1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17#include <linux/types.h>
18#include <linux/socket.h>
19#include <linux/string.h>
20#include <linux/skbuff.h>
21#include <linux/audit.h>
22#include <linux/slab.h>
23#include <net/sock.h>
24#include <net/netlink.h>
25#include <net/genetlink.h>
26#include <net/netlabel.h>
27#include <net/calipso.h>
28#include <linux/atomic.h>
29
30#include "netlabel_user.h"
31#include "netlabel_calipso.h"
32#include "netlabel_mgmt.h"
33#include "netlabel_domainhash.h"
34
35
36struct netlbl_calipso_doiwalk_arg {
37 struct netlink_callback *nl_cb;
38 struct sk_buff *skb;
39 u32 seq;
40};
41
42
43struct netlbl_domhsh_walk_arg {
44 struct netlbl_audit *audit_info;
45 u32 doi;
46};
47
48
49static struct genl_family netlbl_calipso_gnl_family;
50
51
52static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
53 [NLBL_CALIPSO_A_DOI] = { .type = NLA_U32 },
54 [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
55};
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70static int netlbl_calipso_add_pass(struct genl_info *info,
71 struct netlbl_audit *audit_info)
72{
73 int ret_val;
74 struct calipso_doi *doi_def = NULL;
75
76 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
77 if (!doi_def)
78 return -ENOMEM;
79 doi_def->type = CALIPSO_MAP_PASS;
80 doi_def->doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
81 ret_val = calipso_doi_add(doi_def, audit_info);
82 if (ret_val != 0)
83 calipso_doi_free(doi_def);
84
85 return ret_val;
86}
87
88
89
90
91
92
93
94
95
96
97
98static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
99
100{
101 int ret_val = -EINVAL;
102 struct netlbl_audit audit_info;
103
104 if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
105 !info->attrs[NLBL_CALIPSO_A_MTYPE])
106 return -EINVAL;
107
108 netlbl_netlink_auditinfo(&audit_info);
109 switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
110 case CALIPSO_MAP_PASS:
111 ret_val = netlbl_calipso_add_pass(info, &audit_info);
112 break;
113 }
114 if (ret_val == 0)
115 atomic_inc(&netlabel_mgmt_protocount);
116
117 return ret_val;
118}
119
120
121
122
123
124
125
126
127
128
129
130static int netlbl_calipso_list(struct sk_buff *skb, struct genl_info *info)
131{
132 int ret_val;
133 struct sk_buff *ans_skb = NULL;
134 void *data;
135 u32 doi;
136 struct calipso_doi *doi_def;
137
138 if (!info->attrs[NLBL_CALIPSO_A_DOI]) {
139 ret_val = -EINVAL;
140 goto list_failure;
141 }
142
143 doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
144
145 doi_def = calipso_doi_getdef(doi);
146 if (!doi_def) {
147 ret_val = -EINVAL;
148 goto list_failure;
149 }
150
151 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
152 if (!ans_skb) {
153 ret_val = -ENOMEM;
154 goto list_failure_put;
155 }
156 data = genlmsg_put_reply(ans_skb, info, &netlbl_calipso_gnl_family,
157 0, NLBL_CALIPSO_C_LIST);
158 if (!data) {
159 ret_val = -ENOMEM;
160 goto list_failure_put;
161 }
162
163 ret_val = nla_put_u32(ans_skb, NLBL_CALIPSO_A_MTYPE, doi_def->type);
164 if (ret_val != 0)
165 goto list_failure_put;
166
167 calipso_doi_putdef(doi_def);
168
169 genlmsg_end(ans_skb, data);
170 return genlmsg_reply(ans_skb, info);
171
172list_failure_put:
173 calipso_doi_putdef(doi_def);
174list_failure:
175 kfree_skb(ans_skb);
176 return ret_val;
177}
178
179
180
181
182
183
184
185
186
187
188
189
190
191static int netlbl_calipso_listall_cb(struct calipso_doi *doi_def, void *arg)
192{
193 int ret_val = -ENOMEM;
194 struct netlbl_calipso_doiwalk_arg *cb_arg = arg;
195 void *data;
196
197 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
198 cb_arg->seq, &netlbl_calipso_gnl_family,
199 NLM_F_MULTI, NLBL_CALIPSO_C_LISTALL);
200 if (!data)
201 goto listall_cb_failure;
202
203 ret_val = nla_put_u32(cb_arg->skb, NLBL_CALIPSO_A_DOI, doi_def->doi);
204 if (ret_val != 0)
205 goto listall_cb_failure;
206 ret_val = nla_put_u32(cb_arg->skb,
207 NLBL_CALIPSO_A_MTYPE,
208 doi_def->type);
209 if (ret_val != 0)
210 goto listall_cb_failure;
211
212 genlmsg_end(cb_arg->skb, data);
213 return 0;
214
215listall_cb_failure:
216 genlmsg_cancel(cb_arg->skb, data);
