blob: 5f14c8462e30182a8fd5ad7577d5e3e37d9b31d9 [file] [log] [blame]
Paul Moore96cb8e32006-08-03 16:48:59 -07001/*
2 * NetLabel CIPSO/IPv4 Support
3 *
4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
7 *
8 * Author: Paul Moore <paul.moore@hp.com>
9 *
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28 *
29 */
30
31#include <linux/types.h>
32#include <linux/socket.h>
33#include <linux/string.h>
34#include <linux/skbuff.h>
Paul Moore32f50cd2006-09-28 14:51:47 -070035#include <linux/audit.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090036#include <linux/slab.h>
Paul Moore96cb8e32006-08-03 16:48:59 -070037#include <net/sock.h>
38#include <net/netlink.h>
39#include <net/genetlink.h>
40#include <net/netlabel.h>
41#include <net/cipso_ipv4.h>
Paul Moorec783f1c2008-01-29 08:37:52 -050042#include <asm/atomic.h>
Paul Moore96cb8e32006-08-03 16:48:59 -070043
44#include "netlabel_user.h"
45#include "netlabel_cipso_v4.h"
Paul Moore23bcdc12007-07-18 12:28:45 -040046#include "netlabel_mgmt.h"
Paul Mooreb1edeb12008-10-10 10:16:31 -040047#include "netlabel_domainhash.h"
Paul Moore96cb8e32006-08-03 16:48:59 -070048
Paul Moorefd385852006-09-25 15:56:37 -070049/* Argument struct for cipso_v4_doi_walk() */
50struct netlbl_cipsov4_doiwalk_arg {
51 struct netlink_callback *nl_cb;
52 struct sk_buff *skb;
53 u32 seq;
54};
55
Paul Mooreb1edeb12008-10-10 10:16:31 -040056/* Argument struct for netlbl_domhsh_walk() */
57struct netlbl_domhsh_walk_arg {
58 struct netlbl_audit *audit_info;
59 u32 doi;
60};
61
Paul Moore96cb8e32006-08-03 16:48:59 -070062/* NetLabel Generic NETLINK CIPSOv4 family */
63static struct genl_family netlbl_cipsov4_gnl_family = {
64 .id = GENL_ID_GENERATE,
65 .hdrsize = 0,
66 .name = NETLBL_NLTYPE_CIPSOV4_NAME,
67 .version = NETLBL_PROTO_VERSION,
Paul Moorefd385852006-09-25 15:56:37 -070068 .maxattr = NLBL_CIPSOV4_A_MAX,
Paul Moore96cb8e32006-08-03 16:48:59 -070069};
70
Paul Moorefd385852006-09-25 15:56:37 -070071/* NetLabel Netlink attribute policy */
Patrick McHardyef7c79e2007-06-05 12:38:30 -070072static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
Paul Moorefd385852006-09-25 15:56:37 -070073 [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
74 [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
75 [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
76 [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
77 [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
78 [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
79 [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
80 [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
81 [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
82 [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
83 [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
84 [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
85};
Paul Moore96cb8e32006-08-03 16:48:59 -070086
87/*
88 * Helper Functions
89 */
90
91/**
Paul Moorefd385852006-09-25 15:56:37 -070092 * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
93 * @info: the Generic NETLINK info block
94 * @doi_def: the CIPSO V4 DOI definition
95 *
96 * Description:
97 * Parse the common sections of a ADD message and fill in the related values
98 * in @doi_def. Returns zero on success, negative values on failure.
99 *
100 */
101static int netlbl_cipsov4_add_common(struct genl_info *info,
102 struct cipso_v4_doi *doi_def)
103{
104 struct nlattr *nla;
105 int nla_rem;
106 u32 iter = 0;
107
108 doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
109
110 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST],
111 NLBL_CIPSOV4_A_MAX,
112 netlbl_cipsov4_genl_policy) != 0)
113 return -EINVAL;
114
115 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200116 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) {
Paul Moore2a2f11c2007-01-05 15:08:22 -0500117 if (iter >= CIPSO_V4_TAG_MAXCNT)
Paul Moorefd385852006-09-25 15:56:37 -0700118 return -EINVAL;
119 doi_def->tags[iter++] = nla_get_u8(nla);
120 }
Paul Moore2a2f11c2007-01-05 15:08:22 -0500121 while (iter < CIPSO_V4_TAG_MAXCNT)
122 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
Paul Moorefd385852006-09-25 15:56:37 -0700123
124 return 0;
125}
Paul Moore96cb8e32006-08-03 16:48:59 -0700126
127/*
128 * NetLabel Command Handlers
129 */
130
131/**
132 * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
Paul Moorefd385852006-09-25 15:56:37 -0700133 * @info: the Generic NETLINK info block
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500134 * @audit_info: NetLabel audit information
Paul Moore96cb8e32006-08-03 16:48:59 -0700135 *
136 * Description:
Paul Moore15c45f72008-10-10 10:16:34 -0400137 * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
138 * message and add it to the CIPSO V4 engine. Return zero on success and
139 * non-zero on error.
