blob: c2f2a53a487919bcb45e882b9ff8859c699b9d56 [file] [log] [blame]
Paul Moore96cb8e32006-08-03 16:48:59 -07001/*
2 * NetLabel CIPSO/IPv4 Support
3 *
4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
7 *
Paul Moore82c21bf2011-08-01 11:10:33 +00008 * Author: Paul Moore <paul@paul-moore.com>
Paul Moore96cb8e32006-08-03 16:48:59 -07009 *
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
Jeff Kirsherd484ff12013-12-06 09:13:41 -080026 * along with this program; if not, see <http://www.gnu.org/licenses/>.
Paul Moore96cb8e32006-08-03 16:48:59 -070027 *
28 */
29
30#include <linux/types.h>
31#include <linux/socket.h>
32#include <linux/string.h>
33#include <linux/skbuff.h>
Paul Moore32f50cd2006-09-28 14:51:47 -070034#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090035#include <linux/slab.h>
Paul Moore96cb8e32006-08-03 16:48:59 -070036#include <net/sock.h>
37#include <net/netlink.h>
38#include <net/genetlink.h>
39#include <net/netlabel.h>
40#include <net/cipso_ipv4.h>
Arun Sharma600634972011-07-26 16:09:06 -070041#include <linux/atomic.h>
Paul Moore96cb8e32006-08-03 16:48:59 -070042
43#include "netlabel_user.h"
44#include "netlabel_cipso_v4.h"
Paul Moore23bcdc12007-07-18 12:28:45 -040045#include "netlabel_mgmt.h"
Paul Mooreb1edeb12008-10-10 10:16:31 -040046#include "netlabel_domainhash.h"
Paul Moore96cb8e32006-08-03 16:48:59 -070047
Paul Moorefd385852006-09-25 15:56:37 -070048/* Argument struct for cipso_v4_doi_walk() */
49struct netlbl_cipsov4_doiwalk_arg {
50 struct netlink_callback *nl_cb;
51 struct sk_buff *skb;
52 u32 seq;
53};
54
Paul Mooreb1edeb12008-10-10 10:16:31 -040055/* Argument struct for netlbl_domhsh_walk() */
56struct netlbl_domhsh_walk_arg {
57 struct netlbl_audit *audit_info;
58 u32 doi;
59};
60
Paul Moore96cb8e32006-08-03 16:48:59 -070061/* NetLabel Generic NETLINK CIPSOv4 family */
62static struct genl_family netlbl_cipsov4_gnl_family = {
63 .id = GENL_ID_GENERATE,
64 .hdrsize = 0,
65 .name = NETLBL_NLTYPE_CIPSOV4_NAME,
66 .version = NETLBL_PROTO_VERSION,
Paul Moorefd385852006-09-25 15:56:37 -070067 .maxattr = NLBL_CIPSOV4_A_MAX,
Paul Moore96cb8e32006-08-03 16:48:59 -070068};
69
Paul Moorefd385852006-09-25 15:56:37 -070070/* NetLabel Netlink attribute policy */
Patrick McHardyef7c79e2007-06-05 12:38:30 -070071static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
Paul Moorefd385852006-09-25 15:56:37 -070072 [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
73 [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
74 [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
75 [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
76 [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
77 [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
78 [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
79 [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
80 [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
81 [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
82 [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
83 [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
84};
Paul Moore96cb8e32006-08-03 16:48:59 -070085
86/*
87 * Helper Functions
88 */
89
90/**
Paul Moorefd385852006-09-25 15:56:37 -070091 * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
92 * @info: the Generic NETLINK info block
93 * @doi_def: the CIPSO V4 DOI definition
94 *
95 * Description:
96 * Parse the common sections of a ADD message and fill in the related values
97 * in @doi_def. Returns zero on success, negative values on failure.
