net/netlabel/netlabel_calipso.c

   1 /*
   2  * NetLabel CALIPSO/IPv6 Support
   3  *
   4  * This file defines the CALIPSO/IPv6 functions for the NetLabel system.  The
   5  * NetLabel system manages static and dynamic label mappings for network
   6  * protocols such as CIPSO and CALIPSO.
   7  *
   8  * Authors: Paul Moore <paul@paul-moore.com>
   9  *          Huw Davies <huw@codeweavers.com>
  10  *
  11  */
  12
  13 /* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14  * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
  15  *
  16  * This program is free software;  you can redistribute it and/or modify
  17  * it under the terms of the GNU General Public License as published by
  18  * the Free Software Foundation; either version 2 of the License, or
  19  * (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  24  * the GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  28  *
  29  */
  30
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/string.h>
  34 #include <linux/skbuff.h>
  35 #include <linux/audit.h>
  36 #include <linux/slab.h>
  37 #include <net/sock.h>
  38 #include <net/netlink.h>
  39 #include <net/genetlink.h>
  40 #include <net/netlabel.h>
  41 #include <net/calipso.h>
  42 #include <linux/atomic.h>
  43
  44 #include "netlabel_user.h"
  45 #include "netlabel_calipso.h"
  46 #include "netlabel_mgmt.h"
  47 #include "netlabel_domainhash.h"
  48
  49 /* Argument struct for calipso_doi_walk() */
  50 struct netlbl_calipso_doiwalk_arg {
  51         struct netlink_callback *nl_cb;
  52         struct sk_buff *skb;
  53         u32 seq;
  54 };
  55
  56 /* Argument struct for netlbl_domhsh_walk() */
  57 struct netlbl_domhsh_walk_arg {
  58         struct netlbl_audit *audit_info;
  59         u32 doi;
  60 };
  61
  62 /* NetLabel Generic NETLINK CALIPSO family */
  63 static struct genl_family netlbl_calipso_gnl_family;
  64
  65 /* NetLabel Netlink attribute policy */
  66 static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
  67         [NLBL_CALIPSO_A_DOI] = { .type = NLA_U32 },
  68         [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
  69 };
  70
  71 /* NetLabel Command Handlers
  72  */
  73 /**
  74  * netlbl_calipso_add_pass - Adds a CALIPSO pass DOI definition
  75  * @info: the Generic NETLINK info block
  76  * @audit_info: NetLabel audit information
  77  *
  78  * Description:
  79  * Create a new CALIPSO_MAP_PASS DOI definition based on the given ADD message
  80  * and add it to the CALIPSO engine.  Return zero on success and non-zero on
  81  * error.
  82  *
  83  */
  84 static int netlbl_calipso_add_pass(struct genl_info *info,
  85                                    struct netlbl_audit *audit_info)
  86 {
  87         int ret_val;
  88         struct calipso_doi *doi_def = NULL;
  89
  90         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
  91         if (!doi_def)
  92                 return -ENOMEM;
  93         doi_def->type = CALIPSO_MAP_PASS;
  94         doi_def->doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
  95         ret_val = calipso_doi_add(doi_def, audit_info);
  96         if (ret_val != 0)
  97                 calipso_doi_free(doi_def);
  98
  99         return ret_val;
 100 }
 101
 102 /**
 103  * netlbl_calipso_add - Handle an ADD message
 104  * @skb: the NETLINK buffer
 105  * @info: the Generic NETLINK info block
 106  *
 107  * Description:
 108  * Create a new DOI definition based on the given ADD message and add it to the
 109  * CALIPSO engine.  Returns zero on success, negative values on failure.
 110  *
 111  */
 112 static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
 113
 114 {
 115         int ret_val = -EINVAL;
 116         struct netlbl_audit audit_info;
 117
 118         if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
 119             !info->attrs[NLBL_CALIPSO_A_MTYPE])
 120                 return -EINVAL;
 121
 122         netlbl_netlink_auditinfo(skb, &audit_info);
 123         switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
 124         case CALIPSO_MAP_PASS:
 125                 ret_val = netlbl_calipso_add_pass(info, &audit_info);
 126                 break;
 127         }
 128         if (ret_val == 0)
 129                 atomic_inc(&netlabel_mgmt_protocount);
 130
 131         return ret_val;
 132 }
 133
 134 /**
 135  * netlbl_calipso_list - Handle a LIST message
 136  * @skb: the NETLINK buffer
 137  * @info: the Generic NETLINK info block
 138  *
 139  * Description:
 140  * Process a user generated LIST message and respond accordingly.
