netlabel_mgmt.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856
  1. /*
  2. * NetLabel Management Support
  3. *
  4. * This file defines the management functions for the NetLabel system. The
  5. * NetLabel system manages static and dynamic label mappings for network
  6. * protocols such as CIPSO and RIPSO.
  7. *
  8. * Author: Paul Moore <paul@paul-moore.com>
  9. *
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
  13. *
  14. * This program is free software; you can redistribute it and/or modify
  15. * it under the terms of the GNU General Public License as published by
  16. * the Free Software Foundation; either version 2 of the License, or
  17. * (at your option) any later version.
  18. *
  19. * This program is distributed in the hope that it will be useful,
  20. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
  22. * the GNU General Public License for more details.
  23. *
  24. * You should have received a copy of the GNU General Public License
  25. * along with this program; if not, see <http://www.gnu.org/licenses/>.
  26. *
  27. */
  28. #include <linux/types.h>
  29. #include <linux/socket.h>
  30. #include <linux/string.h>
  31. #include <linux/skbuff.h>
  32. #include <linux/in.h>
  33. #include <linux/in6.h>
  34. #include <linux/slab.h>
  35. #include <net/sock.h>
  36. #include <net/netlink.h>
  37. #include <net/genetlink.h>
  38. #include <net/ip.h>
  39. #include <net/ipv6.h>
  40. #include <net/netlabel.h>
  41. #include <net/cipso_ipv4.h>
  42. #include <net/calipso.h>
  43. #include <linux/atomic.h>
  44. #include "netlabel_calipso.h"
  45. #include "netlabel_domainhash.h"
  46. #include "netlabel_user.h"
  47. #include "netlabel_mgmt.h"
  48. /* NetLabel configured protocol counter */
  49. atomic_t netlabel_mgmt_protocount = ATOMIC_INIT(0);
  50. /* Argument struct for netlbl_domhsh_walk() */
  51. struct netlbl_domhsh_walk_arg {
  52. struct netlink_callback *nl_cb;
  53. struct sk_buff *skb;
  54. u32 seq;
  55. };
  56. /* NetLabel Generic NETLINK CIPSOv4 family */
  57. static struct genl_family netlbl_mgmt_gnl_family;
  58. /* NetLabel Netlink attribute policy */
  59. static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
  60. [NLBL_MGMT_A_DOMAIN] = { .type = NLA_NUL_STRING },
  61. [NLBL_MGMT_A_PROTOCOL] = { .type = NLA_U32 },
  62. [NLBL_MGMT_A_VERSION] = { .type = NLA_U32 },
  63. [NLBL_MGMT_A_CV4DOI] = { .type = NLA_U32 },
  64. [NLBL_MGMT_A_FAMILY] = { .type = NLA_U16 },
  65. [NLBL_MGMT_A_CLPDOI] = { .type = NLA_U32 },
  66. };
  67. /*
  68. * Helper Functions
  69. */
  70. /**
  71. * netlbl_mgmt_add - Handle an ADD message
  72. * @info: the Generic NETLINK info block
  73. * @audit_info: NetLabel audit information
  74. *
  75. * Description:
  76. * Helper function for the ADD and ADDDEF messages to add the domain mappings
  77. * from the message to the hash table. See netlabel.h for a description of the
  78. * message format. Returns zero on success, negative values on failure.