98 *
99 */
100static int netlbl_cipsov4_add_common(struct genl_info *info,
101 struct cipso_v4_doi *doi_def)
102{
103 struct nlattr *nla;
104 int nla_rem;
105 u32 iter = 0;
106
107 doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
108
109 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST],
110 NLBL_CIPSOV4_A_MAX,
111 netlbl_cipsov4_genl_policy) != 0)
112 return -EINVAL;
113
114 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200115 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) {
Paul Moore2a2f11c2007-01-05 15:08:22 -0500116 if (iter >= CIPSO_V4_TAG_MAXCNT)
Paul Moorefd385852006-09-25 15:56:37 -0700117 return -EINVAL;
118 doi_def->tags[iter++] = nla_get_u8(nla);
119 }
Paul Moore2a2f11c2007-01-05 15:08:22 -0500120 while (iter < CIPSO_V4_TAG_MAXCNT)
121 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
Paul Moorefd385852006-09-25 15:56:37 -0700122
123 return 0;
124}
Paul Moore96cb8e32006-08-03 16:48:59 -0700125
126/*
127 * NetLabel Command Handlers
128 */
129
130/**
131 * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
Paul Moorefd385852006-09-25 15:56:37 -0700132 * @info: the Generic NETLINK info block
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500133 * @audit_info: NetLabel audit information
Paul Moore96cb8e32006-08-03 16:48:59 -0700134 *
135 * Description:
Paul Moore15c45f72008-10-10 10:16:34 -0400136 * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
137 * message and add it to the CIPSO V4 engine. Return zero on success and
138 * non-zero on error.
Paul Moore96cb8e32006-08-03 16:48:59 -0700139 *
140 */
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500141static int netlbl_cipsov4_add_std(struct genl_info *info,
142 struct netlbl_audit *audit_info)
Paul Moore96cb8e32006-08-03 16:48:59 -0700143{
144 int ret_val = -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700145 struct cipso_v4_doi *doi_def = NULL;
Paul Moorefd385852006-09-25 15:56:37 -0700146 struct nlattr *nla_a;
147 struct nlattr *nla_b;
148 int nla_a_rem;
149 int nla_b_rem;
Paul Moorecaff5b6a2006-12-15 16:49:28 -0500150 u32 iter;
Paul Moore96cb8e32006-08-03 16:48:59 -0700151
Paul Moore32f50cd2006-09-28 14:51:47 -0700152 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
Paul Moorefd385852006-09-25 15:56:37 -0700153 !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
154 return -EINVAL;
155
156 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
157 NLBL_CIPSOV4_A_MAX,
158 netlbl_cipsov4_genl_policy) != 0)
159 return -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700160
161 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
Paul Moorefd385852006-09-25 15:56:37 -0700162 if (doi_def == NULL)
163 return -ENOMEM;
Paul Moore96cb8e32006-08-03 16:48:59 -0700164 doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
165 if (doi_def->map.std == NULL) {
166 ret_val = -ENOMEM;
167 goto add_std_failure;
168 }
Paul Moore15c45f72008-10-10 10:16:34 -0400169 doi_def->type = CIPSO_V4_MAP_TRANS;
Paul Moore96cb8e32006-08-03 16:48:59 -0700170
Paul Moorefd385852006-09-25 15:56:37 -0700171 ret_val = netlbl_cipsov4_add_common(info, doi_def);
172 if (ret_val != 0)
173 goto add_std_failure;
Paul Moore1fd2a252006-12-15 16:49:27 -0500174 ret_val = -EINVAL;
Paul Moorefd385852006-09-25 15:56:37 -0700175
176 nla_for_each_nested(nla_a,
177 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
178 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200179 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
Paul Moore1fd2a252006-12-15 16:49:27 -0500180 if (nla_validate_nested(nla_a,
181 NLBL_CIPSOV4_A_MAX,
182 netlbl_cipsov4_genl_policy) != 0)
183 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700184 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200185 switch (nla_type(nla_b)) {
Paul Moorefd385852006-09-25 15:56:37 -0700186 case NLBL_CIPSOV4_A_MLSLVLLOC:
Paul Moore1fd2a252006-12-15 16:49:27 -0500187 if (nla_get_u32(nla_b) >
188 CIPSO_V4_MAX_LOC_LVLS)
189 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700190 if (nla_get_u32(nla_b) >=
191 doi_def->map.std->lvl.local_size)
192 doi_def->map.std->lvl.local_size =
193 nla_get_u32(nla_b) + 1;
194 break;
195 case NLBL_CIPSOV4_A_MLSLVLREM:
Paul Moore1fd2a252006-12-15 16:49:27 -0500196 if (nla_get_u32(nla_b) >
197 CIPSO_V4_MAX_REM_LVLS)
198 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700199 if (nla_get_u32(nla_b) >=
200 doi_def->map.std->lvl.cipso_size)
201 doi_def->map.std->lvl.cipso_size =
202 nla_get_u32(nla_b) + 1;
203 break;
204 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700205 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700206 doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
207 sizeof(u32),
208 GFP_KERNEL);
209 if (doi_def->map.std->lvl.local == NULL) {
210 ret_val = -ENOMEM;
211 goto add_std_failure;
212 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700213 doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
214 sizeof(u32),
215 GFP_KERNEL);
216 if (doi_def->map.std->lvl.cipso == NULL) {
217 ret_val = -ENOMEM;
218 goto add_std_failure;
219 }
Paul Moorecaff5b6a2006-12-15 16:49:28 -0500220 for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
221 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
222 for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
223 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
Paul Moorefd385852006-09-25 15:56:37 -0700224 nla_for_each_nested(nla_a,
225 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
226 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200227 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
Paul Moorefd385852006-09-25 15:56:37 -0700228 struct nlattr *lvl_loc;
229 struct nlattr *lvl_rem;
Paul Moore96cb8e32006-08-03 16:48:59 -0700230
Paul Moorefd385852006-09-25 15:56:37 -0700231 lvl_loc = nla_find_nested(nla_a,
232 NLBL_CIPSOV4_A_MLSLVLLOC);
233 lvl_rem = nla_find_nested(nla_a,
234 NLBL_CIPSOV4_A_MLSLVLREM);
235 if (lvl_loc == NULL || lvl_rem == NULL)
236 goto add_std_failure;
237 doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
238 nla_get_u32(lvl_rem);
239 doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
240 nla_get_u32(lvl_loc);
241 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700242
Paul Moorefd385852006-09-25 15:56:37 -0700243 if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
244 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
245 NLBL_CIPSOV4_A_MAX,
246 netlbl_cipsov4_genl_policy) != 0)
Paul Moore96cb8e32006-08-03 16:48:59 -0700247 goto add_std_failure;
248
Paul Moorefd385852006-09-25 15:56:37 -0700249 nla_for_each_nested(nla_a,
250 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
251 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200252 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
Paul Moorefd385852006-09-25 15:56:37 -0700253 if (nla_validate_nested(nla_a,
254 NLBL_CIPSOV4_A_MAX,
255 netlbl_cipsov4_genl_policy) != 0)
256 goto add_std_failure;
257 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200258 switch (nla_type(nla_b)) {
Paul Moorefd385852006-09-25 15:56:37 -0700259 case NLBL_CIPSOV4_A_MLSCATLOC:
Paul Moore1fd2a252006-12-15 16:49:27 -0500260 if (nla_get_u32(nla_b) >
261 CIPSO_V4_MAX_LOC_CATS)
262 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700263 if (nla_get_u32(nla_b) >=
264 doi_def->map.std->cat.local_size)
265 doi_def->map.std->cat.local_size =
266 nla_get_u32(nla_b) + 1;
267 break;
268 case NLBL_CIPSOV4_A_MLSCATREM:
Paul Moore1fd2a252006-12-15 16:49:27 -0500269 if (nla_get_u32(nla_b) >
270 CIPSO_V4_MAX_REM_CATS)
271 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700272 if (nla_get_u32(nla_b) >=
273 doi_def->map.std->cat.cipso_size)
274 doi_def->map.std->cat.cipso_size =
275 nla_get_u32(nla_b) + 1;
276 break;
277 }
278 }
Paul Moorefd385852006-09-25 15:56:37 -0700279 doi_def->map.std->cat.local = kcalloc(
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900280 doi_def->map.std->cat.local_size,
Paul Moorefd385852006-09-25 15:56:37 -0700281 sizeof(u32),
282 GFP_KERNEL);
283 if (doi_def->map.std->cat.local == NULL) {
284 ret_val = -ENOMEM;
285 goto add_std_failure;
286 }
287 doi_def->map.std->cat.cipso = kcalloc(
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900288 doi_def->map.std->cat.cipso_size,
Paul Moorefd385852006-09-25 15:56:37 -0700289 sizeof(u32),
290 GFP_KERNEL);
291 if (doi_def->map.std->cat.cipso == NULL) {
