Commit | Line | Data |
---|---|---|
d15c345f PM |
1 | /* |
2 | * NetLabel Management Support | |
3 | * | |
4 | * This file defines the management functions for the NetLabel system. The | |
5 | * NetLabel system manages static and dynamic label mappings for network | |
6 | * protocols such as CIPSO and RIPSO. | |
7 | * | |
82c21bfa | 8 | * Author: Paul Moore <paul@paul-moore.com> |
d15c345f PM |
9 | * |
10 | */ | |
11 | ||
12 | /* | |
63c41688 | 13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008 |
d15c345f PM |
14 | * |
15 | * This program is free software; you can redistribute it and/or modify | |
16 | * it under the terms of the GNU General Public License as published by | |
17 | * the Free Software Foundation; either version 2 of the License, or | |
18 | * (at your option) any later version. | |
19 | * | |
20 | * This program is distributed in the hope that it will be useful, | |
21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See | |
23 | * the GNU General Public License for more details. | |
24 | * | |
25 | * You should have received a copy of the GNU General Public License | |
26 | * along with this program; if not, write to the Free Software | |
27 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
28 | * | |
29 | */ | |
30 | ||
31 | #include <linux/types.h> | |
32 | #include <linux/socket.h> | |
33 | #include <linux/string.h> | |
34 | #include <linux/skbuff.h> | |
63c41688 PM |
35 | #include <linux/in.h> |
36 | #include <linux/in6.h> | |
5a0e3ad6 | 37 | #include <linux/slab.h> |
d15c345f PM |
38 | #include <net/sock.h> |
39 | #include <net/netlink.h> | |
40 | #include <net/genetlink.h> | |
63c41688 PM |
41 | #include <net/ip.h> |
42 | #include <net/ipv6.h> | |
d15c345f PM |
43 | #include <net/netlabel.h> |
44 | #include <net/cipso_ipv4.h> | |
60063497 | 45 | #include <linux/atomic.h> |
d15c345f PM |
46 | |
47 | #include "netlabel_domainhash.h" | |
48 | #include "netlabel_user.h" | |
49 | #include "netlabel_mgmt.h" | |
50 | ||
c783f1ce PM |
51 | /* NetLabel configured protocol counter */ |
52 | atomic_t netlabel_mgmt_protocount = ATOMIC_INIT(0); | |
23bcdc1a | 53 | |
fd385855 PM |
54 | /* Argument struct for netlbl_domhsh_walk() */ |
55 | struct netlbl_domhsh_walk_arg { | |
56 | struct netlink_callback *nl_cb; | |
57 | struct sk_buff *skb; | |
58 | u32 seq; | |
59 | }; | |
60 | ||
d15c345f PM |
61 | /* NetLabel Generic NETLINK CIPSOv4 family */ |
62 | static struct genl_family netlbl_mgmt_gnl_family = { | |
63 | .id = GENL_ID_GENERATE, | |
64 | .hdrsize = 0, | |
65 | .name = NETLBL_NLTYPE_MGMT_NAME, | |
66 | .version = NETLBL_PROTO_VERSION, | |
fd385855 | 67 | .maxattr = NLBL_MGMT_A_MAX, |
d15c345f PM |
68 | }; |
69 | ||
fd385855 | 70 | /* NetLabel Netlink attribute policy */ |
ef7c79ed | 71 | static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = { |
fd385855 PM |
72 | [NLBL_MGMT_A_DOMAIN] = { .type = NLA_NUL_STRING }, |
73 | [NLBL_MGMT_A_PROTOCOL] = { .type = NLA_U32 }, | |
74 | [NLBL_MGMT_A_VERSION] = { .type = NLA_U32 }, | |
75 | [NLBL_MGMT_A_CV4DOI] = { .type = NLA_U32 }, | |
76 | }; | |
d15c345f PM |
77 | |
78 | /* | |
63c41688 | 79 | * Helper Functions |
d15c345f PM |
80 | */ |
81 | ||
82 | /** | |
83 | * netlbl_mgmt_add - Handle an ADD message | |
d15c345f | 84 | * @info: the Generic NETLINK info block |
63c41688 | 85 | * @audit_info: NetLabel audit information |
d15c345f PM |
86 | * |
87 | * Description: | |
63c41688 PM |
88 | * Helper function for the ADD and ADDDEF messages to add the domain mappings |
89 | * from the message to the hash table. See netlabel.h for a description of the | |