  79. *
  80. */
  81. static int netlbl_mgmt_add_common(struct genl_info *info,
  82. struct netlbl_audit *audit_info)
  83. {
  84. int ret_val = -EINVAL;
  85. struct netlbl_domaddr_map *addrmap = NULL;
  86. struct cipso_v4_doi *cipsov4 = NULL;
  87. #if IS_ENABLED(CONFIG_IPV6)
  88. struct calipso_doi *calipso = NULL;
  89. #endif
  90. u32 tmp_val;
  91. struct netlbl_dom_map *entry = kzalloc(sizeof(*entry), GFP_KERNEL);
  92. if (!entry)
  93. return -ENOMEM;
  94. entry->def.type = nla_get_u32(info->attrs[NLBL_MGMT_A_PROTOCOL]);
  95. if (info->attrs[NLBL_MGMT_A_DOMAIN]) {
  96. size_t tmp_size = nla_len(info->attrs[NLBL_MGMT_A_DOMAIN]);
  97. entry->domain = kmalloc(tmp_size, GFP_KERNEL);
  98. if (entry->domain == NULL) {
  99. ret_val = -ENOMEM;
  100. goto add_free_entry;
  101. }
  102. nla_strlcpy(entry->domain,
  103. info->attrs[NLBL_MGMT_A_DOMAIN], tmp_size);
  104. }
  105. /* NOTE: internally we allow/use a entry->def.type value of
  106. * NETLBL_NLTYPE_ADDRSELECT but we don't currently allow users
  107. * to pass that as a protocol value because we need to know the
  108. * "real" protocol */
  109. switch (entry->def.type) {
  110. case NETLBL_NLTYPE_UNLABELED:
  111. if (info->attrs[NLBL_MGMT_A_FAMILY])
  112. entry->family =
  113. nla_get_u16(info->attrs[NLBL_MGMT_A_FAMILY]);
  114. else
  115. entry->family = AF_UNSPEC;
  116. break;
  117. case NETLBL_NLTYPE_CIPSOV4:
  118. if (!info->attrs[NLBL_MGMT_A_CV4DOI])
  119. goto add_free_domain;
  120. tmp_val = nla_get_u32(info->attrs[NLBL_MGMT_A_CV4DOI]);
  121. cipsov4 = cipso_v4_doi_getdef(tmp_val);
  122. if (cipsov4 == NULL)
  123. goto add_free_domain;
  124. entry->family = AF_INET;
  125. entry->def.cipso = cipsov4;
  126. break;
  127. #if IS_ENABLED(CONFIG_IPV6)
  128. case NETLBL_NLTYPE_CALIPSO:
  129. if (!info->attrs[NLBL_MGMT_A_CLPDOI])
  130. goto add_free_domain;
  131. tmp_val = nla_get_u32(info->attrs[NLBL_MGMT_A_CLPDOI]);
  132. calipso = calipso_doi_getdef(tmp_val);
  133. if (calipso == NULL)
  134. goto add_free_domain;
  135. entry->family = AF_INET6;
  136. entry->def.calipso = calipso;
  137. break;
  138. #endif /* IPv6 */
  139. default:
  140. goto add_free_domain;
  141. }
  142. if ((entry->family == AF_INET && info->attrs[NLBL_MGMT_A_IPV6ADDR]) ||
  143. (entry->family == AF_INET6 && info->attrs[NLBL_MGMT_A_IPV4ADDR]))
  144. goto add_doi_put_def;
  145. if (info->attrs[NLBL_MGMT_A_IPV4ADDR]) {
  146. struct in_addr *addr;
  147. struct in_addr *mask;
  148. struct netlbl_domaddr4_map *map;
  149. addrmap = kzalloc(sizeof(*addrmap), GFP_KERNEL);
  150. if (addrmap == NULL) {
  151. ret_val = -ENOMEM;
  152. goto add_doi_put_def;
  153. }
  154. INIT_LIST_HEAD(&addrmap->list4);
  155. INIT_LIST_HEAD(&addrmap->list6);
  156. if (nla_len(info->attrs[NLBL_MGMT_A_IPV4ADDR]) !=
  157. sizeof(struct in_addr)) {
  158. ret_val = -EINVAL;
  159. goto add_free_addrmap;
  160. }
  161. if (nla_len(info->attrs[NLBL_MGMT_A_IPV4MASK]) !=
  162. sizeof(struct in_addr)) {
  163. ret_val = -EINVAL;
  164. goto add_free_addrmap;
  165. }
  166. addr = nla_data(info->attrs[NLBL_MGMT_A_IPV4ADDR]);
  167. mask = nla_data(info->attrs[NLBL_MGMT_A_IPV4MASK]);