292 ret_val = -ENOMEM;
293 goto add_std_failure;
294 }
Paul Moorecaff5b6a2006-12-15 16:49:28 -0500295 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
296 doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
297 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
298 doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
Paul Moorefd385852006-09-25 15:56:37 -0700299 nla_for_each_nested(nla_a,
300 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
301 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200302 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
Paul Moorefd385852006-09-25 15:56:37 -0700303 struct nlattr *cat_loc;
304 struct nlattr *cat_rem;
Paul Moore96cb8e32006-08-03 16:48:59 -0700305
Paul Moorefd385852006-09-25 15:56:37 -0700306 cat_loc = nla_find_nested(nla_a,
307 NLBL_CIPSOV4_A_MLSCATLOC);
308 cat_rem = nla_find_nested(nla_a,
309 NLBL_CIPSOV4_A_MLSCATREM);
310 if (cat_loc == NULL || cat_rem == NULL)
311 goto add_std_failure;
312 doi_def->map.std->cat.local[
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900313 nla_get_u32(cat_loc)] =
Paul Moorefd385852006-09-25 15:56:37 -0700314 nla_get_u32(cat_rem);
315 doi_def->map.std->cat.cipso[
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900316 nla_get_u32(cat_rem)] =
Paul Moorefd385852006-09-25 15:56:37 -0700317 nla_get_u32(cat_loc);
318 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700319 }
320
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500321 ret_val = cipso_v4_doi_add(doi_def, audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700322 if (ret_val != 0)
323 goto add_std_failure;
324 return 0;
325
326add_std_failure:
327 if (doi_def)
Paul Mooreb1edeb12008-10-10 10:16:31 -0400328 cipso_v4_doi_free(doi_def);
Paul Moore96cb8e32006-08-03 16:48:59 -0700329 return ret_val;
330}
331
332/**
333 * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
Paul Moorefd385852006-09-25 15:56:37 -0700334 * @info: the Generic NETLINK info block
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500335 * @audit_info: NetLabel audit information
Paul Moore96cb8e32006-08-03 16:48:59 -0700336 *
337 * Description:
338 * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
339 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
340 * error.
341 *
342 */
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500343static int netlbl_cipsov4_add_pass(struct genl_info *info,
344 struct netlbl_audit *audit_info)
Paul Moore96cb8e32006-08-03 16:48:59 -0700345{
Paul Moorefd385852006-09-25 15:56:37 -0700346 int ret_val;
Paul Moore96cb8e32006-08-03 16:48:59 -0700347 struct cipso_v4_doi *doi_def = NULL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700348
Paul Moore32f50cd2006-09-28 14:51:47 -0700349 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
Paul Moorefd385852006-09-25 15:56:37 -0700350 return -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700351
352 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
Paul Moorefd385852006-09-25 15:56:37 -0700353 if (doi_def == NULL)
354 return -ENOMEM;
Paul Moore96cb8e32006-08-03 16:48:59 -0700355 doi_def->type = CIPSO_V4_MAP_PASS;
356
Paul Moorefd385852006-09-25 15:56:37 -0700357 ret_val = netlbl_cipsov4_add_common(info, doi_def);
358 if (ret_val != 0)
359 goto add_pass_failure;
Paul Moore96cb8e32006-08-03 16:48:59 -0700360
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500361 ret_val = cipso_v4_doi_add(doi_def, audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700362 if (ret_val != 0)
363 goto add_pass_failure;
364 return 0;
365
366add_pass_failure:
Paul Mooreb1edeb12008-10-10 10:16:31 -0400367 cipso_v4_doi_free(doi_def);
Paul Moore96cb8e32006-08-03 16:48:59 -0700368 return ret_val;
369}
370
371/**
Paul Moored91d4072008-10-10 10:16:34 -0400372 * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
373 * @info: the Generic NETLINK info block
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500374 * @audit_info: NetLabel audit information
Paul Moored91d4072008-10-10 10:16:34 -0400375 *
376 * Description:
377 * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
378 * message and add it to the CIPSO V4 engine. Return zero on success and
379 * non-zero on error.
