Loading...
1/*
2 * NetLabel CIPSO/IPv4 Support
3 *
4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
7 *
8 * Author: Paul Moore <paul@paul-moore.com>
9 *
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28 *
29 */
30
31#include <linux/types.h>
32#include <linux/socket.h>
33#include <linux/string.h>
34#include <linux/skbuff.h>
35#include <linux/audit.h>
36#include <linux/slab.h>
37#include <net/sock.h>
38#include <net/netlink.h>
39#include <net/genetlink.h>
40#include <net/netlabel.h>
41#include <net/cipso_ipv4.h>
42#include <linux/atomic.h>
43
44#include "netlabel_user.h"
45#include "netlabel_cipso_v4.h"
46#include "netlabel_mgmt.h"
47#include "netlabel_domainhash.h"
48
49/* Argument struct for cipso_v4_doi_walk() */
50struct netlbl_cipsov4_doiwalk_arg {
51 struct netlink_callback *nl_cb;
52 struct sk_buff *skb;
53 u32 seq;
54};
55
56/* Argument struct for netlbl_domhsh_walk() */
57struct netlbl_domhsh_walk_arg {
58 struct netlbl_audit *audit_info;
59 u32 doi;
60};
61
62/* NetLabel Generic NETLINK CIPSOv4 family */
63static struct genl_family netlbl_cipsov4_gnl_family = {
64 .id = GENL_ID_GENERATE,
65 .hdrsize = 0,
66 .name = NETLBL_NLTYPE_CIPSOV4_NAME,
67 .version = NETLBL_PROTO_VERSION,
68 .maxattr = NLBL_CIPSOV4_A_MAX,
69};
70
71/* NetLabel Netlink attribute policy */
72static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
73 [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
74 [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
75 [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
76 [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
77 [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
78 [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
79 [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
80 [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
81 [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
82 [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
83 [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
84 [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
85};
86
87/*
88 * Helper Functions
89 */
90
91/**
92 * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
93 * @info: the Generic NETLINK info block
94 * @doi_def: the CIPSO V4 DOI definition
95 *
96 * Description:
97 * Parse the common sections of a ADD message and fill in the related values
98 * in @doi_def. Returns zero on success, negative values on failure.
99 *
100 */
101static int netlbl_cipsov4_add_common(struct genl_info *info,
102 struct cipso_v4_doi *doi_def)
103{
104 struct nlattr *nla;
105 int nla_rem;
106 u32 iter = 0;
107
108 doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
109
110 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST],
111 NLBL_CIPSOV4_A_MAX,
112 netlbl_cipsov4_genl_policy) != 0)
113 return -EINVAL;
114
115 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
116 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) {
117 if (iter >= CIPSO_V4_TAG_MAXCNT)
118 return -EINVAL;
119 doi_def->tags[iter++] = nla_get_u8(nla);
120 }
121 while (iter < CIPSO_V4_TAG_MAXCNT)
122 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
123
124 return 0;
125}
126
127/*
128 * NetLabel Command Handlers
129 */
130
131/**
132 * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
133 * @info: the Generic NETLINK info block
134 * @audit_info: NetLabel audit information
135 *
136 * Description:
137 * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
138 * message and add it to the CIPSO V4 engine. Return zero on success and
139 * non-zero on error.
140 *
141 */
142static int netlbl_cipsov4_add_std(struct genl_info *info,
143 struct netlbl_audit *audit_info)
144{
145 int ret_val = -EINVAL;
146 struct cipso_v4_doi *doi_def = NULL;
147 struct nlattr *nla_a;
148 struct nlattr *nla_b;
149 int nla_a_rem;
150 int nla_b_rem;
151 u32 iter;
152
153 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
154 !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
155 return -EINVAL;
156
157 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
158 NLBL_CIPSOV4_A_MAX,
159 netlbl_cipsov4_genl_policy) != 0)
160 return -EINVAL;
161
162 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
163 if (doi_def == NULL)
164 return -ENOMEM;
165 doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
166 if (doi_def->map.std == NULL) {
167 ret_val = -ENOMEM;
168 goto add_std_failure;
169 }
170 doi_def->type = CIPSO_V4_MAP_TRANS;
171
172 ret_val = netlbl_cipsov4_add_common(info, doi_def);
173 if (ret_val != 0)
174 goto add_std_failure;
175 ret_val = -EINVAL;
176
177 nla_for_each_nested(nla_a,
178 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
179 nla_a_rem)
180 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
181 if (nla_validate_nested(nla_a,
182 NLBL_CIPSOV4_A_MAX,
183 netlbl_cipsov4_genl_policy) != 0)
184 goto add_std_failure;
185 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
186 switch (nla_type(nla_b)) {
187 case NLBL_CIPSOV4_A_MLSLVLLOC:
188 if (nla_get_u32(nla_b) >
189 CIPSO_V4_MAX_LOC_LVLS)
190 goto add_std_failure;
191 if (nla_get_u32(nla_b) >=
192 doi_def->map.std->lvl.local_size)
193 doi_def->map.std->lvl.local_size =
194 nla_get_u32(nla_b) + 1;
195 break;
196 case NLBL_CIPSOV4_A_MLSLVLREM:
197 if (nla_get_u32(nla_b) >
198 CIPSO_V4_MAX_REM_LVLS)
199 goto add_std_failure;
200 if (nla_get_u32(nla_b) >=
201 doi_def->map.std->lvl.cipso_size)
202 doi_def->map.std->lvl.cipso_size =
203 nla_get_u32(nla_b) + 1;
204 break;
205 }
206 }
207 doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
208 sizeof(u32),
209 GFP_KERNEL);
210 if (doi_def->map.std->lvl.local == NULL) {
211 ret_val = -ENOMEM;
212 goto add_std_failure;
213 }
214 doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
215 sizeof(u32),
216 GFP_KERNEL);
217 if (doi_def->map.std->lvl.cipso == NULL) {
218 ret_val = -ENOMEM;
219 goto add_std_failure;
220 }
