~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netlabel/netlabel_cipso_v4.c

Version: ~ [ linux-5.13-rc1 ] ~ [ linux-5.12.2 ] ~ [ linux-5.11.19 ] ~ [ linux-5.10.35 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.117 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.190 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.232 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.268 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.268 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0-or-later
  2 /*
  3  * NetLabel CIPSO/IPv4 Support
  4  *
  5  * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
  6  * NetLabel system manages static and dynamic label mappings for network
  7  * protocols such as CIPSO and RIPSO.
  8  *
  9  * Author: Paul Moore <paul@paul-moore.com>
 10  */
 11 
 12 /*
 13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 14  */
 15 
 16 #include <linux/types.h>
 17 #include <linux/socket.h>
 18 #include <linux/string.h>
 19 #include <linux/skbuff.h>
 20 #include <linux/audit.h>
 21 #include <linux/slab.h>
 22 #include <net/sock.h>
 23 #include <net/netlink.h>
 24 #include <net/genetlink.h>
 25 #include <net/netlabel.h>
 26 #include <net/cipso_ipv4.h>
 27 #include <linux/atomic.h>
 28 
 29 #include "netlabel_user.h"
 30 #include "netlabel_cipso_v4.h"
 31 #include "netlabel_mgmt.h"
 32 #include "netlabel_domainhash.h"
 33 
 34 /* Argument struct for cipso_v4_doi_walk() */
 35 struct netlbl_cipsov4_doiwalk_arg {
 36         struct netlink_callback *nl_cb;
 37         struct sk_buff *skb;
 38         u32 seq;
 39 };
 40 
 41 /* Argument struct for netlbl_domhsh_walk() */
 42 struct netlbl_domhsh_walk_arg {
 43         struct netlbl_audit *audit_info;
 44         u32 doi;
 45 };
 46 
 47 /* NetLabel Generic NETLINK CIPSOv4 family */
 48 static struct genl_family netlbl_cipsov4_gnl_family;
 49 /* NetLabel Netlink attribute policy */
 50 static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
 51         [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
 52         [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
 53         [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
 54         [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
 55         [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
 56         [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
 57         [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
 58         [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
 59         [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
 60         [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
 61         [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
 62         [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
 63 };
 64 
 65 /*
 66  * Helper Functions
 67  */
 68 
 69 /**
 70  * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
 71  * @info: the Generic NETLINK info block
 72  * @doi_def: the CIPSO V4 DOI definition
 73  *
 74  * Description:
 75  * Parse the common sections of a ADD message and fill in the related values
 76  * in @doi_def.  Returns zero on success, negative values on failure.
 77  *
 78  */
 79 static int netlbl_cipsov4_add_common(struct genl_info *info,
 80                                      struct cipso_v4_doi *doi_def)
 81 {
 82         struct nlattr *nla;
 83         int nla_rem;
 84         u32 iter = 0;
 85 
 86         doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 87 
 88         if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_TAGLST],
 89                                            NLBL_CIPSOV4_A_MAX,
 90                                            netlbl_cipsov4_genl_policy,
 91                                            NULL) != 0)
 92                 return -EINVAL;
 93 
 94         nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
 95                 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) {
 96                         if (iter >= CIPSO_V4_TAG_MAXCNT)
 97                                 return -EINVAL;
 98                         doi_def->tags[iter++] = nla_get_u8(nla);
 99                 }
100         while (iter < CIPSO_V4_TAG_MAXCNT)
101                 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
102 
103         return 0;
104 }
105 
106 /*
107  * NetLabel Command Handlers
108  */
109 
110 /**
111  * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
112  * @info: the Generic NETLINK info block
113  * @audit_info: NetLabel audit information
114  *
115  * Description:
116  * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
117  * message and add it to the CIPSO V4 engine.  Return zero on success and
118  * non-zero on error.