Paul Moore96cb8e32006-08-03 16:48:59 -0700140 *
141 */
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500142static int netlbl_cipsov4_add_std(struct genl_info *info,
143 struct netlbl_audit *audit_info)
Paul Moore96cb8e32006-08-03 16:48:59 -0700144{
145 int ret_val = -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700146 struct cipso_v4_doi *doi_def = NULL;
Paul Moorefd385852006-09-25 15:56:37 -0700147 struct nlattr *nla_a;
148 struct nlattr *nla_b;
149 int nla_a_rem;
150 int nla_b_rem;
Paul Moorecaff5b62006-12-15 16:49:28 -0500151 u32 iter;
Paul Moore96cb8e32006-08-03 16:48:59 -0700152
Paul Moore32f50cd2006-09-28 14:51:47 -0700153 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
Paul Moorefd385852006-09-25 15:56:37 -0700154 !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
155 return -EINVAL;
156
157 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
158 NLBL_CIPSOV4_A_MAX,
159 netlbl_cipsov4_genl_policy) != 0)
160 return -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700161
162 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
Paul Moorefd385852006-09-25 15:56:37 -0700163 if (doi_def == NULL)
164 return -ENOMEM;
Paul Moore96cb8e32006-08-03 16:48:59 -0700165 doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
166 if (doi_def->map.std == NULL) {
167 ret_val = -ENOMEM;
168 goto add_std_failure;
169 }
Paul Moore15c45f72008-10-10 10:16:34 -0400170 doi_def->type = CIPSO_V4_MAP_TRANS;
Paul Moore96cb8e32006-08-03 16:48:59 -0700171
Paul Moorefd385852006-09-25 15:56:37 -0700172 ret_val = netlbl_cipsov4_add_common(info, doi_def);
173 if (ret_val != 0)
174 goto add_std_failure;
Paul Moore1fd2a252006-12-15 16:49:27 -0500175 ret_val = -EINVAL;
Paul Moorefd385852006-09-25 15:56:37 -0700176
177 nla_for_each_nested(nla_a,
178 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
179 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200180 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
Paul Moore1fd2a252006-12-15 16:49:27 -0500181 if (nla_validate_nested(nla_a,
182 NLBL_CIPSOV4_A_MAX,
183 netlbl_cipsov4_genl_policy) != 0)
184 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700185 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200186 switch (nla_type(nla_b)) {
Paul Moorefd385852006-09-25 15:56:37 -0700187 case NLBL_CIPSOV4_A_MLSLVLLOC:
Paul Moore1fd2a252006-12-15 16:49:27 -0500188 if (nla_get_u32(nla_b) >
189 CIPSO_V4_MAX_LOC_LVLS)
190 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700191 if (nla_get_u32(nla_b) >=
192 doi_def->map.std->lvl.local_size)
193 doi_def->map.std->lvl.local_size =
194 nla_get_u32(nla_b) + 1;
195 break;
196 case NLBL_CIPSOV4_A_MLSLVLREM:
Paul Moore1fd2a252006-12-15 16:49:27 -0500197 if (nla_get_u32(nla_b) >
198 CIPSO_V4_MAX_REM_LVLS)
199 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700200 if (nla_get_u32(nla_b) >=
201 doi_def->map.std->lvl.cipso_size)
202 doi_def->map.std->lvl.cipso_size =
203 nla_get_u32(nla_b) + 1;
204 break;
205 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700206 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700207 doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
208 sizeof(u32),
209 GFP_KERNEL);
210 if (doi_def->map.std->lvl.local == NULL) {
211 ret_val = -ENOMEM;
212 goto add_std_failure;
213 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700214 doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
215 sizeof(u32),
216 GFP_KERNEL);
217 if (doi_def->map.std->lvl.cipso == NULL) {
218 ret_val = -ENOMEM;
219 goto add_std_failure;
220 }
Paul Moorecaff5b62006-12-15 16:49:28 -0500221 for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
222 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
223 for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
224 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
Paul Moorefd385852006-09-25 15:56:37 -0700225 nla_for_each_nested(nla_a,
226 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
227 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200228 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
Paul Moorefd385852006-09-25 15:56:37 -0700229 struct nlattr *lvl_loc;