90 | * message format. Returns zero on success, negative values on failure. | |
d15c345f PM |
91 | * |
92 | */ | |
63c41688 PM |
93 | static int netlbl_mgmt_add_common(struct genl_info *info, |
94 | struct netlbl_audit *audit_info) | |
d15c345f PM |
95 | { |
96 | int ret_val = -EINVAL; | |
d15c345f | 97 | struct netlbl_dom_map *entry = NULL; |
63c41688 PM |
98 | struct netlbl_domaddr_map *addrmap = NULL; |
99 | struct cipso_v4_doi *cipsov4 = NULL; | |
d15c345f | 100 | u32 tmp_val; |
95d4e6be | 101 | |
fd385855 PM |
102 | entry = kzalloc(sizeof(*entry), GFP_KERNEL); |
103 | if (entry == NULL) { | |
104 | ret_val = -ENOMEM; | |
105 | goto add_failure; | |
106 | } | |
fd385855 | 107 | entry->type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]); |
63c41688 PM |
108 | if (info->attrs[NLBL_MGMT_A_DOMAIN]) { |
109 | size_t tmp_size = nla_len(info->attrs[NLBL_MGMT_A_DOMAIN]); | |
110 | entry->domain = kmalloc(tmp_size, GFP_KERNEL); | |
111 | if (entry->domain == NULL) { | |
112 | ret_val = -ENOMEM; | |
113 | goto add_failure; | |
114 | } | |
115 | nla_strlcpy(entry->domain, | |
116 | info->attrs[NLBL_MGMT_A_DOMAIN], tmp_size); | |
117 | } | |
118 | ||
119 | /* NOTE: internally we allow/use a entry->type value of | |
120 | * NETLBL_NLTYPE_ADDRSELECT but we don't currently allow users | |
121 | * to pass that as a protocol value because we need to know the | |
122 | * "real" protocol */ | |
d15c345f | 123 | |
fd385855 PM |
124 | switch (entry->type) { |
125 | case NETLBL_NLTYPE_UNLABELED: | |
fd385855 PM |
126 | break; |
127 | case NETLBL_NLTYPE_CIPSOV4: | |
128 | if (!info->attrs[NLBL_MGMT_A_CV4DOI]) | |
d15c345f | 129 | goto add_failure; |
d15c345f | 130 | |
fd385855 | 131 | tmp_val = nla_get_u32(info->attrs[NLBL_MGMT_A_CV4DOI]); |
63c41688 PM |
132 | cipsov4 = cipso_v4_doi_getdef(tmp_val); |
133 | if (cipsov4 == NULL) | |
d15c345f | 134 | goto add_failure; |
63c41688 | 135 | entry->type_def.cipsov4 = cipsov4; |
fd385855 PM |
136 | break; |
137 | default: | |
138 | goto add_failure; | |
d15c345f | 139 | } |
63c41688 PM |
140 | |
141 | if (info->attrs[NLBL_MGMT_A_IPV4ADDR]) { | |
142 | struct in_addr *addr; | |
143 | struct in_addr *mask; | |
144 | struct netlbl_domaddr4_map *map; | |
145 | ||
146 | addrmap = kzalloc(sizeof(*addrmap), GFP_KERNEL); | |
147 | if (addrmap == NULL) { | |
148 | ret_val = -ENOMEM; | |
149 | goto add_failure; | |
150 | } | |
151 | INIT_LIST_HEAD(&addrmap->list4); | |
152 | INIT_LIST_HEAD(&addrmap->list6); | |
153 | ||
154 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV4ADDR]) != | |
155 | sizeof(struct in_addr)) { | |
156 | ret_val = -EINVAL; | |
157 | goto add_failure; | |
158 | } | |
159 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV4MASK]) != | |
160 | sizeof(struct in_addr)) { | |
161 | ret_val = -EINVAL; | |
162 | goto add_failure; | |
163 | } | |
164 | addr = nla_data(info->attrs[NLBL_MGMT_A_IPV4ADDR]); | |
165 | mask = nla_data(info->attrs[NLBL_MGMT_A_IPV4MASK]); | |
166 | ||
167 | map = kzalloc(sizeof(*map), GFP_KERNEL); | |
168 | if (map == NULL) { | |
169 | ret_val = -ENOMEM; | |
170 | goto add_failure; | |
171 | } | |
172 | map->list.addr = addr->s_addr & mask->s_addr; | |
173 | map->list.mask = mask->s_addr; | |
174 | map->list.valid = 1; | |
175 | map->type = entry->type; | |
176 | if (cipsov4) | |
177 | map->type_def.cipsov4 = cipsov4; | |
178 | ||
179 | ret_val = netlbl_af4list_add(&map->list, &addrmap->list4); | |
180 | if (ret_val != 0) { | |
181 | kfree(map); | |
182 | goto add_failure; | |
183 | } | |
184 | ||
185 | entry->type = NETLBL_NLTYPE_ADDRSELECT; | |
186 | entry->type_def.addrsel = addrmap; | |