 141  * Returns zero on success and negative values on error.
 142  *
 143  */
 144 static int netlbl_calipso_list(struct sk_buff *skb, struct genl_info *info)
 145 {
 146         int ret_val;
 147         struct sk_buff *ans_skb = NULL;
 148         void *data;
 149         u32 doi;
 150         struct calipso_doi *doi_def;
 151
 152         if (!info->attrs[NLBL_CALIPSO_A_DOI]) {
 153                 ret_val = -EINVAL;
 154                 goto list_failure;
 155         }
 156
 157         doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
 158
 159         doi_def = calipso_doi_getdef(doi);
 160         if (!doi_def) {
 161                 ret_val = -EINVAL;
 162                 goto list_failure;
 163         }
 164
 165         ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 166         if (!ans_skb) {
 167                 ret_val = -ENOMEM;
 168                 goto list_failure_put;
 169         }
 170         data = genlmsg_put_reply(ans_skb, info, &netlbl_calipso_gnl_family,
 171                                  0, NLBL_CALIPSO_C_LIST);
 172         if (!data) {
 173                 ret_val = -ENOMEM;
 174                 goto list_failure_put;
 175         }
 176
 177         ret_val = nla_put_u32(ans_skb, NLBL_CALIPSO_A_MTYPE, doi_def->type);
 178         if (ret_val != 0)
 179                 goto list_failure_put;
 180
 181         calipso_doi_putdef(doi_def);
 182
 183         genlmsg_end(ans_skb, data);
 184         return genlmsg_reply(ans_skb, info);
 185
 186 list_failure_put:
 187         calipso_doi_putdef(doi_def);
 188 list_failure:
 189         kfree_skb(ans_skb);
 190         return ret_val;
 191 }
 192
 193 /**
 194  * netlbl_calipso_listall_cb - calipso_doi_walk() callback for LISTALL
 195  * @doi_def: the CALIPSO DOI definition
 196  * @arg: the netlbl_calipso_doiwalk_arg structure
 197  *
 198  * Description:
 199  * This function is designed to be used as a callback to the
 200  * calipso_doi_walk() function for use in generating a response for a LISTALL
 201  * message.  Returns the size of the message on success, negative values on
 202  * failure.
 203  *
 204  */
 205 static int netlbl_calipso_listall_cb(struct calipso_doi *doi_def, void *arg)
 206 {
 207         int ret_val = -ENOMEM;
 208         struct netlbl_calipso_doiwalk_arg *cb_arg = arg;
 209         void *data;
 210
 211         data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
 212                            cb_arg->seq, &netlbl_calipso_gnl_family,
 213                            NLM_F_MULTI, NLBL_CALIPSO_C_LISTALL);
 214         if (!data)
 215                 goto listall_cb_failure;
 216
 217         ret_val = nla_put_u32(cb_arg->skb, NLBL_CALIPSO_A_DOI, doi_def->doi);
 218         if (ret_val != 0)
 219                 goto listall_cb_failure;
 220         ret_val = nla_put_u32(cb_arg->skb,
 221                               NLBL_CALIPSO_A_MTYPE,
 222                               doi_def->type);
 223         if (ret_val != 0)
 224                 goto listall_cb_failure;
 225
 226         genlmsg_end(cb_arg->skb, data);
 227         return 0;
 228
 229 listall_cb_failure:
 230         genlmsg_cancel(cb_arg->skb, data);
 231         return ret_val;
 232 }
 233
 234 /**
 235  * netlbl_calipso_listall - Handle a LISTALL message
 236  * @skb: the NETLINK buffer
 237  * @cb: the NETLINK callback
 238  *
 239  * Description:
 240  * Process a user generated LISTALL message and respond accordingly.  Returns
 241  * zero on success and negative values on error.