380 *
381 */
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500382static int netlbl_cipsov4_add_local(struct genl_info *info,
383 struct netlbl_audit *audit_info)
Paul Moored91d4072008-10-10 10:16:34 -0400384{
385 int ret_val;
386 struct cipso_v4_doi *doi_def = NULL;
387
388 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
389 return -EINVAL;
390
391 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
392 if (doi_def == NULL)
393 return -ENOMEM;
394 doi_def->type = CIPSO_V4_MAP_LOCAL;
395
396 ret_val = netlbl_cipsov4_add_common(info, doi_def);
397 if (ret_val != 0)
398 goto add_local_failure;
399
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500400 ret_val = cipso_v4_doi_add(doi_def, audit_info);
Paul Moored91d4072008-10-10 10:16:34 -0400401 if (ret_val != 0)
402 goto add_local_failure;
403 return 0;
404
405add_local_failure:
406 cipso_v4_doi_free(doi_def);
407 return ret_val;
408}
409
410/**
Paul Moore96cb8e32006-08-03 16:48:59 -0700411 * netlbl_cipsov4_add - Handle an ADD message
412 * @skb: the NETLINK buffer
413 * @info: the Generic NETLINK info block
414 *
415 * Description:
416 * Create a new DOI definition based on the given ADD message and add it to the
417 * CIPSO V4 engine. Returns zero on success, negative values on failure.
418 *
419 */
420static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
421
422{
423 int ret_val = -EINVAL;
Paul Moore95d4e6b2006-09-29 17:05:05 -0700424 struct netlbl_audit audit_info;
Paul Moore96cb8e32006-08-03 16:48:59 -0700425
Paul Moore32f50cd2006-09-28 14:51:47 -0700426 if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
427 !info->attrs[NLBL_CIPSOV4_A_MTYPE])
Paul Moorefd385852006-09-25 15:56:37 -0700428 return -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700429
Paul Moore95d4e6b2006-09-29 17:05:05 -0700430 netlbl_netlink_auditinfo(skb, &audit_info);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500431 switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
Paul Moore15c45f72008-10-10 10:16:34 -0400432 case CIPSO_V4_MAP_TRANS:
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500433 ret_val = netlbl_cipsov4_add_std(info, &audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700434 break;
435 case CIPSO_V4_MAP_PASS:
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500436 ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700437 break;
Paul Moored91d4072008-10-10 10:16:34 -0400438 case CIPSO_V4_MAP_LOCAL:
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500439 ret_val = netlbl_cipsov4_add_local(info, &audit_info);
Paul Moored91d4072008-10-10 10:16:34 -0400440 break;
Paul Moore96cb8e32006-08-03 16:48:59 -0700441 }
Paul Moore23bcdc12007-07-18 12:28:45 -0400442 if (ret_val == 0)
Paul Moorec783f1c2008-01-29 08:37:52 -0500443 atomic_inc(&netlabel_mgmt_protocount);
Paul Moore96cb8e32006-08-03 16:48:59 -0700444
Paul Moore96cb8e32006-08-03 16:48:59 -0700445 return ret_val;
446}
447
448/**
449 * netlbl_cipsov4_list - Handle a LIST message
450 * @skb: the NETLINK buffer
451 * @info: the Generic NETLINK info block
452 *
453 * Description:
Paul Moorefd385852006-09-25 15:56:37 -0700454 * Process a user generated LIST message and respond accordingly. While the
455 * response message generated by the kernel is straightforward, determining
456 * before hand the size of the buffer to allocate is not (we have to generate
457 * the message to know the size). In order to keep this function sane what we
458 * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
459 * that size, if we fail then we restart with a larger buffer and try again.
460 * We continue in this manner until we hit a limit of failed attempts then we
461 * give up and just send an error message. Returns zero on success and
462 * negative values on error.
