1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31#include <linux/init.h>
32#include <linux/types.h>
33#include <linux/audit.h>
34#include <linux/in.h>
35#include <linux/in6.h>
36#include <net/ip.h>
37#include <net/ipv6.h>
38#include <net/netlabel.h>
39#include <net/cipso_ipv4.h>
40#include <asm/bug.h>
41#include <asm/atomic.h>
42
43#include "netlabel_domainhash.h"
44#include "netlabel_unlabeled.h"
45#include "netlabel_cipso_v4.h"
46#include "netlabel_user.h"
47#include "netlabel_mgmt.h"
48#include "netlabel_addrlist.h"
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68int netlbl_cfg_map_del(const char *domain,
69 u16 family,
70 const void *addr,
71 const void *mask,
72 struct netlbl_audit *audit_info)
73{
74 if (addr == NULL && mask == NULL) {
75 return netlbl_domhsh_remove(domain, audit_info);
76 } else if (addr != NULL && mask != NULL) {
77 switch (family) {
78 case AF_INET:
79 return netlbl_domhsh_remove_af4(domain, addr, mask,
80 audit_info);
81 default:
82 return -EPFNOSUPPORT;
83 }
84 } else
85 return -EINVAL;
86}
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102int netlbl_cfg_unlbl_map_add(const char *domain,
103 u16 family,
104 const void *addr,
105 const void *mask,
106 struct netlbl_audit *audit_info)
107{
108 int ret_val = -ENOMEM;
109 struct netlbl_dom_map *entry;
110 struct netlbl_domaddr_map *addrmap = NULL;
111 struct netlbl_domaddr4_map *map4 = NULL;
112 struct netlbl_domaddr6_map *map6 = NULL;
113 const struct in_addr *addr4, *mask4;
114 const struct in6_addr *addr6, *mask6;
115
116 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
117 if (entry == NULL)
118 return -ENOMEM;
119 if (domain != NULL) {
120 entry->domain = kstrdup(domain, GFP_ATOMIC);
121 if (entry->domain == NULL)
122 goto cfg_unlbl_map_add_failure;
123 }
124
125 if (addr == NULL && mask == NULL)
126 entry->type = NETLBL_NLTYPE_UNLABELED;
127 else if (addr != NULL && mask != NULL) {
128 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
129 if (addrmap == NULL)
130 goto cfg_unlbl_map_add_failure;
131 INIT_LIST_HEAD(&addrmap->list4);
132 INIT_LIST_HEAD(&addrmap->list6);
133
134 switch (family) {
135 case AF_INET:
136 addr4 = addr;
137 mask4 = mask;
138 map4 = kzalloc(sizeof(*map4), GFP_ATOMIC);
139 if (map4 == NULL)
140 goto cfg_unlbl_map_add_failure;
141 map4->type = NETLBL_NLTYPE_UNLABELED;
142 map4->list.addr = addr4->s_addr & mask4->s_addr;
143 map4->list.mask = mask4->s_addr;
144 map4->list.valid = 1;
145 ret_val = netlbl_af4list_add(&map4->list,
146 &addrmap->list4);
147 if (ret_val != 0)
148 goto cfg_unlbl_map_add_failure;
149 break;
150 case AF_INET6:
151 addr6 = addr;
152 mask6 = mask;
153 map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
154 if (map6 == NULL)
155 goto cfg_unlbl_map_add_failure;
156 map6->type = NETLBL_NLTYPE_UNLABELED;
157 ipv6_addr_copy(&map6->list.addr, addr6);
158 map6->list.addr.s6_addr32[0] &= mask6->s6_addr32[0];
159 map6->list.addr.s6_addr32[1] &= mask6->s6_addr32[1];
160 map6->list.addr.s6_addr32[2] &= mask6->s6_addr32[2];
161 map6->list.addr.s6_addr32[3] &= mask6->s6_addr32[3];
162 ipv6_addr_copy(&map6->list.mask, mask6);
163 map6->list.valid = 1;
164 ret_val = netlbl_af4list_add(&map4->list,
165 &addrmap->list4);