217 return ret_val;
218}
219
220
221
222
223
224
225
226
227
228
229
230static int netlbl_calipso_listall(struct sk_buff *skb,
231 struct netlink_callback *cb)
232{
233 struct netlbl_calipso_doiwalk_arg cb_arg;
234 u32 doi_skip = cb->args[0];
235
236 cb_arg.nl_cb = cb;
237 cb_arg.skb = skb;
238 cb_arg.seq = cb->nlh->nlmsg_seq;
239
240 calipso_doi_walk(&doi_skip, netlbl_calipso_listall_cb, &cb_arg);
241
242 cb->args[0] = doi_skip;
243 return skb->len;
244}
245
246
247
248
249
250
251
252
253
254
255
256
257
258static int netlbl_calipso_remove_cb(struct netlbl_dom_map *entry, void *arg)
259{
260 struct netlbl_domhsh_walk_arg *cb_arg = arg;
261
262 if (entry->def.type == NETLBL_NLTYPE_CALIPSO &&
263 entry->def.calipso->doi == cb_arg->doi)
264 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
265
266 return 0;
267}
268
269
270
271
272
273
274
275
276
277
278
279static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info)
280{
281 int ret_val = -EINVAL;
282 struct netlbl_domhsh_walk_arg cb_arg;
283 struct netlbl_audit audit_info;
284 u32 skip_bkt = 0;
285 u32 skip_chain = 0;
286
287 if (!info->attrs[NLBL_CALIPSO_A_DOI])
288 return -EINVAL;
289
290 netlbl_netlink_auditinfo(&audit_info);
291 cb_arg.doi = nla_get_u32(info->attrs[NLBL_CALIPSO_A_DOI]);
292 cb_arg.audit_info = &audit_info;
293 ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
294 netlbl_calipso_remove_cb, &cb_arg);
295 if (ret_val == 0 || ret_val == -ENOENT) {
296 ret_val = calipso_doi_remove(cb_arg.doi, &audit_info);
297 if (ret_val == 0)
298 atomic_dec(&netlabel_mgmt_protocount);
299 }
300
301 return ret_val;
302}
303
304
305
306
307static const struct genl_small_ops netlbl_calipso_ops[] = {
308 {
309 .cmd = NLBL_CALIPSO_C_ADD,
310 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
311 .flags = GENL_ADMIN_PERM,
312 .doit = netlbl_calipso_add,
313 .dumpit = NULL,
314 },
315 {
316 .cmd = NLBL_CALIPSO_C_REMOVE,
317 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
318 .flags = GENL_ADMIN_PERM,
319 .doit = netlbl_calipso_remove,
320 .dumpit = NULL,
321 },
322 {
323 .cmd = NLBL_CALIPSO_C_LIST,
324 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
325 .flags = 0,
326 .doit = netlbl_calipso_list,
327 .dumpit = NULL,
328 },
329 {
330 .cmd = NLBL_CALIPSO_C_LISTALL,
331 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
332 .flags = 0,
333 .doit = NULL,
334 .dumpit = netlbl_calipso_listall,
335 },
336};
337
338static struct genl_family netlbl_calipso_gnl_family __ro_after_init = {
339 .hdrsize = 0,
340 .name = NETLBL_NLTYPE_CALIPSO_NAME,
341 .version = NETLBL_PROTO_VERSION,
342 .maxattr = NLBL_CALIPSO_A_MAX,
343 .policy = calipso_genl_policy,
344 .module = THIS_MODULE,
345 .small_ops = netlbl_calipso_ops,
346 .n_small_ops = ARRAY_SIZE(netlbl_calipso_ops),
347};
348
349
350
351
352
353
354
355
356
357
358
359
360int __init netlbl_calipso_genl_init(void)
361{
362 return genl_register_family(&netlbl_calipso_gnl_family);
363}
364
365static const struct netlbl_calipso_ops *calipso_ops;
366
367
368
369
370
371
372
373
374
375const struct netlbl_calipso_ops *
376netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
377{
378 return xchg(&calipso_ops, ops);
379}
380EXPORT_SYMBOL(netlbl_calipso_ops_register);
381
382static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
383{
384 return READ_ONCE(calipso_ops);
385}
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400int calipso_doi_add(struct calipso_doi *doi_def,
401 struct netlbl_audit *audit_info)
402{
403 int ret_val = -ENOMSG;
404 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
405
406 if (ops)
407 ret_val = ops->doi_add(doi_def, audit_info);
408 return ret_val;
409}
410
411
412
413
414
415
416
417
418
419void calipso_doi_free(struct calipso_doi *doi_def)
420{
421 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
422
423 if (ops)
424 ops->doi_free(doi_def);
425}
426
427
428
429
430
431
432
433
434
435
436
437
438int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info)
439{
440 int ret_val = -ENOMSG;
441 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
442
443 if (ops)