230 struct nlattr *lvl_rem;
Paul Moore96cb8e32006-08-03 16:48:59 -0700231
Paul Moorefd385852006-09-25 15:56:37 -0700232 lvl_loc = nla_find_nested(nla_a,
233 NLBL_CIPSOV4_A_MLSLVLLOC);
234 lvl_rem = nla_find_nested(nla_a,
235 NLBL_CIPSOV4_A_MLSLVLREM);
236 if (lvl_loc == NULL || lvl_rem == NULL)
237 goto add_std_failure;
238 doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
239 nla_get_u32(lvl_rem);
240 doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
241 nla_get_u32(lvl_loc);
242 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700243
Paul Moorefd385852006-09-25 15:56:37 -0700244 if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
245 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
246 NLBL_CIPSOV4_A_MAX,
247 netlbl_cipsov4_genl_policy) != 0)
Paul Moore96cb8e32006-08-03 16:48:59 -0700248 goto add_std_failure;
249
Paul Moorefd385852006-09-25 15:56:37 -0700250 nla_for_each_nested(nla_a,
251 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
252 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200253 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
Paul Moorefd385852006-09-25 15:56:37 -0700254 if (nla_validate_nested(nla_a,
255 NLBL_CIPSOV4_A_MAX,
256 netlbl_cipsov4_genl_policy) != 0)
257 goto add_std_failure;
258 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200259 switch (nla_type(nla_b)) {
Paul Moorefd385852006-09-25 15:56:37 -0700260 case NLBL_CIPSOV4_A_MLSCATLOC:
Paul Moore1fd2a252006-12-15 16:49:27 -0500261 if (nla_get_u32(nla_b) >
262 CIPSO_V4_MAX_LOC_CATS)
263 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700264 if (nla_get_u32(nla_b) >=
265 doi_def->map.std->cat.local_size)
266 doi_def->map.std->cat.local_size =
267 nla_get_u32(nla_b) + 1;
268 break;
269 case NLBL_CIPSOV4_A_MLSCATREM:
Paul Moore1fd2a252006-12-15 16:49:27 -0500270 if (nla_get_u32(nla_b) >
271 CIPSO_V4_MAX_REM_CATS)
272 goto add_std_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700273 if (nla_get_u32(nla_b) >=
274 doi_def->map.std->cat.cipso_size)
275 doi_def->map.std->cat.cipso_size =
276 nla_get_u32(nla_b) + 1;
277 break;
278 }
279 }
Paul Moorefd385852006-09-25 15:56:37 -0700280 doi_def->map.std->cat.local = kcalloc(
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900281 doi_def->map.std->cat.local_size,
Paul Moorefd385852006-09-25 15:56:37 -0700282 sizeof(u32),
283 GFP_KERNEL);
284 if (doi_def->map.std->cat.local == NULL) {
285 ret_val = -ENOMEM;
286 goto add_std_failure;
287 }
288 doi_def->map.std->cat.cipso = kcalloc(
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900289 doi_def->map.std->cat.cipso_size,
Paul Moorefd385852006-09-25 15:56:37 -0700290 sizeof(u32),
291 GFP_KERNEL);
292 if (doi_def->map.std->cat.cipso == NULL) {
293 ret_val = -ENOMEM;
294 goto add_std_failure;
295 }
Paul Moorecaff5b62006-12-15 16:49:28 -0500296 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
297 doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
298 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
299 doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
Paul Moorefd385852006-09-25 15:56:37 -0700300 nla_for_each_nested(nla_a,
301 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
302 nla_a_rem)
Thomas Graf8f4c1f92007-09-12 14:44:36 +0200303 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
Paul Moorefd385852006-09-25 15:56:37 -0700304 struct nlattr *cat_loc;
305 struct nlattr *cat_rem;
Paul Moore96cb8e32006-08-03 16:48:59 -0700306
Paul Moorefd385852006-09-25 15:56:37 -0700307 cat_loc = nla_find_nested(nla_a,
308 NLBL_CIPSOV4_A_MLSCATLOC);
309 cat_rem = nla_find_nested(nla_a,
310 NLBL_CIPSOV4_A_MLSCATREM);
311 if (cat_loc == NULL || cat_rem == NULL)
312 goto add_std_failure;
313 doi_def->map.std->cat.local[
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900314 nla_get_u32(cat_loc)] =
Paul Moorefd385852006-09-25 15:56:37 -0700315 nla_get_u32(cat_rem);
316 doi_def->map.std->cat.cipso[
YOSHIFUJI Hideakie1a95262007-02-09 23:25:05 +0900317 nla_get_u32(cat_rem)] =
Paul Moorefd385852006-09-25 15:56:37 -0700318 nla_get_u32(cat_loc);