  168. map = kzalloc(sizeof(*map), GFP_KERNEL);
  169. if (map == NULL) {
  170. ret_val = -ENOMEM;
  171. goto add_free_addrmap;
  172. }
  173. map->list.addr = addr->s_addr & mask->s_addr;
  174. map->list.mask = mask->s_addr;
  175. map->list.valid = 1;
  176. map->def.type = entry->def.type;
  177. if (cipsov4)
  178. map->def.cipso = cipsov4;
  179. ret_val = netlbl_af4list_add(&map->list, &addrmap->list4);
  180. if (ret_val != 0) {
  181. kfree(map);
  182. goto add_free_addrmap;
  183. }
  184. entry->family = AF_INET;
  185. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  186. entry->def.addrsel = addrmap;
  187. #if IS_ENABLED(CONFIG_IPV6)
  188. } else if (info->attrs[NLBL_MGMT_A_IPV6ADDR]) {
  189. struct in6_addr *addr;
  190. struct in6_addr *mask;
  191. struct netlbl_domaddr6_map *map;
  192. addrmap = kzalloc(sizeof(*addrmap), GFP_KERNEL);
  193. if (addrmap == NULL) {
  194. ret_val = -ENOMEM;
  195. goto add_doi_put_def;
  196. }
  197. INIT_LIST_HEAD(&addrmap->list4);
  198. INIT_LIST_HEAD(&addrmap->list6);
  199. if (nla_len(info->attrs[NLBL_MGMT_A_IPV6ADDR]) !=
  200. sizeof(struct in6_addr)) {
  201. ret_val = -EINVAL;
  202. goto add_free_addrmap;
  203. }
  204. if (nla_len(info->attrs[NLBL_MGMT_A_IPV6MASK]) !=
  205. sizeof(struct in6_addr)) {
  206. ret_val = -EINVAL;
  207. goto add_free_addrmap;
  208. }
  209. addr = nla_data(info->attrs[NLBL_MGMT_A_IPV6ADDR]);
  210. mask = nla_data(info->attrs[NLBL_MGMT_A_IPV6MASK]);
  211. map = kzalloc(sizeof(*map), GFP_KERNEL);
  212. if (map == NULL) {
  213. ret_val = -ENOMEM;
  214. goto add_free_addrmap;
  215. }
  216. map->list.addr = *addr;
  217. map->list.addr.s6_addr32[0] &= mask->s6_addr32[0];
  218. map->list.addr.s6_addr32[1] &= mask->s6_addr32[1];
  219. map->list.addr.s6_addr32[2] &= mask->s6_addr32[2];
  220. map->list.addr.s6_addr32[3] &= mask->s6_addr32[3];
  221. map->list.mask = *mask;
  222. map->list.valid = 1;
  223. map->def.type = entry->def.type;
  224. if (calipso)
  225. map->def.calipso = calipso;
  226. ret_val = netlbl_af6list_add(&map->list, &addrmap->list6);
  227. if (ret_val != 0) {
  228. kfree(map);
  229. goto add_free_addrmap;
  230. }
  231. entry->family = AF_INET6;
  232. entry->def.type = NETLBL_NLTYPE_ADDRSELECT;
  233. entry->def.addrsel = addrmap;
  234. #endif /* IPv6 */
  235. }
  236. ret_val = netlbl_domhsh_add(entry, audit_info);
  237. if (ret_val != 0)
  238. goto add_free_addrmap;
  239. return 0;
  240. add_free_addrmap:
  241. kfree(addrmap);
  242. add_doi_put_def:
  243. cipso_v4_doi_putdef(cipsov4);
  244. #if IS_ENABLED(CONFIG_IPV6)
  245. calipso_doi_putdef(calipso);
  246. #endif
  247. add_free_domain:
  248. kfree(entry->domain);
  249. add_free_entry:
  250. kfree(entry);
  251. return ret_val;
  252. }
  253. /**
  254. * netlbl_mgmt_listentry - List a NetLabel/LSM domain map entry
  255. * @skb: the NETLINK buffer
  256. * @entry: the map entry
  257. *
  258. * Description:
  259. * This function is a helper function used by the LISTALL and LISTDEF command
  260. * handlers. The caller is responsible for ensuring that the RCU read lock
  261. * is held. Returns zero on success, negative values on failure.