221 for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
222 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
223 for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
224 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
225 nla_for_each_nested(nla_a,
226 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
227 nla_a_rem)
228 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
229 struct nlattr *lvl_loc;
230 struct nlattr *lvl_rem;
231
232 lvl_loc = nla_find_nested(nla_a,
233 NLBL_CIPSOV4_A_MLSLVLLOC);
234 lvl_rem = nla_find_nested(nla_a,
235 NLBL_CIPSOV4_A_MLSLVLREM);
236 if (lvl_loc == NULL || lvl_rem == NULL)
237 goto add_std_failure;
238 doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
239 nla_get_u32(lvl_rem);
240 doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
241 nla_get_u32(lvl_loc);
242 }
243
244 if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
245 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
246 NLBL_CIPSOV4_A_MAX,
247 netlbl_cipsov4_genl_policy) != 0)
248 goto add_std_failure;
249
250 nla_for_each_nested(nla_a,
251 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
252 nla_a_rem)
253 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
254 if (nla_validate_nested(nla_a,
255 NLBL_CIPSOV4_A_MAX,
256 netlbl_cipsov4_genl_policy) != 0)
257 goto add_std_failure;
258 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
259 switch (nla_type(nla_b)) {
260 case NLBL_CIPSOV4_A_MLSCATLOC:
261 if (nla_get_u32(nla_b) >
262 CIPSO_V4_MAX_LOC_CATS)
263 goto add_std_failure;
264 if (nla_get_u32(nla_b) >=
265 doi_def->map.std->cat.local_size)
266 doi_def->map.std->cat.local_size =
267 nla_get_u32(nla_b) + 1;
268 break;
269 case NLBL_CIPSOV4_A_MLSCATREM:
270 if (nla_get_u32(nla_b) >
271 CIPSO_V4_MAX_REM_CATS)
272 goto add_std_failure;
273 if (nla_get_u32(nla_b) >=
274 doi_def->map.std->cat.cipso_size)
275 doi_def->map.std->cat.cipso_size =
276 nla_get_u32(nla_b) + 1;
277 break;
278 }
279 }
280 doi_def->map.std->cat.local = kcalloc(
281 doi_def->map.std->cat.local_size,
282 sizeof(u32),
283 GFP_KERNEL);
284 if (doi_def->map.std->cat.local == NULL) {
285 ret_val = -ENOMEM;
286 goto add_std_failure;
287 }
288 doi_def->map.std->cat.cipso = kcalloc(
289 doi_def->map.std->cat.cipso_size,
290 sizeof(u32),
291 GFP_KERNEL);
292 if (doi_def->map.std->cat.cipso == NULL) {
293 ret_val = -ENOMEM;
294 goto add_std_failure;
295 }
296 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
297 doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
298 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
299 doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
300 nla_for_each_nested(nla_a,
301 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
302 nla_a_rem)
303 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
304 struct nlattr *cat_loc;
305 struct nlattr *cat_rem;
306
307 cat_loc = nla_find_nested(nla_a,
308 NLBL_CIPSOV4_A_MLSCATLOC);
309 cat_rem = nla_find_nested(nla_a,
310 NLBL_CIPSOV4_A_MLSCATREM);
311 if (cat_loc == NULL || cat_rem == NULL)
312 goto add_std_failure;
313 doi_def->map.std->cat.local[
314 nla_get_u32(cat_loc)] =
315 nla_get_u32(cat_rem);
316 doi_def->map.std->cat.cipso[
317 nla_get_u32(cat_rem)] =
318 nla_get_u32(cat_loc);
319 }
320 }
321
322 ret_val = cipso_v4_doi_add(doi_def, audit_info);
323 if (ret_val != 0)
324 goto add_std_failure;
325 return 0;
326
327add_std_failure:
328 if (doi_def)
329 cipso_v4_doi_free(doi_def);
330 return ret_val;
331}
332
333/**
334 * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
335 * @info: the Generic NETLINK info block
336 * @audit_info: NetLabel audit information
337 *
338 * Description:
339 * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
340 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
341 * error.
342 *
343 */
344static int netlbl_cipsov4_add_pass(struct genl_info *info,
345 struct netlbl_audit *audit_info)
346{
347 int ret_val;
348 struct cipso_v4_doi *doi_def = NULL;
349
350 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
351 return -EINVAL;
352
353 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
354 if (doi_def == NULL)
355 return -ENOMEM;
356 doi_def->type = CIPSO_V4_MAP_PASS;
357
358 ret_val = netlbl_cipsov4_add_common(info, doi_def);
359 if (ret_val != 0)
360 goto add_pass_failure;
361
362 ret_val = cipso_v4_doi_add(doi_def, audit_info);
363 if (ret_val != 0)
364 goto add_pass_failure;
365 return 0;
366
367add_pass_failure:
368 cipso_v4_doi_free(doi_def);
369 return ret_val;
370}
371
372/**
373 * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
374 * @info: the Generic NETLINK info block
375 * @audit_info: NetLabel audit information
376 *
377 * Description:
378 * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
379 * message and add it to the CIPSO V4 engine. Return zero on success and
380 * non-zero on error.
381 *
382 */
383static int netlbl_cipsov4_add_local(struct genl_info *info,
384 struct netlbl_audit *audit_info)
385{
386 int ret_val;
387 struct cipso_v4_doi *doi_def = NULL;
388
389 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
390 return -EINVAL;
391
392 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
393 if (doi_def == NULL)
394 return -ENOMEM;
395 doi_def->type = CIPSO_V4_MAP_LOCAL;
396
397 ret_val = netlbl_cipsov4_add_common(info, doi_def);
398 if (ret_val != 0)
399 goto add_local_failure;
400
401 ret_val = cipso_v4_doi_add(doi_def, audit_info);
402 if (ret_val != 0)
403 goto add_local_failure;
404 return 0;
405
406add_local_failure:
407 cipso_v4_doi_free(doi_def);
408 return ret_val;
409}
410
411/**
412 * netlbl_cipsov4_add - Handle an ADD message
413 * @skb: the NETLINK buffer
414 * @info: the Generic NETLINK info block
415 *
416 * Description:
417 * Create a new DOI definition based on the given ADD message and add it to the
418 * CIPSO V4 engine. Returns zero on success, negative values on failure.