119  *
120  */
121 static int netlbl_cipsov4_add_std(struct genl_info *info,
122                                   struct netlbl_audit *audit_info)
123 {
124         int ret_val = -EINVAL;
125         struct cipso_v4_doi *doi_def = NULL;
126         struct nlattr *nla_a;
127         struct nlattr *nla_b;
128         int nla_a_rem;
129         int nla_b_rem;
130         u32 iter;
131 
132         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
133             !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
134                 return -EINVAL;
135 
136         if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
137                                            NLBL_CIPSOV4_A_MAX,
138                                            netlbl_cipsov4_genl_policy,
139                                            NULL) != 0)
140                 return -EINVAL;
141 
142         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
143         if (doi_def == NULL)
144                 return -ENOMEM;
145         doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
146         if (doi_def->map.std == NULL) {
147                 ret_val = -ENOMEM;
148                 goto add_std_failure;
149         }
150         doi_def->type = CIPSO_V4_MAP_TRANS;
151 
152         ret_val = netlbl_cipsov4_add_common(info, doi_def);
153         if (ret_val != 0)
154                 goto add_std_failure;
155         ret_val = -EINVAL;
156 
157         nla_for_each_nested(nla_a,
158                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
159                             nla_a_rem)
160                 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
161                         if (nla_validate_nested_deprecated(nla_a,
162                                                            NLBL_CIPSOV4_A_MAX,
163                                                            netlbl_cipsov4_genl_policy,
164                                                            NULL) != 0)
165                                 goto add_std_failure;
166                         nla_for_each_nested(nla_b, nla_a, nla_b_rem)
167                                 switch (nla_type(nla_b)) {
168                                 case NLBL_CIPSOV4_A_MLSLVLLOC:
169                                         if (nla_get_u32(nla_b) >
170                                             CIPSO_V4_MAX_LOC_LVLS)
171                                                 goto add_std_failure;
172                                         if (nla_get_u32(nla_b) >=
173                                             doi_def->map.std->lvl.local_size)
174                                              doi_def->map.std->lvl.local_size =
175                                                      nla_get_u32(nla_b) + 1;
176                                         break;
177                                 case NLBL_CIPSOV4_A_MLSLVLREM:
178                                         if (nla_get_u32(nla_b) >
179                                             CIPSO_V4_MAX_REM_LVLS)
180                                                 goto add_std_failure;
181                                         if (nla_get_u32(nla_b) >=
182                                             doi_def->map.std->lvl.cipso_size)
183                                              doi_def->map.std->lvl.cipso_size =
184                                                      nla_get_u32(nla_b) + 1;
185                                         break;
186                                 }
187                 }
188         doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
189                                               sizeof(u32),
190                                               GFP_KERNEL);
191         if (doi_def->map.std->lvl.local == NULL) {
192                 ret_val = -ENOMEM;
193                 goto add_std_failure;
194         }
195         doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
196                                               sizeof(u32),
197                                               GFP_KERNEL);
198         if (doi_def->map.std->lvl.cipso == NULL) {
199                 ret_val = -ENOMEM;
200                 goto add_std_failure;
201         }
202         for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
203                 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
204         for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
205                 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
206         nla_for_each_nested(nla_a,
207                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
208                             nla_a_rem)
209                 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
210                         struct nlattr *lvl_loc;
211                         struct nlattr *lvl_rem;
212 
213                         lvl_loc = nla_find_nested(nla_a,
214                                                   NLBL_CIPSOV4_A_MLSLVLLOC);
215                         lvl_rem = nla_find_nested(nla_a,
216                                                   NLBL_CIPSOV4_A_MLSLVLREM);
217                         if (lvl_loc == NULL || lvl_rem == NULL)
218                                 goto add_std_failure;
219                         doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
220                                 nla_get_u32(lvl_rem);
221                         doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
222                                 nla_get_u32(lvl_loc);
223                 }
224 
225         if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
226                 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
227                                                    NLBL_CIPSOV4_A_MAX,
228                                                    netlbl_cipsov4_genl_policy,
229                                                    NULL) != 0)
230                         goto add_std_failure;
231 
232                 nla_for_each_nested(nla_a,
233                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
234                                     nla_a_rem)
235                         if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
236                                 if (nla_validate_nested_deprecated(nla_a,
237                                                                    NLBL_CIPSOV4_A_MAX,
238                                                                    netlbl_cipsov4_genl_policy,
239                                                                    NULL) != 0)
240                                         goto add_std_failure;
241                                 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
242                                         switch (nla_type(nla_b)) {
243                                         case NLBL_CIPSOV4_A_MLSCATLOC:
244                                                 if (nla_get_u32(nla_b) >
