1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * NetLabel CIPSO/IPv4 Support 4 * 5 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The 6 * NetLabel system manages static and dynamic label mappings for network 7 * protocols such as CIPSO and RIPSO. 8 * 9 * Author: Paul Moore <paul@paul-moore.com> 10 */ 11 12 /* 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 14 */ 15 16 #include <linux/types.h> 17 #include <linux/socket.h> 18 #include <linux/string.h> 19 #include <linux/skbuff.h> 20 #include <linux/audit.h> 21 #include <linux/slab.h> 22 #include <net/sock.h> 23 #include <net/netlink.h> 24 #include <net/genetlink.h> 25 #include <net/netlabel.h> 26 #include <net/cipso_ipv4.h> 27 #include <linux/atomic.h> 28 29 #include "netlabel_user.h" 30 #include "netlabel_cipso_v4.h" 31 #include "netlabel_mgmt.h" 32 #include "netlabel_domainhash.h" 33 34 /* Argument struct for cipso_v4_doi_walk() */ 35 struct netlbl_cipsov4_doiwalk_arg { 36 struct netlink_callback *nl_cb; 37 struct sk_buff *skb; 38 u32 seq; 39 }; 40 41 /* Argument struct for netlbl_domhsh_walk() */ 42 struct netlbl_domhsh_walk_arg { 43 struct netlbl_audit *audit_info; 44 u32 doi; 45 }; 46 47 /* NetLabel Generic NETLINK CIPSOv4 family */ 48 static struct genl_family netlbl_cipsov4_gnl_family; 49 /* NetLabel Netlink attribute policy */ 50 static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = { 51 [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 }, 52 [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 }, 53 [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 }, 54 [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED }, 55 [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 }, 56 [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 }, 57 [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED }, 58 [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED }, 59 [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 }, 60 [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 }, 61 [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED }, 62 [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED }, 63 }; 64 65 /* 66 * Helper Functions 67 */ 68 69 /** 70 * netlbl_cipsov4_add_common - Parse the common sections of a ADD message 71 * @info: the Generic NETLINK info block 72 * @doi_def: the CIPSO V4 DOI definition 73 * 74 * Description: 75 * Parse the common sections of a ADD message and fill in the related values 76 * in @doi_def. Returns zero on success, negative values on failure. 77 * 78 */ 79 static int netlbl_cipsov4_add_common(struct genl_info *info, 80 struct cipso_v4_doi *doi_def) 81 { 82 struct nlattr *nla; 83 int nla_rem; 84 u32 iter = 0; 85 86 doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); 87 88 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_TAGLST], 89 NLBL_CIPSOV4_A_MAX, 90 netlbl_cipsov4_genl_policy, 91 NULL) != 0) 92 return -EINVAL; 93 94 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem) 95 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) { 96 if (iter >= CIPSO_V4_TAG_MAXCNT) 97 return -EINVAL; 98 doi_def->tags[iter++] = nla_get_u8(nla); 99 } 100 while (iter < CIPSO_V4_TAG_MAXCNT) 101 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID; 102 103 return 0; 104 } 105 106 /* 107 * NetLabel Command Handlers 108 */ 109 110 /** 111 * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition 112 * @info: the Generic NETLINK info block 113 * @audit_info: NetLabel audit information 114 * 115 * Description: 116 * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD 117 * message and add it to the CIPSO V4 engine. Return zero on success and 118 * non-zero on error. 