419 *
420 */
421static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
422
423{
424 int ret_val = -EINVAL;
425 struct netlbl_audit audit_info;
426
427 if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
428 !info->attrs[NLBL_CIPSOV4_A_MTYPE])
429 return -EINVAL;
430
431 netlbl_netlink_auditinfo(skb, &audit_info);
432 switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
433 case CIPSO_V4_MAP_TRANS:
434 ret_val = netlbl_cipsov4_add_std(info, &audit_info);
435 break;
436 case CIPSO_V4_MAP_PASS:
437 ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
438 break;
439 case CIPSO_V4_MAP_LOCAL:
440 ret_val = netlbl_cipsov4_add_local(info, &audit_info);
441 break;
442 }
443 if (ret_val == 0)
444 atomic_inc(&netlabel_mgmt_protocount);
445
446 return ret_val;
447}
448
449/**
450 * netlbl_cipsov4_list - Handle a LIST message
451 * @skb: the NETLINK buffer
452 * @info: the Generic NETLINK info block
453 *
454 * Description:
455 * Process a user generated LIST message and respond accordingly. While the
456 * response message generated by the kernel is straightforward, determining
457 * before hand the size of the buffer to allocate is not (we have to generate
458 * the message to know the size). In order to keep this function sane what we
459 * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
460 * that size, if we fail then we restart with a larger buffer and try again.
461 * We continue in this manner until we hit a limit of failed attempts then we
462 * give up and just send an error message. Returns zero on success and
463 * negative values on error.
464 *
465 */
466static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
467{
468 int ret_val;
469 struct sk_buff *ans_skb = NULL;
470 u32 nlsze_mult = 1;
471 void *data;
472 u32 doi;
473 struct nlattr *nla_a;
474 struct nlattr *nla_b;
475 struct cipso_v4_doi *doi_def;
476 u32 iter;
477
478 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
479 ret_val = -EINVAL;
480 goto list_failure;
481 }
482
483list_start:
484 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
485 if (ans_skb == NULL) {
486 ret_val = -ENOMEM;
487 goto list_failure;
488 }
489 data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
490 0, NLBL_CIPSOV4_C_LIST);
491 if (data == NULL) {
492 ret_val = -ENOMEM;
493 goto list_failure;
494 }
495
496 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
497
498 rcu_read_lock();
499 doi_def = cipso_v4_doi_getdef(doi);
500 if (doi_def == NULL) {
501 ret_val = -EINVAL;
502 goto list_failure_lock;
503 }
504
505 ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
506 if (ret_val != 0)
507 goto list_failure_lock;
508
509 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST);
510 if (nla_a == NULL) {
511 ret_val = -ENOMEM;
512 goto list_failure_lock;
513 }
514 for (iter = 0;
515 iter < CIPSO_V4_TAG_MAXCNT &&
516 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
517 iter++) {
518 ret_val = nla_put_u8(ans_skb,
519 NLBL_CIPSOV4_A_TAG,
520 doi_def->tags[iter]);
521 if (ret_val != 0)
522 goto list_failure_lock;
523 }
524 nla_nest_end(ans_skb, nla_a);
525
526 switch (doi_def->type) {
527 case CIPSO_V4_MAP_TRANS:
528 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
529 if (nla_a == NULL) {
530 ret_val = -ENOMEM;
531 goto list_failure_lock;
532 }
533 for (iter = 0;
534 iter < doi_def->map.std->lvl.local_size;
535 iter++) {
536 if (doi_def->map.std->lvl.local[iter] ==
537 CIPSO_V4_INV_LVL)
538 continue;
539
540 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL);
541 if (nla_b == NULL) {
542 ret_val = -ENOMEM;
543 goto list_retry;
544 }
545 ret_val = nla_put_u32(ans_skb,
546 NLBL_CIPSOV4_A_MLSLVLLOC,
547 iter);
548 if (ret_val != 0)
549 goto list_retry;
550 ret_val = nla_put_u32(ans_skb,
551 NLBL_CIPSOV4_A_MLSLVLREM,
552 doi_def->map.std->lvl.local[iter]);
553 if (ret_val != 0)
554 goto list_retry;
555 nla_nest_end(ans_skb, nla_b);
556 }
557 nla_nest_end(ans_skb, nla_a);
558
559 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST);
560 if (nla_a == NULL) {
561 ret_val = -ENOMEM;
562 goto list_retry;
563 }
564 for (iter = 0;
565 iter < doi_def->map.std->cat.local_size;
566 iter++) {
567 if (doi_def->map.std->cat.local[iter] ==
568 CIPSO_V4_INV_CAT)
569 continue;
570
571 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT);
572 if (nla_b == NULL) {
573 ret_val = -ENOMEM;
574 goto list_retry;
575 }
576 ret_val = nla_put_u32(ans_skb,
577 NLBL_CIPSOV4_A_MLSCATLOC,
578 iter);
579 if (ret_val != 0)
580 goto list_retry;
581 ret_val = nla_put_u32(ans_skb,
582 NLBL_CIPSOV4_A_MLSCATREM,
583 doi_def->map.std->cat.local[iter]);
584 if (ret_val != 0)
585 goto list_retry;
586 nla_nest_end(ans_skb, nla_b);
587 }
588 nla_nest_end(ans_skb, nla_a);
589
590 break;
591 }
592 rcu_read_unlock();
593
594 genlmsg_end(ans_skb, data);
595 return genlmsg_reply(ans_skb, info);
596
597list_retry:
598 /* XXX - this limit is a guesstimate */
599 if (nlsze_mult < 4) {
600 rcu_read_unlock();
601 kfree_skb(ans_skb);
602 nlsze_mult *= 2;
603 goto list_start;
604 }
605list_failure_lock:
606 rcu_read_unlock();
607list_failure:
608 kfree_skb(ans_skb);
609 return ret_val;
610}
611
612/**
613 * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
614 * @doi_def: the CIPSOv4 DOI definition
615 * @arg: the netlbl_cipsov4_doiwalk_arg structure
616 *
617 * Description:
618 * This function is designed to be used as a callback to the
619 * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
620 * message. Returns the size of the message on success, negative values on
621 * failure.