166 if (ret_val != 0)
167 goto cfg_unlbl_map_add_failure;
168 break;
169 default:
170 goto cfg_unlbl_map_add_failure;
171 break;
172 }
173
174 entry->type_def.addrsel = addrmap;
175 entry->type = NETLBL_NLTYPE_ADDRSELECT;
176 } else {
177 ret_val = -EINVAL;
178 goto cfg_unlbl_map_add_failure;
179 }
180
181 ret_val = netlbl_domhsh_add(entry, audit_info);
182 if (ret_val != 0)
183 goto cfg_unlbl_map_add_failure;
184
185 return 0;
186
187cfg_unlbl_map_add_failure:
188 kfree(entry->domain);
189 kfree(entry);
190 kfree(addrmap);
191 kfree(map4);
192 kfree(map6);
193 return ret_val;
194}
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213int netlbl_cfg_unlbl_static_add(struct net *net,
214 const char *dev_name,
215 const void *addr,
216 const void *mask,
217 u16 family,
218 u32 secid,
219 struct netlbl_audit *audit_info)
220{
221 u32 addr_len;
222
223 switch (family) {
224 case AF_INET:
225 addr_len = sizeof(struct in_addr);
226 break;
227 case AF_INET6:
228 addr_len = sizeof(struct in6_addr);
229 break;
230 default:
231 return -EPFNOSUPPORT;
232 }
233
234 return netlbl_unlhsh_add(net,
235 dev_name, addr, mask, addr_len,
236 secid, audit_info);
237}
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255int netlbl_cfg_unlbl_static_del(struct net *net,
256 const char *dev_name,
257 const void *addr,
258 const void *mask,
259 u16 family,
260 struct netlbl_audit *audit_info)
261{
262 u32 addr_len;
263
264 switch (family) {
265 case AF_INET:
266 addr_len = sizeof(struct in_addr);
267 break;
268 case AF_INET6:
269 addr_len = sizeof(struct in6_addr);
270 break;
271 default:
272 return -EPFNOSUPPORT;
273 }
274
275 return netlbl_unlhsh_remove(net,
276 dev_name, addr, mask, addr_len,
277 audit_info);
278}
279
280
281
282
283
284
285
286
287
288
289
290int netlbl_cfg_cipsov4_add(struct cipso_v4_doi *doi_def,
291 struct netlbl_audit *audit_info)
292{
293 return cipso_v4_doi_add(doi_def, audit_info);
294}
295
296
297
298
299
300
301
302
303
304
305
306void netlbl_cfg_cipsov4_del(u32 doi, struct netlbl_audit *audit_info)
307{
308 cipso_v4_doi_remove(doi, audit_info);
309}
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325int netlbl_cfg_cipsov4_map_add(u32 doi,
326 const char *domain,
327 const struct in_addr *addr,
328 const struct in_addr *mask,
329 struct netlbl_audit *audit_info)
330{
331 int ret_val = -ENOMEM;
332 struct cipso_v4_doi *doi_def;
333 struct netlbl_dom_map *entry;
334 struct netlbl_domaddr_map *addrmap = NULL;
335 struct netlbl_domaddr4_map *addrinfo = NULL;
336
337 doi_def = cipso_v4_doi_getdef(doi);
338 if (doi_def == NULL)
339 return -ENOENT;
340
341 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
342 if (entry == NULL)
343 return -ENOMEM;
344 if (domain != NULL) {
345 entry->domain = kstrdup(domain, GFP_ATOMIC);
346 if (entry->domain == NULL)
347 goto cfg_cipsov4_map_add_failure;
348 }
349
350 if (addr == NULL && mask == NULL) {
351 entry->type_def.cipsov4 = doi_def;
352 entry->type = NETLBL_NLTYPE_CIPSOV4;
353 } else if (addr != NULL && mask != NULL) {
354 addrmap = kzalloc(sizeof(*addrmap), GFP_ATOMIC);
355 if (addrmap == NULL)
356 goto cfg_cipsov4_map_add_failure;
357 INIT_LIST_HEAD(&addrmap->list4);
358 INIT_LIST_HEAD(&addrmap->list6);
