xref: /linux/include/net/netlabel.h (revision 3fd6c59042dbba50391e30862beac979491145fe)
1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /*
3  * NetLabel System
4  *
5  * The NetLabel system manages static and dynamic label mappings for network
6  * protocols such as CIPSO and RIPSO.
7  *
8  * Author: Paul Moore <paul@paul-moore.com>
9  */
10 
11 /*
12  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
13  */
14 
15 #ifndef _NETLABEL_H
16 #define _NETLABEL_H
17 
18 #include <linux/types.h>
19 #include <linux/slab.h>
20 #include <linux/net.h>
21 #include <linux/skbuff.h>
22 #include <linux/in.h>
23 #include <linux/in6.h>
24 #include <net/netlink.h>
25 #include <net/request_sock.h>
26 #include <linux/refcount.h>
27 
28 struct cipso_v4_doi;
29 struct calipso_doi;
30 
31 /*
32  * NetLabel - A management interface for maintaining network packet label
33  *            mapping tables for explicit packet labeling protocols.
34  *
35  * Network protocols such as CIPSO and RIPSO require a label translation layer
36  * to convert the label on the packet into something meaningful on the host
37  * machine.  In the current Linux implementation these mapping tables live
38  * inside the kernel; NetLabel provides a mechanism for user space applications
39  * to manage these mapping tables.
40  *
41  * NetLabel makes use of the Generic NETLINK mechanism as a transport layer to
42  * send messages between kernel and user space.  The general format of a
43  * NetLabel message is shown below:
44  *
45  *  +-----------------+-------------------+--------- --- -- -
46  *  | struct nlmsghdr | struct genlmsghdr | payload
47  *  +-----------------+-------------------+--------- --- -- -
48  *
49  * The 'nlmsghdr' and 'genlmsghdr' structs should be dealt with like normal.
50  * The payload is dependent on the subsystem specified in the
51  * 'nlmsghdr->nlmsg_type' and should be defined below, supporting functions
52  * should be defined in the corresponding net/netlabel/netlabel_<subsys>.h|c
53  * file.  All of the fields in the NetLabel payload are NETLINK attributes, see
54  * the include/net/netlink.h file for more information on NETLINK attributes.
55  *
56  */
57 
58 /*
59  * NetLabel NETLINK protocol
60  */
61 
62 /* NetLabel NETLINK protocol version
63  *  1: initial version
64  *  2: added static labels for unlabeled connections
65  *  3: network selectors added to the NetLabel/LSM domain mapping and the
66  *     CIPSO_V4_MAP_LOCAL CIPSO mapping was added
67  */
68 #define NETLBL_PROTO_VERSION            3
69 
70 /* NetLabel NETLINK types/families */
71 #define NETLBL_NLTYPE_NONE              0
72 #define NETLBL_NLTYPE_MGMT              1
73 #define NETLBL_NLTYPE_MGMT_NAME         "NLBL_MGMT"
74 #define NETLBL_NLTYPE_RIPSO             2
75 #define NETLBL_NLTYPE_RIPSO_NAME        "NLBL_RIPSO"
76 #define NETLBL_NLTYPE_CIPSOV4           3
77 #define NETLBL_NLTYPE_CIPSOV4_NAME      "NLBL_CIPSOv4"
78 #define NETLBL_NLTYPE_CIPSOV6           4
79 #define NETLBL_NLTYPE_CIPSOV6_NAME      "NLBL_CIPSOv6"
80 #define NETLBL_NLTYPE_UNLABELED         5
81 #define NETLBL_NLTYPE_UNLABELED_NAME    "NLBL_UNLBL"
82 #define NETLBL_NLTYPE_ADDRSELECT        6
83 #define NETLBL_NLTYPE_ADDRSELECT_NAME   "NLBL_ADRSEL"
84 #define NETLBL_NLTYPE_CALIPSO           7
85 #define NETLBL_NLTYPE_CALIPSO_NAME      "NLBL_CALIPSO"
86 
87 /*
88  * NetLabel - Kernel API for accessing the network packet label mappings.
