Commit | Line | Data |
---|---|---|
96cb8e33 PM |
1 | /* |
2 | * NetLabel CIPSO/IPv4 Support | |
3 | * | |
4 | * This file defines the CIPSO/IPv4 functions for the NetLabel system. The | |
5 | * NetLabel system manages static and dynamic label mappings for network | |
6 | * protocols such as CIPSO and RIPSO. | |
7 | * | |
8 | * Author: Paul Moore <paul.moore@hp.com> | |
9 | * | |
10 | */ | |
11 | ||
12 | /* | |
13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 | |
14 | * | |
15 | * This program is free software; you can redistribute it and/or modify | |
16 | * it under the terms of the GNU General Public License as published by | |
17 | * the Free Software Foundation; either version 2 of the License, or | |
18 | * (at your option) any later version. | |
19 | * | |
20 | * This program is distributed in the hope that it will be useful, | |
21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See | |
23 | * the GNU General Public License for more details. | |
24 | * | |
25 | * You should have received a copy of the GNU General Public License | |
26 | * along with this program; if not, write to the Free Software | |
27 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
28 | * | |
29 | */ | |
30 | ||
31 | #include <linux/types.h> | |
32 | #include <linux/socket.h> | |
33 | #include <linux/string.h> | |
34 | #include <linux/skbuff.h> | |
32f50cde | 35 | #include <linux/audit.h> |
96cb8e33 PM |
36 | #include <net/sock.h> |
37 | #include <net/netlink.h> | |
38 | #include <net/genetlink.h> | |
39 | #include <net/netlabel.h> | |
40 | #include <net/cipso_ipv4.h> | |
c783f1ce | 41 | #include <asm/atomic.h> |
96cb8e33 PM |
42 | |
43 | #include "netlabel_user.h" | |
44 | #include "netlabel_cipso_v4.h" | |
23bcdc1a | 45 | #include "netlabel_mgmt.h" |
b1edeb10 | 46 | #include "netlabel_domainhash.h" |
96cb8e33 | 47 | |
fd385855 PM |
48 | /* Argument struct for cipso_v4_doi_walk() */ |
49 | struct netlbl_cipsov4_doiwalk_arg { | |
50 | struct netlink_callback *nl_cb; | |
51 | struct sk_buff *skb; | |
52 | u32 seq; | |
53 | }; | |
54 | ||
b1edeb10 PM |
55 | /* Argument struct for netlbl_domhsh_walk() */ |
56 | struct netlbl_domhsh_walk_arg { | |
57 | struct netlbl_audit *audit_info; | |
58 | u32 doi; | |
59 | }; | |
60 | ||
96cb8e33 PM |
61 | /* NetLabel Generic NETLINK CIPSOv4 family */ |
62 | static struct genl_family netlbl_cipsov4_gnl_family = { | |
63 | .id = GENL_ID_GENERATE, | |
64 | .hdrsize = 0, | |
65 | .name = NETLBL_NLTYPE_CIPSOV4_NAME, | |
66 | .version = NETLBL_PROTO_VERSION, | |
fd385855 | 67 | .maxattr = NLBL_CIPSOV4_A_MAX, |
96cb8e33 PM |
68 | }; |
69 | ||
fd385855 | 70 | /* NetLabel Netlink attribute policy */ |
ef7c79ed | 71 | static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = { |
fd385855 PM |
72 | [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 }, |
73 | [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 }, | |
74 | [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 }, | |
75 | [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED }, | |
76 | [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 }, | |
77 | [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 }, | |
78 | [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED }, | |
79 | [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED }, | |
80 | [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 }, | |
81 | [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 }, | |
82 | [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED }, | |
83 | [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED }, | |
84 | }; | |
96cb8e33 PM |
85 | |
86 | /* | |
87 | * Helper Functions | |
88 | */ | |
89 | ||
fd385855 PM |
90 | /** |