359
360 addrinfo = kzalloc(sizeof(*addrinfo), GFP_ATOMIC);
361 if (addrinfo == NULL)
362 goto cfg_cipsov4_map_add_failure;
363 addrinfo->type_def.cipsov4 = doi_def;
364 addrinfo->type = NETLBL_NLTYPE_CIPSOV4;
365 addrinfo->list.addr = addr->s_addr & mask->s_addr;
366 addrinfo->list.mask = mask->s_addr;
367 addrinfo->list.valid = 1;
368 ret_val = netlbl_af4list_add(&addrinfo->list, &addrmap->list4);
369 if (ret_val != 0)
370 goto cfg_cipsov4_map_add_failure;
371
372 entry->type_def.addrsel = addrmap;
373 entry->type = NETLBL_NLTYPE_ADDRSELECT;
374 } else {
375 ret_val = -EINVAL;
376 goto cfg_cipsov4_map_add_failure;
377 }
378
379 ret_val = netlbl_domhsh_add(entry, audit_info);
380 if (ret_val != 0)
381 goto cfg_cipsov4_map_add_failure;
382
383 return 0;
384
385cfg_cipsov4_map_add_failure:
386 cipso_v4_doi_putdef(doi_def);
387 kfree(entry->domain);
388 kfree(entry);
389 kfree(addrmap);
390 kfree(addrinfo);
391 return ret_val;
392}
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
409 u32 offset)
410{
411 struct netlbl_lsm_secattr_catmap *iter = catmap;
412 u32 node_idx;
413 u32 node_bit;
414 NETLBL_CATMAP_MAPTYPE bitmap;
415
416 if (offset > iter->startbit) {
417 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
418 iter = iter->next;
419 if (iter == NULL)
420 return -ENOENT;
421 }
422 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
423 node_bit = offset - iter->startbit -
424 (NETLBL_CATMAP_MAPSIZE * node_idx);
425 } else {
426 node_idx = 0;
427 node_bit = 0;
428 }
429 bitmap = iter->bitmap[node_idx] >> node_bit;
430
431 for (;;) {
432 if (bitmap != 0) {
433 while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
434 bitmap >>= 1;
435 node_bit++;
436 }
437 return iter->startbit +
438 (NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit;
439 }
440 if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
441 if (iter->next != NULL) {
442 iter = iter->next;
443 node_idx = 0;
444 } else
445 return -ENOENT;
446 }
447 bitmap = iter->bitmap[node_idx];
448 node_bit = 0;
449 }
450
451 return -ENOENT;
452}
453
454
455
456
457
458
459
460
461
462
463
464
465int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
466 u32 offset)
467{
468 struct netlbl_lsm_secattr_catmap *iter = catmap;
469 u32 node_idx;
470 u32 node_bit;
471 NETLBL_CATMAP_MAPTYPE bitmask;
472 NETLBL_CATMAP_MAPTYPE bitmap;
473
474 if (offset > iter->startbit) {
475 while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
476 iter = iter->next;
477 if (iter == NULL)
478 return -ENOENT;
479 }
480 node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
481 node_bit = offset - iter->startbit -
482 (NETLBL_CATMAP_MAPSIZE * node_idx);
483 } else {
484 node_idx = 0;
485 node_bit = 0;
486 }
487 bitmask = NETLBL_CATMAP_BIT << node_bit;
488
489 for (;;) {
490 bitmap = iter->bitmap[node_idx];
491 while (bitmask != 0 && (bitmap & bitmask) != 0) {
492 bitmask <<= 1;
493 node_bit++;
494 }
495
496 if (bitmask != 0)
497 return iter->startbit +
498 (NETLBL_CATMAP_MAPSIZE * node_idx) +
499 node_bit - 1;
500 else if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
501 if (iter->next == NULL)
502 return iter->startbit + NETLBL_CATMAP_SIZE - 1;
503 iter = iter->next;
504 node_idx = 0;
505 }