319 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700320 }
321
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500322 ret_val = cipso_v4_doi_add(doi_def, audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700323 if (ret_val != 0)
324 goto add_std_failure;
325 return 0;
326
327add_std_failure:
328 if (doi_def)
Paul Mooreb1edeb12008-10-10 10:16:31 -0400329 cipso_v4_doi_free(doi_def);
Paul Moore96cb8e32006-08-03 16:48:59 -0700330 return ret_val;
331}
332
333/**
334 * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
Paul Moorefd385852006-09-25 15:56:37 -0700335 * @info: the Generic NETLINK info block
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500336 * @audit_info: NetLabel audit information
Paul Moore96cb8e32006-08-03 16:48:59 -0700337 *
338 * Description:
339 * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
340 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
341 * error.
342 *
343 */
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500344static int netlbl_cipsov4_add_pass(struct genl_info *info,
345 struct netlbl_audit *audit_info)
Paul Moore96cb8e32006-08-03 16:48:59 -0700346{
Paul Moorefd385852006-09-25 15:56:37 -0700347 int ret_val;
Paul Moore96cb8e32006-08-03 16:48:59 -0700348 struct cipso_v4_doi *doi_def = NULL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700349
Paul Moore32f50cd2006-09-28 14:51:47 -0700350 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
Paul Moorefd385852006-09-25 15:56:37 -0700351 return -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700352
353 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
Paul Moorefd385852006-09-25 15:56:37 -0700354 if (doi_def == NULL)
355 return -ENOMEM;
Paul Moore96cb8e32006-08-03 16:48:59 -0700356 doi_def->type = CIPSO_V4_MAP_PASS;
357
Paul Moorefd385852006-09-25 15:56:37 -0700358 ret_val = netlbl_cipsov4_add_common(info, doi_def);
359 if (ret_val != 0)
360 goto add_pass_failure;
Paul Moore96cb8e32006-08-03 16:48:59 -0700361
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500362 ret_val = cipso_v4_doi_add(doi_def, audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700363 if (ret_val != 0)
364 goto add_pass_failure;
365 return 0;
366
367add_pass_failure:
Paul Mooreb1edeb12008-10-10 10:16:31 -0400368 cipso_v4_doi_free(doi_def);
Paul Moore96cb8e32006-08-03 16:48:59 -0700369 return ret_val;
370}
371
372/**
Paul Moored91d4072008-10-10 10:16:34 -0400373 * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
374 * @info: the Generic NETLINK info block
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500375 * @audit_info: NetLabel audit information
Paul Moored91d4072008-10-10 10:16:34 -0400376 *
377 * Description:
378 * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
379 * message and add it to the CIPSO V4 engine. Return zero on success and
380 * non-zero on error.
381 *
382 */
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500383static int netlbl_cipsov4_add_local(struct genl_info *info,
384 struct netlbl_audit *audit_info)
Paul Moored91d4072008-10-10 10:16:34 -0400385{
386 int ret_val;
387 struct cipso_v4_doi *doi_def = NULL;
388
389 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
390 return -EINVAL;
391
392 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
393 if (doi_def == NULL)
394 return -ENOMEM;
395 doi_def->type = CIPSO_V4_MAP_LOCAL;
396
397 ret_val = netlbl_cipsov4_add_common(info, doi_def);
398 if (ret_val != 0)
399 goto add_local_failure;
400
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500401 ret_val = cipso_v4_doi_add(doi_def, audit_info);
Paul Moored91d4072008-10-10 10:16:34 -0400402 if (ret_val != 0)
403 goto add_local_failure;
404 return 0;
405
406add_local_failure:
407 cipso_v4_doi_free(doi_def);
408 return ret_val;
409}
410
411/**
Paul Moore96cb8e32006-08-03 16:48:59 -0700412 * netlbl_cipsov4_add - Handle an ADD message
413 * @skb: the NETLINK buffer
414 * @info: the Generic NETLINK info block
415 *
416 * Description:
417 * Create a new DOI definition based on the given ADD message and add it to the
418 * CIPSO V4 engine. Returns zero on success, negative values on failure.