  262. *
  263. */
  264. static int netlbl_mgmt_listentry(struct sk_buff *skb,
  265. struct netlbl_dom_map *entry)
  266. {
  267. int ret_val = 0;
  268. struct nlattr *nla_a;
  269. struct nlattr *nla_b;
  270. struct netlbl_af4list *iter4;
  271. #if IS_ENABLED(CONFIG_IPV6)
  272. struct netlbl_af6list *iter6;
  273. #endif
  274. if (entry->domain != NULL) {
  275. ret_val = nla_put_string(skb,
  276. NLBL_MGMT_A_DOMAIN, entry->domain);
  277. if (ret_val != 0)
  278. return ret_val;
  279. }
  280. ret_val = nla_put_u16(skb, NLBL_MGMT_A_FAMILY, entry->family);
  281. if (ret_val != 0)
  282. return ret_val;
  283. switch (entry->def.type) {
  284. case NETLBL_NLTYPE_ADDRSELECT:
  285. nla_a = nla_nest_start(skb, NLBL_MGMT_A_SELECTORLIST);
  286. if (nla_a == NULL)
  287. return -ENOMEM;
  288. netlbl_af4list_foreach_rcu(iter4, &entry->def.addrsel->list4) {
  289. struct netlbl_domaddr4_map *map4;
  290. struct in_addr addr_struct;
  291. nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR);
  292. if (nla_b == NULL)
  293. return -ENOMEM;
  294. addr_struct.s_addr = iter4->addr;
  295. ret_val = nla_put_in_addr(skb, NLBL_MGMT_A_IPV4ADDR,
  296. addr_struct.s_addr);
  297. if (ret_val != 0)
  298. return ret_val;
  299. addr_struct.s_addr = iter4->mask;
  300. ret_val = nla_put_in_addr(skb, NLBL_MGMT_A_IPV4MASK,
  301. addr_struct.s_addr);
  302. if (ret_val != 0)
  303. return ret_val;
  304. map4 = netlbl_domhsh_addr4_entry(iter4);
  305. ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
  306. map4->def.type);
  307. if (ret_val != 0)
  308. return ret_val;
  309. switch (map4->def.type) {
  310. case NETLBL_NLTYPE_CIPSOV4:
  311. ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
  312. map4->def.cipso->doi);
  313. if (ret_val != 0)
  314. return ret_val;
  315. break;
  316. }
  317. nla_nest_end(skb, nla_b);
  318. }
  319. #if IS_ENABLED(CONFIG_IPV6)
  320. netlbl_af6list_foreach_rcu(iter6, &entry->def.addrsel->list6) {
  321. struct netlbl_domaddr6_map *map6;
  322. nla_b = nla_nest_start(skb, NLBL_MGMT_A_ADDRSELECTOR);
  323. if (nla_b == NULL)
  324. return -ENOMEM;
  325. ret_val = nla_put_in6_addr(skb, NLBL_MGMT_A_IPV6ADDR,
  326. &iter6->addr);
  327. if (ret_val != 0)
  328. return ret_val;
  329. ret_val = nla_put_in6_addr(skb, NLBL_MGMT_A_IPV6MASK,
  330. &iter6->mask);
  331. if (ret_val != 0)
  332. return ret_val;
  333. map6 = netlbl_domhsh_addr6_entry(iter6);
  334. ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
  335. map6->def.type);
  336. if (ret_val != 0)
  337. return ret_val;
  338. switch (map6->def.type) {
  339. case NETLBL_NLTYPE_CALIPSO:
  340. ret_val = nla_put_u32(skb, NLBL_MGMT_A_CLPDOI,
  341. map6->def.calipso->doi);
  342. if (ret_val != 0)
  343. return ret_val;
  344. break;
  345. }
  346. nla_nest_end(skb, nla_b);
  347. }
  348. #endif /* IPv6 */
  349. nla_nest_end(skb, nla_a);
  350. break;
  351. case NETLBL_NLTYPE_UNLABELED:
  352. ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
  353. entry->def.type);
  354. break;
  355. case NETLBL_NLTYPE_CIPSOV4:
  356. ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
  357. entry->def.type);
  358. if (ret_val != 0)
  359. return ret_val;
  360. ret_val = nla_put_u32(skb, NLBL_MGMT_A_CV4DOI,
  361. entry->def.cipso->doi);
  362. break;
  363. case NETLBL_NLTYPE_CALIPSO:
  364. ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL,
  365. entry->def.type);
  366. if (ret_val != 0)
  367. return ret_val;
  368. ret_val = nla_put_u32(skb, NLBL_MGMT_A_CLPDOI,
  369. entry->def.calipso->doi);
  370. break;
  371. }
  372. return ret_val;
  373. }
  374. /*
  375. * NetLabel Command Handlers
  376. */
  377. /**
  378. * netlbl_mgmt_add - Handle an ADD message
  379. * @skb: the NETLINK buffer
  380. * @info: the Generic NETLINK info block
  381. *
  382. * Description:
  383. * Process a user generated ADD message and add the domains from the message
  384. * to the hash table. See netlabel.h for a description of the message format.