91 | * netlbl_cipsov4_add_common - Parse the common sections of a ADD message | |
92 | * @info: the Generic NETLINK info block | |
93 | * @doi_def: the CIPSO V4 DOI definition | |
94 | * | |
95 | * Description: | |
96 | * Parse the common sections of a ADD message and fill in the related values | |
97 | * in @doi_def. Returns zero on success, negative values on failure. | |
98 | * | |
99 | */ | |
100 | static int netlbl_cipsov4_add_common(struct genl_info *info, | |
101 | struct cipso_v4_doi *doi_def) | |
102 | { | |
103 | struct nlattr *nla; | |
104 | int nla_rem; | |
105 | u32 iter = 0; | |
106 | ||
107 | doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); | |
108 | ||
109 | if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST], | |
110 | NLBL_CIPSOV4_A_MAX, | |
111 | netlbl_cipsov4_genl_policy) != 0) | |
112 | return -EINVAL; | |
113 | ||
114 | nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem) | |
8f4c1f9b | 115 | if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) { |
2a2f11c2 | 116 | if (iter >= CIPSO_V4_TAG_MAXCNT) |
fd385855 PM |
117 | return -EINVAL; |
118 | doi_def->tags[iter++] = nla_get_u8(nla); | |
119 | } | |
2a2f11c2 PM |
120 | while (iter < CIPSO_V4_TAG_MAXCNT) |
121 | doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID; | |
fd385855 PM |
122 | |
123 | return 0; | |
124 | } | |
96cb8e33 PM |
125 | |
126 | /* | |
127 | * NetLabel Command Handlers | |
128 | */ | |
129 | ||
130 | /** | |
131 | * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition | |
fd385855 | 132 | * @info: the Generic NETLINK info block |
96cb8e33 PM |
133 | * |
134 | * Description: | |
15c45f7b PM |
135 | * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD |
136 | * message and add it to the CIPSO V4 engine. Return zero on success and | |
137 | * non-zero on error. | |
96cb8e33 PM |
138 | * |
139 | */ | |
fd385855 | 140 | static int netlbl_cipsov4_add_std(struct genl_info *info) |
96cb8e33 PM |
141 | { |
142 | int ret_val = -EINVAL; | |
96cb8e33 | 143 | struct cipso_v4_doi *doi_def = NULL; |
fd385855 PM |
144 | struct nlattr *nla_a; |
145 | struct nlattr *nla_b; | |
146 | int nla_a_rem; | |
147 | int nla_b_rem; | |
caff5b6a | 148 | u32 iter; |
96cb8e33 | 149 | |
32f50cde | 150 | if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] || |
fd385855 PM |
151 | !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST]) |
152 | return -EINVAL; | |
153 | ||
154 | if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], | |
155 | NLBL_CIPSOV4_A_MAX, | |
156 | netlbl_cipsov4_genl_policy) != 0) | |
157 | return -EINVAL; | |
96cb8e33 PM |
158 | |
159 | doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); | |
fd385855 PM |
160 | if (doi_def == NULL) |
161 | return -ENOMEM; | |
96cb8e33 PM |
162 | doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL); |
163 | if (doi_def->map.std == NULL) { | |
164 | ret_val = -ENOMEM; | |
165 | goto add_std_failure; | |
166 | } | |
15c45f7b | 167 | doi_def->type = CIPSO_V4_MAP_TRANS; |
96cb8e33 | 168 | |
fd385855 PM |
169 | ret_val = netlbl_cipsov4_add_common(info, doi_def); |
170 | if (ret_val != 0) | |
96cb8e33 | 171 | goto add_std_failure; |
1fd2a25b | 172 | ret_val = -EINVAL; |
96cb8e33 | 173 | |
fd385855 PM |
174 | nla_for_each_nested(nla_a, |
175 | info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], | |
176 | nla_a_rem) | |
8f4c1f9b | 177 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { |
1fd2a25b PM |
178 | if (nla_validate_nested(nla_a, |
179 | NLBL_CIPSOV4_A_MAX, | |
180 | netlbl_cipsov4_genl_policy) != 0) | |
181 | goto add_std_failure; | |
fd385855 | 182 | nla_for_each_nested(nla_b, nla_a, nla_b_rem) |
8f4c1f9b | 183 | switch (nla_type(nla_b)) { |