419 *
420 */
421static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
422
423{
424 int ret_val = -EINVAL;
Paul Moore32f50cd2006-09-28 14:51:47 -0700425 const char *type_str = "(unknown)";
Paul Moore95d4e6b2006-09-29 17:05:05 -0700426 struct netlbl_audit audit_info;
Paul Moore96cb8e32006-08-03 16:48:59 -0700427
Paul Moore32f50cd2006-09-28 14:51:47 -0700428 if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
429 !info->attrs[NLBL_CIPSOV4_A_MTYPE])
Paul Moorefd385852006-09-25 15:56:37 -0700430 return -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700431
Paul Moore95d4e6b2006-09-29 17:05:05 -0700432 netlbl_netlink_auditinfo(skb, &audit_info);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500433 switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
Paul Moore15c45f72008-10-10 10:16:34 -0400434 case CIPSO_V4_MAP_TRANS:
435 type_str = "trans";
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500436 ret_val = netlbl_cipsov4_add_std(info, &audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700437 break;
438 case CIPSO_V4_MAP_PASS:
Paul Moore32f50cd2006-09-28 14:51:47 -0700439 type_str = "pass";
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500440 ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700441 break;
Paul Moored91d4072008-10-10 10:16:34 -0400442 case CIPSO_V4_MAP_LOCAL:
443 type_str = "local";
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500444 ret_val = netlbl_cipsov4_add_local(info, &audit_info);
Paul Moored91d4072008-10-10 10:16:34 -0400445 break;
Paul Moore96cb8e32006-08-03 16:48:59 -0700446 }
Paul Moore23bcdc12007-07-18 12:28:45 -0400447 if (ret_val == 0)
Paul Moorec783f1c2008-01-29 08:37:52 -0500448 atomic_inc(&netlabel_mgmt_protocount);
Paul Moore96cb8e32006-08-03 16:48:59 -0700449
Paul Moore96cb8e32006-08-03 16:48:59 -0700450 return ret_val;
451}
452
453/**
454 * netlbl_cipsov4_list - Handle a LIST message
455 * @skb: the NETLINK buffer
456 * @info: the Generic NETLINK info block
457 *
458 * Description:
Paul Moorefd385852006-09-25 15:56:37 -0700459 * Process a user generated LIST message and respond accordingly. While the
460 * response message generated by the kernel is straightforward, determining
461 * before hand the size of the buffer to allocate is not (we have to generate
462 * the message to know the size). In order to keep this function sane what we
463 * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
464 * that size, if we fail then we restart with a larger buffer and try again.
465 * We continue in this manner until we hit a limit of failed attempts then we
466 * give up and just send an error message. Returns zero on success and
467 * negative values on error.