622 *
623 */
624static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
625{
626 int ret_val = -ENOMEM;
627 struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
628 void *data;
629
630 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
631 cb_arg->seq, &netlbl_cipsov4_gnl_family,
632 NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
633 if (data == NULL)
634 goto listall_cb_failure;
635
636 ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
637 if (ret_val != 0)
638 goto listall_cb_failure;
639 ret_val = nla_put_u32(cb_arg->skb,
640 NLBL_CIPSOV4_A_MTYPE,
641 doi_def->type);
642 if (ret_val != 0)
643 goto listall_cb_failure;
644
645 return genlmsg_end(cb_arg->skb, data);
646
647listall_cb_failure:
648 genlmsg_cancel(cb_arg->skb, data);
649 return ret_val;
650}
651
652/**
653 * netlbl_cipsov4_listall - Handle a LISTALL message
654 * @skb: the NETLINK buffer
655 * @cb: the NETLINK callback
656 *
657 * Description:
658 * Process a user generated LISTALL message and respond accordingly. Returns
659 * zero on success and negative values on error.
660 *
661 */
662static int netlbl_cipsov4_listall(struct sk_buff *skb,
663 struct netlink_callback *cb)
664{
665 struct netlbl_cipsov4_doiwalk_arg cb_arg;
666 u32 doi_skip = cb->args[0];
667
668 cb_arg.nl_cb = cb;
669 cb_arg.skb = skb;
670 cb_arg.seq = cb->nlh->nlmsg_seq;
671
672 cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
673
674 cb->args[0] = doi_skip;
675 return skb->len;
676}
677
678/**
679 * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE
680 * @entry: LSM domain mapping entry
681 * @arg: the netlbl_domhsh_walk_arg structure
682 *
683 * Description:
684 * This function is intended for use by netlbl_cipsov4_remove() as the callback
685 * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
686 * which are associated with the CIPSO DOI specified in @arg. Returns zero on
687 * success, negative values on failure.
688 *
689 */
690static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
691{
692 struct netlbl_domhsh_walk_arg *cb_arg = arg;
693
694 if (entry->type == NETLBL_NLTYPE_CIPSOV4 &&
695 entry->type_def.cipsov4->doi == cb_arg->doi)
696 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
697
698 return 0;
699}
700
701/**
702 * netlbl_cipsov4_remove - Handle a REMOVE message
703 * @skb: the NETLINK buffer
704 * @info: the Generic NETLINK info block
705 *
706 * Description:
707 * Process a user generated REMOVE message and respond accordingly. Returns
708 * zero on success, negative values on failure.
709 *
710 */
711static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
712{
713 int ret_val = -EINVAL;
714 struct netlbl_domhsh_walk_arg cb_arg;
715 struct netlbl_audit audit_info;
716 u32 skip_bkt = 0;
717 u32 skip_chain = 0;
718
719 if (!info->attrs[NLBL_CIPSOV4_A_DOI])
720 return -EINVAL;
721
722 netlbl_netlink_auditinfo(skb, &audit_info);
723 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
724 cb_arg.audit_info = &audit_info;
725 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
726 netlbl_cipsov4_remove_cb, &cb_arg);
727 if (ret_val == 0 || ret_val == -ENOENT) {
728 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info);
729 if (ret_val == 0)
730 atomic_dec(&netlabel_mgmt_protocount);
731 }
732
733 return ret_val;
734}
735
736/*
737 * NetLabel Generic NETLINK Command Definitions
738 */
739
740static struct genl_ops netlbl_cipsov4_ops[] = {
741 {
742 .cmd = NLBL_CIPSOV4_C_ADD,
743 .flags = GENL_ADMIN_PERM,
744 .policy = netlbl_cipsov4_genl_policy,
745 .doit = netlbl_cipsov4_add,
746 .dumpit = NULL,
747 },
748 {
749 .cmd = NLBL_CIPSOV4_C_REMOVE,
750 .flags = GENL_ADMIN_PERM,
751 .policy = netlbl_cipsov4_genl_policy,
752 .doit = netlbl_cipsov4_remove,
753 .dumpit = NULL,
754 },
755 {
756 .cmd = NLBL_CIPSOV4_C_LIST,
757 .flags = 0,
758 .policy = netlbl_cipsov4_genl_policy,
759 .doit = netlbl_cipsov4_list,
760 .dumpit = NULL,
761 },
762 {
763 .cmd = NLBL_CIPSOV4_C_LISTALL,
764 .flags = 0,
765 .policy = netlbl_cipsov4_genl_policy,
766 .doit = NULL,
767 .dumpit = netlbl_cipsov4_listall,
768 },
769};
770
771/*
772 * NetLabel Generic NETLINK Protocol Functions
773 */
774
775/**
776 * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
777 *
778 * Description:
779 * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
780 * mechanism. Returns zero on success, negative values on failure.
781 *
782 */
783int __init netlbl_cipsov4_genl_init(void)
784{
785 return genl_register_family_with_ops(&netlbl_cipsov4_gnl_family,
786 netlbl_cipsov4_ops, ARRAY_SIZE(netlbl_cipsov4_ops));
787}
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * NetLabel CIPSO/IPv4 Support
4 *
5 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
6 * NetLabel system manages static and dynamic label mappings for network
7 * protocols such as CIPSO and RIPSO.