 242  *
 243  */
 244 static int netlbl_calipso_listall(struct sk_buff *skb,
 245                                   struct netlink_callback *cb)
 246 {
 247         struct netlbl_calipso_doiwalk_arg cb_arg;
 248         u32 doi_skip = cb->args[0];
 249
 250         cb_arg.nl_cb = cb;
 251         cb_arg.skb = skb;
 252         cb_arg.seq = cb->nlh->nlmsg_seq;
 253
 254         calipso_doi_walk(&doi_skip, netlbl_calipso_listall_cb, &cb_arg);
 255
 256         cb->args[0] = doi_skip;
 257         return skb->len;
 258 }
 259
 260 /**
 261  * netlbl_calipso_remove_cb - netlbl_calipso_remove() callback for REMOVE
 262  * @entry: LSM domain mapping entry
 263  * @arg: the netlbl_domhsh_walk_arg structure
 264  *
 265  * Description:
 266  * This function is intended for use by netlbl_calipso_remove() as the callback
 267  * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
 268  * which are associated with the CALIPSO DOI specified in @arg.  Returns zero on
 269  * success, negative values on failure.
 270  *
 271  */
 272 static int netlbl_calipso_remove_cb(struct netlbl_dom_map *entry, void *arg)
 273 {
 274         struct netlbl_domhsh_walk_arg *cb_arg = arg;
 275
 276         if (entry->def.type == NETLBL_NLTYPE_CALIPSO &&
 277             entry->def.calipso->doi == cb_arg->doi)
 278                 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
 279
 280         return 0;
 281 }
 282
 283 /**
 284  * netlbl_calipso_remove - Handle a REMOVE message
 285  * @skb: the NETLINK buffer
 286  * @info: the Generic NETLINK info block
 287  *
 288  * Description:
 289  * Process a user generated REMOVE message and respond accordingly.  Returns
 290  * zero on success, negative values on failure.
 291  *
 292  */
 293 static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info)
 294 {
 295         int ret_val = -EINVAL;
 296         struct netlbl_domhsh_walk_arg cb_arg;
 297         struct netlbl_audit audit_info;
 298         u32 skip_bkt = 0;
 299         u32 skip_chain = 0;
 300
 301         if (!info->attrs[NLBL_CALIPSO_A_DOI])
 302                 return -EINVAL;
 303
 304         netlbl_netlink_auditinfo(skb, &audit_info);
 305         cb_arg.doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
 306         cb_arg.audit_info = &audit_info;
 307         ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
 308                                      netlbl_calipso_remove_cb, &cb_arg);
 309         if (ret_val == 0 || ret_val == -ENOENT) {
 310                 ret_val = calipso_doi_remove(cb_arg.doi, &audit_info);
 311                 if (ret_val == 0)
 312                         atomic_dec(&netlabel_mgmt_protocount);
 313         }
 314
 315         return ret_val;
 316 }
 317
 318 /* NetLabel Generic NETLINK Command Definitions
 319  */
 320
 321 static const struct genl_ops netlbl_calipso_ops[] = {
 322         {
 323         .cmd = NLBL_CALIPSO_C_ADD,
 324         .flags = GENL_ADMIN_PERM,
 325         .policy = calipso_genl_policy,
 326         .doit = netlbl_calipso_add,
 327         .dumpit = NULL,
 328         },
 329         {
 330         .cmd = NLBL_CALIPSO_C_REMOVE,
 331         .flags = GENL_ADMIN_PERM,
 332         .policy = calipso_genl_policy,
 333         .doit = netlbl_calipso_remove,
 334         .dumpit = NULL,
 335         },
 336         {
 337         .cmd = NLBL_CALIPSO_C_LIST,
 338         .flags = 0,
 339         .policy = calipso_genl_policy,
 340         .doit = netlbl_calipso_list,
 341         .dumpit = NULL,
 342         },
 343         {
 344         .cmd = NLBL_CALIPSO_C_LISTALL,
 345         .flags = 0,
 346         .policy = calipso_genl_policy,
 347         .doit = NULL,
 348         .dumpit = netlbl_calipso_listall,
 349         },
 350 };
 351
 352 static struct genl_family netlbl_calipso_gnl_family __ro_after_init = {
 353         .hdrsize = 0,
 354         .name = NETLBL_NLTYPE_CALIPSO_NAME,
 355         .version = NETLBL_PROTO_VERSION,
 356         .maxattr = NLBL_CALIPSO_A_MAX,
 357         .module = THIS_MODULE,
 358         .ops = netlbl_calipso_ops,
 359         .n_ops = ARRAY_SIZE(netlbl_calipso_ops),
 360 };
 361
 362 /* NetLabel Generic NETLINK Protocol Functions
 363  */
 364
 365 /**
 366  * netlbl_calipso_genl_init - Register the CALIPSO NetLabel component
 367  *
 368  * Description:
 369  * Register the CALIPSO packet NetLabel component with the Generic NETLINK
 370  * mechanism.  Returns zero on success, negative values on failure.