506 bitmask = NETLBL_CATMAP_BIT;
507 node_bit = 0;
508 }
509
510 return -ENOENT;
511}
512
513
514
515
516
517
518
519
520
521
522
523
524int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
525 u32 bit,
526 gfp_t flags)
527{
528 struct netlbl_lsm_secattr_catmap *iter = catmap;
529 u32 node_bit;
530 u32 node_idx;
531
532 while (iter->next != NULL &&
533 bit >= (iter->startbit + NETLBL_CATMAP_SIZE))
534 iter = iter->next;
535 if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
536 iter->next = netlbl_secattr_catmap_alloc(flags);
537 if (iter->next == NULL)
538 return -ENOMEM;
539 iter = iter->next;
540 iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1);
541 }
542
543
544 node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
545 node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx);
546 iter->bitmap[node_idx] |= NETLBL_CATMAP_BIT << node_bit;
547
548 return 0;
549}
550
551
552
553
554
555
556
557
558
559
560
561
562
563int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
564 u32 start,
565 u32 end,
566 gfp_t flags)
567{
568 int ret_val = 0;
569 struct netlbl_lsm_secattr_catmap *iter = catmap;
570 u32 iter_max_spot;
571 u32 spot;
572
573
574
575
576
577
578
579 while (iter->next != NULL &&
580 start >= (iter->startbit + NETLBL_CATMAP_SIZE))
581 iter = iter->next;
582 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
583
584 for (spot = start; spot <= end && ret_val == 0; spot++) {
585 if (spot >= iter_max_spot && iter->next != NULL) {
586 iter = iter->next;
587 iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
588 }
589 ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC);
590 }
591
592 return ret_val;
593}
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611int netlbl_enabled(void)
612{
613
614
615
616 return (atomic_read(&netlabel_mgmt_protocount) > 0);
617}
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634int netlbl_sock_setattr(struct sock *sk,
635 u16 family,
636 const struct netlbl_lsm_secattr *secattr)
637{
638 int ret_val;
639 struct netlbl_dom_map *dom_entry;
640
641 rcu_read_lock();
642 dom_entry = netlbl_domhsh_getentry(secattr->domain);
643 if (dom_entry == NULL) {
644 ret_val = -ENOENT;
645 goto socket_setattr_return;
646 }
647 switch (family) {
648 case AF_INET:
649 switch (dom_entry->type) {
650 case NETLBL_NLTYPE_ADDRSELECT:
651 ret_val = -EDESTADDRREQ;
652 break;
653 case NETLBL_NLTYPE_CIPSOV4:
654 ret_val = cipso_v4_sock_setattr(sk,
655 dom_entry->type_def.cipsov4,
656 secattr);
657 break;
658 case NETLBL_NLTYPE_UNLABELED:
659 ret_val = 0;
660 break;
661 default:
662 ret_val = -ENOENT;
663 }
664 break;
665#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
666 case AF_INET6:
667
668
669 ret_val = 0;
670 break;
671#endif
672 default:
673 ret_val = -EPROTONOSUPPORT;
674 }
675
676socket_setattr_return:
677 rcu_read_unlock();
678 return ret_val;
679}
680
681
682
683
684
685
686
687
688
689
690void netlbl_sock_delattr(struct sock *sk)
691{
692 cipso_v4_sock_delattr(sk);
693}
694
695
696
697
698
699
700
701
702
703
704
705
706
707int netlbl_sock_getattr(struct sock *sk,
708 struct netlbl_lsm_secattr *secattr)
709{
710 int ret_val;
711
712 switch (sk->sk_family) {
713 case AF_INET:
714 ret_val = cipso_v4_sock_getattr(sk, secattr);