8 *
9 * Author: Paul Moore <paul@paul-moore.com>
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 */
15
16#include <linux/types.h>
17#include <linux/socket.h>
18#include <linux/string.h>
19#include <linux/skbuff.h>
20#include <linux/audit.h>
21#include <linux/slab.h>
22#include <net/sock.h>
23#include <net/netlink.h>
24#include <net/genetlink.h>
25#include <net/netlabel.h>
26#include <net/cipso_ipv4.h>
27#include <linux/atomic.h>
28
29#include "netlabel_user.h"
30#include "netlabel_cipso_v4.h"
31#include "netlabel_mgmt.h"
32#include "netlabel_domainhash.h"
33
34/* Argument struct for cipso_v4_doi_walk() */
35struct netlbl_cipsov4_doiwalk_arg {
36 struct netlink_callback *nl_cb;
37 struct sk_buff *skb;
38 u32 seq;
39};
40
41/* Argument struct for netlbl_domhsh_walk() */
42struct netlbl_domhsh_walk_arg {
43 struct netlbl_audit *audit_info;
44 u32 doi;
45};
46
47/* NetLabel Generic NETLINK CIPSOv4 family */
48static struct genl_family netlbl_cipsov4_gnl_family;
49/* NetLabel Netlink attribute policy */
50static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
51 [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
52 [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
53 [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
54 [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
55 [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
56 [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
57 [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
58 [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
59 [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
60 [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
61 [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
62 [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
63};
64
65/*
66 * Helper Functions
67 */
68
69/**
70 * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
71 * @info: the Generic NETLINK info block
72 * @doi_def: the CIPSO V4 DOI definition
73 *
74 * Description:
75 * Parse the common sections of a ADD message and fill in the related values
76 * in @doi_def. Returns zero on success, negative values on failure.
77 *
78 */
79static int netlbl_cipsov4_add_common(struct genl_info *info,
80 struct cipso_v4_doi *doi_def)
81{
82 struct nlattr *nla;
83 int nla_rem;
84 u32 iter = 0;
85
86 doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
87
88 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_TAGLST],
89 NLBL_CIPSOV4_A_MAX,
90 netlbl_cipsov4_genl_policy,
91 NULL) != 0)
92 return -EINVAL;
93
94 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
95 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) {
96 if (iter >= CIPSO_V4_TAG_MAXCNT)
97 return -EINVAL;
98 doi_def->tags[iter++] = nla_get_u8(nla);
99 }
100 while (iter < CIPSO_V4_TAG_MAXCNT)
101 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
102
103 return 0;
104}
105
106/*
107 * NetLabel Command Handlers
108 */
109
110/**
111 * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
112 * @info: the Generic NETLINK info block
113 * @audit_info: NetLabel audit information
114 *
115 * Description:
116 * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
117 * message and add it to the CIPSO V4 engine. Return zero on success and
118 * non-zero on error.
119 *
120 */
121static int netlbl_cipsov4_add_std(struct genl_info *info,
122 struct netlbl_audit *audit_info)
123{
124 int ret_val = -EINVAL;
125 struct cipso_v4_doi *doi_def = NULL;
126 struct nlattr *nla_a;
127 struct nlattr *nla_b;
128 int nla_a_rem;
129 int nla_b_rem;
130 u32 iter;
131
132 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
133 !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
134 return -EINVAL;
135
136 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
137 NLBL_CIPSOV4_A_MAX,
138 netlbl_cipsov4_genl_policy,
139 NULL) != 0)
140 return -EINVAL;
141
142 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
143 if (doi_def == NULL)
144 return -ENOMEM;
145 doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
146 if (doi_def->map.std == NULL) {
147 ret_val = -ENOMEM;
148 goto add_std_failure;
149 }
150 doi_def->type = CIPSO_V4_MAP_TRANS;
151
152 ret_val = netlbl_cipsov4_add_common(info, doi_def);
153 if (ret_val != 0)
154 goto add_std_failure;
155 ret_val = -EINVAL;
156
157 nla_for_each_nested(nla_a,
158 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
159 nla_a_rem)
160 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
161 if (nla_validate_nested_deprecated(nla_a,
162 NLBL_CIPSOV4_A_MAX,
163 netlbl_cipsov4_genl_policy,
164 NULL) != 0)
165 goto add_std_failure;
166 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
167 switch (nla_type(nla_b)) {
168 case NLBL_CIPSOV4_A_MLSLVLLOC:
169 if (nla_get_u32(nla_b) >
170 CIPSO_V4_MAX_LOC_LVLS)
171 goto add_std_failure;
172 if (nla_get_u32(nla_b) >=
173 doi_def->map.std->lvl.local_size)
174 doi_def->map.std->lvl.local_size =
175 nla_get_u32(nla_b) + 1;
176 break;
177 case NLBL_CIPSOV4_A_MLSLVLREM:
178 if (nla_get_u32(nla_b) >
179 CIPSO_V4_MAX_REM_LVLS)
180 goto add_std_failure;
181 if (nla_get_u32(nla_b) >=
182 doi_def->map.std->lvl.cipso_size)
183 doi_def->map.std->lvl.cipso_size =
184 nla_get_u32(nla_b) + 1;
185 break;
186 }
187 }
188 doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
189 sizeof(u32),
190 GFP_KERNEL);
191 if (doi_def->map.std->lvl.local == NULL) {
192 ret_val = -ENOMEM;
193 goto add_std_failure;
194 }
195 doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
196 sizeof(u32),
197 GFP_KERNEL);
198 if (doi_def->map.std->lvl.cipso == NULL) {
199 ret_val = -ENOMEM;
200 goto add_std_failure;
201 }
202 for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
203 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