89  *
90  * The following functions are provided for use by other kernel modules,
91  * specifically kernel LSM modules, to provide a consistent, transparent API
92  * for dealing with explicit packet labeling protocols such as CIPSO and
93  * RIPSO.  The functions defined here are implemented in the
94  * net/netlabel/netlabel_kapi.c file.
95  *
96  */
97 
98 /* NetLabel audit information */
99 struct netlbl_audit {
100 	struct lsm_prop prop;
101 	kuid_t loginuid;
102 	unsigned int sessionid;
103 };
104 
105 /*
106  * LSM security attributes
107  */
108 
109 /**
110  * struct netlbl_lsm_cache - NetLabel LSM security attribute cache
111  * @refcount: atomic reference counter
112  * @free: LSM supplied function to free the cache data
113  * @data: LSM supplied cache data
114  *
115  * Description:
116  * This structure is provided for LSMs which wish to make use of the NetLabel
117  * caching mechanism to store LSM specific data/attributes in the NetLabel
118  * cache.  If the LSM has to perform a lot of translation from the NetLabel
119  * security attributes into it's own internal representation then the cache
120  * mechanism can provide a way to eliminate some or all of that translation
121  * overhead on a cache hit.
122  *
123  */
124 struct netlbl_lsm_cache {
125 	refcount_t refcount;
126 	void (*free) (const void *data);
127 	void *data;
128 };
129 
130 /**
131  * struct netlbl_lsm_catmap - NetLabel LSM secattr category bitmap
132  * @startbit: the value of the lowest order bit in the bitmap
133  * @bitmap: the category bitmap
134  * @next: pointer to the next bitmap "node" or NULL
135  *
136  * Description:
137  * This structure is used to represent category bitmaps.  Due to the large
138  * number of categories supported by most labeling protocols it is not
139  * practical to transfer a full bitmap internally so NetLabel adopts a sparse
140  * bitmap structure modeled after SELinux's ebitmap structure.
141  * The catmap bitmap field MUST be a power of two in length and large
142  * enough to hold at least 240 bits.  Special care (i.e. check the code!)
143  * should be used when changing these values as the LSM implementation
144  * probably has functions which rely on the sizes of these types to speed
145  * processing.
146  *
147  */
148 #define NETLBL_CATMAP_MAPCNT            4
149 #define NETLBL_CATMAP_MAPSIZE           (sizeof(u64) * 8)
150 #define NETLBL_CATMAP_SIZE              (NETLBL_CATMAP_MAPSIZE * \
151 					 NETLBL_CATMAP_MAPCNT)
152 #define NETLBL_CATMAP_BIT               ((u64)0x01)
153 struct netlbl_lsm_catmap {
154 	u32 startbit;
155 	u64 bitmap[NETLBL_CATMAP_MAPCNT];
156 	struct netlbl_lsm_catmap *next;
157 };
158 
159 /**
160  * struct netlbl_lsm_secattr - NetLabel LSM security attributes
161  * @flags: indicate structure attributes, see NETLBL_SECATTR_*
162  * @type: indicate the NLTYPE of the attributes
163  * @domain: the NetLabel LSM domain
164  * @cache: NetLabel LSM specific cache
165  * @attr.mls: MLS sensitivity label
166  * @attr.mls.cat: MLS category bitmap
167  * @attr.mls.lvl: MLS sensitivity level
168  * @attr.secid: LSM specific secid token
169  *
170  * Description:
171  * This structure is used to pass security attributes between NetLabel and the
172  * LSM modules.  The flags field is used to specify which fields within the
173  * struct are valid and valid values can be created by bitwise OR'ing the
174  * NETLBL_SECATTR_* defines.  The domain field is typically set by the LSM to
175  * specify domain specific configuration settings and is not usually used by
176  * NetLabel itself when returning security attributes to the LSM.