Paul Moore96cb8e32006-08-03 16:48:59 -0700463 *
464 */
465static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
466{
Paul Moorefd385852006-09-25 15:56:37 -0700467 int ret_val;
468 struct sk_buff *ans_skb = NULL;
469 u32 nlsze_mult = 1;
470 void *data;
Paul Moore96cb8e32006-08-03 16:48:59 -0700471 u32 doi;
Paul Moorefd385852006-09-25 15:56:37 -0700472 struct nlattr *nla_a;
473 struct nlattr *nla_b;
474 struct cipso_v4_doi *doi_def;
475 u32 iter;
Paul Moore96cb8e32006-08-03 16:48:59 -0700476
Paul Moorefd385852006-09-25 15:56:37 -0700477 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
478 ret_val = -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700479 goto list_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700480 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700481
Paul Moorefd385852006-09-25 15:56:37 -0700482list_start:
Thomas Graf339bf982006-11-10 14:10:15 -0800483 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
Paul Moore96cb8e32006-08-03 16:48:59 -0700484 if (ans_skb == NULL) {
485 ret_val = -ENOMEM;
486 goto list_failure;
487 }
Thomas Graf17c157c2006-11-14 19:46:02 -0800488 data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
489 0, NLBL_CIPSOV4_C_LIST);
Paul Moorefd385852006-09-25 15:56:37 -0700490 if (data == NULL) {
491 ret_val = -ENOMEM;
492 goto list_failure;
493 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700494
Paul Moorefd385852006-09-25 15:56:37 -0700495 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
496
497 rcu_read_lock();
498 doi_def = cipso_v4_doi_getdef(doi);
499 if (doi_def == NULL) {
500 ret_val = -EINVAL;
Paul Moore56196702008-10-10 10:16:29 -0400501 goto list_failure_lock;
Paul Moorefd385852006-09-25 15:56:37 -0700502 }
503
504 ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
505 if (ret_val != 0)
506 goto list_failure_lock;
507
508 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST);
509 if (nla_a == NULL) {
510 ret_val = -ENOMEM;
511 goto list_failure_lock;
512 }
513 for (iter = 0;
514 iter < CIPSO_V4_TAG_MAXCNT &&
515 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
516 iter++) {
517 ret_val = nla_put_u8(ans_skb,
518 NLBL_CIPSOV4_A_TAG,
519 doi_def->tags[iter]);
520 if (ret_val != 0)
521 goto list_failure_lock;
522 }
523 nla_nest_end(ans_skb, nla_a);
524
525 switch (doi_def->type) {
Paul Moore15c45f72008-10-10 10:16:34 -0400526 case CIPSO_V4_MAP_TRANS:
Paul Moorefd385852006-09-25 15:56:37 -0700527 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
528 if (nla_a == NULL) {
529 ret_val = -ENOMEM;
530 goto list_failure_lock;
531 }
532 for (iter = 0;
533 iter < doi_def->map.std->lvl.local_size;
534 iter++) {
535 if (doi_def->map.std->lvl.local[iter] ==
536 CIPSO_V4_INV_LVL)
537 continue;
538
539 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL);
540 if (nla_b == NULL) {
541 ret_val = -ENOMEM;
542 goto list_retry;
543 }
544 ret_val = nla_put_u32(ans_skb,
545 NLBL_CIPSOV4_A_MLSLVLLOC,
546 iter);
547 if (ret_val != 0)
548 goto list_retry;
549 ret_val = nla_put_u32(ans_skb,
550 NLBL_CIPSOV4_A_MLSLVLREM,
551 doi_def->map.std->lvl.local[iter]);
552 if (ret_val != 0)
553 goto list_retry;
554 nla_nest_end(ans_skb, nla_b);
555 }
556 nla_nest_end(ans_skb, nla_a);
557
558 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST);
559 if (nla_a == NULL) {
560 ret_val = -ENOMEM;
561 goto list_retry;
562 }
563 for (iter = 0;
564 iter < doi_def->map.std->cat.local_size;
565 iter++) {
566 if (doi_def->map.std->cat.local[iter] ==
567 CIPSO_V4_INV_CAT)
568 continue;
569
570 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT);
571 if (nla_b == NULL) {
572 ret_val = -ENOMEM;
573 goto list_retry;
574 }
575 ret_val = nla_put_u32(ans_skb,
576 NLBL_CIPSOV4_A_MLSCATLOC,
577 iter);
578 if (ret_val != 0)
579 goto list_retry;
580 ret_val = nla_put_u32(ans_skb,
581 NLBL_CIPSOV4_A_MLSCATREM,
582 doi_def->map.std->cat.local[iter]);
583 if (ret_val != 0)
584 goto list_retry;
585 nla_nest_end(ans_skb, nla_b);
586 }
587 nla_nest_end(ans_skb, nla_a);
588
589 break;
590 }
591 rcu_read_unlock();
592
593 genlmsg_end(ans_skb, data);
Denis V. Lunevfe785be2008-07-10 16:53:39 -0700594 return genlmsg_reply(ans_skb, info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700595
Paul Moorefd385852006-09-25 15:56:37 -0700596list_retry:
597 /* XXX - this limit is a guesstimate */
598 if (nlsze_mult < 4) {
599 rcu_read_unlock();
600 kfree_skb(ans_skb);
Denis V. Lunev83aa2e92008-07-14 22:28:25 -0700601 nlsze_mult *= 2;
Paul Moorefd385852006-09-25 15:56:37 -0700602 goto list_start;
603 }
604list_failure_lock:
605 rcu_read_unlock();
Paul Moore96cb8e32006-08-03 16:48:59 -0700606list_failure:
Paul Moorefd385852006-09-25 15:56:37 -0700607 kfree_skb(ans_skb);
608 return ret_val;
609}
610
611/**
612 * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
613 * @doi_def: the CIPSOv4 DOI definition
614 * @arg: the netlbl_cipsov4_doiwalk_arg structure
615 *
616 * Description:
617 * This function is designed to be used as a callback to the
618 * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
619 * message. Returns the size of the message on success, negative values on
620 * failure.