Paul Moore96cb8e32006-08-03 16:48:59 -0700468 *
469 */
470static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
471{
Paul Moorefd385852006-09-25 15:56:37 -0700472 int ret_val;
473 struct sk_buff *ans_skb = NULL;
474 u32 nlsze_mult = 1;
475 void *data;
Paul Moore96cb8e32006-08-03 16:48:59 -0700476 u32 doi;
Paul Moorefd385852006-09-25 15:56:37 -0700477 struct nlattr *nla_a;
478 struct nlattr *nla_b;
479 struct cipso_v4_doi *doi_def;
480 u32 iter;
Paul Moore96cb8e32006-08-03 16:48:59 -0700481
Paul Moorefd385852006-09-25 15:56:37 -0700482 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
483 ret_val = -EINVAL;
Paul Moore96cb8e32006-08-03 16:48:59 -0700484 goto list_failure;
Paul Moorefd385852006-09-25 15:56:37 -0700485 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700486
Paul Moorefd385852006-09-25 15:56:37 -0700487list_start:
Thomas Graf339bf982006-11-10 14:10:15 -0800488 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
Paul Moore96cb8e32006-08-03 16:48:59 -0700489 if (ans_skb == NULL) {
490 ret_val = -ENOMEM;
491 goto list_failure;
492 }
Thomas Graf17c157c2006-11-14 19:46:02 -0800493 data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
494 0, NLBL_CIPSOV4_C_LIST);
Paul Moorefd385852006-09-25 15:56:37 -0700495 if (data == NULL) {
496 ret_val = -ENOMEM;
497 goto list_failure;
498 }
Paul Moore96cb8e32006-08-03 16:48:59 -0700499
Paul Moorefd385852006-09-25 15:56:37 -0700500 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
501
502 rcu_read_lock();
503 doi_def = cipso_v4_doi_getdef(doi);
504 if (doi_def == NULL) {
505 ret_val = -EINVAL;
Paul Moore56196702008-10-10 10:16:29 -0400506 goto list_failure_lock;
Paul Moorefd385852006-09-25 15:56:37 -0700507 }
508
509 ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
510 if (ret_val != 0)
511 goto list_failure_lock;
512
513 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST);
514 if (nla_a == NULL) {
515 ret_val = -ENOMEM;
516 goto list_failure_lock;
517 }
518 for (iter = 0;
519 iter < CIPSO_V4_TAG_MAXCNT &&
520 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
521 iter++) {
522 ret_val = nla_put_u8(ans_skb,
523 NLBL_CIPSOV4_A_TAG,
524 doi_def->tags[iter]);
525 if (ret_val != 0)
526 goto list_failure_lock;
527 }
528 nla_nest_end(ans_skb, nla_a);
529
530 switch (doi_def->type) {
Paul Moore15c45f72008-10-10 10:16:34 -0400531 case CIPSO_V4_MAP_TRANS:
Paul Moorefd385852006-09-25 15:56:37 -0700532 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
533 if (nla_a == NULL) {
534 ret_val = -ENOMEM;
535 goto list_failure_lock;
536 }
537 for (iter = 0;
538 iter < doi_def->map.std->lvl.local_size;
539 iter++) {
540 if (doi_def->map.std->lvl.local[iter] ==
541 CIPSO_V4_INV_LVL)
542 continue;
543
544 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL);
545 if (nla_b == NULL) {
546 ret_val = -ENOMEM;
547 goto list_retry;
548 }
549 ret_val = nla_put_u32(ans_skb,
550 NLBL_CIPSOV4_A_MLSLVLLOC,
551 iter);
552 if (ret_val != 0)
553 goto list_retry;
554 ret_val = nla_put_u32(ans_skb,
555 NLBL_CIPSOV4_A_MLSLVLREM,
556 doi_def->map.std->lvl.local[iter]);
557 if (ret_val != 0)
558 goto list_retry;
559 nla_nest_end(ans_skb, nla_b);
560 }
561 nla_nest_end(ans_skb, nla_a);
562
563 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST);
564 if (nla_a == NULL) {
565 ret_val = -ENOMEM;
566 goto list_retry;
567 }
568 for (iter = 0;
569 iter < doi_def->map.std->cat.local_size;
570 iter++) {
571 if (doi_def->map.std->cat.local[iter] ==
572 CIPSO_V4_INV_CAT)
573 continue;
574
575 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT);
576 if (nla_b == NULL) {
577 ret_val = -ENOMEM;
578 goto list_retry;
579 }
580 ret_val = nla_put_u32(ans_skb,
581 NLBL_CIPSOV4_A_MLSCATLOC,
582 iter);
583 if (ret_val != 0)
584 goto list_retry;
585 ret_val = nla_put_u32(ans_skb,
586 NLBL_CIPSOV4_A_MLSCATREM,
587 doi_def->map.std->cat.local[iter]);
588 if (ret_val != 0)
589 goto list_retry;
590 nla_nest_end(ans_skb, nla_b);
591 }
592 nla_nest_end(ans_skb, nla_a);
593
594 break;
595 }
596 rcu_read_unlock();
597
598 genlmsg_end(ans_skb, data);
Denis V. Lunevfe785be2008-07-10 16:53:39 -0700599 return genlmsg_reply(ans_skb, info);
Paul Moore96cb8e32006-08-03 16:48:59 -0700600
Paul Moorefd385852006-09-25 15:56:37 -0700601list_retry:
602 /* XXX - this limit is a guesstimate */
603 if (nlsze_mult < 4) {
604 rcu_read_unlock();
605 kfree_skb(ans_skb);
Denis V. Lunev83aa2e92008-07-14 22:28:25 -0700606 nlsze_mult *= 2;
Paul Moorefd385852006-09-25 15:56:37 -0700607 goto list_start;
608 }
609list_failure_lock:
610 rcu_read_unlock();
Paul Moore96cb8e32006-08-03 16:48:59 -0700611list_failure:
Paul Moorefd385852006-09-25 15:56:37 -0700612 kfree_skb(ans_skb);
613 return ret_val;
614}
615
616/**
617 * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
618 * @doi_def: the CIPSOv4 DOI definition
619 * @arg: the netlbl_cipsov4_doiwalk_arg structure
620 *
621 * Description:
622 * This function is designed to be used as a callback to the
623 * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
624 * message. Returns the size of the message on success, negative values on
625 * failure.