119 * 120 */ 121 static int netlbl_cipsov4_add_std(struct genl_info *info, 122 struct netlbl_audit *audit_info) 123 { 124 int ret_val = -EINVAL; 125 struct cipso_v4_doi *doi_def = NULL; 126 struct nlattr *nla_a; 127 struct nlattr *nla_b; 128 int nla_a_rem; 129 int nla_b_rem; 130 u32 iter; 131 132 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] || 133 !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST]) 134 return -EINVAL; 135 136 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], 137 NLBL_CIPSOV4_A_MAX, 138 netlbl_cipsov4_genl_policy, 139 NULL) != 0) 140 return -EINVAL; 141 142 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); 143 if (doi_def == NULL) 144 return -ENOMEM; 145 doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL); 146 if (doi_def->map.std == NULL) { 147 kfree(doi_def); 148 return -ENOMEM; 149 } 150 doi_def->type = CIPSO_V4_MAP_TRANS; 151 152 ret_val = netlbl_cipsov4_add_common(info, doi_def); 153 if (ret_val != 0) 154 goto add_std_failure; 155 ret_val = -EINVAL; 156 157 nla_for_each_nested(nla_a, 158 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], 159 nla_a_rem) 160 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { 161 if (nla_validate_nested_deprecated(nla_a, 162 NLBL_CIPSOV4_A_MAX, 163 netlbl_cipsov4_genl_policy, 164 NULL) != 0) 165 goto add_std_failure; 166 nla_for_each_nested(nla_b, nla_a, nla_b_rem) 167 switch (nla_type(nla_b)) { 168 case NLBL_CIPSOV4_A_MLSLVLLOC: 169 if (nla_get_u32(nla_b) > 170 CIPSO_V4_MAX_LOC_LVLS) 171 goto add_std_failure; 172 if (nla_get_u32(nla_b) >= 173 doi_def->map.std->lvl.local_size) 174 doi_def->map.std->lvl.local_size = 175 nla_get_u32(nla_b) + 1; 176 break; 177 case NLBL_CIPSOV4_A_MLSLVLREM: 178 if (nla_get_u32(nla_b) > 179 CIPSO_V4_MAX_REM_LVLS) 180 goto add_std_failure; 181 if (nla_get_u32(nla_b) >= 182 doi_def->map.std->lvl.cipso_size) 183 doi_def->map.std->lvl.cipso_size = 184 nla_get_u32(nla_b) + 1; 185 break; 186 } 187 } 188 doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size, 189 sizeof(u32), 190 GFP_KERNEL | __GFP_NOWARN); 191 if (doi_def->map.std->lvl.local == NULL) { 192 ret_val = -ENOMEM; 193 goto add_std_failure; 194 } 195 doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size, 196 sizeof(u32), 197 GFP_KERNEL | __GFP_NOWARN); 198 if (doi_def->map.std->lvl.cipso == NULL) { 199 ret_val = -ENOMEM; 200 goto add_std_failure; 201 } 202 for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++) 203 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL; 204 for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++) 205 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL; 206 nla_for_each_nested(nla_a, 207 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST], 208 nla_a_rem) 209 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) { 210 struct nlattr *lvl_loc; 211 struct nlattr *lvl_rem; 212 213 lvl_loc = nla_find_nested(nla_a, 214 NLBL_CIPSOV4_A_MLSLVLLOC); 215 lvl_rem = nla_find_nested(nla_a, 216 NLBL_CIPSOV4_A_MLSLVLREM); 217 if (lvl_loc == NULL || lvl_rem == NULL) 218 goto add_std_failure; 219 doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] = 220 nla_get_u32(lvl_rem); 221 doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] = 222 nla_get_u32(lvl_loc); 223 } 224 225 if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) { 226 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSCATLST], 227 NLBL_CIPSOV4_A_MAX, 228 netlbl_cipsov4_genl_policy, 229 NULL) != 0) 230 goto add_std_failure; 231 232 nla_for_each_nested(nla_a, 233 info->attrs[NLBL_CIPSOV4_A_MLSCATLST], 234 nla_a_rem) 235 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { 236 if (nla_validate_nested_deprecated(nla_a, 237 NLBL_CIPSOV4_A_MAX, 238 netlbl_cipsov4_genl_policy, 239 NULL) != 0) 240 goto add_std_failure; 241 nla_for_each_nested(nla_b, nla_a, nla_b_rem) 242 switch (nla_type(nla_b)) { 243 case NLBL_CIPSOV4_A_MLSCATLOC: 244 if (nla_get_u32(nla_b) > 245 CIPSO_V4_MAX_LOC_CATS) 246 