715 break;
716#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
717 case AF_INET6:
718 ret_val = -ENOMSG;
719 break;
720#endif
721 default:
722 ret_val = -EPROTONOSUPPORT;
723 }
724
725 return ret_val;
726}
727
728
729
730
731
732
733
734
735
736
737
738
739
740int netlbl_conn_setattr(struct sock *sk,
741 struct sockaddr *addr,
742 const struct netlbl_lsm_secattr *secattr)
743{
744 int ret_val;
745 struct sockaddr_in *addr4;
746 struct netlbl_domaddr4_map *af4_entry;
747
748 rcu_read_lock();
749 switch (addr->sa_family) {
750 case AF_INET:
751 addr4 = (struct sockaddr_in *)addr;
752 af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
753 addr4->sin_addr.s_addr);
754 if (af4_entry == NULL) {
755 ret_val = -ENOENT;
756 goto conn_setattr_return;
757 }
758 switch (af4_entry->type) {
759 case NETLBL_NLTYPE_CIPSOV4:
760 ret_val = cipso_v4_sock_setattr(sk,
761 af4_entry->type_def.cipsov4,
762 secattr);
763 break;
764 case NETLBL_NLTYPE_UNLABELED:
765
766
767 cipso_v4_sock_delattr(sk);
768 ret_val = 0;
769 break;
770 default:
771 ret_val = -ENOENT;
772 }
773 break;
774#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
775 case AF_INET6:
776
777
778 ret_val = 0;
779 break;
780#endif
781 default:
782 ret_val = -EPROTONOSUPPORT;
783 }
784
785conn_setattr_return:
786 rcu_read_unlock();
787 return ret_val;
788}
789
790
791
792
793
794
795
796
797
798
799
800int netlbl_req_setattr(struct request_sock *req,
801 const struct netlbl_lsm_secattr *secattr)
802{
803 int ret_val;
804 struct netlbl_dom_map *dom_entry;
805 struct netlbl_domaddr4_map *af4_entry;
806 u32 proto_type;
807 struct cipso_v4_doi *proto_cv4;
808
809 rcu_read_lock();
810 dom_entry = netlbl_domhsh_getentry(secattr->domain);
811 if (dom_entry == NULL) {
812 ret_val = -ENOENT;
813 goto req_setattr_return;
814 }
815 switch (req->rsk_ops->family) {
816 case AF_INET:
817 if (dom_entry->type == NETLBL_NLTYPE_ADDRSELECT) {
818 struct inet_request_sock *req_inet = inet_rsk(req);
819 af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
820 req_inet->rmt_addr);
821 if (af4_entry == NULL) {
822 ret_val = -ENOENT;
823 goto req_setattr_return;
824 }
825 proto_type = af4_entry->type;
826 proto_cv4 = af4_entry->type_def.cipsov4;
827 } else {
828 proto_type = dom_entry->type;
829 proto_cv4 = dom_entry->type_def.cipsov4;
830 }
831 switch (proto_type) {
832 case NETLBL_NLTYPE_CIPSOV4:
833 ret_val = cipso_v4_req_setattr(req, proto_cv4, secattr);
834 break;
835 case NETLBL_NLTYPE_UNLABELED:
836
837
838 cipso_v4_req_delattr(req);
839 ret_val = 0;
840 break;
841 default:
842 ret_val = -ENOENT;
843 }
844 break;
845#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
846 case AF_INET6:
847
848
849 ret_val = 0;
850 break;
851#endif
852 default:
853 ret_val = -EPROTONOSUPPORT;
854 }
855
856req_setattr_return:
857 rcu_read_unlock();
858 return ret_val;
859}
860
861
862
863
864
865
866
867
868
869void netlbl_req_delattr(struct request_sock *req)
870{
871 cipso_v4_req_delattr(req);
872}
873
874
875
876
877
878
879
880
881
882
883
884
885int netlbl_skbuff_setattr(struct sk_buff *skb,
886 u16 family,
887 const struct netlbl_lsm_secattr *secattr)
888{
889 int ret_val;
890 struct iphdr *hdr4;