dfd56b8b | 187 | #if IS_ENABLED(CONFIG_IPV6) |
63c41688 PM |
188 | } else if (info->attrs[NLBL_MGMT_A_IPV6ADDR]) { |
189 | struct in6_addr *addr; | |
190 | struct in6_addr *mask; | |
191 | struct netlbl_domaddr6_map *map; | |
192 | ||
193 | addrmap = kzalloc(sizeof(*addrmap), GFP_KERNEL); | |
194 | if (addrmap == NULL) { | |
195 | ret_val = -ENOMEM; | |
196 | goto add_failure; | |
197 | } | |
198 | INIT_LIST_HEAD(&addrmap->list4); | |
199 | INIT_LIST_HEAD(&addrmap->list6); | |
200 | ||
201 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV6ADDR]) != | |
202 | sizeof(struct in6_addr)) { | |
203 | ret_val = -EINVAL; | |
204 | goto add_failure; | |
205 | } | |
206 | if (nla_len(info->attrs[NLBL_MGMT_A_IPV6MASK]) != | |
207 | sizeof(struct in6_addr)) { | |
208 | ret_val = -EINVAL; | |
209 | goto add_failure; | |
210 | } | |
211 | addr = nla_data(info->attrs[NLBL_MGMT_A_IPV6ADDR]); | |
212 | mask = nla_data(info->attrs[NLBL_MGMT_A_IPV6MASK]); | |
213 | ||
214 | map = kzalloc(sizeof(*map), GFP_KERNEL); | |
215 | if (map == NULL) { | |
216 | ret_val = -ENOMEM; | |
217 | goto add_failure; | |
218 | } | |
4e3fd7a0 | 219 | map->list.addr = *addr; |
63c41688 PM |
220 | map->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; |
221 | map->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; | |
222 | map->list.addr.s6_addr32[2] &= mask->s6_addr32[2]; | |
223 | map->list.addr.s6_addr32[3] &= mask->s6_addr32[3]; | |
4e3fd7a0 | 224 | map->list.mask = *mask; |
63c41688 PM |
225 | map->list.valid = 1; |
226 | map->type = entry->type; | |
227 | ||
228 | ret_val = netlbl_af6list_add(&map->list, &addrmap->list6); | |
229 | if (ret_val != 0) { | |
230 | kfree(map); | |
231 | goto add_failure; | |
232 | } | |
233 | ||
234 | entry->type = NETLBL_NLTYPE_ADDRSELECT; | |
235 | entry->type_def.addrsel = addrmap; | |
236 | #endif /* IPv6 */ | |
237 | } | |
238 | ||
239 | ret_val = netlbl_domhsh_add(entry, audit_info); | |
fd385855 PM |
240 | if (ret_val != 0) |
241 | goto add_failure; | |
d15c345f | 242 | |
d15c345f PM |
243 | return 0; |
244 | ||
245 | add_failure: | |
63c41688 PM |
246 | if (cipsov4) |
247 | cipso_v4_doi_putdef(cipsov4); | |
d15c345f PM |
248 | if (entry) |
249 | kfree(entry->domain); | |
63c41688 | 250 | kfree(addrmap); |
d15c345f | 251 | kfree(entry); |
d15c345f PM |
252 | return ret_val; |
253 | } | |
254 | ||
63c41688 PM |
255 | /** |
256 | * netlbl_mgmt_listentry - List a NetLabel/LSM domain map entry | |
257 | * @skb: the NETLINK buffer | |
258 | * @entry: the map entry | |
259 | * | |
260 | * Description: | |
261 | * This function is a helper function used by the LISTALL and LISTDEF command | |
25985edc | 262 | * handlers. The caller is responsible for ensuring that the RCU read lock |
63c41688 PM |
263 | * is held. Returns zero on success, negative values on failure. |
264 | * | |
265 | */ | |
266 | static int netlbl_mgmt_listentry(struct sk_buff *skb, | |
267 | struct netlbl_dom_map *entry) | |
268 | { | |
f8a02479 | 269 | int ret_val = 0; |
63c41688 PM |
270 | struct nlattr *nla_a; |
271 | struct nlattr *nla_b; | |
272 | struct netlbl_af4list *iter4; | |
dfd56b8b | 273 | #if IS_ENABLED(CONFIG_IPV6) |
63c41688 PM |
274 | struct netlbl_af6list *iter6; |
275 | #endif | |
276 | ||
277 | if (entry->domain != NULL) { | |
278 | ret_val = nla_put_string(skb, | |
279 | NLBL_MGMT_A_DOMAIN, entry->domain); | |
280 | if (ret_val != 0) | |
281 | return ret_val; | |
282 | } | |
283 | ||
284 | switch (entry->type) { | |
285 | case NETLBL_NLTYPE_ADDRSELECT: | |
286 | nla_a = nla_nest_start(skb, NLBL_MGMT_A_SELECTORLIST); | |
287 | if (nla_a == NULL) | |