177  *
178  */
179 struct netlbl_lsm_secattr {
180 	u32 flags;
181 	/* bitmap values for 'flags' */
182 #define NETLBL_SECATTR_NONE             0x00000000
183 #define NETLBL_SECATTR_DOMAIN           0x00000001
184 #define NETLBL_SECATTR_DOMAIN_CPY       (NETLBL_SECATTR_DOMAIN | \
185 					 NETLBL_SECATTR_FREE_DOMAIN)
186 #define NETLBL_SECATTR_CACHE            0x00000002
187 #define NETLBL_SECATTR_MLS_LVL          0x00000004
188 #define NETLBL_SECATTR_MLS_CAT          0x00000008
189 #define NETLBL_SECATTR_SECID            0x00000010
190 	/* bitmap meta-values for 'flags' */
191 #define NETLBL_SECATTR_FREE_DOMAIN      0x01000000
192 #define NETLBL_SECATTR_CACHEABLE        (NETLBL_SECATTR_MLS_LVL | \
193 					 NETLBL_SECATTR_MLS_CAT | \
194 					 NETLBL_SECATTR_SECID)
195 	u32 type;
196 	char *domain;
197 	struct netlbl_lsm_cache *cache;
198 	struct {
199 		struct {
200 			struct netlbl_lsm_catmap *cat;
201 			u32 lvl;
202 		} mls;
203 		u32 secid;
204 	} attr;
205 };
206 
207 /**
208  * struct netlbl_calipso_ops - NetLabel CALIPSO operations
209  * @doi_add: add a CALIPSO DOI
210  * @doi_free: free a CALIPSO DOI
211  * @doi_remove: remove a CALIPSO DOI
212  * @doi_getdef: returns a reference to a DOI
213  * @doi_putdef: releases a reference of a DOI
214  * @doi_walk: enumerate the DOI list
215  * @sock_getattr: retrieve the socket's attr
216  * @sock_setattr: set the socket's attr
217  * @sock_delattr: remove the socket's attr
218  * @req_setattr: set the req socket's attr
219  * @req_delattr: remove the req socket's attr
220  * @opt_getattr: retrieve attr from memory block
221  * @skbuff_optptr: find option in packet
222  * @skbuff_setattr: set the skbuff's attr
223  * @skbuff_delattr: remove the skbuff's attr
224  * @cache_invalidate: invalidate cache
225  * @cache_add: add cache entry
226  *
227  * Description:
228  * This structure is filled out by the CALIPSO engine and passed
229  * to the NetLabel core via a call to netlbl_calipso_ops_register().
230  * It enables the CALIPSO engine (and hence IPv6) to be compiled
231  * as a module.
232  */
233 struct netlbl_calipso_ops {
234 	int (*doi_add)(struct calipso_doi *doi_def,
235 		       struct netlbl_audit *audit_info);
236 	void (*doi_free)(struct calipso_doi *doi_def);
237 	int (*doi_remove)(u32 doi, struct netlbl_audit *audit_info);
238 	struct calipso_doi *(*doi_getdef)(u32 doi);
239 	void (*doi_putdef)(struct calipso_doi *doi_def);
240 	int (*doi_walk)(u32 *skip_cnt,
241 			int (*callback)(struct calipso_doi *doi_def, void *arg),
242 			void *cb_arg);
243 	int (*sock_getattr)(struct sock *sk,
244 			    struct netlbl_lsm_secattr *secattr);
245 	int (*sock_setattr)(struct sock *sk,
246 			    const struct calipso_doi *doi_def,
247 			    const struct netlbl_lsm_secattr *secattr);
248 	void (*sock_delattr)(struct sock *sk);
249 	int (*req_setattr)(struct request_sock *req,
250 			   const struct calipso_doi *doi_def,
251 			   const struct netlbl_lsm_secattr *secattr);
252 	void (*req_delattr)(struct request_sock *req);
253 	int (*opt_getattr)(const unsigned char *calipso,
254 			   struct netlbl_lsm_secattr *secattr);
255 	unsigned char *(*skbuff_optptr)(const struct sk_buff *skb);
256 	int (*skbuff_setattr)(struct sk_buff *skb,
257 			      const struct calipso_doi *doi_def,
258 			      const struct netlbl_lsm_secattr *secattr);
259 	int (*skbuff_delattr)(struct sk_buff *skb);
260 	void (*cache_invalidate)(void);
261 	int (*cache_add)(const unsigned char *calipso_ptr,
262 			 const struct netlbl_lsm_secattr *secattr);
263 };
264 
265 /*
266  * LSM security attribute operations (inline)
267  */
268 
269 /**
270  * netlbl_secattr_cache_alloc - Allocate and initialize a secattr cache
271  * @flags: the memory allocation flags
272  *
273  * Description:
274  * Allocate and initialize a netlbl_lsm_cache structure.  Returns a pointer
275  * on success, NULL on failure.