891 struct netlbl_domaddr4_map *af4_entry;
892
893 rcu_read_lock();
894 switch (family) {
895 case AF_INET:
896 hdr4 = ip_hdr(skb);
897 af4_entry = netlbl_domhsh_getentry_af4(secattr->domain,
898 hdr4->daddr);
899 if (af4_entry == NULL) {
900 ret_val = -ENOENT;
901 goto skbuff_setattr_return;
902 }
903 switch (af4_entry->type) {
904 case NETLBL_NLTYPE_CIPSOV4:
905 ret_val = cipso_v4_skbuff_setattr(skb,
906 af4_entry->type_def.cipsov4,
907 secattr);
908 break;
909 case NETLBL_NLTYPE_UNLABELED:
910
911
912 ret_val = cipso_v4_skbuff_delattr(skb);
913 break;
914 default:
915 ret_val = -ENOENT;
916 }
917 break;
918#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
919 case AF_INET6:
920
921
922 ret_val = 0;
923 break;
924#endif
925 default:
926 ret_val = -EPROTONOSUPPORT;
927 }
928
929skbuff_setattr_return:
930 rcu_read_unlock();
931 return ret_val;
932}
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947int netlbl_skbuff_getattr(const struct sk_buff *skb,
948 u16 family,
949 struct netlbl_lsm_secattr *secattr)
950{
951 switch (family) {
952 case AF_INET:
953 if (CIPSO_V4_OPTEXIST(skb) &&
954 cipso_v4_skbuff_getattr(skb, secattr) == 0)
955 return 0;
956 break;
957#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
958 case AF_INET6:
959 break;
960#endif
961 }
962
963 return netlbl_unlabel_getattr(skb, family, secattr);
964}
965
966
967
968
969
970
971
972
973
974
975
976
977
978void netlbl_skbuff_err(struct sk_buff *skb, int error, int gateway)
979{
980 if (CIPSO_V4_OPTEXIST(skb))
981 cipso_v4_error(skb, error, gateway);
982}
983
984
985
986
987
988
989
990
991
992
993void netlbl_cache_invalidate(void)
994{
995 cipso_v4_cache_invalidate();
996}
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009int netlbl_cache_add(const struct sk_buff *skb,
1010 const struct netlbl_lsm_secattr *secattr)
1011{
1012 if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
1013 return -ENOMSG;
1014
1015 if (CIPSO_V4_OPTEXIST(skb))
1016 return cipso_v4_cache_add(skb, secattr);
1017
1018 return -ENOMSG;
1019}
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037struct audit_buffer *netlbl_audit_start(int type,
1038 struct netlbl_audit *audit_info)
1039{
1040 return netlbl_audit_start_common(type, audit_info);
1041}
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054static int __init netlbl_init(void)
1055{
1056 int ret_val;
1057
1058 printk(KERN_INFO "NetLabel: Initializing\n");
1059 printk(KERN_INFO "NetLabel: domain hash size = %u\n",
1060 (1 << NETLBL_DOMHSH_BITSIZE));
1061 printk(KERN_INFO "NetLabel: protocols ="
1062 " UNLABELED"
1063 " CIPSOv4"
1064 "\n");
1065
1066 ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
1067 if (ret_val != 0)
1068 goto init_failure;
1069
1070 ret_val = netlbl_unlabel_init(NETLBL_UNLHSH_BITSIZE);
1071 if (ret_val != 0)
1072 goto init_failure;
1073
1074 ret_val = netlbl_netlink_init();
1075 if (ret_val != 0)
1076 goto init_failure;
1077
1078 ret_val = netlbl_unlabel_defconf();
1079 if (ret_val != 0)
1080 goto init_failure;
1081 printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n");
1082
1083 return 0;
1084
1085init_failure:
1086 panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
1087}
1088
1089subsys_initcall(netlbl_init);
1090