621 *
622 */
623static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
624{
625 int ret_val = -ENOMEM;
626 struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
627 void *data;
628
Eric W. Biederman15e47302012-09-07 20:12:54 +0000629 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
Thomas Graf17c157c2006-11-14 19:46:02 -0800630 cb_arg->seq, &netlbl_cipsov4_gnl_family,
631 NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
Paul Moorefd385852006-09-25 15:56:37 -0700632 if (data == NULL)
633 goto listall_cb_failure;
634
635 ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
636 if (ret_val != 0)
637 goto listall_cb_failure;
638 ret_val = nla_put_u32(cb_arg->skb,
639 NLBL_CIPSOV4_A_MTYPE,
640 doi_def->type);
641 if (ret_val != 0)
642 goto listall_cb_failure;
643
644 return genlmsg_end(cb_arg->skb, data);
645
646listall_cb_failure:
647 genlmsg_cancel(cb_arg->skb, data);
Paul Moore96cb8e32006-08-03 16:48:59 -0700648 return ret_val;
649}
650
651/**
652 * netlbl_cipsov4_listall - Handle a LISTALL message
653 * @skb: the NETLINK buffer
Paul Moorefd385852006-09-25 15:56:37 -0700654 * @cb: the NETLINK callback
Paul Moore96cb8e32006-08-03 16:48:59 -0700655 *
656 * Description:
657 * Process a user generated LISTALL message and respond accordingly. Returns
658 * zero on success and negative values on error.
659 *
660 */
Paul Moorefd385852006-09-25 15:56:37 -0700661static int netlbl_cipsov4_listall(struct sk_buff *skb,
662 struct netlink_callback *cb)
Paul Moore96cb8e32006-08-03 16:48:59 -0700663{
Paul Moorefd385852006-09-25 15:56:37 -0700664 struct netlbl_cipsov4_doiwalk_arg cb_arg;
Paul Moore56196702008-10-10 10:16:29 -0400665 u32 doi_skip = cb->args[0];
Paul Moore96cb8e32006-08-03 16:48:59 -0700666
Paul Moorefd385852006-09-25 15:56:37 -0700667 cb_arg.nl_cb = cb;
668 cb_arg.skb = skb;
669 cb_arg.seq = cb->nlh->nlmsg_seq;
Paul Moore96cb8e32006-08-03 16:48:59 -0700670
Paul Moorefd385852006-09-25 15:56:37 -0700671 cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
Paul Moore96cb8e32006-08-03 16:48:59 -0700672
Paul Moorefd385852006-09-25 15:56:37 -0700673 cb->args[0] = doi_skip;
674 return skb->len;
Paul Moore96cb8e32006-08-03 16:48:59 -0700675}
676
677/**
Paul Mooreb1edeb12008-10-10 10:16:31 -0400678 * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE
679 * @entry: LSM domain mapping entry
680 * @arg: the netlbl_domhsh_walk_arg structure
681 *
682 * Description:
683 * This function is intended for use by netlbl_cipsov4_remove() as the callback
684 * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
685 * which are associated with the CIPSO DOI specified in @arg. Returns zero on
686 * success, negative values on failure.
687 *
688 */
689static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
690{
691 struct netlbl_domhsh_walk_arg *cb_arg = arg;
692
Paul Moore6a8b7f02013-08-02 14:45:08 -0400693 if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
694 entry->def.cipso->doi == cb_arg->doi)
Paul Mooreb1edeb12008-10-10 10:16:31 -0400695 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
696
697 return 0;
698}
699
700/**
Paul Moore96cb8e32006-08-03 16:48:59 -0700701 * netlbl_cipsov4_remove - Handle a REMOVE message
702 * @skb: the NETLINK buffer
703 * @info: the Generic NETLINK info block
704 *
705 * Description:
706 * Process a user generated REMOVE message and respond accordingly. Returns
707 * zero on success, negative values on failure.