276  *
277  */
netlbl_secattr_cache_alloc_noprof(gfp_t flags)278 static inline struct netlbl_lsm_cache *netlbl_secattr_cache_alloc_noprof(gfp_t flags)
279 {
280 	struct netlbl_lsm_cache *cache;
281 
282 	cache = kzalloc_noprof(sizeof(*cache), flags);
283 	if (cache)
284 		refcount_set(&cache->refcount, 1);
285 	return cache;
286 }
287 #define netlbl_secattr_cache_alloc(...)	\
288 		alloc_hooks(netlbl_secattr_cache_alloc_noprof(__VA_ARGS__))
289 
290 /**
291  * netlbl_secattr_cache_free - Frees a netlbl_lsm_cache struct
292  * @cache: the struct to free
293  *
294  * Description:
295  * Frees @secattr including all of the internal buffers.
296  *
297  */
netlbl_secattr_cache_free(struct netlbl_lsm_cache * cache)298 static inline void netlbl_secattr_cache_free(struct netlbl_lsm_cache *cache)
299 {
300 	if (!refcount_dec_and_test(&cache->refcount))
301 		return;
302 
303 	if (cache->free)
304 		cache->free(cache->data);
305 	kfree(cache);
306 }
307 
308 /**
309  * netlbl_catmap_alloc - Allocate a LSM secattr catmap
310  * @flags: memory allocation flags
311  *
312  * Description:
313  * Allocate memory for a LSM secattr catmap, returns a pointer on success, NULL
314  * on failure.
315  *
316  */
netlbl_catmap_alloc_noprof(gfp_t flags)317 static inline struct netlbl_lsm_catmap *netlbl_catmap_alloc_noprof(gfp_t flags)
318 {
319 	return kzalloc_noprof(sizeof(struct netlbl_lsm_catmap), flags);
320 }
321 #define netlbl_catmap_alloc(...)	alloc_hooks(netlbl_catmap_alloc_noprof(__VA_ARGS__))
322 
323 /**
324  * netlbl_catmap_free - Free a LSM secattr catmap
325  * @catmap: the category bitmap
326  *
327  * Description:
328  * Free a LSM secattr catmap.
329  *
330  */
netlbl_catmap_free(struct netlbl_lsm_catmap * catmap)331 static inline void netlbl_catmap_free(struct netlbl_lsm_catmap *catmap)
332 {
333 	struct netlbl_lsm_catmap *iter;
334 
335 	while (catmap) {
336 		iter = catmap;
337 		catmap = catmap->next;
338 		kfree(iter);
339 	}
340 }
341 
342 /**
343  * netlbl_secattr_init - Initialize a netlbl_lsm_secattr struct
344  * @secattr: the struct to initialize
345  *
346  * Description:
347  * Initialize an already allocated netlbl_lsm_secattr struct.