  385. * Returns zero on success, negative values on failure.
  386. *
  387. */
  388. static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info)
  389. {
  390. struct netlbl_audit audit_info;
  391. if ((!info->attrs[NLBL_MGMT_A_DOMAIN]) ||
  392. (!info->attrs[NLBL_MGMT_A_PROTOCOL]) ||
  393. (info->attrs[NLBL_MGMT_A_IPV4ADDR] &&
  394. info->attrs[NLBL_MGMT_A_IPV6ADDR]) ||
  395. (info->attrs[NLBL_MGMT_A_IPV4MASK] &&
  396. info->attrs[NLBL_MGMT_A_IPV6MASK]) ||
  397. ((info->attrs[NLBL_MGMT_A_IPV4ADDR] != NULL) ^
  398. (info->attrs[NLBL_MGMT_A_IPV4MASK] != NULL)) ||
  399. ((info->attrs[NLBL_MGMT_A_IPV6ADDR] != NULL) ^
  400. (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL)))
  401. return -EINVAL;
  402. netlbl_netlink_auditinfo(skb, &audit_info);
  403. return netlbl_mgmt_add_common(info, &audit_info);
  404. }
  405. /**
  406. * netlbl_mgmt_remove - Handle a REMOVE message
  407. * @skb: the NETLINK buffer
  408. * @info: the Generic NETLINK info block
  409. *
  410. * Description:
  411. * Process a user generated REMOVE message and remove the specified domain
  412. * mappings. Returns zero on success, negative values on failure.
  413. *
  414. */
  415. static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info)
  416. {
  417. char *domain;
  418. struct netlbl_audit audit_info;
  419. if (!info->attrs[NLBL_MGMT_A_DOMAIN])
  420. return -EINVAL;
  421. netlbl_netlink_auditinfo(skb, &audit_info);
  422. domain = nla_data(info->attrs[NLBL_MGMT_A_DOMAIN]);
  423. return netlbl_domhsh_remove(domain, AF_UNSPEC, &audit_info);
  424. }
  425. /**
  426. * netlbl_mgmt_listall_cb - netlbl_domhsh_walk() callback for LISTALL
  427. * @entry: the domain mapping hash table entry
  428. * @arg: the netlbl_domhsh_walk_arg structure
  429. *
  430. * Description:
  431. * This function is designed to be used as a callback to the
  432. * netlbl_domhsh_walk() function for use in generating a response for a LISTALL
  433. * message. Returns the size of the message on success, negative values on
  434. * failure.
  435. *
  436. */
  437. static int netlbl_mgmt_listall_cb(struct netlbl_dom_map *entry, void *arg)
  438. {
  439. int ret_val = -ENOMEM;
  440. struct netlbl_domhsh_walk_arg *cb_arg = arg;
  441. void *data;
  442. data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
  443. cb_arg->seq, &netlbl_mgmt_gnl_family,
  444. NLM_F_MULTI, NLBL_MGMT_C_LISTALL);
  445. if (data == NULL)
  446. goto listall_cb_failure;
  447. ret_val = netlbl_mgmt_listentry(cb_arg->skb, entry);
  448. if (ret_val != 0)
  449. goto listall_cb_failure;
  450. cb_arg->seq++;
  451. genlmsg_end(cb_arg->skb, data);
  452. return 0;
  453. listall_cb_failure:
  454. genlmsg_cancel(cb_arg->skb, data);
  455. return ret_val;
  456. }
  457. /**
  458. * netlbl_mgmt_listall - Handle a LISTALL message
  459. * @skb: the NETLINK buffer
  460. * @cb: the NETLINK callback
  461. *
  462. * Description:
  463. * Process a user generated LISTALL message and dumps the domain hash table in
  464. * a form suitable for use in a kernel generated LISTALL message. Returns zero
  465. * on success, negative values on failure.