204 for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
205 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
206 nla_for_each_nested(nla_a,
207 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
208 nla_a_rem)
209 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
210 struct nlattr *lvl_loc;
211 struct nlattr *lvl_rem;
212
213 lvl_loc = nla_find_nested(nla_a,
214 NLBL_CIPSOV4_A_MLSLVLLOC);
215 lvl_rem = nla_find_nested(nla_a,
216 NLBL_CIPSOV4_A_MLSLVLREM);
217 if (lvl_loc == NULL || lvl_rem == NULL)
218 goto add_std_failure;
219 doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
220 nla_get_u32(lvl_rem);
221 doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
222 nla_get_u32(lvl_loc);
223 }
224
225 if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
226 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
227 NLBL_CIPSOV4_A_MAX,
228 netlbl_cipsov4_genl_policy,
229 NULL) != 0)
230 goto add_std_failure;
231
232 nla_for_each_nested(nla_a,
233 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
234 nla_a_rem)
235 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
236 if (nla_validate_nested_deprecated(nla_a,
237 NLBL_CIPSOV4_A_MAX,
238 netlbl_cipsov4_genl_policy,
239 NULL) != 0)
240 goto add_std_failure;
241 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
242 switch (nla_type(nla_b)) {
243 case NLBL_CIPSOV4_A_MLSCATLOC:
244 if (nla_get_u32(nla_b) >
245 CIPSO_V4_MAX_LOC_CATS)
246 goto add_std_failure;
247 if (nla_get_u32(nla_b) >=
248 doi_def->map.std->cat.local_size)
249 doi_def->map.std->cat.local_size =
250 nla_get_u32(nla_b) + 1;
251 break;
252 case NLBL_CIPSOV4_A_MLSCATREM:
253 if (nla_get_u32(nla_b) >
254 CIPSO_V4_MAX_REM_CATS)
255 goto add_std_failure;
256 if (nla_get_u32(nla_b) >=
257 doi_def->map.std->cat.cipso_size)
258 doi_def->map.std->cat.cipso_size =
259 nla_get_u32(nla_b) + 1;
260 break;
261 }
262 }
263 doi_def->map.std->cat.local = kcalloc(
264 doi_def->map.std->cat.local_size,
265 sizeof(u32),
266 GFP_KERNEL);
267 if (doi_def->map.std->cat.local == NULL) {
268 ret_val = -ENOMEM;
269 goto add_std_failure;
270 }
271 doi_def->map.std->cat.cipso = kcalloc(
272 doi_def->map.std->cat.cipso_size,
273 sizeof(u32),
274 GFP_KERNEL);
275 if (doi_def->map.std->cat.cipso == NULL) {
276 ret_val = -ENOMEM;
277 goto add_std_failure;
278 }
279 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
280 doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
281 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
282 doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
283 nla_for_each_nested(nla_a,
284 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
285 nla_a_rem)
286 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
287 struct nlattr *cat_loc;
288 struct nlattr *cat_rem;
289
290 cat_loc = nla_find_nested(nla_a,
291 NLBL_CIPSOV4_A_MLSCATLOC);
292 cat_rem = nla_find_nested(nla_a,
293 NLBL_CIPSOV4_A_MLSCATREM);
294 if (cat_loc == NULL || cat_rem == NULL)
295 goto add_std_failure;
296 doi_def->map.std->cat.local[
297 nla_get_u32(cat_loc)] =
298 nla_get_u32(cat_rem);
299 doi_def->map.std->cat.cipso[
300 nla_get_u32(cat_rem)] =
301 nla_get_u32(cat_loc);
302 }
303 }
304
305 ret_val = cipso_v4_doi_add(doi_def, audit_info);
306 if (ret_val != 0)
307 goto add_std_failure;
308 return 0;
309
310add_std_failure:
311 cipso_v4_doi_free(doi_def);
312 return ret_val;
313}
314
315/**
316 * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
317 * @info: the Generic NETLINK info block
318 * @audit_info: NetLabel audit information
319 *
320 * Description:
321 * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
322 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
323 * error.
324 *
325 */
326static int netlbl_cipsov4_add_pass(struct genl_info *info,
327 struct netlbl_audit *audit_info)
328{
329 int ret_val;
330 struct cipso_v4_doi *doi_def = NULL;
331
332 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
333 return -EINVAL;
334
335 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
336 if (doi_def == NULL)
337 return -ENOMEM;
338 doi_def->type = CIPSO_V4_MAP_PASS;
339
340 ret_val = netlbl_cipsov4_add_common(info, doi_def);
341 if (ret_val != 0)
342 goto add_pass_failure;
343
344 ret_val = cipso_v4_doi_add(doi_def, audit_info);
345 if (ret_val != 0)
346 goto add_pass_failure;
347 return 0;
348
349add_pass_failure:
350 cipso_v4_doi_free(doi_def);
351 return ret_val;
352}
353
354/**
355 * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
356 * @info: the Generic NETLINK info block
357 * @audit_info: NetLabel audit information
358 *
359 * Description:
360 * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
361 * message and add it to the CIPSO V4 engine. Return zero on success and
362 * non-zero on error.
363 *
364 */
365static int netlbl_cipsov4_add_local(struct genl_info *info,
366 struct netlbl_audit *audit_info)
367{
368 int ret_val;
369 struct cipso_v4_doi *doi_def = NULL;
370
371 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
372 return -EINVAL;
373
374 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
375 if (doi_def == NULL)
376 return -ENOMEM;
377 doi_def->type = CIPSO_V4_MAP_LOCAL;
378
379 ret_val = netlbl_cipsov4_add_common(info, doi_def);
380 if (ret_val != 0)
381 goto add_local_failure;
382
383 ret_val = cipso_v4_doi_add(doi_def, audit_info);
384 if (ret_val != 0)
385 goto add_local_failure;
386 return 0;
387
388add_local_failure:
389 cipso_v4_doi_free(doi_def);
390 return ret_val;
391}
392
393/**
394 * netlbl_cipsov4_add - Handle an ADD message
395 * @skb: the NETLINK buffer
396 * @info: the Generic NETLINK info block
397 *
398 * Description:
399 * Create a new DOI definition based on the given ADD message and add it to the
400 * CIPSO V4 engine. Returns zero on success, negative values on failure.