348  *
349  */
netlbl_secattr_init(struct netlbl_lsm_secattr * secattr)350 static inline void netlbl_secattr_init(struct netlbl_lsm_secattr *secattr)
351 {
352 	memset(secattr, 0, sizeof(*secattr));
353 }
354 
355 /**
356  * netlbl_secattr_destroy - Clears a netlbl_lsm_secattr struct
357  * @secattr: the struct to clear
358  *
359  * Description:
360  * Destroys the @secattr struct, including freeing all of the internal buffers.
361  * The struct must be reset with a call to netlbl_secattr_init() before reuse.
362  *
363  */
netlbl_secattr_destroy(struct netlbl_lsm_secattr * secattr)364 static inline void netlbl_secattr_destroy(struct netlbl_lsm_secattr *secattr)
365 {
366 	if (secattr->flags & NETLBL_SECATTR_FREE_DOMAIN)
367 		kfree(secattr->domain);
368 	if (secattr->flags & NETLBL_SECATTR_CACHE)
369 		netlbl_secattr_cache_free(secattr->cache);
370 	if (secattr->flags & NETLBL_SECATTR_MLS_CAT)
371 		netlbl_catmap_free(secattr->attr.mls.cat);
372 }
373 
374 /**
375  * netlbl_secattr_alloc - Allocate and initialize a netlbl_lsm_secattr struct
376  * @flags: the memory allocation flags
377  *
378  * Description:
379  * Allocate and initialize a netlbl_lsm_secattr struct.  Returns a valid
380  * pointer on success, or NULL on failure.
381  *
382  */
netlbl_secattr_alloc_noprof(gfp_t flags)383 static inline struct netlbl_lsm_secattr *netlbl_secattr_alloc_noprof(gfp_t flags)
384 {
385 	return kzalloc_noprof(sizeof(struct netlbl_lsm_secattr), flags);
386 }
387 #define netlbl_secattr_alloc(...)	alloc_hooks(netlbl_secattr_alloc_noprof(__VA_ARGS__))
388 
389 /**
390  * netlbl_secattr_free - Frees a netlbl_lsm_secattr struct
391  * @secattr: the struct to free
392  *
393  * Description:
394  * Frees @secattr including all of the internal buffers.
395  *
396  */
netlbl_secattr_free(struct netlbl_lsm_secattr * secattr)397 static inline void netlbl_secattr_free(struct netlbl_lsm_secattr *secattr)
398 {
399 	netlbl_secattr_destroy(secattr);
400 	kfree(secattr);
401 }
402 
403 #ifdef CONFIG_NETLABEL
404 /*
405  * LSM configuration operations
406  */
407 int netlbl_cfg_map_del(const char *domain,
408 		       u16 family,
409 		       const void *addr,
410 		       const void *mask,
411 		       struct netlbl_audit *audit_info);
412 int netlbl_cfg_unlbl_map_add(const char *domain,
413 			     u16 family,
414 			     const void *addr,
415 			     const void *mask,
416 			     struct netlbl_audit *audit_info);
417 int netlbl_cfg_unlbl_static_add(struct net *net,
418 				const char *dev_name,
419 				const void *addr,
420 				const void *mask,
421 				u16 family,
422 				u32 secid,
423 				struct netlbl_audit *audit_info);
424 int netlbl_cfg_unlbl_static_del(struct net *net,
425 				const char *dev_name,
426 				const void *addr,
427 				const void *mask,
428 				u16 family,
429 				struct netlbl_audit *audit_info);
430 int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
431 			   struct netlbl_audit *audit_info);
432 void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info);
433 int netlbl_cfg_cipsov4_map_add(u32 doi,
434 			       const char *domain,
435 			       const struct in_addr *addr,
436 			       const struct in_addr *mask,
437 			       struct netlbl_audit *audit_info);
438 int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
439 			   struct netlbl_audit *audit_info);
440 void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info);