  466. *
  467. */
  468. static int netlbl_mgmt_listall(struct sk_buff *skb,
  469. struct netlink_callback *cb)
  470. {
  471. struct netlbl_domhsh_walk_arg cb_arg;
  472. u32 skip_bkt = cb->args[0];
  473. u32 skip_chain = cb->args[1];
  474. cb_arg.nl_cb = cb;
  475. cb_arg.skb = skb;
  476. cb_arg.seq = cb->nlh->nlmsg_seq;
  477. netlbl_domhsh_walk(&skip_bkt,
  478. &skip_chain,
  479. netlbl_mgmt_listall_cb,
  480. &cb_arg);
  481. cb->args[0] = skip_bkt;
  482. cb->args[1] = skip_chain;
  483. return skb->len;
  484. }
  485. /**
  486. * netlbl_mgmt_adddef - Handle an ADDDEF message
  487. * @skb: the NETLINK buffer
  488. * @info: the Generic NETLINK info block
  489. *
  490. * Description:
  491. * Process a user generated ADDDEF message and respond accordingly. Returns
  492. * zero on success, negative values on failure.
  493. *
  494. */
  495. static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info)
  496. {
  497. struct netlbl_audit audit_info;
  498. if ((!info->attrs[NLBL_MGMT_A_PROTOCOL]) ||
  499. (info->attrs[NLBL_MGMT_A_IPV4ADDR] &&
  500. info->attrs[NLBL_MGMT_A_IPV6ADDR]) ||
  501. (info->attrs[NLBL_MGMT_A_IPV4MASK] &&
  502. info->attrs[NLBL_MGMT_A_IPV6MASK]) ||
  503. ((info->attrs[NLBL_MGMT_A_IPV4ADDR] != NULL) ^
  504. (info->attrs[NLBL_MGMT_A_IPV4MASK] != NULL)) ||
  505. ((info->attrs[NLBL_MGMT_A_IPV6ADDR] != NULL) ^
  506. (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL)))
  507. return -EINVAL;
  508. netlbl_netlink_auditinfo(skb, &audit_info);
  509. return netlbl_mgmt_add_common(info, &audit_info);
  510. }
  511. /**
  512. * netlbl_mgmt_removedef - Handle a REMOVEDEF message
  513. * @skb: the NETLINK buffer
  514. * @info: the Generic NETLINK info block
  515. *
  516. * Description:
  517. * Process a user generated REMOVEDEF message and remove the default domain
  518. * mapping. Returns zero on success, negative values on failure.
  519. *
  520. */
  521. static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info)
  522. {
  523. struct netlbl_audit audit_info;
  524. netlbl_netlink_auditinfo(skb, &audit_info);
  525. return netlbl_domhsh_remove_default(AF_UNSPEC, &audit_info);
  526. }
  527. /**
  528. * netlbl_mgmt_listdef - Handle a LISTDEF message
  529. * @skb: the NETLINK buffer
  530. * @info: the Generic NETLINK info block
  531. *
  532. * Description:
  533. * Process a user generated LISTDEF message and dumps the default domain
  534. * mapping in a form suitable for use in a kernel generated LISTDEF message.
  535. * Returns zero on success, negative values on failure.