626 *
627 */
628static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
629{
630 int ret_val = -ENOMEM;
631 struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
632 void *data;
633
Thomas Graf17c157c2006-11-14 19:46:02 -0800634 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
635 cb_arg->seq, &netlbl_cipsov4_gnl_family,
636 NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
Paul Moorefd385852006-09-25 15:56:37 -0700637 if (data == NULL)
638 goto listall_cb_failure;
639
640 ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
641 if (ret_val != 0)
642 goto listall_cb_failure;
643 ret_val = nla_put_u32(cb_arg->skb,
644 NLBL_CIPSOV4_A_MTYPE,
645 doi_def->type);
646 if (ret_val != 0)
647 goto listall_cb_failure;
648
649 return genlmsg_end(cb_arg->skb, data);
650
651listall_cb_failure:
652 genlmsg_cancel(cb_arg->skb, data);
Paul Moore96cb8e32006-08-03 16:48:59 -0700653 return ret_val;
654}
655
656/**
657 * netlbl_cipsov4_listall - Handle a LISTALL message
658 * @skb: the NETLINK buffer
Paul Moorefd385852006-09-25 15:56:37 -0700659 * @cb: the NETLINK callback
Paul Moore96cb8e32006-08-03 16:48:59 -0700660 *
661 * Description:
662 * Process a user generated LISTALL message and respond accordingly. Returns
663 * zero on success and negative values on error.
664 *
665 */
Paul Moorefd385852006-09-25 15:56:37 -0700666static int netlbl_cipsov4_listall(struct sk_buff *skb,
667 struct netlink_callback *cb)
Paul Moore96cb8e32006-08-03 16:48:59 -0700668{
Paul Moorefd385852006-09-25 15:56:37 -0700669 struct netlbl_cipsov4_doiwalk_arg cb_arg;
Paul Moore56196702008-10-10 10:16:29 -0400670 u32 doi_skip = cb->args[0];
Paul Moore96cb8e32006-08-03 16:48:59 -0700671
Paul Moorefd385852006-09-25 15:56:37 -0700672 cb_arg.nl_cb = cb;
673 cb_arg.skb = skb;
674 cb_arg.seq = cb->nlh->nlmsg_seq;
Paul Moore96cb8e32006-08-03 16:48:59 -0700675
Paul Moorefd385852006-09-25 15:56:37 -0700676 cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
Paul Moore96cb8e32006-08-03 16:48:59 -0700677
Paul Moorefd385852006-09-25 15:56:37 -0700678 cb->args[0] = doi_skip;
679 return skb->len;
Paul Moore96cb8e32006-08-03 16:48:59 -0700680}
681
682/**
Paul Mooreb1edeb12008-10-10 10:16:31 -0400683 * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE
684 * @entry: LSM domain mapping entry
685 * @arg: the netlbl_domhsh_walk_arg structure
686 *
687 * Description:
688 * This function is intended for use by netlbl_cipsov4_remove() as the callback
689 * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
690 * which are associated with the CIPSO DOI specified in @arg. Returns zero on
691 * success, negative values on failure.
692 *
693 */
694static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
695{
696 struct netlbl_domhsh_walk_arg *cb_arg = arg;
697
698 if (entry->type == NETLBL_NLTYPE_CIPSOV4 &&
699 entry->type_def.cipsov4->doi == cb_arg->doi)
700 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
701
702 return 0;
703}
704
705/**
Paul Moore96cb8e32006-08-03 16:48:59 -0700706 * netlbl_cipsov4_remove - Handle a REMOVE message
707 * @skb: the NETLINK buffer
708 * @info: the Generic NETLINK info block
709 *
710 * Description:
711 * Process a user generated REMOVE message and respond accordingly. Returns
712 * zero on success, negative values on failure.