288 | return -ENOMEM; | |
289 | ||
290 | netlbl_af4list_foreach_rcu(iter4, | |
291 | &entry->type_def.addrsel->list4) { | |
292 | struct netlbl_domaddr4_map *map4; | |
293 | struct in_addr addr_struct; | |
294 | ||
295 | nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR); | |
296 | if (nla_b == NULL) | |
297 | return -ENOMEM; | |
298 | ||
299 | addr_struct.s_addr = iter4->addr; | |
300 | ret_val = nla_put(skb, NLBL_MGMT_A_IPV4ADDR, | |
301 | sizeof(struct in_addr), | |
302 | &addr_struct); | |
303 | if (ret_val != 0) | |
304 | return ret_val; | |
305 | addr_struct.s_addr = iter4->mask; | |
306 | ret_val = nla_put(skb, NLBL_MGMT_A_IPV4MASK, | |
307 | sizeof(struct in_addr), | |
308 | &addr_struct); | |
309 | if (ret_val != 0) | |
310 | return ret_val; | |
311 | map4 = netlbl_domhsh_addr4_entry(iter4); | |
312 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, | |
313 | map4->type); | |
314 | if (ret_val != 0) | |
315 | return ret_val; | |
316 | switch (map4->type) { | |
317 | case NETLBL_NLTYPE_CIPSOV4: | |
318 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI, | |
319 | map4->type_def.cipsov4->doi); | |
320 | if (ret_val != 0) | |
321 | return ret_val; | |
322 | break; | |
323 | } | |
324 | ||
325 | nla_nest_end(skb, nla_b); | |
326 | } | |
dfd56b8b | 327 | #if IS_ENABLED(CONFIG_IPV6) |
63c41688 PM |
328 | netlbl_af6list_foreach_rcu(iter6, |
329 | &entry->type_def.addrsel->list6) { | |
330 | struct netlbl_domaddr6_map *map6; | |
331 | ||
332 | nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR); | |
333 | if (nla_b == NULL) | |
334 | return -ENOMEM; | |
335 | ||
336 | ret_val = nla_put(skb, NLBL_MGMT_A_IPV6ADDR, | |
337 | sizeof(struct in6_addr), | |
338 | &iter6->addr); | |
339 | if (ret_val != 0) | |
340 | return ret_val; | |
341 | ret_val = nla_put(skb, NLBL_MGMT_A_IPV6MASK, | |
342 | sizeof(struct in6_addr), | |
343 | &iter6->mask); | |
344 | if (ret_val != 0) | |
345 | return ret_val; | |
346 | map6 = netlbl_domhsh_addr6_entry(iter6); | |
347 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, | |
348 | map6->type); | |
349 | if (ret_val != 0) | |
350 | return ret_val; | |
351 | ||
352 | nla_nest_end(skb, nla_b); | |
353 | } | |
354 | #endif /* IPv6 */ | |
355 | ||
356 | nla_nest_end(skb, nla_a); | |
357 | break; | |
358 | case NETLBL_NLTYPE_UNLABELED: | |
359 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type); | |
360 | break; | |
361 | case NETLBL_NLTYPE_CIPSOV4: | |
362 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, entry->type); | |
363 | if (ret_val != 0) | |
364 | return ret_val; | |
365 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI, | |
366 | entry->type_def.cipsov4->doi); | |
367 | break; | |
368 | } | |
369 | ||
370 | return ret_val; | |
371 | } | |
372 | ||
373 | /* | |
374 | * NetLabel Command Handlers | |
375 | */ | |
376 | ||
377 | /** | |
378 | * netlbl_mgmt_add - Handle an ADD message | |
379 | * @skb: the NETLINK buffer | |
380 | * @info: the Generic NETLINK info block | |
381 | * | |
382 | * Description: | |
383 | * Process a user generated ADD message and add the domains from the message | |
384 | * to the hash table. See netlabel.h for a description of the message format. | |
385 | * Returns zero on success, negative values on failure. | |
386 | * | |
387 | */ | |
388 | static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info) | |
389 | { | |
390 | struct netlbl_audit audit_info; | |
391 | ||
392 | if ((!info->attrs[NLBL_MGMT_A_DOMAIN]) || | |
393 | (!info->attrs[NLBL_MGMT_A_PROTOCOL]) || | |
394 | (info->attrs[NLBL_MGMT_A_IPV4ADDR] && | |
395 | info->attrs[NLBL_MGMT_A_IPV6ADDR]) || | |