  536. *
  537. */
  538. static int netlbl_mgmt_listdef(struct sk_buff *skb, struct genl_info *info)
  539. {
  540. int ret_val = -ENOMEM;
  541. struct sk_buff *ans_skb = NULL;
  542. void *data;
  543. struct netlbl_dom_map *entry;
  544. u16 family;
  545. if (info->attrs[NLBL_MGMT_A_FAMILY])
  546. family = nla_get_u16(info->attrs[NLBL_MGMT_A_FAMILY]);
  547. else
  548. family = AF_INET;
  549. ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  550. if (ans_skb == NULL)
  551. return -ENOMEM;
  552. data = genlmsg_put_reply(ans_skb, info, &netlbl_mgmt_gnl_family,
  553. 0, NLBL_MGMT_C_LISTDEF);
  554. if (data == NULL)
  555. goto listdef_failure;
  556. rcu_read_lock();
  557. entry = netlbl_domhsh_getentry(NULL, family);
  558. if (entry == NULL) {
  559. ret_val = -ENOENT;
  560. goto listdef_failure_lock;
  561. }
  562. ret_val = netlbl_mgmt_listentry(ans_skb, entry);
  563. rcu_read_unlock();
  564. if (ret_val != 0)
  565. goto listdef_failure;
  566. genlmsg_end(ans_skb, data);
  567. return genlmsg_reply(ans_skb, info);
  568. listdef_failure_lock:
  569. rcu_read_unlock();
  570. listdef_failure:
  571. kfree_skb(ans_skb);
  572. return ret_val;
  573. }
  574. /**
  575. * netlbl_mgmt_protocols_cb - Write an individual PROTOCOL message response
  576. * @skb: the skb to write to
  577. * @cb: the NETLINK callback
  578. * @protocol: the NetLabel protocol to use in the message
  579. *
  580. * Description:
  581. * This function is to be used in conjunction with netlbl_mgmt_protocols() to
  582. * answer a application's PROTOCOLS message. Returns the size of the message
  583. * on success, negative values on failure.
  584. *
  585. */
  586. static int netlbl_mgmt_protocols_cb(struct sk_buff *skb,
  587. struct netlink_callback *cb,
  588. u32 protocol)
  589. {
  590. int ret_val = -ENOMEM;
  591. void *data;
  592. data = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, cb->nlh->nlmsg_seq,
  593. &netlbl_mgmt_gnl_family, NLM_F_MULTI,
  594. NLBL_MGMT_C_PROTOCOLS);
  595. if (data == NULL)
  596. goto protocols_cb_failure;
  597. ret_val = nla_put_u32(skb, NLBL_MGMT_A_PROTOCOL, protocol);
  598. if (ret_val != 0)
  599. goto protocols_cb_failure;
  600. genlmsg_end(skb, data);
  601. return 0;
  602. protocols_cb_failure:
  603. genlmsg_cancel(skb, data);
  604. return ret_val;
  605. }
  606. /**
  607. * netlbl_mgmt_protocols - Handle a PROTOCOLS message
  608. * @skb: the NETLINK buffer
  609. * @cb: the NETLINK callback
  610. *
  611. * Description:
  612. * Process a user generated PROTOCOLS message and respond accordingly.
  613. *
  614. */
  615. static int netlbl_mgmt_protocols(struct sk_buff *skb,
  616. struct netlink_callback *cb)
  617. {
  618. u32 protos_sent = cb->args[0];
  619. if (protos_sent == 0) {
  620. if (netlbl_mgmt_protocols_cb(skb,
  621. cb,
  622. NETLBL_NLTYPE_UNLABELED) < 0)
  623. goto protocols_return;
  624. protos_sent++;
  625. }
  626. if (protos_sent == 1) {
  627. if (netlbl_mgmt_protocols_cb(skb,
  628. cb,
  629. NETLBL_NLTYPE_CIPSOV4) < 0)
  630. goto protocols_return;
  631. protos_sent++;
  632. }
  633. #if IS_ENABLED(CONFIG_IPV6)
  634. if (protos_sent == 2) {
  635. if (netlbl_mgmt_protocols_cb(skb,
  636. cb,
  637. NETLBL_NLTYPE_CALIPSO) < 0)
  638. goto protocols_return;
  639. protos_sent++;
  640. }
  641. #endif
  642. protocols_return:
  643. cb->args[0] = protos_sent;
  644. return skb->len;
  645. }
  646. /**
  647. * netlbl_mgmt_version - Handle a VERSION message
  648. * @skb: the NETLINK buffer
  649. * @info: the Generic NETLINK info block
  650. *
  651. * Description:
  652. * Process a user generated VERSION message and respond accordingly. Returns
  653. * zero on success, negative values on failure.