fd385855 | 184 | case NLBL_CIPSOV4_A_MLSLVLLOC: |
1fd2a25b PM |
185 | if (nla_get_u32(nla_b) > |
186 | CIPSO_V4_MAX_LOC_LVLS) | |
187 | goto add_std_failure; | |
fd385855 PM |
188 | if (nla_get_u32(nla_b) >= |
189 | doi_def->map.std->lvl.local_size) | |
190 | doi_def->map.std->lvl.local_size = | |
191 | nla_get_u32(nla_b) + 1; | |
192 | break; | |
193 | case NLBL_CIPSOV4_A_MLSLVLREM: | |
1fd2a25b PM |
194 | if (nla_get_u32(nla_b) > |
195 | CIPSO_V4_MAX_REM_LVLS) | |
196 | goto add_std_failure; | |
fd385855 PM |
197 | if (nla_get_u32(nla_b) >= |
198 | doi_def->map.std->lvl.cipso_size) | |
199 | doi_def->map.std->lvl.cipso_size = | |
200 | nla_get_u32(nla_b) + 1; | |
201 | break; | |
202 | } | |
203 | } | |
96cb8e33 PM |
204 | doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, |
205 | sizeof(u32), | |
206 | GFP_KERNEL); | |
207 | if (doi_def->map.std->lvl.local == NULL) { | |
208 | ret_val = -ENOMEM; | |
209 | goto add_std_failure; | |
210 | } | |
96cb8e33 PM |
211 | doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, |
212 | sizeof(u32), | |
213 | GFP_KERNEL); | |
214 | if (doi_def->map.std->lvl.cipso == NULL) { | |
215 | ret_val = -ENOMEM; | |
216 | goto add_std_failure; | |
217 | } | |
caff5b6a PM |
218 | for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++) |
219 | doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL; | |
220 | for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++) | |
221 | doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL; | |
fd385855 PM |
222 | nla_for_each_nested(nla_a, |
223 | info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], | |
224 | nla_a_rem) | |
8f4c1f9b | 225 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { |
fd385855 PM |
226 | struct nlattr *lvl_loc; |
227 | struct nlattr *lvl_rem; | |
228 | ||
fd385855 PM |
229 | lvl_loc = nla_find_nested(nla_a, |
230 | NLBL_CIPSOV4_A_MLSLVLLOC); | |
231 | lvl_rem = nla_find_nested(nla_a, | |
232 | NLBL_CIPSOV4_A_MLSLVLREM); | |
233 | if (lvl_loc == NULL || lvl_rem == NULL) | |
234 | goto add_std_failure; | |
235 | doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] = | |
236 | nla_get_u32(lvl_rem); | |
237 | doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] = | |
238 | nla_get_u32(lvl_loc); | |
239 | } | |
96cb8e33 | 240 | |
fd385855 PM |
241 | if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) { |
242 | if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST], | |
243 | NLBL_CIPSOV4_A_MAX, | |
244 | netlbl_cipsov4_genl_policy) != 0) | |
245 | goto add_std_failure; | |
246 | ||
247 | nla_for_each_nested(nla_a, | |
248 | info->attrs[NLBL_CIPSOV4_A_MLSCATLST], | |
249 | nla_a_rem) | |
8f4c1f9b | 250 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { |
fd385855 PM |
251 | if (nla_validate_nested(nla_a, |
252 | NLBL_CIPSOV4_A_MAX, | |
253 | netlbl_cipsov4_genl_policy) != 0) | |
254 | goto add_std_failure; | |
255 | nla_for_each_nested(nla_b, nla_a, nla_b_rem) | |
8f4c1f9b | 256 | switch (nla_type(nla_b)) { |
fd385855 | 257 | case NLBL_CIPSOV4_A_MLSCATLOC: |
1fd2a25b PM |
258 | if (nla_get_u32(nla_b) > |
259 | CIPSO_V4_MAX_LOC_CATS) | |
260 | goto add_std_failure; | |
fd385855 PM |
261 | if (nla_get_u32(nla_b) >= |
262 | doi_def->map.std->cat.local_size) | |
263 | doi_def->map.std->cat.local_size = | |
264 | nla_get_u32(nla_b) + 1; | |
265 | break; | |
266 | case NLBL_CIPSOV4_A_MLSCATREM: | |
1fd2a25b PM |
267 | if (nla_get_u32(nla_b) > |
268 | CIPSO_V4_MAX_REM_CATS) | |
269 | goto add_std_failure; | |
fd385855 PM |
270 | if (nla_get_u32(nla_b) >= |
271 | doi_def->map.std->cat.cipso_size) | |
272 | doi_def->map.std->cat.cipso_size = | |
273 | nla_get_u32(nla_b) + 1; | |
274 | break; | |