396 | (info->attrs[NLBL_MGMT_A_IPV4MASK] && | |
397 | info->attrs[NLBL_MGMT_A_IPV6MASK]) || | |
398 | ((info->attrs[NLBL_MGMT_A_IPV4ADDR] != NULL) ^ | |
399 | (info->attrs[NLBL_MGMT_A_IPV4MASK] != NULL)) || | |
400 | ((info->attrs[NLBL_MGMT_A_IPV6ADDR] != NULL) ^ | |
401 | (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL))) | |
402 | return -EINVAL; | |
403 | ||
404 | netlbl_netlink_auditinfo(skb, &audit_info); | |
405 | ||
406 | return netlbl_mgmt_add_common(info, &audit_info); | |
407 | } | |
408 | ||
d15c345f PM |
409 | /** |
410 | * netlbl_mgmt_remove - Handle a REMOVE message | |
411 | * @skb: the NETLINK buffer | |
412 | * @info: the Generic NETLINK info block | |
413 | * | |
414 | * Description: | |
415 | * Process a user generated REMOVE message and remove the specified domain | |
416 | * mappings. Returns zero on success, negative values on failure. | |
417 | * | |
418 | */ | |
419 | static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info) | |
420 | { | |
fd385855 | 421 | char *domain; |
95d4e6be | 422 | struct netlbl_audit audit_info; |
d15c345f | 423 | |
fd385855 PM |
424 | if (!info->attrs[NLBL_MGMT_A_DOMAIN]) |
425 | return -EINVAL; | |
d15c345f | 426 | |
95d4e6be PM |
427 | netlbl_netlink_auditinfo(skb, &audit_info); |
428 | ||
fd385855 | 429 | domain = nla_data(info->attrs[NLBL_MGMT_A_DOMAIN]); |
95d4e6be | 430 | return netlbl_domhsh_remove(domain, &audit_info); |
fd385855 PM |
431 | } |
432 | ||
433 | /** | |
434 | * netlbl_mgmt_listall_cb - netlbl_domhsh_walk() callback for LISTALL | |
435 | * @entry: the domain mapping hash table entry | |
436 | * @arg: the netlbl_domhsh_walk_arg structure | |
437 | * | |
438 | * Description: | |
439 | * This function is designed to be used as a callback to the | |
440 | * netlbl_domhsh_walk() function for use in generating a response for a LISTALL | |
441 | * message. Returns the size of the message on success, negative values on | |
442 | * failure. | |
443 | * | |
444 | */ | |
445 | static int netlbl_mgmt_listall_cb(struct netlbl_dom_map *entry, void *arg) | |
446 | { | |
447 | int ret_val = -ENOMEM; | |
448 | struct netlbl_domhsh_walk_arg *cb_arg = arg; | |
449 | void *data; | |
450 | ||
15e47304 | 451 | data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, |
17c157c8 TG |
452 | cb_arg->seq, &netlbl_mgmt_gnl_family, |
453 | NLM_F_MULTI, NLBL_MGMT_C_LISTALL); | |
fd385855 PM |
454 | if (data == NULL) |
455 | goto listall_cb_failure; | |
456 | ||
63c41688 | 457 | ret_val = netlbl_mgmt_listentry(cb_arg->skb, entry); |
fd385855 PM |
458 | if (ret_val != 0) |
459 | goto listall_cb_failure; | |
d15c345f | 460 | |
fd385855 PM |
461 | cb_arg->seq++; |
462 | return genlmsg_end(cb_arg->skb, data); | |
d15c345f | 463 | |
fd385855 PM |
464 | listall_cb_failure: |
465 | genlmsg_cancel(cb_arg->skb, data); | |
d15c345f PM |
466 | return ret_val; |
467 | } | |
468 | ||
469 | /** | |
fd385855 | 470 | * netlbl_mgmt_listall - Handle a LISTALL message |
d15c345f | 471 | * @skb: the NETLINK buffer |
fd385855 | 472 | * @cb: the NETLINK callback |
d15c345f PM |
473 | * |
474 | * Description: | |
fd385855 PM |
475 | * Process a user generated LISTALL message and dumps the domain hash table in |
476 | * a form suitable for use in a kernel generated LISTALL message. Returns zero | |
477 | * on success, negative values on failure. | |
d15c345f PM |
478 | * |
479 | */ | |
fd385855 PM |
480 | static int netlbl_mgmt_listall(struct sk_buff *skb, |
481 | struct netlink_callback *cb) | |
d15c345f | 482 | { |
fd385855 PM |
483 | struct netlbl_domhsh_walk_arg cb_arg; |
484 | u32 skip_bkt = cb->args[0]; | |
