return genl_register_family(&netlbl_mgmt_gnl_family); |
d15c345f | 856 | } |