708 *
709 */
710static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
711{
Paul Moorefd385852006-09-25 15:56:37 -0700712 int ret_val = -EINVAL;
Paul Mooreb1edeb12008-10-10 10:16:31 -0400713 struct netlbl_domhsh_walk_arg cb_arg;
Paul Moore95d4e6b2006-09-29 17:05:05 -0700714 struct netlbl_audit audit_info;
Paul Mooreb1edeb12008-10-10 10:16:31 -0400715 u32 skip_bkt = 0;
716 u32 skip_chain = 0;
Paul Moore96cb8e32006-08-03 16:48:59 -0700717
Paul Moore95d4e6b2006-09-29 17:05:05 -0700718 if (!info->attrs[NLBL_CIPSOV4_A_DOI])
719 return -EINVAL;
Paul Moore32f50cd2006-09-28 14:51:47 -0700720
Paul Moore95d4e6b2006-09-29 17:05:05 -0700721 netlbl_netlink_auditinfo(skb, &audit_info);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500722 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400723 cb_arg.audit_info = &audit_info;
724 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
725 netlbl_cipsov4_remove_cb, &cb_arg);
726 if (ret_val == 0 || ret_val == -ENOENT) {
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500727 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400728 if (ret_val == 0)
729 atomic_dec(&netlabel_mgmt_protocount);
730 }
Paul Moore95d4e6b2006-09-29 17:05:05 -0700731
Paul Moore96cb8e32006-08-03 16:48:59 -0700732 return ret_val;
733}
734
735/*
736 * NetLabel Generic NETLINK Command Definitions
737 */
738
Johannes Berg4534de82013-11-14 17:14:46 +0100739static const struct genl_ops netlbl_cipsov4_ops[] = {
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800740 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700741 .cmd = NLBL_CIPSOV4_C_ADD,
Paul Moorefd385852006-09-25 15:56:37 -0700742 .flags = GENL_ADMIN_PERM,
743 .policy = netlbl_cipsov4_genl_policy,
Paul Moore96cb8e32006-08-03 16:48:59 -0700744 .doit = netlbl_cipsov4_add,
745 .dumpit = NULL,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800746 },
747 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700748 .cmd = NLBL_CIPSOV4_C_REMOVE,
Paul Moorefd385852006-09-25 15:56:37 -0700749 .flags = GENL_ADMIN_PERM,
750 .policy = netlbl_cipsov4_genl_policy,
Paul Moore96cb8e32006-08-03 16:48:59 -0700751 .doit = netlbl_cipsov4_remove,
752 .dumpit = NULL,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800753 },
754 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700755 .cmd = NLBL_CIPSOV4_C_LIST,
756 .flags = 0,
Paul Moorefd385852006-09-25 15:56:37 -0700757 .policy = netlbl_cipsov4_genl_policy,
Paul Moore96cb8e32006-08-03 16:48:59 -0700758 .doit = netlbl_cipsov4_list,
759 .dumpit = NULL,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800760 },
761 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700762 .cmd = NLBL_CIPSOV4_C_LISTALL,
763 .flags = 0,
Paul Moorefd385852006-09-25 15:56:37 -0700764 .policy = netlbl_cipsov4_genl_policy,
765 .doit = NULL,
766 .dumpit = netlbl_cipsov4_listall,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800767 },
Paul Moore96cb8e32006-08-03 16:48:59 -0700768};
769
770/*
771 * NetLabel Generic NETLINK Protocol Functions
772 */
773
774/**
775 * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
776 *
777 * Description:
778 * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
779 * mechanism. Returns zero on success, negative values on failure.
780 *
781 */
Pavel Emelyanov05705e42008-02-17 22:33:57 -0800782int __init netlbl_cipsov4_genl_init(void)
Paul Moore96cb8e32006-08-03 16:48:59 -0700783{
Michał Mirosław7ae740d2009-05-21 10:34:05 +0000784 return genl_register_family_with_ops(&netlbl_cipsov4_gnl_family,
Johannes Bergc53ed742013-11-19 15:19:31 +0100785 netlbl_cipsov4_ops);
Paul Moore96cb8e32006-08-03 16:48:59 -0700786}