401 *
402 */
403static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
404
405{
406 int ret_val = -EINVAL;
407 struct netlbl_audit audit_info;
408
409 if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
410 !info->attrs[NLBL_CIPSOV4_A_MTYPE])
411 return -EINVAL;
412
413 netlbl_netlink_auditinfo(skb, &audit_info);
414 switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
415 case CIPSO_V4_MAP_TRANS:
416 ret_val = netlbl_cipsov4_add_std(info, &audit_info);
417 break;
418 case CIPSO_V4_MAP_PASS:
419 ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
420 break;
421 case CIPSO_V4_MAP_LOCAL:
422 ret_val = netlbl_cipsov4_add_local(info, &audit_info);
423 break;
424 }
425 if (ret_val == 0)
426 atomic_inc(&netlabel_mgmt_protocount);
427
428 return ret_val;
429}
430
431/**
432 * netlbl_cipsov4_list - Handle a LIST message
433 * @skb: the NETLINK buffer
434 * @info: the Generic NETLINK info block
435 *
436 * Description:
437 * Process a user generated LIST message and respond accordingly. While the
438 * response message generated by the kernel is straightforward, determining
439 * before hand the size of the buffer to allocate is not (we have to generate
440 * the message to know the size). In order to keep this function sane what we
441 * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
442 * that size, if we fail then we restart with a larger buffer and try again.
443 * We continue in this manner until we hit a limit of failed attempts then we
444 * give up and just send an error message. Returns zero on success and
445 * negative values on error.
446 *
447 */
448static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
449{
450 int ret_val;
451 struct sk_buff *ans_skb = NULL;
452 u32 nlsze_mult = 1;
453 void *data;
454 u32 doi;
455 struct nlattr *nla_a;
456 struct nlattr *nla_b;
457 struct cipso_v4_doi *doi_def;
458 u32 iter;
459
460 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
461 ret_val = -EINVAL;
462 goto list_failure;
463 }
464
465list_start:
466 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
467 if (ans_skb == NULL) {
468 ret_val = -ENOMEM;
469 goto list_failure;
470 }
471 data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
472 0, NLBL_CIPSOV4_C_LIST);
473 if (data == NULL) {
474 ret_val = -ENOMEM;
475 goto list_failure;
476 }
477
478 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
479
480 rcu_read_lock();
481 doi_def = cipso_v4_doi_getdef(doi);
482 if (doi_def == NULL) {
483 ret_val = -EINVAL;
484 goto list_failure_lock;
485 }
486
487 ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
488 if (ret_val != 0)
489 goto list_failure_lock;
490
491 nla_a = nla_nest_start_noflag(ans_skb, NLBL_CIPSOV4_A_TAGLST);
492 if (nla_a == NULL) {
493 ret_val = -ENOMEM;
494 goto list_failure_lock;
495 }
496 for (iter = 0;
497 iter < CIPSO_V4_TAG_MAXCNT &&
498 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
499 iter++) {
500 ret_val = nla_put_u8(ans_skb,
501 NLBL_CIPSOV4_A_TAG,
502 doi_def->tags[iter]);
503 if (ret_val != 0)
504 goto list_failure_lock;
505 }
506 nla_nest_end(ans_skb, nla_a);
507
508 switch (doi_def->type) {
509 case CIPSO_V4_MAP_TRANS:
510 nla_a = nla_nest_start_noflag(ans_skb,
511 NLBL_CIPSOV4_A_MLSLVLLST);
512 if (nla_a == NULL) {
513 ret_val = -ENOMEM;
514 goto list_failure_lock;
515 }
516 for (iter = 0;
517 iter < doi_def->map.std->lvl.local_size;
518 iter++) {
519 if (doi_def->map.std->lvl.local[iter] ==
520 CIPSO_V4_INV_LVL)
521 continue;
522
523 nla_b = nla_nest_start_noflag(ans_skb,
524 NLBL_CIPSOV4_A_MLSLVL);
525 if (nla_b == NULL) {
526 ret_val = -ENOMEM;
527 goto list_retry;
528 }
529 ret_val = nla_put_u32(ans_skb,
530 NLBL_CIPSOV4_A_MLSLVLLOC,
531 iter);
532 if (ret_val != 0)
533 goto list_retry;
534 ret_val = nla_put_u32(ans_skb,
535 NLBL_CIPSOV4_A_MLSLVLREM,
536 doi_def->map.std->lvl.local[iter]);
537 if (ret_val != 0)
538 goto list_retry;
539 nla_nest_end(ans_skb, nla_b);
540 }
541 nla_nest_end(ans_skb, nla_a);
542
543 nla_a = nla_nest_start_noflag(ans_skb,
544 NLBL_CIPSOV4_A_MLSCATLST);
545 if (nla_a == NULL) {
546 ret_val = -ENOMEM;
547 goto list_retry;
548 }
549 for (iter = 0;
550 iter < doi_def->map.std->cat.local_size;
551 iter++) {
552 if (doi_def->map.std->cat.local[iter] ==
553 CIPSO_V4_INV_CAT)
554 continue;
555
556 nla_b = nla_nest_start_noflag(ans_skb,
557 NLBL_CIPSOV4_A_MLSCAT);
558 if (nla_b == NULL) {
559 ret_val = -ENOMEM;
560 goto list_retry;
561 }
562 ret_val = nla_put_u32(ans_skb,
563 NLBL_CIPSOV4_A_MLSCATLOC,
564 iter);
565 if (ret_val != 0)
566 goto list_retry;
567 ret_val = nla_put_u32(ans_skb,
568 NLBL_CIPSOV4_A_MLSCATREM,
569 doi_def->map.std->cat.local[iter]);
570 if (ret_val != 0)
571 goto list_retry;
572 nla_nest_end(ans_skb, nla_b);
573 }
574 nla_nest_end(ans_skb, nla_a);
575
576 break;
577 }
578 rcu_read_unlock();
579
580 genlmsg_end(ans_skb, data);
581 return genlmsg_reply(ans_skb, info);
582
583list_retry:
584 /* XXX - this limit is a guesstimate */
585 if (nlsze_mult < 4) {
586 rcu_read_unlock();
587 kfree_skb(ans_skb);
588 nlsze_mult *= 2;
589 goto list_start;
590 }
591list_failure_lock:
592 rcu_read_unlock();
593list_failure:
594 kfree_skb(ans_skb);
595 return ret_val;
596}
597
598/**
599 * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
600 * @doi_def: the CIPSOv4 DOI definition
601 * @arg: the netlbl_cipsov4_doiwalk_arg structure
602 *
603 * Description:
604 * This function is designed to be used as a callback to the
605 * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
606 * message. Returns the size of the message on success, negative values on
607 * failure.