goto add_std_failure; 247 if (nla_get_u32(nla_b) >= 248 doi_def->map.std->cat.local_size) 249 doi_def->map.std->cat.local_size = 250 nla_get_u32(nla_b) + 1; 251 break; 252 case NLBL_CIPSOV4_A_MLSCATREM: 253 if (nla_get_u32(nla_b) > 254 CIPSO_V4_MAX_REM_CATS) 255 goto add_std_failure; 256 if (nla_get_u32(nla_b) >= 257 doi_def->map.std->cat.cipso_size) 258 doi_def->map.std->cat.cipso_size = 259 nla_get_u32(nla_b) + 1; 260 break; 261 } 262 } 263 doi_def->map.std->cat.local = kcalloc( 264 doi_def->map.std->cat.local_size, 265 sizeof(u32), 266 GFP_KERNEL | __GFP_NOWARN); 267 if (doi_def->map.std->cat.local == NULL) { 268 ret_val = -ENOMEM; 269 goto add_std_failure; 270 } 271 doi_def->map.std->cat.cipso = kcalloc( 272 doi_def->map.std->cat.cipso_size, 273 sizeof(u32), 274 GFP_KERNEL | __GFP_NOWARN); 275 if (doi_def->map.std->cat.cipso == NULL) { 276 ret_val = -ENOMEM; 277 goto add_std_failure; 278 } 279 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++) 280 doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT; 281 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++) 282 doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT; 283 nla_for_each_nested(nla_a, 284 info->attrs[NLBL_CIPSOV4_A_MLSCATLST], 285 nla_a_rem) 286 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) { 287 struct nlattr *cat_loc; 288 struct nlattr *cat_rem; 289 290 cat_loc = nla_find_nested(nla_a, 291 NLBL_CIPSOV4_A_MLSCATLOC); 292 cat_rem = nla_find_nested(nla_a, 293 NLBL_CIPSOV4_A_MLSCATREM); 294 if (cat_loc == NULL || cat_rem == NULL) 295 goto add_std_failure; 296 doi_def->map.std->cat.local[ 297 nla_get_u32(cat_loc)] = 298 nla_get_u32(cat_rem); 299 doi_def->map.std->cat.cipso[ 300 nla_get_u32(cat_rem)] = 301 nla_get_u32(cat_loc); 302 } 303 } 304 305 ret_val = cipso_v4_doi_add(doi_def, audit_info); 306 if (ret_val != 0) 307 goto add_std_failure; 308 return 0; 309 310 add_std_failure: 311 cipso_v4_doi_free(doi_def); 312 return ret_val; 313 } 314 315 /** 316 * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition 317 * @info: the Generic NETLINK info block 318 * @audit_info: NetLabel audit information 319 * 320 * Description: 321 * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message 322 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on 323 * error. 324 * 325 */ 326 static int netlbl_cipsov4_add_pass(struct genl_info *info, 327 struct netlbl_audit *audit_info) 328 { 329 int ret_val; 330 struct cipso_v4_doi *doi_def = NULL; 331 332 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST]) 333 return -EINVAL; 334 335 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); 336 if (doi_def == NULL) 337 return -ENOMEM; 338 doi_def->type = CIPSO_V4_MAP_PASS; 339 340 ret_val = netlbl_cipsov4_add_common(info, doi_def); 341 if (ret_val != 0) 342 goto add_pass_failure; 343 344 ret_val = cipso_v4_doi_add(doi_def, audit_info); 345 if (ret_val != 0) 346 goto add_pass_failure; 347 return 0; 348 349 add_pass_failure: 350 cipso_v4_doi_free(doi_def); 351 return ret_val; 352 } 353 354 /** 355 * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition 356 * @info: the Generic NETLINK info block 357 * @audit_info: NetLabel audit information 358 * 359 * Description: 360 * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD 361 * message and add it to the CIPSO V4 engine. Return zero on success and 362 * non-zero on error. 