441 int netlbl_cfg_calipso_map_add(u32 doi,
442 			       const char *domain,
443 			       const struct in6_addr *addr,
444 			       const struct in6_addr *mask,
445 			       struct netlbl_audit *audit_info);
446 /*
447  * LSM security attribute operations
448  */
449 int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap, u32 offset);
450 int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap, u32 offset);
451 int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
452 			  u32 *offset,
453 			  unsigned long *bitmap);
454 int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
455 			 u32 bit,
456 			 gfp_t flags);
457 int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap,
458 			 u32 start,
459 			 u32 end,
460 			 gfp_t flags);
461 int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
462 			  u32 offset,
463 			  unsigned long bitmap,
464 			  gfp_t flags);
465 
466 /* Bitmap functions
467  */
468 int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len,
469 		       u32 offset, u8 state);
470 void netlbl_bitmap_setbit(unsigned char *bitmap, u32 bit, u8 state);
471 
472 /*
473  * LSM protocol operations (NetLabel LSM/kernel API)
474  */
475 int netlbl_enabled(void);
476 int netlbl_sock_setattr(struct sock *sk,
477 			u16 family,
478 			const struct netlbl_lsm_secattr *secattr,
479 			bool sk_locked);
480 void netlbl_sock_delattr(struct sock *sk);
481 int netlbl_sock_getattr(struct sock *sk,
482 			struct netlbl_lsm_secattr *secattr);
483 int netlbl_conn_setattr(struct sock *sk,
484 			struct sockaddr *addr,
485 			const struct netlbl_lsm_secattr *secattr);
486 int netlbl_req_setattr(struct request_sock *req,
487 		       const struct netlbl_lsm_secattr *secattr);
488 void netlbl_req_delattr(struct request_sock *req);
489 int netlbl_skbuff_setattr(struct sk_buff *skb,
490 			  u16 family,
491 			  const struct netlbl_lsm_secattr *secattr);
492 int netlbl_skbuff_getattr(const struct sk_buff *skb,
493 			  u16 family,
494 			  struct netlbl_lsm_secattr *secattr);
495 void netlbl_skbuff_err(struct sk_buff *skb, u16 family, int error, int gateway);
496 bool netlbl_sk_lock_check(struct sock *sk);
497 
498 /*
499  * LSM label mapping cache operations
500  */
501 void netlbl_cache_invalidate(void);
502 int netlbl_cache_add(const struct sk_buff *skb, u16 family,
503 		     const struct netlbl_lsm_secattr *secattr);
504 
505 /*
506  * Protocol engine operations
507  */
508 struct audit_buffer *netlbl_audit_start(int type,
509 					struct netlbl_audit *audit_info);
510 #else
netlbl_cfg_map_del(const char * domain,u16 family,const void * addr,const void * mask,struct netlbl_audit * audit_info)511 static inline int netlbl_cfg_map_del(const char *domain,
512 				     u16 family,
513 				     const void *addr,
514 				     const void *mask,
515 				     struct netlbl_audit *audit_info)
516 {
517 	return -ENOSYS;
518 }
netlbl_cfg_unlbl_map_add(const char * domain,u16 family,void * addr,void * mask,struct netlbl_audit * audit_info)519 static inline int netlbl_cfg_unlbl_map_add(const char *domain,
520 					   u16 family,
521 					   void *addr,
522 					   void *mask,
523 					   struct netlbl_audit *audit_info)
524 {
525 	return -ENOSYS;
526 }
netlbl_cfg_unlbl_static_add(struct net * net,const char * dev_name,const void * addr,const void * mask,u16 family,u32 secid,struct netlbl_audit * audit_info)527 static inline int netlbl_cfg_unlbl_static_add(struct net *net,