275 | } | |
276 | } | |
fd385855 | 277 | doi_def->map.std->cat.local = kcalloc( |
e1a95265 | 278 | doi_def->map.std->cat.local_size, |
96cb8e33 PM |
279 | sizeof(u32), |
280 | GFP_KERNEL); | |
fd385855 PM |
281 | if (doi_def->map.std->cat.local == NULL) { |
282 | ret_val = -ENOMEM; | |
283 | goto add_std_failure; | |
284 | } | |
285 | doi_def->map.std->cat.cipso = kcalloc( | |
e1a95265 | 286 | doi_def->map.std->cat.cipso_size, |
96cb8e33 PM |
287 | sizeof(u32), |
288 | GFP_KERNEL); | |
fd385855 PM |
289 | if (doi_def->map.std->cat.cipso == NULL) { |
290 | ret_val = -ENOMEM; | |
96cb8e33 | 291 | goto add_std_failure; |
fd385855 | 292 | } |
caff5b6a PM |
293 | for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++) |
294 | doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT; | |
295 | for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++) | |
296 | doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT; | |
fd385855 PM |
297 | nla_for_each_nested(nla_a, |
298 | info->attrs[NLBL_CIPSOV4_A_MLSCATLST], | |
299 | nla_a_rem) | |
8f4c1f9b | 300 | if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { |
fd385855 PM |
301 | struct nlattr *cat_loc; |
302 | struct nlattr *cat_rem; | |
303 | ||
304 | cat_loc = nla_find_nested(nla_a, | |
305 | NLBL_CIPSOV4_A_MLSCATLOC); | |
306 | cat_rem = nla_find_nested(nla_a, | |
307 | NLBL_CIPSOV4_A_MLSCATREM); | |
308 | if (cat_loc == NULL || cat_rem == NULL) | |
309 | goto add_std_failure; | |
310 | doi_def->map.std->cat.local[ | |
e1a95265 | 311 | nla_get_u32(cat_loc)] = |
fd385855 PM |
312 | nla_get_u32(cat_rem); |
313 | doi_def->map.std->cat.cipso[ | |
e1a95265 | 314 | nla_get_u32(cat_rem)] = |
fd385855 PM |
315 | nla_get_u32(cat_loc); |
316 | } | |
96cb8e33 PM |
317 | } |
318 | ||
96cb8e33 PM |
319 | ret_val = cipso_v4_doi_add(doi_def); |
320 | if (ret_val != 0) | |
321 | goto add_std_failure; | |
322 | return 0; | |
323 | ||
324 | add_std_failure: | |
325 | if (doi_def) | |
b1edeb10 | 326 | cipso_v4_doi_free(doi_def); |
96cb8e33 PM |
327 | return ret_val; |
328 | } | |
329 | ||
330 | /** | |
331 | * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition | |
fd385855 | 332 | * @info: the Generic NETLINK info block |
96cb8e33 PM |
333 | * |
334 | * Description: | |
335 | * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message | |
336 | * and add it to the CIPSO V4 engine. Return zero on success and non-zero on | |
337 | * error. | |
338 | * | |
339 | */ | |
fd385855 | 340 | static int netlbl_cipsov4_add_pass(struct genl_info *info) |
96cb8e33 | 341 | { |
fd385855 | 342 | int ret_val; |
96cb8e33 | 343 | struct cipso_v4_doi *doi_def = NULL; |
96cb8e33 | 344 | |
32f50cde | 345 | if (!info->attrs[NLBL_CIPSOV4_A_TAGLST]) |
fd385855 | 346 | return -EINVAL; |
96cb8e33 PM |
347 | |
348 | doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); | |
fd385855 PM |
349 | if (doi_def == NULL) |
350 | return -ENOMEM; | |
96cb8e33 PM |
351 | doi_def->type = CIPSO_V4_MAP_PASS; |
352 | ||
fd385855 PM |
353 | ret_val = netlbl_cipsov4_add_common(info, doi_def); |
354 | if (ret_val != 0) | |
355 | goto add_pass_failure; | |
96cb8e33 | 356 | |
96cb8e33 PM |
357 | ret_val = cipso_v4_doi_add(doi_def); |
358 | if (ret_val != 0) | |
359 | goto add_pass_failure; | |
360 | return 0; | |
361 | ||
362 | add_pass_failure: | |
b1edeb10 | 363 | cipso_v4_doi_free(doi_def); |
96cb8e33 PM |
364 | return ret_val; |
365 | } | |
366 | ||
367 | /** | |
368 | * netlbl_cipsov4_add - Handle an ADD message | |
369 | * @skb: the NETLINK buffer | |
370 | * @info: the Generic NETLINK info block | |
371 | * | |
372 | * Description: | |
373 | * Create a new DOI definition based on the given ADD message and add it to the | |