 371  *
 372  */
 373 int __init netlbl_calipso_genl_init(void)
 374 {
 375         return genl_register_family(&netlbl_calipso_gnl_family);
 376 }
 377
 378 static const struct netlbl_calipso_ops *calipso_ops;
 379
 380 /**
 381  * netlbl_calipso_ops_register - Register the CALIPSO operations
 382  *
 383  * Description:
 384  * Register the CALIPSO packet engine operations.
 385  *
 386  */
 387 const struct netlbl_calipso_ops *
 388 netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
 389 {
 390         return xchg(&calipso_ops, ops);
 391 }
 392 EXPORT_SYMBOL(netlbl_calipso_ops_register);
 393
 394 static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
 395 {
 396         return READ_ONCE(calipso_ops);
 397 }
 398
 399 /**
 400  * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
 401  * @doi_def: the DOI structure
 402  * @audit_info: NetLabel audit information
 403  *
 404  * Description:
 405  * The caller defines a new DOI for use by the CALIPSO engine and calls this
 406  * function to add it to the list of acceptable domains.  The caller must
 407  * ensure that the mapping table specified in @doi_def->map meets all of the
 408  * requirements of the mapping type (see calipso.h for details).  Returns
 409  * zero on success and non-zero on failure.
 410  *
 411  */
 412 int calipso_doi_add(struct calipso_doi *doi_def,
 413                     struct netlbl_audit *audit_info)
 414 {
 415         int ret_val = -ENOMSG;
 416         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 417
 418         if (ops)
 419                 ret_val = ops->doi_add(doi_def, audit_info);
 420         return ret_val;
 421 }
 422
 423 /**
 424  * calipso_doi_free - Frees a DOI definition
 425  * @doi_def: the DOI definition
 426  *
 427  * Description:
 428  * This function frees all of the memory associated with a DOI definition.
 429  *
 430  */
 431 void calipso_doi_free(struct calipso_doi *doi_def)
 432 {
 433         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 434
 435         if (ops)
 436                 ops->doi_free(doi_def);
 437 }
 438
 439 /**
 440  * calipso_doi_remove - Remove an existing DOI from the CALIPSO protocol engine
 441  * @doi: the DOI value
 442  * @audit_secid: the LSM secid to use in the audit message
 443  *
 444  * Description:
 445  * Removes a DOI definition from the CALIPSO engine.  The NetLabel routines will
 446  * be called to release their own LSM domain mappings as well as our own
 447  * domain list.  Returns zero on success and negative values on failure.
 448  *
 449  */
 450 int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info)
 451 {
 452         int ret_val = -ENOMSG;
 453         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 454
 455         if (ops)
 456                 ret_val = ops->doi_remove(doi, audit_info);
 457         return ret_val;
 458 }
 459
 460 /**
 461  * calipso_doi_getdef - Returns a reference to a valid DOI definition
 462  * @doi: the DOI value
 463  *
 464  * Description:
 465  * Searches for a valid DOI definition and if one is found it is returned to
 466  * the caller.  Otherwise NULL is returned.  The caller must ensure that
 467  * calipso_doi_putdef() is called when the caller is done.
 468  *
 469  */
 470 struct calipso_doi *calipso_doi_getdef(u32 doi)
 471 {
 472         struct calipso_doi *ret_val = NULL;
 473         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 474
 475         if (ops)
 476                 ret_val = ops->doi_getdef(doi);
 477         return ret_val;
 478 }
 479
 480 /**
 481  * calipso_doi_putdef - Releases a reference for the given DOI definition
 482  * @doi_def: the DOI definition
 483  *
 484  * Description:
 485  * Releases a DOI definition reference obtained from calipso_doi_getdef().