245                                                     CIPSO_V4_MAX_LOC_CATS)
246                                                         goto add_std_failure;
247                                                 if (nla_get_u32(nla_b) >=
248                                               doi_def->map.std->cat.local_size)
249                                              doi_def->map.std->cat.local_size =
250                                                      nla_get_u32(nla_b) + 1;
251                                                 break;
252                                         case NLBL_CIPSOV4_A_MLSCATREM:
253                                                 if (nla_get_u32(nla_b) >
254                                                     CIPSO_V4_MAX_REM_CATS)
255                                                         goto add_std_failure;
256                                                 if (nla_get_u32(nla_b) >=
257                                               doi_def->map.std->cat.cipso_size)
258                                              doi_def->map.std->cat.cipso_size =
259                                                      nla_get_u32(nla_b) + 1;
260                                                 break;
261                                         }
262                         }
263                 doi_def->map.std->cat.local = kcalloc(
264                                               doi_def->map.std->cat.local_size,
265                                               sizeof(u32),
266                                               GFP_KERNEL);
267                 if (doi_def->map.std->cat.local == NULL) {
268                         ret_val = -ENOMEM;
269                         goto add_std_failure;
270                 }
271                 doi_def->map.std->cat.cipso = kcalloc(
272                                               doi_def->map.std->cat.cipso_size,
273                                               sizeof(u32),
274                                               GFP_KERNEL);
275                 if (doi_def->map.std->cat.cipso == NULL) {
276                         ret_val = -ENOMEM;
277                         goto add_std_failure;
278                 }
279                 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
280                         doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
281                 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
282                         doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
283                 nla_for_each_nested(nla_a,
284                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
285                                     nla_a_rem)
286                         if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
287                                 struct nlattr *cat_loc;
288                                 struct nlattr *cat_rem;
289 
290                                 cat_loc = nla_find_nested(nla_a,
291                                                      NLBL_CIPSOV4_A_MLSCATLOC);
292                                 cat_rem = nla_find_nested(nla_a,
293                                                      NLBL_CIPSOV4_A_MLSCATREM);
294                                 if (cat_loc == NULL || cat_rem == NULL)
295                                         goto add_std_failure;
296                                 doi_def->map.std->cat.local[
297                                                         nla_get_u32(cat_loc)] =
298                                         nla_get_u32(cat_rem);
299                                 doi_def->map.std->cat.cipso[
300                                                         nla_get_u32(cat_rem)] =
301                                         nla_get_u32(cat_loc);
302                         }
303         }
304 
305         ret_val = cipso_v4_doi_add(doi_def, audit_info);
306         if (ret_val != 0)
307                 goto add_std_failure;
308         return 0;
309 
310 add_std_failure:
311         cipso_v4_doi_free(doi_def);
312         return ret_val;
313 }
314 
315 /**
316  * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
317  * @info: the Generic NETLINK info block
318  * @audit_info: NetLabel audit information
319  *
320  * Description:
321  * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
322  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
323  * error.
324  *
325  */
326 static int netlbl_cipsov4_add_pass(struct genl_info *info,
327                                    struct netlbl_audit *audit_info)
328 {
329         int ret_val;
330         struct cipso_v4_doi *doi_def = NULL;
331 
332         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
333                 return -EINVAL;
334 
335         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
336         if (doi_def == NULL)
337                 return -ENOMEM;
338         doi_def->type = CIPSO_V4_MAP_PASS;
339 
340         ret_val = netlbl_cipsov4_add_common(info, doi_def);
341         if (ret_val != 0)
342                 goto add_pass_failure;
343 
344         ret_val = cipso_v4_doi_add(doi_def, audit_info);
345         if (ret_val != 0)
346                 goto add_pass_failure;
347         return 0;
348 
349 add_pass_failure:
350         cipso_v4_doi_free(doi_def);
351         return ret_val;
352 }
353 
354 /**
355  * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
356  * @info: the Generic NETLINK info block
357  * @audit_info: NetLabel audit information
358  *
359  * Description:
360  * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
361  * message and add it to the CIPSO V4 engine.  Return zero on success and
362  * non-zero on error.
363  *
364  */
365 static int netlbl_cipsov4_add_local(struct genl_info *info,
366                                     struct netlbl_audit *audit_info)
367 {
368         int ret_val;
369         struct cipso_v4_doi *doi_def = NULL;
370 
371         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
372                 return -EINVAL;
373 
374         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
375         if (doi_def == NULL)
376                 return -ENOMEM;
377         doi_def->type = CIPSO_V4_MAP_LOCAL;
378 
379         ret_val = netlbl_cipsov4_add_common(info, doi_def);
380         if (ret_val != 0)
381                 goto add_local_failure;
382 
383         ret_val = cipso_v4_doi_add(doi_def, audit_info);
384         if (ret_val != 0)
385                 goto add_local_failure;
386         return 0;
387 
388 add_local_failure:
389         cipso_v4_doi_free(doi_def);
390         return ret_val;
391 }
392 
393 /**
394  * netlbl_cipsov4_add - Handle an ADD message
395  * @skb: the NETLINK buffer
396  * @info: the Generic NETLINK info block
397  *
398  * Description:
399  * Create a new DOI definition based on the given ADD message and add it to the
400  * CIPSO V4 engine.  Returns zero on success, negative values on failure.