374 | * CIPSO V4 engine. Returns zero on success, negative values on failure. | |
375 | * | |
376 | */ | |
377 | static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) | |
378 | ||
379 | { | |
380 | int ret_val = -EINVAL; | |
32f50cde PM |
381 | u32 type; |
382 | u32 doi; | |
383 | const char *type_str = "(unknown)"; | |
384 | struct audit_buffer *audit_buf; | |
95d4e6be | 385 | struct netlbl_audit audit_info; |
96cb8e33 | 386 | |
32f50cde PM |
387 | if (!info->attrs[NLBL_CIPSOV4_A_DOI] || |
388 | !info->attrs[NLBL_CIPSOV4_A_MTYPE]) | |
fd385855 | 389 | return -EINVAL; |
96cb8e33 | 390 | |
95d4e6be PM |
391 | doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); |
392 | netlbl_netlink_auditinfo(skb, &audit_info); | |
393 | ||
32f50cde PM |
394 | type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]); |
395 | switch (type) { | |
15c45f7b PM |
396 | case CIPSO_V4_MAP_TRANS: |
397 | type_str = "trans"; | |
fd385855 | 398 | ret_val = netlbl_cipsov4_add_std(info); |
96cb8e33 PM |
399 | break; |
400 | case CIPSO_V4_MAP_PASS: | |
32f50cde | 401 | type_str = "pass"; |
fd385855 | 402 | ret_val = netlbl_cipsov4_add_pass(info); |
96cb8e33 PM |
403 | break; |
404 | } | |
23bcdc1a | 405 | if (ret_val == 0) |
c783f1ce | 406 | atomic_inc(&netlabel_mgmt_protocount); |
96cb8e33 | 407 | |
95d4e6be PM |
408 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD, |
409 | &audit_info); | |
de64688f PM |
410 | if (audit_buf != NULL) { |
411 | audit_log_format(audit_buf, | |
412 | " cipso_doi=%u cipso_type=%s res=%u", | |
413 | doi, | |
414 | type_str, | |
415 | ret_val == 0 ? 1 : 0); | |
416 | audit_log_end(audit_buf); | |
417 | } | |
32f50cde | 418 | |
96cb8e33 PM |
419 | return ret_val; |
420 | } | |
421 | ||
422 | /** | |
423 | * netlbl_cipsov4_list - Handle a LIST message | |
424 | * @skb: the NETLINK buffer | |
425 | * @info: the Generic NETLINK info block | |
426 | * | |
427 | * Description: | |
fd385855 PM |
428 | * Process a user generated LIST message and respond accordingly. While the |
429 | * response message generated by the kernel is straightforward, determining | |
430 | * before hand the size of the buffer to allocate is not (we have to generate | |
431 | * the message to know the size). In order to keep this function sane what we | |
432 | * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in | |
433 | * that size, if we fail then we restart with a larger buffer and try again. | |
434 | * We continue in this manner until we hit a limit of failed attempts then we | |
435 | * give up and just send an error message. Returns zero on success and | |
436 | * negative values on error. | |
96cb8e33 PM |
437 | * |
438 | */ | |
439 | static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info) | |
440 | { | |
fd385855 PM |
441 | int ret_val; |
442 | struct sk_buff *ans_skb = NULL; | |
443 | u32 nlsze_mult = 1; | |
444 | void *data; | |
96cb8e33 | 445 | u32 doi; |
fd385855 PM |
446 | struct nlattr *nla_a; |
447 | struct nlattr *nla_b; | |
448 | struct cipso_v4_doi *doi_def; | |
449 | u32 iter; | |
96cb8e33 | 450 | |
fd385855 PM |
451 | if (!info->attrs[NLBL_CIPSOV4_A_DOI]) { |
452 | ret_val = -EINVAL; | |
96cb8e33 | 453 | goto list_failure; |
fd385855 | 454 | } |
96cb8e33 | 455 | |
fd385855 | 456 | list_start: |
339bf98f | 457 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL); |
96cb8e33 PM |
458 | if (ans_skb == NULL) { |
459 | ret_val = -ENOMEM; | |
460 | goto list_failure; | |
461 | } | |
17c157c8 TG |
462 | data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family, |
463 | 0, NLBL_CIPSOV4_C_LIST); | |
fd385855 PM |
464 | if (data == NULL) { |
465 | ret_val = -ENOMEM; | |
466 | goto list_failure; | |