 486  *
 487  */
 488 void calipso_doi_putdef(struct calipso_doi *doi_def)
 489 {
 490         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 491
 492         if (ops)
 493                 ops->doi_putdef(doi_def);
 494 }
 495
 496 /**
 497  * calipso_doi_walk - Iterate through the DOI definitions
 498  * @skip_cnt: skip past this number of DOI definitions, updated
 499  * @callback: callback for each DOI definition
 500  * @cb_arg: argument for the callback function
 501  *
 502  * Description:
 503  * Iterate over the DOI definition list, skipping the first @skip_cnt entries.
 504  * For each entry call @callback, if @callback returns a negative value stop
 505  * 'walking' through the list and return.  Updates the value in @skip_cnt upon
 506  * return.  Returns zero on success, negative values on failure.
 507  *
 508  */
 509 int calipso_doi_walk(u32 *skip_cnt,
 510                      int (*callback)(struct calipso_doi *doi_def, void *arg),
 511                      void *cb_arg)
 512 {
 513         int ret_val = -ENOMSG;
 514         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 515
 516         if (ops)
 517                 ret_val = ops->doi_walk(skip_cnt, callback, cb_arg);
 518         return ret_val;
 519 }
 520
 521 /**
 522  * calipso_sock_getattr - Get the security attributes from a sock
 523  * @sk: the sock
 524  * @secattr: the security attributes
 525  *
 526  * Description:
 527  * Query @sk to see if there is a CALIPSO option attached to the sock and if
 528  * there is return the CALIPSO security attributes in @secattr.  This function
 529  * requires that @sk be locked, or privately held, but it does not do any
 530  * locking itself.  Returns zero on success and negative values on failure.
 531  *
 532  */
 533 int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
 534 {
 535         int ret_val = -ENOMSG;
 536         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 537
 538         if (ops)
 539                 ret_val = ops->sock_getattr(sk, secattr);
 540         return ret_val;
 541 }
 542
 543 /**
 544  * calipso_sock_setattr - Add a CALIPSO option to a socket
 545  * @sk: the socket
 546  * @doi_def: the CALIPSO DOI to use
 547  * @secattr: the specific security attributes of the socket
 548  *
 549  * Description:
 550  * Set the CALIPSO option on the given socket using the DOI definition and
 551  * security attributes passed to the function.  This function requires
 552  * exclusive access to @sk, which means it either needs to be in the
 553  * process of being created or locked.  Returns zero on success and negative
 554  * values on failure.
 555  *
 556  */
 557 int calipso_sock_setattr(struct sock *sk,
 558                          const struct calipso_doi *doi_def,
 559                          const struct netlbl_lsm_secattr *secattr)
 560 {
 561         int ret_val = -ENOMSG;
 562         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 563
 564         if (ops)
 565                 ret_val = ops->sock_setattr(sk, doi_def, secattr);
 566         return ret_val;
 567 }
 568
 569 /**
 570  * calipso_sock_delattr - Delete the CALIPSO option from a socket
 571  * @sk: the socket
 572  *
 573  * Description:
 574  * Removes the CALIPSO option from a socket, if present.
 575  *
 576  */
 577 void calipso_sock_delattr(struct sock *sk)
 578 {
 579         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 580
 581         if (ops)
 582                 ops->sock_delattr(sk);
 583 }
 584
 585 /**
 586  * calipso_req_setattr - Add a CALIPSO option to a connection request socket
 587  * @req: the connection request socket
 588  * @doi_def: the CALIPSO DOI to use
 589  * @secattr: the specific security attributes of the socket
 590  *
 591  * Description:
 592  * Set the CALIPSO option on the given socket using the DOI definition and
 593  * security attributes passed to the function.  Returns zero on success and
 594  * negative values on failure.
 595  *
 596  */
 597 int calipso_req_setattr(struct request_sock *req,
 598                         const struct calipso_doi *doi_def,
 599                         const struct netlbl_lsm_secattr *secattr)
 600 {
 601         int ret_val = -ENOMSG;
 602         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 603
 604         if (ops)
 605                 ret_val = ops->req_setattr(req, doi_def, secattr);
 606         return ret_val;
 607 }
 608
 609 /**
 610  * calipso_req_delattr - Delete the CALIPSO option from a request socket
 611  * @reg: the request socket
 612  *
 613  * Description:
 614  * Removes the CALIPSO option from a request socket, if present.