528 					      const char *dev_name,
529 					      const void *addr,
530 					      const void *mask,
531 					      u16 family,
532 					      u32 secid,
533 					      struct netlbl_audit *audit_info)
534 {
535 	return -ENOSYS;
536 }
netlbl_cfg_unlbl_static_del(struct net * net,const char * dev_name,const void * addr,const void * mask,u16 family,struct netlbl_audit * audit_info)537 static inline int netlbl_cfg_unlbl_static_del(struct net *net,
538 					      const char *dev_name,
539 					      const void *addr,
540 					      const void *mask,
541 					      u16 family,
542 					      struct netlbl_audit *audit_info)
543 {
544 	return -ENOSYS;
545 }
netlbl_cfg_cipsov4_add(struct cipso_v4_doi * doi_def,struct netlbl_audit * audit_info)546 static inline int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
547 					 struct netlbl_audit *audit_info)
548 {
549 	return -ENOSYS;
550 }
netlbl_cfg_cipsov4_del(u32 doi,struct netlbl_audit * audit_info)551 static inline void netlbl_cfg_cipsov4_del(u32 doi,
552 					  struct netlbl_audit *audit_info)
553 {
554 	return;
555 }
netlbl_cfg_cipsov4_map_add(u32 doi,const char * domain,const struct in_addr * addr,const struct in_addr * mask,struct netlbl_audit * audit_info)556 static inline int netlbl_cfg_cipsov4_map_add(u32 doi,
557 					     const char *domain,
558 					     const struct in_addr *addr,
559 					     const struct in_addr *mask,
560 					     struct netlbl_audit *audit_info)
561 {
562 	return -ENOSYS;
563 }
netlbl_cfg_calipso_add(struct calipso_doi * doi_def,struct netlbl_audit * audit_info)564 static inline int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
565 					 struct netlbl_audit *audit_info)
566 {
567 	return -ENOSYS;
568 }
netlbl_cfg_calipso_del(u32 doi,struct netlbl_audit * audit_info)569 static inline void netlbl_cfg_calipso_del(u32 doi,
570 					  struct netlbl_audit *audit_info)
571 {
572 	return;
573 }
netlbl_cfg_calipso_map_add(u32 doi,const char * domain,const struct in6_addr * addr,const struct in6_addr * mask,struct netlbl_audit * audit_info)574 static inline int netlbl_cfg_calipso_map_add(u32 doi,
575 					     const char *domain,
576 					     const struct in6_addr *addr,
577 					     const struct in6_addr *mask,
578 					     struct netlbl_audit *audit_info)
579 {
580 	return -ENOSYS;
581 }
netlbl_catmap_walk(struct netlbl_lsm_catmap * catmap,u32 offset)582 static inline int netlbl_catmap_walk(struct netlbl_lsm_catmap *catmap,
583 				     u32 offset)
584 {
585 	return -ENOENT;
586 }
netlbl_catmap_walkrng(struct netlbl_lsm_catmap * catmap,u32 offset)587 static inline int netlbl_catmap_walkrng(struct netlbl_lsm_catmap *catmap,
588 					u32 offset)
589 {
590 	return -ENOENT;
591 }
netlbl_catmap_getlong(struct netlbl_lsm_catmap * catmap,u32 * offset,unsigned long * bitmap)592 static inline int netlbl_catmap_getlong(struct netlbl_lsm_catmap *catmap,
593 					u32 *offset,
594 					unsigned long *bitmap)
595 {
596 	return 0;
597 }
netlbl_catmap_setbit(struct netlbl_lsm_catmap ** catmap,u32 bit,gfp_t flags)598 static inline int netlbl_catmap_setbit(struct netlbl_lsm_catmap **catmap,
599 				       u32 bit,
600 				       gfp_t flags)
601 {
602 	return 0;
603 }
netlbl_catmap_setrng(struct netlbl_lsm_catmap ** catmap,u32 start,u32 end,gfp_t flags)604 static inline int netlbl_catmap_setrng(struct netlbl_lsm_catmap **catmap,