467 | } | |
468 | ||
469 | doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); | |
470 | ||
471 | rcu_read_lock(); | |
472 | doi_def = cipso_v4_doi_getdef(doi); | |
473 | if (doi_def == NULL) { | |
474 | ret_val = -EINVAL; | |
56196701 | 475 | goto list_failure_lock; |
fd385855 PM |
476 | } |
477 | ||
478 | ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type); | |
479 | if (ret_val != 0) | |
480 | goto list_failure_lock; | |
481 | ||
482 | nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST); | |
483 | if (nla_a == NULL) { | |
484 | ret_val = -ENOMEM; | |
485 | goto list_failure_lock; | |
486 | } | |
487 | for (iter = 0; | |
488 | iter < CIPSO_V4_TAG_MAXCNT && | |
489 | doi_def->tags[iter] != CIPSO_V4_TAG_INVALID; | |
490 | iter++) { | |
491 | ret_val = nla_put_u8(ans_skb, | |
492 | NLBL_CIPSOV4_A_TAG, | |
493 | doi_def->tags[iter]); | |
494 | if (ret_val != 0) | |
495 | goto list_failure_lock; | |
496 | } | |
497 | nla_nest_end(ans_skb, nla_a); | |
498 | ||
499 | switch (doi_def->type) { | |
15c45f7b | 500 | case CIPSO_V4_MAP_TRANS: |
fd385855 PM |
501 | nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST); |
502 | if (nla_a == NULL) { | |
503 | ret_val = -ENOMEM; | |
504 | goto list_failure_lock; | |
505 | } | |
506 | for (iter = 0; | |
507 | iter < doi_def->map.std->lvl.local_size; | |
508 | iter++) { | |
509 | if (doi_def->map.std->lvl.local[iter] == | |
510 | CIPSO_V4_INV_LVL) | |
511 | continue; | |
512 | ||
513 | nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL); | |
514 | if (nla_b == NULL) { | |
515 | ret_val = -ENOMEM; | |
516 | goto list_retry; | |
517 | } | |
518 | ret_val = nla_put_u32(ans_skb, | |
519 | NLBL_CIPSOV4_A_MLSLVLLOC, | |
520 | iter); | |
521 | if (ret_val != 0) | |
522 | goto list_retry; | |
523 | ret_val = nla_put_u32(ans_skb, | |
524 | NLBL_CIPSOV4_A_MLSLVLREM, | |
525 | doi_def->map.std->lvl.local[iter]); | |
526 | if (ret_val != 0) | |
527 | goto list_retry; | |
528 | nla_nest_end(ans_skb, nla_b); | |
529 | } | |
530 | nla_nest_end(ans_skb, nla_a); | |
531 | ||
532 | nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST); | |
533 | if (nla_a == NULL) { | |
534 | ret_val = -ENOMEM; | |
535 | goto list_retry; | |
536 | } | |
537 | for (iter = 0; | |
538 | iter < doi_def->map.std->cat.local_size; | |
539 | iter++) { | |
540 | if (doi_def->map.std->cat.local[iter] == | |
541 | CIPSO_V4_INV_CAT) | |
542 | continue; | |
543 | ||
544 | nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT); | |
545 | if (nla_b == NULL) { | |
546 | ret_val = -ENOMEM; | |
547 | goto list_retry; | |
548 | } | |
549 | ret_val = nla_put_u32(ans_skb, | |
550 | NLBL_CIPSOV4_A_MLSCATLOC, | |
551 | iter); | |
552 | if (ret_val != 0) | |
553 | goto list_retry; | |
554 | ret_val = nla_put_u32(ans_skb, | |
555 | NLBL_CIPSOV4_A_MLSCATREM, | |
556 | doi_def->map.std->cat.local[iter]); | |
557 | if (ret_val != 0) | |
558 | goto list_retry; | |
559 | nla_nest_end(ans_skb, nla_b); | |
560 | } | |
561 | nla_nest_end(ans_skb, nla_a); | |
562 | ||
563 | break; | |
564 | } | |
565 | rcu_read_unlock(); | |
96cb8e33 | 566 | |
fd385855 | 567 | genlmsg_end(ans_skb, data); |
fe785bee | 568 | return genlmsg_reply(ans_skb, info); |
96cb8e33 | 569 | |
fd385855 PM |
570 | list_retry: |
571 | /* XXX - this limit is a guesstimate */ | |
572 | if (nlsze_mult < 4) { | |
573 | rcu_read_unlock(); | |
574 | kfree_skb(ans_skb); | |
83aa2e96 | 575 | nlsze_mult *= 2; |
fd385855 PM |
576 | goto list_start; |
577 | } | |
578 | list_failure_lock: | |
579 | rcu_read_unlock(); | |
96cb8e33 | 580 | list_failure: |
fd385855 PM |
581 | kfree_skb(ans_skb); |
582 | return ret_val; | |
583 | } | |
584 | ||
585 | /** | |