444 ret_val = ops->doi_remove(doi, audit_info);
445 return ret_val;
446}
447
448
449
450
451
452
453
454
455
456
457
458struct calipso_doi *calipso_doi_getdef(u32 doi)
459{
460 struct calipso_doi *ret_val = NULL;
461 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
462
463 if (ops)
464 ret_val = ops->doi_getdef(doi);
465 return ret_val;
466}
467
468
469
470
471
472
473
474
475
476void calipso_doi_putdef(struct calipso_doi *doi_def)
477{
478 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
479
480 if (ops)
481 ops->doi_putdef(doi_def);
482}
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497int calipso_doi_walk(u32 *skip_cnt,
498 int (*callback)(struct calipso_doi *doi_def, void *arg),
499 void *cb_arg)
500{
501 int ret_val = -ENOMSG;
502 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
503
504 if (ops)
505 ret_val = ops->doi_walk(skip_cnt, callback, cb_arg);
506 return ret_val;
507}
508
509
510
511
512
513
514
515
516
517
518
519
520
521int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
522{
523 int ret_val = -ENOMSG;
524 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
525
526 if (ops)
527 ret_val = ops->sock_getattr(sk, secattr);
528 return ret_val;
529}
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545int calipso_sock_setattr(struct sock *sk,
546 const struct calipso_doi *doi_def,
547 const struct netlbl_lsm_secattr *secattr)
548{
549 int ret_val = -ENOMSG;
550 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
551
552 if (ops)
553 ret_val = ops->sock_setattr(sk, doi_def, secattr);
554 return ret_val;
555}
556
557
558
559
560
561
562
563
564
565void calipso_sock_delattr(struct sock *sk)
566{
567 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
568
569 if (ops)
570 ops->sock_delattr(sk);
571}
572
573
574
575
576
577
578
579
580
581
582
583
584
585int calipso_req_setattr(struct request_sock *req,
586 const struct calipso_doi *doi_def,
587 const struct netlbl_lsm_secattr *secattr)
588{
589 int ret_val = -ENOMSG;
590 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
591
592 if (ops)
593 ret_val = ops->req_setattr(req, doi_def, secattr);
594 return ret_val;
595}
596
597
598
599
600
601
602
603
604
605void calipso_req_delattr(struct request_sock *req)
606{
607 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
608
609 if (ops)
610 ops->req_delattr(req);
611}
612
613
614
615
616
617
618
619
620
621
622unsigned char *calipso_optptr(const struct sk_buff *skb)
623{
624 unsigned char *ret_val = NULL;
625 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
626
627 if (ops)
628 ret_val = ops->skbuff_optptr(skb);
629 return ret_val;
630}
631
632
633
634
635
636
637
638
639
640
641
642int calipso_getattr(const unsigned char *calipso,
643 struct netlbl_lsm_secattr *secattr)
644{
645 int ret_val = -ENOMSG;
646 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
647
648 if (ops)
649 ret_val = ops->opt_getattr(calipso, secattr);
650 return ret_val;
651}
652
653
654
655
656
657
658
659
660
661
662
663
664int calipso_skbuff_setattr(struct sk_buff *skb,
665 const struct calipso_doi *doi_def,
666 const struct netlbl_lsm_secattr *secattr)
667{
668 int ret_val = -ENOMSG;
669 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
670
671 if (ops)
672 ret_val = ops->skbuff_setattr(skb, doi_def, secattr);
673 return ret_val;
674}
675
676
677
678
679
680
681
682
683
684
685int calipso_skbuff_delattr(struct sk_buff *skb)
686{
687 int ret_val = -ENOMSG;
688 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
689
690 if (ops)
691 ret_val = ops->skbuff_delattr(skb);
692 return ret_val;
693}
694
695
696
697
698
699
700
701
702
703void calipso_cache_invalidate(void)
704{
705 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
706
707 if (ops)
708 ops->cache_invalidate();
709}
710
711
712
713
714
715
716
717
718
719
720
721int calipso_cache_add(const unsigned char *calipso_ptr,
722 const struct netlbl_lsm_secattr *secattr)
723
724{
725 int ret_val = -ENOMSG;
726 const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
727
728 if (ops)
729 ret_val = ops->cache_add(calipso_ptr, secattr);
730 return ret_val;
731}
732