485 | u32 skip_chain = cb->args[1]; | |
486 | ||
487 | cb_arg.nl_cb = cb; | |
488 | cb_arg.skb = skb; | |
489 | cb_arg.seq = cb->nlh->nlmsg_seq; | |
490 | ||
491 | netlbl_domhsh_walk(&skip_bkt, | |
492 | &skip_chain, | |
493 | netlbl_mgmt_listall_cb, | |
494 | &cb_arg); | |
495 | ||
496 | cb->args[0] = skip_bkt; | |
497 | cb->args[1] = skip_chain; | |
498 | return skb->len; | |
d15c345f PM |
499 | } |
500 | ||
501 | /** | |
502 | * netlbl_mgmt_adddef - Handle an ADDDEF message | |
503 | * @skb: the NETLINK buffer | |
504 | * @info: the Generic NETLINK info block | |
505 | * | |
506 | * Description: | |
507 | * Process a user generated ADDDEF message and respond accordingly. Returns | |
508 | * zero on success, negative values on failure. | |
509 | * | |
510 | */ | |
511 | static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info) | |
512 | { | |
95d4e6be | 513 | struct netlbl_audit audit_info; |
d15c345f | 514 | |
63c41688 PM |
515 | if ((!info->attrs[NLBL_MGMT_A_PROTOCOL]) || |
516 | (info->attrs[NLBL_MGMT_A_IPV4ADDR] && | |
517 | info->attrs[NLBL_MGMT_A_IPV6ADDR]) || | |
518 | (info->attrs[NLBL_MGMT_A_IPV4MASK] && | |
519 | info->attrs[NLBL_MGMT_A_IPV6MASK]) || | |
520 | ((info->attrs[NLBL_MGMT_A_IPV4ADDR] != NULL) ^ | |
521 | (info->attrs[NLBL_MGMT_A_IPV4MASK] != NULL)) || | |
522 | ((info->attrs[NLBL_MGMT_A_IPV6ADDR] != NULL) ^ | |
523 | (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL))) | |
524 | return -EINVAL; | |
d15c345f | 525 | |
95d4e6be PM |
526 | netlbl_netlink_auditinfo(skb, &audit_info); |
527 | ||
63c41688 | 528 | return netlbl_mgmt_add_common(info, &audit_info); |
d15c345f PM |
529 | } |
530 | ||
531 | /** | |
532 | * netlbl_mgmt_removedef - Handle a REMOVEDEF message | |
533 | * @skb: the NETLINK buffer | |
534 | * @info: the Generic NETLINK info block | |
535 | * | |
536 | * Description: | |
537 | * Process a user generated REMOVEDEF message and remove the default domain | |
538 | * mapping. Returns zero on success, negative values on failure. | |
539 | * | |
540 | */ | |
541 | static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info) | |
542 | { | |
95d4e6be PM |
543 | struct netlbl_audit audit_info; |
544 | ||
545 | netlbl_netlink_auditinfo(skb, &audit_info); | |
546 | ||
547 | return netlbl_domhsh_remove_default(&audit_info); | |
d15c345f PM |
548 | } |
549 | ||
550 | /** | |
551 | * netlbl_mgmt_listdef - Handle a LISTDEF message | |
552 | * @skb: the NETLINK buffer | |
553 | * @info: the Generic NETLINK info block | |
554 | * | |
555 | * Description: | |
556 | * Process a user generated LISTDEF message and dumps the default domain | |
557 | * mapping in a form suitable for use in a kernel generated LISTDEF message. | |
558 | * Returns zero on success, negative values on failure. | |
559 | * | |
560 | */ | |
561 | static int netlbl_mgmt_listdef(struct sk_buff *skb, struct genl_info *info) | |
562 | { | |
563 | int ret_val = -ENOMEM; | |
fd385855 PM |
564 | struct sk_buff *ans_skb = NULL; |
565 | void *data; | |
566 | struct netlbl_dom_map *entry; | |
d15c345f | 567 | |
339bf98f | 568 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
d15c345f | 569 | if (ans_skb == NULL) |
fd385855 | 570 | return -ENOMEM; |
17c157c8 TG |
571 | data = genlmsg_put_reply(ans_skb, info, &netlbl_mgmt_gnl_family, |
572 | 0, NLBL_MGMT_C_LISTDEF); | |
fd385855 | 573 | if (data == NULL) |
d15c345f | 574 | goto listdef_failure; |
d15c345f | 575 | |
fd385855 PM |
576 | rcu_read_lock(); |
577 | entry = netlbl_domhsh_getentry(NULL); | |
578 | if (entry == NULL) { | |
579 | ret_val = -ENOENT; | |
580 | goto listdef_failure_lock; | |