586 | * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL | |
587 | * @doi_def: the CIPSOv4 DOI definition | |
588 | * @arg: the netlbl_cipsov4_doiwalk_arg structure | |
589 | * | |
590 | * Description: | |
591 | * This function is designed to be used as a callback to the | |
592 | * cipso_v4_doi_walk() function for use in generating a response for a LISTALL | |
593 | * message. Returns the size of the message on success, negative values on | |
594 | * failure. | |
595 | * | |
596 | */ | |
597 | static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg) | |
598 | { | |
599 | int ret_val = -ENOMEM; | |
600 | struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg; | |
601 | void *data; | |
602 | ||
17c157c8 TG |
603 | data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid, |
604 | cb_arg->seq, &netlbl_cipsov4_gnl_family, | |
605 | NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL); | |
fd385855 PM |
606 | if (data == NULL) |
607 | goto listall_cb_failure; | |
608 | ||
609 | ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi); | |
610 | if (ret_val != 0) | |
611 | goto listall_cb_failure; | |
612 | ret_val = nla_put_u32(cb_arg->skb, | |
613 | NLBL_CIPSOV4_A_MTYPE, | |
614 | doi_def->type); | |
615 | if (ret_val != 0) | |
616 | goto listall_cb_failure; | |
617 | ||
618 | return genlmsg_end(cb_arg->skb, data); | |
619 | ||
620 | listall_cb_failure: | |
621 | genlmsg_cancel(cb_arg->skb, data); | |
96cb8e33 PM |
622 | return ret_val; |
623 | } | |
624 | ||
625 | /** | |
626 | * netlbl_cipsov4_listall - Handle a LISTALL message | |
627 | * @skb: the NETLINK buffer | |
fd385855 | 628 | * @cb: the NETLINK callback |
96cb8e33 PM |
629 | * |
630 | * Description: | |
631 | * Process a user generated LISTALL message and respond accordingly. Returns | |
632 | * zero on success and negative values on error. | |
633 | * | |
634 | */ | |
fd385855 PM |
635 | static int netlbl_cipsov4_listall(struct sk_buff *skb, |
636 | struct netlink_callback *cb) | |
96cb8e33 | 637 | { |
fd385855 | 638 | struct netlbl_cipsov4_doiwalk_arg cb_arg; |
56196701 | 639 | u32 doi_skip = cb->args[0]; |
96cb8e33 | 640 | |
fd385855 PM |
641 | cb_arg.nl_cb = cb; |
642 | cb_arg.skb = skb; | |
643 | cb_arg.seq = cb->nlh->nlmsg_seq; | |
96cb8e33 | 644 | |
fd385855 | 645 | cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg); |
96cb8e33 | 646 | |
fd385855 PM |
647 | cb->args[0] = doi_skip; |
648 | return skb->len; | |
96cb8e33 PM |
649 | } |
650 | ||
b1edeb10 PM |
651 | /** |
652 | * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE | |
653 | * @entry: LSM domain mapping entry | |
654 | * @arg: the netlbl_domhsh_walk_arg structure | |
655 | * | |
656 | * Description: | |
657 | * This function is intended for use by netlbl_cipsov4_remove() as the callback | |
658 | * for the netlbl_domhsh_walk() function; it removes LSM domain map entries | |
659 | * which are associated with the CIPSO DOI specified in @arg. Returns zero on | |
660 | * success, negative values on failure. | |
661 | * | |
662 | */ | |
663 | static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg) | |
664 | { | |
665 | struct netlbl_domhsh_walk_arg *cb_arg = arg; | |
666 | ||
667 | if (entry->type == NETLBL_NLTYPE_CIPSOV4 && | |
668 | entry->type_def.cipsov4->doi == cb_arg->doi) | |
669 | return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info); | |
670 | ||
671 | return 0; | |
672 | } | |
673 | ||
96cb8e33 PM |
674 | /** |
675 | * netlbl_cipsov4_remove - Handle a REMOVE message | |
676 | * @skb: the NETLINK buffer | |
677 | * @info: the Generic NETLINK info block | |
678 | * | |
679 | * Description: | |
680 | * Process a user generated REMOVE message and respond accordingly. Returns | |