713 *
714 */
715static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
716{
Paul Moorefd385852006-09-25 15:56:37 -0700717 int ret_val = -EINVAL;
Paul Mooreb1edeb12008-10-10 10:16:31 -0400718 struct netlbl_domhsh_walk_arg cb_arg;
Paul Moore95d4e6b2006-09-29 17:05:05 -0700719 struct netlbl_audit audit_info;
Paul Mooreb1edeb12008-10-10 10:16:31 -0400720 u32 skip_bkt = 0;
721 u32 skip_chain = 0;
Paul Moore96cb8e32006-08-03 16:48:59 -0700722
Paul Moore95d4e6b2006-09-29 17:05:05 -0700723 if (!info->attrs[NLBL_CIPSOV4_A_DOI])
724 return -EINVAL;
Paul Moore32f50cd2006-09-28 14:51:47 -0700725
Paul Moore95d4e6b2006-09-29 17:05:05 -0700726 netlbl_netlink_auditinfo(skb, &audit_info);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500727 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400728 cb_arg.audit_info = &audit_info;
729 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
730 netlbl_cipsov4_remove_cb, &cb_arg);
731 if (ret_val == 0 || ret_val == -ENOENT) {
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500732 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400733 if (ret_val == 0)
734 atomic_dec(&netlabel_mgmt_protocount);
735 }
Paul Moore95d4e6b2006-09-29 17:05:05 -0700736
Paul Moore96cb8e32006-08-03 16:48:59 -0700737 return ret_val;
738}
739
740/*
741 * NetLabel Generic NETLINK Command Definitions
742 */
743
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800744static struct genl_ops netlbl_cipsov4_ops[] = {
745 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700746 .cmd = NLBL_CIPSOV4_C_ADD,
Paul Moorefd385852006-09-25 15:56:37 -0700747 .flags = GENL_ADMIN_PERM,
748 .policy = netlbl_cipsov4_genl_policy,
Paul Moore96cb8e32006-08-03 16:48:59 -0700749 .doit = netlbl_cipsov4_add,
750 .dumpit = NULL,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800751 },
752 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700753 .cmd = NLBL_CIPSOV4_C_REMOVE,
Paul Moorefd385852006-09-25 15:56:37 -0700754 .flags = GENL_ADMIN_PERM,
755 .policy = netlbl_cipsov4_genl_policy,
Paul Moore96cb8e32006-08-03 16:48:59 -0700756 .doit = netlbl_cipsov4_remove,
757 .dumpit = NULL,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800758 },
759 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700760 .cmd = NLBL_CIPSOV4_C_LIST,
761 .flags = 0,
Paul Moorefd385852006-09-25 15:56:37 -0700762 .policy = netlbl_cipsov4_genl_policy,
Paul Moore96cb8e32006-08-03 16:48:59 -0700763 .doit = netlbl_cipsov4_list,
764 .dumpit = NULL,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800765 },
766 {
Paul Moore96cb8e32006-08-03 16:48:59 -0700767 .cmd = NLBL_CIPSOV4_C_LISTALL,
768 .flags = 0,
Paul Moorefd385852006-09-25 15:56:37 -0700769 .policy = netlbl_cipsov4_genl_policy,
770 .doit = NULL,
771 .dumpit = netlbl_cipsov4_listall,
Pavel Emelyanov227c43c2008-02-17 22:33:16 -0800772 },
Paul Moore96cb8e32006-08-03 16:48:59 -0700773};
774
775/*
776 * NetLabel Generic NETLINK Protocol Functions
777 */
778
779/**
780 * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
781 *
782 * Description:
783 * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
784 * mechanism. Returns zero on success, negative values on failure.
785 *
786 */
Pavel Emelyanov05705e42008-02-17 22:33:57 -0800787int __init netlbl_cipsov4_genl_init(void)
Paul Moore96cb8e32006-08-03 16:48:59 -0700788{
Michał Mirosław7ae740d2009-05-21 10:34:05 +0000789 return genl_register_family_with_ops(&netlbl_cipsov4_gnl_family,
790 netlbl_cipsov4_ops, ARRAY_SIZE(netlbl_cipsov4_ops));
Paul Moore96cb8e32006-08-03 16:48:59 -0700791}