363 * 364 */ 365 static int netlbl_cipsov4_add_local(struct genl_info *info, 366 struct netlbl_audit *audit_info) 367 { 368 int ret_val; 369 struct cipso_v4_doi *doi_def = NULL; 370 371 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST]) 372 return -EINVAL; 373 374 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL); 375 if (doi_def == NULL) 376 return -ENOMEM; 377 doi_def->type = CIPSO_V4_MAP_LOCAL; 378 379 ret_val = netlbl_cipsov4_add_common(info, doi_def); 380 if (ret_val != 0) 381 goto add_local_failure; 382 383 ret_val = cipso_v4_doi_add(doi_def, audit_info); 384 if (ret_val != 0) 385 goto add_local_failure; 386 return 0; 387 388 add_local_failure: 389 cipso_v4_doi_free(doi_def); 390 return ret_val; 391 } 392 393 /** 394 * netlbl_cipsov4_add - Handle an ADD message 395 * @skb: the NETLINK buffer 396 * @info: the Generic NETLINK info block 397 * 398 * Description: 399 * Create a new DOI definition based on the given ADD message and add it to the 400 * CIPSO V4 engine. Returns zero on success, negative values on failure. 401 * 402 */ 403 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) 404 405 { 406 int ret_val = -EINVAL; 407 struct netlbl_audit audit_info; 408 409 if (!info->attrs[NLBL_CIPSOV4_A_DOI] || 410 !info->attrs[NLBL_CIPSOV4_A_MTYPE]) 411 return -EINVAL; 412 413 netlbl_netlink_auditinfo(&audit_info); 414 switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) { 415 case CIPSO_V4_MAP_TRANS: 416 ret_val = netlbl_cipsov4_add_std(info, &audit_info); 417 break; 418 case CIPSO_V4_MAP_PASS: 419 ret_val = netlbl_cipsov4_add_pass(info, &audit_info); 420 break; 421 case CIPSO_V4_MAP_LOCAL: 422 ret_val = netlbl_cipsov4_add_local(info, &audit_info); 423 break; 424 } 425 if (ret_val == 0) 426 atomic_inc(&netlabel_mgmt_protocount); 427 428 return ret_val; 429 } 430 431 /** 432 * netlbl_cipsov4_list - Handle a LIST message 433 * @skb: the NETLINK buffer 434 * @info: the Generic NETLINK info block 435 * 436 * Description: 437 * Process a user generated LIST message and respond accordingly. While the 438 * response message generated by the kernel is straightforward, determining 439 * before hand the size of the buffer to allocate is not (we have to generate 440 * the message to know the size). In order to keep this function sane what we 441 * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in 442 * that size, if we fail then we restart with a larger buffer and try again. 443 * We continue in this manner until we hit a limit of failed attempts then we 444 * give up and just send an error message. Returns zero on success and 445 * negative values on error. 446 * 447 */ 448 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info) 449 { 450 int ret_val; 451 struct sk_buff *ans_skb = NULL; 452 u32 nlsze_mult = 1; 453 void *data; 454 u32 doi; 455 struct nlattr *nla_a; 456 struct nlattr *nla_b; 457 struct cipso_v4_doi *doi_def; 458 u32 iter; 459 460 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) { 461 ret_val = -EINVAL; 462 goto list_failure; 463 } 464 465 list_start: 466 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL); 467 if (ans_skb == NULL) { 468 ret_val = -ENOMEM; 469 goto list_failure; 470 } 471 data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family, 472 0, NLBL_CIPSOV4_C_LIST); 473 if (data == NULL) { 474 ret_val = -ENOMEM; 475 goto list_failure; 476 } 477 478 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); 479 480 rcu_read_lock(); 481 doi_def = cipso_v4_doi_getdef(doi); 482 if (doi_def == NULL) { 483 ret_val = -EINVAL; 484 goto list_failure_lock; 485 } 486 487 ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type); 488 if (ret_val != 0) 489 goto list_failure_lock; 490 491 nla_a = nla_nest_start_noflag(ans_skb, NLBL_CIPSOV4_A_TAGLST); 492 if (nla_a == NULL) { 493 ret_val = -ENOMEM; 494 goto list_failure_lock; 495 } 496 for (iter = 0; 497 iter < CIPSO_V4_TAG_MAXCNT && 498 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID; 499 iter++) { 500 ret_val = nla_put_u8(ans_skb, 501 NLBL_CIPSOV4_A_TAG, 502 doi_def->tags[iter]); 503 if (ret_val != 0) 504 goto list_failure_lock; 505 } 506 nla_nest_end(ans_skb, nla_a); 507 508 switch (doi_def->type) { 509 case CIPSO_V4_MAP_TRANS: 510 nla_a = nla_nest_start_noflag(ans_skb, 511 