681 | * zero on success, negative values on failure. | |
682 | * | |
683 | */ | |
684 | static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info) | |
685 | { | |
fd385855 | 686 | int ret_val = -EINVAL; |
32f50cde | 687 | u32 doi = 0; |
b1edeb10 | 688 | struct netlbl_domhsh_walk_arg cb_arg; |
32f50cde | 689 | struct audit_buffer *audit_buf; |
95d4e6be | 690 | struct netlbl_audit audit_info; |
b1edeb10 PM |
691 | u32 skip_bkt = 0; |
692 | u32 skip_chain = 0; | |
96cb8e33 | 693 | |
95d4e6be PM |
694 | if (!info->attrs[NLBL_CIPSOV4_A_DOI]) |
695 | return -EINVAL; | |
32f50cde | 696 | |
95d4e6be PM |
697 | doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); |
698 | netlbl_netlink_auditinfo(skb, &audit_info); | |
699 | ||
b1edeb10 PM |
700 | cb_arg.doi = doi; |
701 | cb_arg.audit_info = &audit_info; | |
702 | ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain, | |
703 | netlbl_cipsov4_remove_cb, &cb_arg); | |
704 | if (ret_val == 0 || ret_val == -ENOENT) { | |
705 | ret_val = cipso_v4_doi_remove(doi, &audit_info); | |
706 | if (ret_val == 0) | |
707 | atomic_dec(&netlabel_mgmt_protocount); | |
708 | } | |
95d4e6be PM |
709 | |
710 | audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL, | |
711 | &audit_info); | |
de64688f PM |
712 | if (audit_buf != NULL) { |
713 | audit_log_format(audit_buf, | |
714 | " cipso_doi=%u res=%u", | |
715 | doi, | |
716 | ret_val == 0 ? 1 : 0); | |
717 | audit_log_end(audit_buf); | |
718 | } | |
96cb8e33 | 719 | |
96cb8e33 PM |
720 | return ret_val; |
721 | } | |
722 | ||
723 | /* | |
724 | * NetLabel Generic NETLINK Command Definitions | |
725 | */ | |
726 | ||
227c43c3 PE |
727 | static struct genl_ops netlbl_cipsov4_ops[] = { |
728 | { | |
96cb8e33 | 729 | .cmd = NLBL_CIPSOV4_C_ADD, |
fd385855 PM |
730 | .flags = GENL_ADMIN_PERM, |
731 | .policy = netlbl_cipsov4_genl_policy, | |
96cb8e33 PM |
732 | .doit = netlbl_cipsov4_add, |
733 | .dumpit = NULL, | |
227c43c3 PE |
734 | }, |
735 | { | |
96cb8e33 | 736 | .cmd = NLBL_CIPSOV4_C_REMOVE, |
fd385855 PM |
737 | .flags = GENL_ADMIN_PERM, |
738 | .policy = netlbl_cipsov4_genl_policy, | |
96cb8e33 PM |
739 | .doit = netlbl_cipsov4_remove, |
740 | .dumpit = NULL, | |
227c43c3 PE |
741 | }, |
742 | { | |
96cb8e33 PM |
743 | .cmd = NLBL_CIPSOV4_C_LIST, |
744 | .flags = 0, | |
fd385855 | 745 | .policy = netlbl_cipsov4_genl_policy, |
96cb8e33 PM |
746 | .doit = netlbl_cipsov4_list, |
747 | .dumpit = NULL, | |
227c43c3 PE |
748 | }, |
749 | { | |
96cb8e33 PM |
750 | .cmd = NLBL_CIPSOV4_C_LISTALL, |
751 | .flags = 0, | |
fd385855 PM |
752 | .policy = netlbl_cipsov4_genl_policy, |
753 | .doit = NULL, | |
754 | .dumpit = netlbl_cipsov4_listall, | |
227c43c3 | 755 | }, |
96cb8e33 PM |
756 | }; |
757 | ||
758 | /* | |
759 | * NetLabel Generic NETLINK Protocol Functions | |
760 | */ | |
761 | ||
762 | /** | |
763 | * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component | |
764 | * | |
765 | * Description: | |
766 | * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK | |
767 | * mechanism. Returns zero on success, negative values on failure. | |
768 | * | |
769 | */ | |
05705e4e | 770 | int __init netlbl_cipsov4_genl_init(void) |
96cb8e33 | 771 | { |
227c43c3 | 772 | int ret_val, i; |
96cb8e33 PM |
773 | |
774 | ret_val = genl_register_family(&netlbl_cipsov4_gnl_family); | |
775 | if (ret_val != 0) | |
776 | return ret_val; | |
777 | ||
227c43c3 PE |
778 | for (i = 0; i < ARRAY_SIZE(netlbl_cipsov4_ops); i++) { |
779 | ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family, | |
780 | &netlbl_cipsov4_ops[i]); | |
781 | if (ret_val != 0) | |
782 | return ret_val; | |
783 | } | |
96cb8e33 PM |
784 | |
785 | return 0; | |
786 | } |