605 				       u32 start,
606 				       u32 end,
607 				       gfp_t flags)
608 {
609 	return 0;
610 }
netlbl_catmap_setlong(struct netlbl_lsm_catmap ** catmap,u32 offset,unsigned long bitmap,gfp_t flags)611 static inline int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
612 					u32 offset,
613 					unsigned long bitmap,
614 					gfp_t flags)
615 {
616 	return 0;
617 }
netlbl_enabled(void)618 static inline int netlbl_enabled(void)
619 {
620 	return 0;
621 }
netlbl_sock_setattr(struct sock * sk,u16 family,const struct netlbl_lsm_secattr * secattr,bool sk_locked)622 static inline int netlbl_sock_setattr(struct sock *sk,
623 				      u16 family,
624 				      const struct netlbl_lsm_secattr *secattr,
625 				      bool sk_locked)
626 {
627 	return -ENOSYS;
628 }
netlbl_sock_delattr(struct sock * sk)629 static inline void netlbl_sock_delattr(struct sock *sk)
630 {
631 }
netlbl_sock_getattr(struct sock * sk,struct netlbl_lsm_secattr * secattr)632 static inline int netlbl_sock_getattr(struct sock *sk,
633 				      struct netlbl_lsm_secattr *secattr)
634 {
635 	return -ENOSYS;
636 }
netlbl_conn_setattr(struct sock * sk,struct sockaddr * addr,const struct netlbl_lsm_secattr * secattr)637 static inline int netlbl_conn_setattr(struct sock *sk,
638 				      struct sockaddr *addr,
639 				      const struct netlbl_lsm_secattr *secattr)
640 {
641 	return -ENOSYS;
642 }
netlbl_req_setattr(struct request_sock * req,const struct netlbl_lsm_secattr * secattr)643 static inline int netlbl_req_setattr(struct request_sock *req,
644 				     const struct netlbl_lsm_secattr *secattr)
645 {
646 	return -ENOSYS;
647 }
netlbl_req_delattr(struct request_sock * req)648 static inline void netlbl_req_delattr(struct request_sock *req)
649 {
650 	return;
651 }
netlbl_skbuff_setattr(struct sk_buff * skb,u16 family,const struct netlbl_lsm_secattr * secattr)652 static inline int netlbl_skbuff_setattr(struct sk_buff *skb,
653 				      u16 family,
654 				      const struct netlbl_lsm_secattr *secattr)
655 {
656 	return -ENOSYS;
657 }
netlbl_skbuff_getattr(const struct sk_buff * skb,u16 family,struct netlbl_lsm_secattr * secattr)658 static inline int netlbl_skbuff_getattr(const struct sk_buff *skb,
659 					u16 family,
660 					struct netlbl_lsm_secattr *secattr)
661 {
662 	return -ENOSYS;
663 }
netlbl_skbuff_err(struct sk_buff * skb,int error,int gateway)664 static inline void netlbl_skbuff_err(struct sk_buff *skb,
665 				     int error,
666 				     int gateway)
667 {
668 	return;
669 }
netlbl_cache_invalidate(void)670 static inline void netlbl_cache_invalidate(void)
671 {
672 	return;
673 }
netlbl_cache_add(const struct sk_buff * skb,u16 family,const struct netlbl_lsm_secattr * secattr)674 static inline int netlbl_cache_add(const struct sk_buff *skb, u16 family,
675 				   const struct netlbl_lsm_secattr *secattr)
676 {
677 	return 0;
678 }
netlbl_audit_start(int type,struct netlbl_audit * audit_info)679 static inline struct audit_buffer *netlbl_audit_start(int type,
680 						struct netlbl_audit *audit_info)
681 {
682 	return NULL;
683 }
684 
netlbl_sk_lock_check(struct sock * sk)685 static inline bool netlbl_sk_lock_check(struct sock *sk)
686 {
687 	return true;
688 }
689 #endif /* CONFIG_NETLABEL */
690 
691 const struct netlbl_calipso_ops *
692 netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops);
693 
694 #endif /* _NETLABEL_H */
695