581 | } | |
63c41688 | 582 | ret_val = netlbl_mgmt_listentry(ans_skb, entry); |
fd385855 | 583 | rcu_read_unlock(); |
63c41688 PM |
584 | if (ret_val != 0) |
585 | goto listdef_failure; | |
d15c345f | 586 | |
fd385855 | 587 | genlmsg_end(ans_skb, data); |
fe785bee | 588 | return genlmsg_reply(ans_skb, info); |
d15c345f | 589 | |
fd385855 PM |
590 | listdef_failure_lock: |
591 | rcu_read_unlock(); | |
d15c345f | 592 | listdef_failure: |
fd385855 | 593 | kfree_skb(ans_skb); |
d15c345f PM |
594 | return ret_val; |
595 | } | |
596 | ||
597 | /** | |
fd385855 PM |
598 | * netlbl_mgmt_protocols_cb - Write an individual PROTOCOL message response |
599 | * @skb: the skb to write to | |
fd385855 PM |
600 | * @cb: the NETLINK callback |
601 | * @protocol: the NetLabel protocol to use in the message | |
d15c345f PM |
602 | * |
603 | * Description: | |
fd385855 PM |
604 | * This function is to be used in conjunction with netlbl_mgmt_protocols() to |
605 | * answer a application's PROTOCOLS message. Returns the size of the message | |
606 | * on success, negative values on failure. | |
d15c345f PM |
607 | * |
608 | */ | |
fd385855 PM |
609 | static int netlbl_mgmt_protocols_cb(struct sk_buff *skb, |
610 | struct netlink_callback *cb, | |
611 | u32 protocol) | |
d15c345f PM |
612 | { |
613 | int ret_val = -ENOMEM; | |
fd385855 PM |
614 | void *data; |
615 | ||
15e47304 | 616 | data = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq, |
17c157c8 TG |
617 | &netlbl_mgmt_gnl_family, NLM_F_MULTI, |
618 | NLBL_MGMT_C_PROTOCOLS); | |
fd385855 PM |
619 | if (data == NULL) |
620 | goto protocols_cb_failure; | |
621 | ||
622 | ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, protocol); | |
d15c345f | 623 | if (ret_val != 0) |
fd385855 | 624 | goto protocols_cb_failure; |
d15c345f | 625 | |
fd385855 | 626 | return genlmsg_end(skb, data); |
d15c345f | 627 | |
fd385855 PM |
628 | protocols_cb_failure: |
629 | genlmsg_cancel(skb, data); | |
d15c345f PM |
630 | return ret_val; |
631 | } | |
632 | ||
fd385855 PM |
633 | /** |
634 | * netlbl_mgmt_protocols - Handle a PROTOCOLS message | |
635 | * @skb: the NETLINK buffer | |
636 | * @cb: the NETLINK callback | |
637 | * | |
638 | * Description: | |
639 | * Process a user generated PROTOCOLS message and respond accordingly. | |
640 | * | |
641 | */ | |
642 | static int netlbl_mgmt_protocols(struct sk_buff *skb, | |
643 | struct netlink_callback *cb) | |
644 | { | |
645 | u32 protos_sent = cb->args[0]; | |
646 | ||
647 | if (protos_sent == 0) { | |
648 | if (netlbl_mgmt_protocols_cb(skb, | |
649 | cb, | |
650 | NETLBL_NLTYPE_UNLABELED) < 0) | |
651 | goto protocols_return; | |
652 | protos_sent++; | |
653 | } | |
654 | if (protos_sent == 1) { | |
655 | if (netlbl_mgmt_protocols_cb(skb, | |
656 | cb, | |
657 | NETLBL_NLTYPE_CIPSOV4) < 0) | |
658 | goto protocols_return; | |
659 | protos_sent++; | |
660 | } | |
661 | ||
662 | protocols_return: | |
663 | cb->args[0] = protos_sent; | |
664 | return skb->len; | |
665 | } | |
666 | ||
d15c345f PM |
667 | /** |
668 | * netlbl_mgmt_version - Handle a VERSION message | |
669 | * @skb: the NETLINK buffer | |
670 | * @info: the Generic NETLINK info block | |
671 | * | |
672 | * Description: | |
673 | * Process a user generated VERSION message and respond accordingly. Returns | |
674 | * zero on success, negative values on failure. | |
675 | * | |
676 | */ | |
677 | static int netlbl_mgmt_version(struct sk_buff *skb, struct genl_info *info) | |
678 | { | |
679 | int ret_val = -ENOMEM; | |
680 | struct sk_buff *ans_skb = NULL; | |
fd385855 | 681 | void *data; |
d15c345f | 682 | |