401  *
402  */
403 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
404 
405 {
406         int ret_val = -EINVAL;
407         struct netlbl_audit audit_info;
408 
409         if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
410             !info->attrs[NLBL_CIPSOV4_A_MTYPE])
411                 return -EINVAL;
412 
413         netlbl_netlink_auditinfo(skb, &audit_info);
414         switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
415         case CIPSO_V4_MAP_TRANS:
416                 ret_val = netlbl_cipsov4_add_std(info, &audit_info);
417                 break;
418         case CIPSO_V4_MAP_PASS:
419                 ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
420                 break;
421         case CIPSO_V4_MAP_LOCAL:
422                 ret_val = netlbl_cipsov4_add_local(info, &audit_info);
423                 break;
424         }
425         if (ret_val == 0)
426                 atomic_inc(&netlabel_mgmt_protocount);
427 
428         return ret_val;
429 }
430 
431 /**
432  * netlbl_cipsov4_list - Handle a LIST message
433  * @skb: the NETLINK buffer
434  * @info: the Generic NETLINK info block
435  *
436  * Description:
437  * Process a user generated LIST message and respond accordingly.  While the
438  * response message generated by the kernel is straightforward, determining
439  * before hand the size of the buffer to allocate is not (we have to generate
440  * the message to know the size).  In order to keep this function sane what we
441  * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
442  * that size, if we fail then we restart with a larger buffer and try again.
443  * We continue in this manner until we hit a limit of failed attempts then we
444  * give up and just send an error message.  Returns zero on success and
445  * negative values on error.
446  *
447  */
448 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
449 {
450         int ret_val;
451         struct sk_buff *ans_skb = NULL;
452         u32 nlsze_mult = 1;
453         void *data;
454         u32 doi;
455         struct nlattr *nla_a;
456         struct nlattr *nla_b;
457         struct cipso_v4_doi *doi_def;
458         u32 iter;
459 
460         if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
461                 ret_val = -EINVAL;
462                 goto list_failure;
463         }
464 
465 list_start:
466         ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
467         if (ans_skb == NULL) {
468                 ret_val = -ENOMEM;
469                 goto list_failure;
470         }
471         data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
472                                  0, NLBL_CIPSOV4_C_LIST);
473         if (data == NULL) {
474                 ret_val = -ENOMEM;
475                 goto list_failure;
476         }
477 
478         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
479 
480         rcu_read_lock();
481         doi_def = cipso_v4_doi_getdef(doi);
482         if (doi_def == NULL) {
483                 ret_val = -EINVAL;
484                 goto list_failure_lock;
485         }
486 
487         ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
488         if (ret_val != 0)
489                 goto list_failure_lock;
490 
491         nla_a = nla_nest_start_noflag(ans_skb, NLBL_CIPSOV4_A_TAGLST);
492         if (nla_a == NULL) {
493                 ret_val = -ENOMEM;
494                 goto list_failure_lock;
495         }
496         for (iter = 0;
497              iter < CIPSO_V4_TAG_MAXCNT &&
498                doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
499              iter++) {
500                 ret_val = nla_put_u8(ans_skb,
501                                      NLBL_CIPSOV4_A_TAG,
502                                      doi_def->tags[iter]);
503                 if (ret_val != 0)
504                         goto list_failure_lock;
505         }
506         nla_nest_end(ans_skb, nla_a);
507 
508         switch (doi_def->type) {
509         case CIPSO_V4_MAP_TRANS:
510                 nla_a = nla_nest_start_noflag(ans_skb,
511                                               NLBL_CIPSOV4_A_MLSLVLLST);
512                 if (nla_a == NULL) {
513                         ret_val = -ENOMEM;
514                         goto list_failure_lock;
515                 }
516                 for (iter = 0;
517                      iter < doi_def->map.std->lvl.local_size;
518                      iter++) {
519                         if (doi_def->map.std->lvl.local[iter] ==
520                             CIPSO_V4_INV_LVL)
521                                 continue;
522 
523                         nla_b = nla_nest_start_noflag(ans_skb,
524                                                       NLBL_CIPSOV4_A_MLSLVL);
525                         if (nla_b == NULL) {
526                                 ret_val = -ENOMEM;