 615  *
 616  */
 617 void calipso_req_delattr(struct request_sock *req)
 618 {
 619         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 620
 621         if (ops)
 622                 ops->req_delattr(req);
 623 }
 624
 625 /**
 626  * calipso_optptr - Find the CALIPSO option in the packet
 627  * @skb: the packet
 628  *
 629  * Description:
 630  * Parse the packet's IP header looking for a CALIPSO option.  Returns a pointer
 631  * to the start of the CALIPSO option on success, NULL if one if not found.
 632  *
 633  */
 634 unsigned char *calipso_optptr(const struct sk_buff *skb)
 635 {
 636         unsigned char *ret_val = NULL;
 637         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 638
 639         if (ops)
 640                 ret_val = ops->skbuff_optptr(skb);
 641         return ret_val;
 642 }
 643
 644 /**
 645  * calipso_getattr - Get the security attributes from a memory block.
 646  * @calipso: the CALIPSO option
 647  * @secattr: the security attributes
 648  *
 649  * Description:
 650  * Inspect @calipso and return the security attributes in @secattr.
 651  * Returns zero on success and negative values on failure.
 652  *
 653  */
 654 int calipso_getattr(const unsigned char *calipso,
 655                     struct netlbl_lsm_secattr *secattr)
 656 {
 657         int ret_val = -ENOMSG;
 658         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 659
 660         if (ops)
 661                 ret_val = ops->opt_getattr(calipso, secattr);
 662         return ret_val;
 663 }
 664
 665 /**
 666  * calipso_skbuff_setattr - Set the CALIPSO option on a packet
 667  * @skb: the packet
 668  * @doi_def: the CALIPSO DOI to use
 669  * @secattr: the security attributes
 670  *
 671  * Description:
 672  * Set the CALIPSO option on the given packet based on the security attributes.
 673  * Returns a pointer to the IP header on success and NULL on failure.
 674  *
 675  */
 676 int calipso_skbuff_setattr(struct sk_buff *skb,
 677                            const struct calipso_doi *doi_def,
 678                            const struct netlbl_lsm_secattr *secattr)
 679 {
 680         int ret_val = -ENOMSG;
 681         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 682
 683         if (ops)
 684                 ret_val = ops->skbuff_setattr(skb, doi_def, secattr);
 685         return ret_val;
 686 }
 687
 688 /**
 689  * calipso_skbuff_delattr - Delete any CALIPSO options from a packet
 690  * @skb: the packet
 691  *
 692  * Description:
 693  * Removes any and all CALIPSO options from the given packet.  Returns zero on
 694  * success, negative values on failure.
 695  *
 696  */
 697 int calipso_skbuff_delattr(struct sk_buff *skb)
 698 {
 699         int ret_val = -ENOMSG;
 700         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 701
 702         if (ops)
 703                 ret_val = ops->skbuff_delattr(skb);
 704         return ret_val;
 705 }
 706
 707 /**
 708  * calipso_cache_invalidate - Invalidates the current CALIPSO cache
 709  *
 710  * Description:
 711  * Invalidates and frees any entries in the CALIPSO cache.  Returns zero on
 712  * success and negative values on failure.
 713  *
 714  */
 715 void calipso_cache_invalidate(void)
 716 {
 717         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 718
 719         if (ops)
 720                 ops->cache_invalidate();
 721 }
 722
 723 /**
 724  * calipso_cache_add - Add an entry to the CALIPSO cache
 725  * @calipso_ptr: the CALIPSO option
 726  * @secattr: the packet's security attributes
 727  *
 728  * Description:
 729  * Add a new entry into the CALIPSO label mapping cache.
 730  * Returns zero on success, negative values on failure.
 731  *
 732  */
 733 int calipso_cache_add(const unsigned char *calipso_ptr,
 734                       const struct netlbl_lsm_secattr *secattr)
 735
 736 {
 737         int ret_val = -ENOMSG;
 738         const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
 739
 740         if (ops)
 741                 ret_val = ops->cache_add(calipso_ptr, secattr);
 742         return ret_val;
 743 }