339bf98f | 683 | ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); |
d15c345f | 684 | if (ans_skb == NULL) |
fd385855 | 685 | return -ENOMEM; |
17c157c8 TG |
686 | data = genlmsg_put_reply(ans_skb, info, &netlbl_mgmt_gnl_family, |
687 | 0, NLBL_MGMT_C_VERSION); | |
fd385855 | 688 | if (data == NULL) |
d15c345f PM |
689 | goto version_failure; |
690 | ||
fd385855 PM |
691 | ret_val = nla_put_u32(ans_skb, |
692 | NLBL_MGMT_A_VERSION, | |
693 | NETLBL_PROTO_VERSION); | |
d15c345f PM |
694 | if (ret_val != 0) |
695 | goto version_failure; | |
696 | ||
fd385855 | 697 | genlmsg_end(ans_skb, data); |
fe785bee | 698 | return genlmsg_reply(ans_skb, info); |
d15c345f PM |
699 | |
700 | version_failure: | |
701 | kfree_skb(ans_skb); | |
d15c345f PM |
702 | return ret_val; |
703 | } | |
704 | ||
705 | ||
706 | /* | |
707 | * NetLabel Generic NETLINK Command Definitions | |
708 | */ | |
709 | ||
227c43c3 PE |
710 | static struct genl_ops netlbl_mgmt_genl_ops[] = { |
711 | { | |
d15c345f | 712 | .cmd = NLBL_MGMT_C_ADD, |
fd385855 PM |
713 | .flags = GENL_ADMIN_PERM, |
714 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
715 | .doit = netlbl_mgmt_add, |
716 | .dumpit = NULL, | |
227c43c3 PE |
717 | }, |
718 | { | |
d15c345f | 719 | .cmd = NLBL_MGMT_C_REMOVE, |
fd385855 PM |
720 | .flags = GENL_ADMIN_PERM, |
721 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
722 | .doit = netlbl_mgmt_remove, |
723 | .dumpit = NULL, | |
227c43c3 PE |
724 | }, |
725 | { | |
fd385855 | 726 | .cmd = NLBL_MGMT_C_LISTALL, |
d15c345f | 727 | .flags = 0, |
fd385855 PM |
728 | .policy = netlbl_mgmt_genl_policy, |
729 | .doit = NULL, | |
730 | .dumpit = netlbl_mgmt_listall, | |
227c43c3 PE |
731 | }, |
732 | { | |
d15c345f | 733 | .cmd = NLBL_MGMT_C_ADDDEF, |
fd385855 PM |
734 | .flags = GENL_ADMIN_PERM, |
735 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
736 | .doit = netlbl_mgmt_adddef, |
737 | .dumpit = NULL, | |
227c43c3 PE |
738 | }, |
739 | { | |
d15c345f | 740 | .cmd = NLBL_MGMT_C_REMOVEDEF, |
fd385855 PM |
741 | .flags = GENL_ADMIN_PERM, |
742 | .policy = netlbl_mgmt_genl_policy, | |
d15c345f PM |
743 | .doit = netlbl_mgmt_removedef, |
744 | .dumpit = NULL, | |
227c43c3 PE |
745 | }, |
746 | { | |
d15c345f PM |
747 | .cmd = NLBL_MGMT_C_LISTDEF, |
748 | .flags = 0, | |
fd385855 | 749 | .policy = netlbl_mgmt_genl_policy, |
d15c345f PM |
750 | .doit = netlbl_mgmt_listdef, |
751 | .dumpit = NULL, | |
227c43c3 PE |
752 | }, |
753 | { | |
fd385855 | 754 | .cmd = NLBL_MGMT_C_PROTOCOLS, |
d15c345f | 755 | .flags = 0, |
fd385855 PM |
756 | .policy = netlbl_mgmt_genl_policy, |
757 | .doit = NULL, | |
758 | .dumpit = netlbl_mgmt_protocols, | |
227c43c3 PE |
759 | }, |
760 | { | |
d15c345f PM |
761 | .cmd = NLBL_MGMT_C_VERSION, |
762 | .flags = 0, | |
fd385855 | 763 | .policy = netlbl_mgmt_genl_policy, |
d15c345f PM |
764 | .doit = netlbl_mgmt_version, |
765 | .dumpit = NULL, | |
227c43c3 | 766 | }, |
d15c345f PM |
767 | }; |
768 | ||
769 | /* | |
770 | * NetLabel Generic NETLINK Protocol Functions | |
771 | */ | |
772 | ||
773 | /** | |
774 | * netlbl_mgmt_genl_init - Register the NetLabel management component | |
775 | * | |
776 | * Description: | |
777 | * Register the NetLabel management component with the Generic NETLINK | |
778 | * mechanism. Returns zero on success, negative values on failure. | |
779 | * | |
780 | */ | |
05705e4e | 781 | int __init netlbl_mgmt_genl_init(void) |
d15c345f | 782 | { |
7ae740df MM |
783 | return genl_register_family_with_ops(&netlbl_mgmt_gnl_family, |
784 | netlbl_mgmt_genl_ops, ARRAY_SIZE(netlbl_mgmt_genl_ops)); | |
d15c345f | 785 | } |