NLBL_CIPSOV4_A_MLSLVLLST); 512 if (nla_a == NULL) { 513 ret_val = -ENOMEM; 514 goto list_failure_lock; 515 } 516 for (iter = 0; 517 iter < doi_def->map.std->lvl.local_size; 518 iter++) { 519 if (doi_def->map.std->lvl.local[iter] == 520 CIPSO_V4_INV_LVL) 521 continue; 522 523 nla_b = nla_nest_start_noflag(ans_skb, 524 NLBL_CIPSOV4_A_MLSLVL); 525 if (nla_b == NULL) { 526 ret_val = -ENOMEM; 527 goto list_retry; 528 } 529 ret_val = nla_put_u32(ans_skb, 530 NLBL_CIPSOV4_A_MLSLVLLOC, 531 iter); 532 if (ret_val != 0) 533 goto list_retry; 534 ret_val = nla_put_u32(ans_skb, 535 NLBL_CIPSOV4_A_MLSLVLREM, 536 doi_def->map.std->lvl.local[iter]); 537 if (ret_val != 0) 538 goto list_retry; 539 nla_nest_end(ans_skb, nla_b); 540 } 541 nla_nest_end(ans_skb, nla_a); 542 543 nla_a = nla_nest_start_noflag(ans_skb, 544 NLBL_CIPSOV4_A_MLSCATLST); 545 if (nla_a == NULL) { 546 ret_val = -ENOMEM; 547 goto list_retry; 548 } 549 for (iter = 0; 550 iter < doi_def->map.std->cat.local_size; 551 iter++) { 552 if (doi_def->map.std->cat.local[iter] == 553 CIPSO_V4_INV_CAT) 554 continue; 555 556 nla_b = nla_nest_start_noflag(ans_skb, 557 NLBL_CIPSOV4_A_MLSCAT); 558 if (nla_b == NULL) { 559 ret_val = -ENOMEM; 560 goto list_retry; 561 } 562 ret_val = nla_put_u32(ans_skb, 563 NLBL_CIPSOV4_A_MLSCATLOC, 564 iter); 565 if (ret_val != 0) 566 goto list_retry; 567 ret_val = nla_put_u32(ans_skb, 568 NLBL_CIPSOV4_A_MLSCATREM, 569 doi_def->map.std->cat.local[iter]); 570 if (ret_val != 0) 571 goto list_retry; 572 nla_nest_end(ans_skb, nla_b); 573 } 574 nla_nest_end(ans_skb, nla_a); 575 576 break; 577 } 578 cipso_v4_doi_putdef(doi_def); 579 rcu_read_unlock(); 580 581 genlmsg_end(ans_skb, data); 582 return genlmsg_reply(ans_skb, info); 583 584 list_retry: 585 /* XXX - this limit is a guesstimate */ 586 if (nlsze_mult < 4) { 587 cipso_v4_doi_putdef(doi_def); 588 rcu_read_unlock(); 589 kfree_skb(ans_skb); 590 nlsze_mult *= 2; 591 goto list_start; 592 } 593 list_failure_lock: 594 cipso_v4_doi_putdef(doi_def); 595 rcu_read_unlock(); 596 list_failure: 597 kfree_skb(ans_skb); 598 return ret_val; 599 } 600 601 /** 602 * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL 603 * @doi_def: the CIPSOv4 DOI definition 604 * @arg: the netlbl_cipsov4_doiwalk_arg structure 605 * 606 * Description: 607 * This function is designed to be used as a callback to the 608 * cipso_v4_doi_walk() function for use in generating a response for a LISTALL 609 * message. Returns the size of the message on success, negative values on 610 * failure. 611 * 612 */ 613 static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg) 614 { 615 int ret_val = -ENOMEM; 616 struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg; 617 void *data; 618 619 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, 620 cb_arg->seq, &netlbl_cipsov4_gnl_family, 621 NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL); 622 if (data == NULL) 623 goto listall_cb_failure; 624 625 ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi); 626 if (ret_val != 0) 627 goto listall_cb_failure; 628 ret_val = nla_put_u32(cb_arg->skb, 629 NLBL_CIPSOV4_A_MTYPE, 630 doi_def->type); 631 if (ret_val != 0) 632 goto listall_cb_failure; 633 634 genlmsg_end(cb_arg->skb, data); 635 return 0; 636 637 listall_cb_failure: 638 genlmsg_cancel(cb_arg->skb, data); 639 return ret_val; 640 } 641 642 /** 643 * netlbl_cipsov4_listall - Handle a LISTALL message 644 * @skb: the NETLINK buffer 645 * @cb: the NETLINK callback 646 * 647 * Description: 648 * Process a user generated LISTALL message and respond accordingly. Returns 649 * zero on success and negative values on error. 650 * 651 */ 652 static int netlbl_cipsov4_listall(struct sk_buff *skb, 653 struct netlink_callback *cb) 654 { 655 struct netlbl_cipsov4_doiwalk_arg cb_arg; 656 u32 doi_skip = cb->args[0]; 657 658 cb_arg.nl_cb = cb; 659 cb_arg.skb = skb; 660 cb_arg.seq = cb->nlh->nlmsg_seq; 661 662 cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg); 663 664 cb->args[0] = doi_skip; 665 return skb->len; 666 } 667 668 /** 669 * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE 670 * @entry: LSM domain mapping entry 671 * @arg: the netlbl_domhsh_walk_arg structure 672 * 673 * Description: 674 * This function is intended for use by netlbl_cipsov4_remove() as the callback 675 * for the netlbl_domhsh_walk() function; it removes LSM domain map entries 676 * which are associated with the CIPSO DOI specified in @arg. Returns zero on 677 * success, negative values on failure. 678 * 679 */ 680 static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg) 681 { 682 struct netlbl_domhsh_walk_arg *cb_arg = arg; 683 684 if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 && 685 entry->def.cipso->doi == cb_arg->doi) 686 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info); 687 688 return 0; 689 } 690 691 /** 692 * netlbl_cipsov4_remove - Handle a REMOVE message 693 * @skb: the NETLINK buffer 694 * @info: the Generic NETLINK info block 695 * 696 * Description: 697 * Process a user generated REMOVE message and respond accordingly. Returns 698 * zero on success, negative values on failure. 699 * 700 */ 701 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info) 702 { 703 int ret_val = -EINVAL; 704 struct netlbl_domhsh_walk_arg cb_arg; 705 struct netlbl_audit audit_info; 706 u32 skip_bkt = 0; 707 u32 skip_chain = 0; 708 709 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) 710 return -EINVAL; 711 712 netlbl_netlink_auditinfo(&audit_info); 713 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]); 714 cb_arg.audit_info = &audit_info; 715 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain, 716 netlbl_cipsov4_remove_cb, &cb_arg); 717 if (ret_val == 0 || ret_val == -ENOENT) { 718 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info); 719 if (ret_val == 0) 720 atomic_dec(&netlabel_mgmt_protocount); 721 } 722 723 return ret_val; 724 } 725 726 /* 727 * NetLabel Generic NETLINK Command Definitions 728 */ 729 730 static const struct genl_small_ops netlbl_cipsov4_ops[] = { 731 { 732 .cmd = NLBL_CIPSOV4_C_ADD, 733 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 734 .flags = GENL_ADMIN_PERM, 735 .doit = netlbl_cipsov4_add, 736 .dumpit = NULL, 737 }, 738 { 739 .cmd = NLBL_CIPSOV4_C_REMOVE, 740 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 741 .flags = GENL_ADMIN_PERM, 742 .doit = netlbl_cipsov4_remove, 743 .dumpit = NULL, 744 }, 745 { 746 .cmd = NLBL_CIPSOV4_C_LIST, 747 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 748 .flags = 0, 749 .doit = netlbl_cipsov4_list, 750 .dumpit = NULL, 751 }, 752 { 753 .cmd = NLBL_CIPSOV4_C_LISTALL, 754 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP, 755 .flags = 0, 756 .doit = NULL, 757 .dumpit = netlbl_cipsov4_listall, 758 }, 759 }; 760 761 static struct genl_family netlbl_cipsov4_gnl_family __ro_after_init = { 762 .hdrsize = 0, 763 .name = NETLBL_NLTYPE_CIPSOV4_NAME, 764 .version = NETLBL_PROTO_VERSION, 765 .maxattr = NLBL_CIPSOV4_A_MAX, 766 .policy = netlbl_cipsov4_genl_policy, 767 .module = THIS_MODULE, 768 .small_ops = netlbl_cipsov4_ops, 769 .n_small_ops = ARRAY_SIZE(netlbl_cipsov4_ops), 770 .resv_start_op = NLBL_CIPSOV4_C_LISTALL + 1, 771 }; 772 773 /* 774 * NetLabel Generic NETLINK Protocol Functions 775 */ 776 777 /** 778 * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component 779 * 780 * Description: 781 * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK 782 * mechanism. Returns zero on success, negative values on failure. 783 * 784 */ 785 int __init netlbl_cipsov4_genl_init(void) 786 { 787 return genl_register_family(&netlbl_cipsov4_gnl_family); 788 } 789