  654. *
  655. */
  656. static int netlbl_mgmt_version(struct sk_buff *skb, struct genl_info *info)
  657. {
  658. int ret_val = -ENOMEM;
  659. struct sk_buff *ans_skb = NULL;
  660. void *data;
  661. ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  662. if (ans_skb == NULL)
  663. return -ENOMEM;
  664. data = genlmsg_put_reply(ans_skb, info, &netlbl_mgmt_gnl_family,
  665. 0, NLBL_MGMT_C_VERSION);
  666. if (data == NULL)
  667. goto version_failure;
  668. ret_val = nla_put_u32(ans_skb,
  669. NLBL_MGMT_A_VERSION,
  670. NETLBL_PROTO_VERSION);
  671. if (ret_val != 0)
  672. goto version_failure;
  673. genlmsg_end(ans_skb, data);
  674. return genlmsg_reply(ans_skb, info);
  675. version_failure:
  676. kfree_skb(ans_skb);
  677. return ret_val;
  678. }
  679. /*
  680. * NetLabel Generic NETLINK Command Definitions
  681. */
  682. static const struct genl_ops netlbl_mgmt_genl_ops[] = {
  683. {
  684. .cmd = NLBL_MGMT_C_ADD,
  685. .flags = GENL_ADMIN_PERM,
  686. .policy = netlbl_mgmt_genl_policy,
  687. .doit = netlbl_mgmt_add,
  688. .dumpit = NULL,
  689. },
  690. {
  691. .cmd = NLBL_MGMT_C_REMOVE,
  692. .flags = GENL_ADMIN_PERM,
  693. .policy = netlbl_mgmt_genl_policy,
  694. .doit = netlbl_mgmt_remove,
  695. .dumpit = NULL,
  696. },
  697. {
  698. .cmd = NLBL_MGMT_C_LISTALL,
  699. .flags = 0,
  700. .policy = netlbl_mgmt_genl_policy,
  701. .doit = NULL,
  702. .dumpit = netlbl_mgmt_listall,
  703. },
  704. {
  705. .cmd = NLBL_MGMT_C_ADDDEF,
  706. .flags = GENL_ADMIN_PERM,
  707. .policy = netlbl_mgmt_genl_policy,
  708. .doit = netlbl_mgmt_adddef,
  709. .dumpit = NULL,
  710. },
  711. {
  712. .cmd = NLBL_MGMT_C_REMOVEDEF,
  713. .flags = GENL_ADMIN_PERM,
  714. .policy = netlbl_mgmt_genl_policy,
  715. .doit = netlbl_mgmt_removedef,
  716. .dumpit = NULL,
  717. },
  718. {
  719. .cmd = NLBL_MGMT_C_LISTDEF,
  720. .flags = 0,
  721. .policy = netlbl_mgmt_genl_policy,
  722. .doit = netlbl_mgmt_listdef,
  723. .dumpit = NULL,
  724. },
  725. {
  726. .cmd = NLBL_MGMT_C_PROTOCOLS,
  727. .flags = 0,
  728. .policy = netlbl_mgmt_genl_policy,
  729. .doit = NULL,
  730. .dumpit = netlbl_mgmt_protocols,
  731. },
  732. {
  733. .cmd = NLBL_MGMT_C_VERSION,
  734. .flags = 0,
  735. .policy = netlbl_mgmt_genl_policy,
  736. .doit = netlbl_mgmt_version,
  737. .dumpit = NULL,
  738. },
  739. };
  740. static struct genl_family netlbl_mgmt_gnl_family __ro_after_init = {
  741. .hdrsize = 0,
  742. .name = NETLBL_NLTYPE_MGMT_NAME,
  743. .version = NETLBL_PROTO_VERSION,
  744. .maxattr = NLBL_MGMT_A_MAX,
  745. .module = THIS_MODULE,
  746. .ops = netlbl_mgmt_genl_ops,
  747. .n_ops = ARRAY_SIZE(netlbl_mgmt_genl_ops),
  748. };
  749. /*
  750. * NetLabel Generic NETLINK Protocol Functions
  751. */
  752. /**
  753. * netlbl_mgmt_genl_init - Register the NetLabel management component
  754. *
  755. * Description:
  756. * Register the NetLabel management component with the Generic NETLINK
  757. * mechanism. Returns zero on success, negative values on failure.
  758. *
  759. */
  760. int __init netlbl_mgmt_genl_init(void)
  761. {
  762. return genl_register_family(&netlbl_mgmt_gnl_family);
  763. }