527                                 goto list_retry;
528                         }
529                         ret_val = nla_put_u32(ans_skb,
530                                               NLBL_CIPSOV4_A_MLSLVLLOC,
531                                               iter);
532                         if (ret_val != 0)
533                                 goto list_retry;
534                         ret_val = nla_put_u32(ans_skb,
535                                             NLBL_CIPSOV4_A_MLSLVLREM,
536                                             doi_def->map.std->lvl.local[iter]);
537                         if (ret_val != 0)
538                                 goto list_retry;
539                         nla_nest_end(ans_skb, nla_b);
540                 }
541                 nla_nest_end(ans_skb, nla_a);
542 
543                 nla_a = nla_nest_start_noflag(ans_skb,
544                                               NLBL_CIPSOV4_A_MLSCATLST);
545                 if (nla_a == NULL) {
546                         ret_val = -ENOMEM;
547                         goto list_retry;
548                 }
549                 for (iter = 0;
550                      iter < doi_def->map.std->cat.local_size;
551                      iter++) {
552                         if (doi_def->map.std->cat.local[iter] ==
553                             CIPSO_V4_INV_CAT)
554                                 continue;
555 
556                         nla_b = nla_nest_start_noflag(ans_skb,
557                                                       NLBL_CIPSOV4_A_MLSCAT);
558                         if (nla_b == NULL) {
559                                 ret_val = -ENOMEM;
560                                 goto list_retry;
561                         }
562                         ret_val = nla_put_u32(ans_skb,
563                                               NLBL_CIPSOV4_A_MLSCATLOC,
564                                               iter);
565                         if (ret_val != 0)
566                                 goto list_retry;
567                         ret_val = nla_put_u32(ans_skb,
568                                             NLBL_CIPSOV4_A_MLSCATREM,
569                                             doi_def->map.std->cat.local[iter]);
570                         if (ret_val != 0)
571                                 goto list_retry;
572                         nla_nest_end(ans_skb, nla_b);
573                 }
574                 nla_nest_end(ans_skb, nla_a);
575 
576                 break;
577         }
578         rcu_read_unlock();
579 
580         genlmsg_end(ans_skb, data);
581         return genlmsg_reply(ans_skb, info);
582 
583 list_retry:
584         /* XXX - this limit is a guesstimate */
585         if (nlsze_mult < 4) {
586                 rcu_read_unlock();
587                 kfree_skb(ans_skb);
588                 nlsze_mult *= 2;
589                 goto list_start;
590         }
591 list_failure_lock:
592         rcu_read_unlock();
593 list_failure:
594         kfree_skb(ans_skb);
595         return ret_val;
596 }
597 
598 /**
599  * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
600  * @doi_def: the CIPSOv4 DOI definition
601  * @arg: the netlbl_cipsov4_doiwalk_arg structure
602  *
603  * Description:
604  * This function is designed to be used as a callback to the
605  * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
606  * message.  Returns the size of the message on success, negative values on
607  * failure.
608  *
609  */
610 static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
611 {
612         int ret_val = -ENOMEM;
613         struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
614         void *data;
615 
616         data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
617                            cb_arg->seq, &netlbl_cipsov4_gnl_family,
618                            NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
619         if (data == NULL)
620                 goto listall_cb_failure;
621 
622         ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
623         if (ret_val != 0)
624                 goto listall_cb_failure;
625         ret_val = nla_put_u32(cb_arg->skb,
626                               NLBL_CIPSOV4_A_MTYPE,
627                               doi_def->type);
628         if (ret_val != 0)
629                 goto listall_cb_failure;
630 
631         genlmsg_end(cb_arg->skb, data);
632         return 0;
633 
634 listall_cb_failure:
635         genlmsg_cancel(cb_arg->skb, data);
636         return ret_val;
637 }
638 
639 /**
640  * netlbl_cipsov4_listall - Handle a LISTALL message
641  * @skb: the NETLINK buffer
642  * @cb: the NETLINK callback
643  *
644  * Description:
645  * Process a user generated LISTALL message and respond accordingly.  Returns
646  * zero on success and negative values on error.