608 *
609 */
610static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
611{
612 int ret_val = -ENOMEM;
613 struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
614 void *data;
615
616 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
617 cb_arg->seq, &netlbl_cipsov4_gnl_family,
618 NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
619 if (data == NULL)
620 goto listall_cb_failure;
621
622 ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
623 if (ret_val != 0)
624 goto listall_cb_failure;
625 ret_val = nla_put_u32(cb_arg->skb,
626 NLBL_CIPSOV4_A_MTYPE,
627 doi_def->type);
628 if (ret_val != 0)
629 goto listall_cb_failure;
630
631 genlmsg_end(cb_arg->skb, data);
632 return 0;
633
634listall_cb_failure:
635 genlmsg_cancel(cb_arg->skb, data);
636 return ret_val;
637}
638
639/**
640 * netlbl_cipsov4_listall - Handle a LISTALL message
641 * @skb: the NETLINK buffer
642 * @cb: the NETLINK callback
643 *
644 * Description:
645 * Process a user generated LISTALL message and respond accordingly. Returns
646 * zero on success and negative values on error.
647 *
648 */
649static int netlbl_cipsov4_listall(struct sk_buff *skb,
650 struct netlink_callback *cb)
651{
652 struct netlbl_cipsov4_doiwalk_arg cb_arg;
653 u32 doi_skip = cb->args[0];
654
655 cb_arg.nl_cb = cb;
656 cb_arg.skb = skb;
657 cb_arg.seq = cb->nlh->nlmsg_seq;
658
659 cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
660
661 cb->args[0] = doi_skip;
662 return skb->len;
663}
664
665/**
666 * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE
667 * @entry: LSM domain mapping entry
668 * @arg: the netlbl_domhsh_walk_arg structure
669 *
670 * Description:
671 * This function is intended for use by netlbl_cipsov4_remove() as the callback
672 * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
673 * which are associated with the CIPSO DOI specified in @arg. Returns zero on
674 * success, negative values on failure.
675 *
676 */
677static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
678{
679 struct netlbl_domhsh_walk_arg *cb_arg = arg;
680
681 if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
682 entry->def.cipso->doi == cb_arg->doi)
683 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
684
685 return 0;
686}
687
688/**
689 * netlbl_cipsov4_remove - Handle a REMOVE message
690 * @skb: the NETLINK buffer
691 * @info: the Generic NETLINK info block
692 *
693 * Description:
694 * Process a user generated REMOVE message and respond accordingly. Returns
695 * zero on success, negative values on failure.
696 *
697 */
698static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
699{
700 int ret_val = -EINVAL;
701 struct netlbl_domhsh_walk_arg cb_arg;
702 struct netlbl_audit audit_info;
703 u32 skip_bkt = 0;
704 u32 skip_chain = 0;
705
706 if (!info->attrs[NLBL_CIPSOV4_A_DOI])
707 return -EINVAL;
708
709 netlbl_netlink_auditinfo(skb, &audit_info);
710 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
711 cb_arg.audit_info = &audit_info;
712 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
713 netlbl_cipsov4_remove_cb, &cb_arg);
714 if (ret_val == 0 || ret_val == -ENOENT) {
715 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info);
716 if (ret_val == 0)
717 atomic_dec(&netlabel_mgmt_protocount);
718 }
719
720 return ret_val;
721}
722
723/*
724 * NetLabel Generic NETLINK Command Definitions
725 */
726
727static const struct genl_ops netlbl_cipsov4_ops[] = {
728 {
729 .cmd = NLBL_CIPSOV4_C_ADD,
730 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
731 .flags = GENL_ADMIN_PERM,
732 .doit = netlbl_cipsov4_add,
733 .dumpit = NULL,
734 },
735 {
736 .cmd = NLBL_CIPSOV4_C_REMOVE,
737 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
738 .flags = GENL_ADMIN_PERM,
739 .doit = netlbl_cipsov4_remove,
740 .dumpit = NULL,
741 },
742 {
743 .cmd = NLBL_CIPSOV4_C_LIST,
744 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
745 .flags = 0,
746 .doit = netlbl_cipsov4_list,
747 .dumpit = NULL,
748 },
749 {
750 .cmd = NLBL_CIPSOV4_C_LISTALL,
751 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
752 .flags = 0,
753 .doit = NULL,
754 .dumpit = netlbl_cipsov4_listall,
755 },
756};
757
758static struct genl_family netlbl_cipsov4_gnl_family __ro_after_init = {
759 .hdrsize = 0,
760 .name = NETLBL_NLTYPE_CIPSOV4_NAME,
761 .version = NETLBL_PROTO_VERSION,
762 .maxattr = NLBL_CIPSOV4_A_MAX,
763 .policy = netlbl_cipsov4_genl_policy,
764 .module = THIS_MODULE,
765 .ops = netlbl_cipsov4_ops,
766 .n_ops = ARRAY_SIZE(netlbl_cipsov4_ops),
767};
768
769/*
770 * NetLabel Generic NETLINK Protocol Functions
771 */
772
773/**
774 * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
775 *
776 * Description:
777 * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
778 * mechanism. Returns zero on success, negative values on failure.
779 *
780 */
781int __init netlbl_cipsov4_genl_init(void)
782{
783 return genl_register_family(&netlbl_cipsov4_gnl_family);
784}