647  *
648  */
649 static int netlbl_cipsov4_listall(struct sk_buff *skb,
650                                   struct netlink_callback *cb)
651 {
652         struct netlbl_cipsov4_doiwalk_arg cb_arg;
653         u32 doi_skip = cb->args[0];
654 
655         cb_arg.nl_cb = cb;
656         cb_arg.skb = skb;
657         cb_arg.seq = cb->nlh->nlmsg_seq;
658 
659         cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
660 
661         cb->args[0] = doi_skip;
662         return skb->len;
663 }
664 
665 /**
666  * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE
667  * @entry: LSM domain mapping entry
668  * @arg: the netlbl_domhsh_walk_arg structure
669  *
670  * Description:
671  * This function is intended for use by netlbl_cipsov4_remove() as the callback
672  * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
673  * which are associated with the CIPSO DOI specified in @arg.  Returns zero on
674  * success, negative values on failure.
675  *
676  */
677 static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
678 {
679         struct netlbl_domhsh_walk_arg *cb_arg = arg;
680 
681         if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
682             entry->def.cipso->doi == cb_arg->doi)
683                 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
684 
685         return 0;
686 }
687 
688 /**
689  * netlbl_cipsov4_remove - Handle a REMOVE message
690  * @skb: the NETLINK buffer
691  * @info: the Generic NETLINK info block
692  *
693  * Description:
694  * Process a user generated REMOVE message and respond accordingly.  Returns
695  * zero on success, negative values on failure.
696  *
697  */
698 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
699 {
700         int ret_val = -EINVAL;
701         struct netlbl_domhsh_walk_arg cb_arg;
702         struct netlbl_audit audit_info;
703         u32 skip_bkt = 0;
704         u32 skip_chain = 0;
705 
706         if (!info->attrs[NLBL_CIPSOV4_A_DOI])
707                 return -EINVAL;
708 
709         netlbl_netlink_auditinfo(skb, &audit_info);
710         cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
711         cb_arg.audit_info = &audit_info;
712         ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
713                                      netlbl_cipsov4_remove_cb, &cb_arg);
714         if (ret_val == 0 || ret_val == -ENOENT) {
715                 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info);
716                 if (ret_val == 0)
717                         atomic_dec(&netlabel_mgmt_protocount);
718         }
719 
720         return ret_val;
721 }
722 
723 /*
724  * NetLabel Generic NETLINK Command Definitions
725  */
726 
727 static const struct genl_ops netlbl_cipsov4_ops[] = {
728         {
729         .cmd = NLBL_CIPSOV4_C_ADD,
730         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
731         .flags = GENL_ADMIN_PERM,
732         .doit = netlbl_cipsov4_add,
733         .dumpit = NULL,
734         },
735         {
736         .cmd = NLBL_CIPSOV4_C_REMOVE,
737         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
738         .flags = GENL_ADMIN_PERM,
739         .doit = netlbl_cipsov4_remove,
740         .dumpit = NULL,
741         },
742         {
743         .cmd = NLBL_CIPSOV4_C_LIST,
744         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
745         .flags = 0,
746         .doit = netlbl_cipsov4_list,
747         .dumpit = NULL,
748         },
749         {
750         .cmd = NLBL_CIPSOV4_C_LISTALL,
751         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
752         .flags = 0,
753         .doit = NULL,
754         .dumpit = netlbl_cipsov4_listall,
755         },
756 };
757 
758 static struct genl_family netlbl_cipsov4_gnl_family __ro_after_init = {
759         .hdrsize = 0,
760         .name = NETLBL_NLTYPE_CIPSOV4_NAME,
761         .version = NETLBL_PROTO_VERSION,
762         .maxattr = NLBL_CIPSOV4_A_MAX,
763         .policy = netlbl_cipsov4_genl_policy,
764         .module = THIS_MODULE,
765         .ops = netlbl_cipsov4_ops,
766         .n_ops = ARRAY_SIZE(netlbl_cipsov4_ops),
767 };
768 
769 /*
770  * NetLabel Generic NETLINK Protocol Functions
771  */
772 
773 /**
774  * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
775  *
776  * Description:
777  * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
778  * mechanism.  Returns zero on success, negative values on failure.
779  *
780  */
781 int __init netlbl_cipsov4_genl_init(void)
782 {
783         return genl_register_family(&netlbl_cipsov4_gnl_family);
784 }
785 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp