2 * NetLabel CIPSO/IPv4 Support
4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
8 * Author: Paul Moore <paul.moore@hp.com>
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 #include <linux/types.h>
32 #include <linux/socket.h>
33 #include <linux/string.h>
34 #include <linux/skbuff.h>
35 #include <linux/audit.h>
37 #include <net/netlink.h>
38 #include <net/genetlink.h>
39 #include <net/netlabel.h>
40 #include <net/cipso_ipv4.h>
42 #include "netlabel_user.h"
43 #include "netlabel_cipso_v4.h"
45 /* Argument struct for cipso_v4_doi_walk() */
46 struct netlbl_cipsov4_doiwalk_arg {
47 struct netlink_callback *nl_cb;
52 /* NetLabel Generic NETLINK CIPSOv4 family */
53 static struct genl_family netlbl_cipsov4_gnl_family = {
54 .id = GENL_ID_GENERATE,
56 .name = NETLBL_NLTYPE_CIPSOV4_NAME,
57 .version = NETLBL_PROTO_VERSION,
58 .maxattr = NLBL_CIPSOV4_A_MAX,
61 /* NetLabel Netlink attribute policy */
62 static struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
63 [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
64 [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
65 [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
66 [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
67 [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
68 [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
69 [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
70 [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
71 [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
72 [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
73 [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
74 [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
82 * netlbl_cipsov4_doi_free - Frees a CIPSO V4 DOI definition
83 * @entry: the entry's RCU field
86 * This function is designed to be used as a callback to the call_rcu()
87 * function so that the memory allocated to the DOI definition can be released
91 static void netlbl_cipsov4_doi_free(struct rcu_head *entry)
93 struct cipso_v4_doi *ptr;
95 ptr = container_of(entry, struct cipso_v4_doi, rcu);
97 case CIPSO_V4_MAP_STD:
98 kfree(ptr->map.std->lvl.cipso);
99 kfree(ptr->map.std->lvl.local);
100 kfree(ptr->map.std->cat.cipso);
101 kfree(ptr->map.std->cat.local);
108 * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
109 * @info: the Generic NETLINK info block
110 * @doi_def: the CIPSO V4 DOI definition
113 * Parse the common sections of a ADD message and fill in the related values
114 * in @doi_def. Returns zero on success, negative values on failure.
117 static int netlbl_cipsov4_add_common(struct genl_info *info,
118 struct cipso_v4_doi *doi_def)
124 doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
126 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST],
128 netlbl_cipsov4_genl_policy) != 0)
131 nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
132 if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
133 if (iter > CIPSO_V4_TAG_MAXCNT)
135 doi_def->tags[iter++] = nla_get_u8(nla);
137 if (iter < CIPSO_V4_TAG_MAXCNT)
138 doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
144 * NetLabel Command Handlers
148 * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
149 * @info: the Generic NETLINK info block
152 * Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message
153 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
157 static int netlbl_cipsov4_add_std(struct genl_info *info)
159 int ret_val = -EINVAL;
160 struct cipso_v4_doi *doi_def = NULL;
161 struct nlattr *nla_a;
162 struct nlattr *nla_b;
166 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
167 !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
170 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
172 netlbl_cipsov4_genl_policy) != 0)
175 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
178 doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
179 if (doi_def->map.std == NULL) {
181 goto add_std_failure;
183 doi_def->type = CIPSO_V4_MAP_STD;
185 ret_val = netlbl_cipsov4_add_common(info, doi_def);
187 goto add_std_failure;
190 nla_for_each_nested(nla_a,
191 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
193 if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSLVL) {
194 if (nla_validate_nested(nla_a,
196 netlbl_cipsov4_genl_policy) != 0)
197 goto add_std_failure;
198 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
199 switch (nla_b->nla_type) {
200 case NLBL_CIPSOV4_A_MLSLVLLOC:
201 if (nla_get_u32(nla_b) >
202 CIPSO_V4_MAX_LOC_LVLS)
203 goto add_std_failure;
204 if (nla_get_u32(nla_b) >=
205 doi_def->map.std->lvl.local_size)
206 doi_def->map.std->lvl.local_size =
207 nla_get_u32(nla_b) + 1;
209 case NLBL_CIPSOV4_A_MLSLVLREM:
210 if (nla_get_u32(nla_b) >
211 CIPSO_V4_MAX_REM_LVLS)
212 goto add_std_failure;
213 if (nla_get_u32(nla_b) >=
214 doi_def->map.std->lvl.cipso_size)
215 doi_def->map.std->lvl.cipso_size =
216 nla_get_u32(nla_b) + 1;
220 doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
223 if (doi_def->map.std->lvl.local == NULL) {
225 goto add_std_failure;
227 doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
230 if (doi_def->map.std->lvl.cipso == NULL) {
232 goto add_std_failure;
234 nla_for_each_nested(nla_a,
235 info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
237 if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSLVL) {
238 struct nlattr *lvl_loc;
239 struct nlattr *lvl_rem;
241 lvl_loc = nla_find_nested(nla_a,
242 NLBL_CIPSOV4_A_MLSLVLLOC);
243 lvl_rem = nla_find_nested(nla_a,
244 NLBL_CIPSOV4_A_MLSLVLREM);
245 if (lvl_loc == NULL || lvl_rem == NULL)
246 goto add_std_failure;
247 doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
248 nla_get_u32(lvl_rem);
249 doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
250 nla_get_u32(lvl_loc);
253 if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
254 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
256 netlbl_cipsov4_genl_policy) != 0)
257 goto add_std_failure;
259 nla_for_each_nested(nla_a,
260 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
262 if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSCAT) {
263 if (nla_validate_nested(nla_a,
265 netlbl_cipsov4_genl_policy) != 0)
266 goto add_std_failure;
267 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
268 switch (nla_b->nla_type) {
269 case NLBL_CIPSOV4_A_MLSCATLOC:
270 if (nla_get_u32(nla_b) >
271 CIPSO_V4_MAX_LOC_CATS)
272 goto add_std_failure;
273 if (nla_get_u32(nla_b) >=
274 doi_def->map.std->cat.local_size)
275 doi_def->map.std->cat.local_size =
276 nla_get_u32(nla_b) + 1;
278 case NLBL_CIPSOV4_A_MLSCATREM:
279 if (nla_get_u32(nla_b) >
280 CIPSO_V4_MAX_REM_CATS)
281 goto add_std_failure;
282 if (nla_get_u32(nla_b) >=
283 doi_def->map.std->cat.cipso_size)
284 doi_def->map.std->cat.cipso_size =
285 nla_get_u32(nla_b) + 1;
289 doi_def->map.std->cat.local = kcalloc(
290 doi_def->map.std->cat.local_size,
293 if (doi_def->map.std->cat.local == NULL) {
295 goto add_std_failure;
297 doi_def->map.std->cat.cipso = kcalloc(
298 doi_def->map.std->cat.cipso_size,
301 if (doi_def->map.std->cat.cipso == NULL) {
303 goto add_std_failure;
305 nla_for_each_nested(nla_a,
306 info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
308 if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSCAT) {
309 struct nlattr *cat_loc;
310 struct nlattr *cat_rem;
312 cat_loc = nla_find_nested(nla_a,
313 NLBL_CIPSOV4_A_MLSCATLOC);
314 cat_rem = nla_find_nested(nla_a,
315 NLBL_CIPSOV4_A_MLSCATREM);
316 if (cat_loc == NULL || cat_rem == NULL)
317 goto add_std_failure;
318 doi_def->map.std->cat.local[
319 nla_get_u32(cat_loc)] =
320 nla_get_u32(cat_rem);
321 doi_def->map.std->cat.cipso[
322 nla_get_u32(cat_rem)] =
323 nla_get_u32(cat_loc);
327 ret_val = cipso_v4_doi_add(doi_def);
329 goto add_std_failure;
334 netlbl_cipsov4_doi_free(&doi_def->rcu);
339 * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
340 * @info: the Generic NETLINK info block
343 * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
344 * and add it to the CIPSO V4 engine. Return zero on success and non-zero on
348 static int netlbl_cipsov4_add_pass(struct genl_info *info)
351 struct cipso_v4_doi *doi_def = NULL;
353 if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
356 doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
359 doi_def->type = CIPSO_V4_MAP_PASS;
361 ret_val = netlbl_cipsov4_add_common(info, doi_def);
363 goto add_pass_failure;
365 ret_val = cipso_v4_doi_add(doi_def);
367 goto add_pass_failure;
371 netlbl_cipsov4_doi_free(&doi_def->rcu);
376 * netlbl_cipsov4_add - Handle an ADD message
377 * @skb: the NETLINK buffer
378 * @info: the Generic NETLINK info block
381 * Create a new DOI definition based on the given ADD message and add it to the
382 * CIPSO V4 engine. Returns zero on success, negative values on failure.
385 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
388 int ret_val = -EINVAL;
391 const char *type_str = "(unknown)";
392 struct audit_buffer *audit_buf;
393 struct netlbl_audit audit_info;
395 if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
396 !info->attrs[NLBL_CIPSOV4_A_MTYPE])
399 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
400 netlbl_netlink_auditinfo(skb, &audit_info);
402 type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
404 case CIPSO_V4_MAP_STD:
406 ret_val = netlbl_cipsov4_add_std(info);
408 case CIPSO_V4_MAP_PASS:
410 ret_val = netlbl_cipsov4_add_pass(info);
414 audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
416 if (audit_buf != NULL) {
417 audit_log_format(audit_buf,
418 " cipso_doi=%u cipso_type=%s res=%u",
421 ret_val == 0 ? 1 : 0);
422 audit_log_end(audit_buf);
429 * netlbl_cipsov4_list - Handle a LIST message
430 * @skb: the NETLINK buffer
431 * @info: the Generic NETLINK info block
434 * Process a user generated LIST message and respond accordingly. While the
435 * response message generated by the kernel is straightforward, determining
436 * before hand the size of the buffer to allocate is not (we have to generate
437 * the message to know the size). In order to keep this function sane what we
438 * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
439 * that size, if we fail then we restart with a larger buffer and try again.
440 * We continue in this manner until we hit a limit of failed attempts then we
441 * give up and just send an error message. Returns zero on success and
442 * negative values on error.
445 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
448 struct sk_buff *ans_skb = NULL;
452 struct nlattr *nla_a;
453 struct nlattr *nla_b;
454 struct cipso_v4_doi *doi_def;
457 if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
463 ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
464 if (ans_skb == NULL) {
468 data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
469 0, NLBL_CIPSOV4_C_LIST);
475 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
478 doi_def = cipso_v4_doi_getdef(doi);
479 if (doi_def == NULL) {
484 ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
486 goto list_failure_lock;
488 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST);
491 goto list_failure_lock;
494 iter < CIPSO_V4_TAG_MAXCNT &&
495 doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
497 ret_val = nla_put_u8(ans_skb,
499 doi_def->tags[iter]);
501 goto list_failure_lock;
503 nla_nest_end(ans_skb, nla_a);
505 switch (doi_def->type) {
506 case CIPSO_V4_MAP_STD:
507 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
510 goto list_failure_lock;
513 iter < doi_def->map.std->lvl.local_size;
515 if (doi_def->map.std->lvl.local[iter] ==
519 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL);
524 ret_val = nla_put_u32(ans_skb,
525 NLBL_CIPSOV4_A_MLSLVLLOC,
529 ret_val = nla_put_u32(ans_skb,
530 NLBL_CIPSOV4_A_MLSLVLREM,
531 doi_def->map.std->lvl.local[iter]);
534 nla_nest_end(ans_skb, nla_b);
536 nla_nest_end(ans_skb, nla_a);
538 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST);
544 iter < doi_def->map.std->cat.local_size;
546 if (doi_def->map.std->cat.local[iter] ==
550 nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT);
555 ret_val = nla_put_u32(ans_skb,
556 NLBL_CIPSOV4_A_MLSCATLOC,
560 ret_val = nla_put_u32(ans_skb,
561 NLBL_CIPSOV4_A_MLSCATREM,
562 doi_def->map.std->cat.local[iter]);
565 nla_nest_end(ans_skb, nla_b);
567 nla_nest_end(ans_skb, nla_a);
573 genlmsg_end(ans_skb, data);
575 ret_val = genlmsg_reply(ans_skb, info);
582 /* XXX - this limit is a guesstimate */
583 if (nlsze_mult < 4) {
597 * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
598 * @doi_def: the CIPSOv4 DOI definition
599 * @arg: the netlbl_cipsov4_doiwalk_arg structure
602 * This function is designed to be used as a callback to the
603 * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
604 * message. Returns the size of the message on success, negative values on
608 static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
610 int ret_val = -ENOMEM;
611 struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
614 data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
615 cb_arg->seq, &netlbl_cipsov4_gnl_family,
616 NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
618 goto listall_cb_failure;
620 ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
622 goto listall_cb_failure;
623 ret_val = nla_put_u32(cb_arg->skb,
624 NLBL_CIPSOV4_A_MTYPE,
627 goto listall_cb_failure;
629 return genlmsg_end(cb_arg->skb, data);
632 genlmsg_cancel(cb_arg->skb, data);
637 * netlbl_cipsov4_listall - Handle a LISTALL message
638 * @skb: the NETLINK buffer
639 * @cb: the NETLINK callback
642 * Process a user generated LISTALL message and respond accordingly. Returns
643 * zero on success and negative values on error.
646 static int netlbl_cipsov4_listall(struct sk_buff *skb,
647 struct netlink_callback *cb)
649 struct netlbl_cipsov4_doiwalk_arg cb_arg;
650 int doi_skip = cb->args[0];
654 cb_arg.seq = cb->nlh->nlmsg_seq;
656 cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
658 cb->args[0] = doi_skip;
663 * netlbl_cipsov4_remove - Handle a REMOVE message
664 * @skb: the NETLINK buffer
665 * @info: the Generic NETLINK info block
668 * Process a user generated REMOVE message and respond accordingly. Returns
669 * zero on success, negative values on failure.
672 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
674 int ret_val = -EINVAL;
676 struct audit_buffer *audit_buf;
677 struct netlbl_audit audit_info;
679 if (!info->attrs[NLBL_CIPSOV4_A_DOI])
682 doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
683 netlbl_netlink_auditinfo(skb, &audit_info);
685 ret_val = cipso_v4_doi_remove(doi,
687 netlbl_cipsov4_doi_free);
689 audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
691 if (audit_buf != NULL) {
692 audit_log_format(audit_buf,
693 " cipso_doi=%u res=%u",
695 ret_val == 0 ? 1 : 0);
696 audit_log_end(audit_buf);
703 * NetLabel Generic NETLINK Command Definitions
706 static struct genl_ops netlbl_cipsov4_genl_c_add = {
707 .cmd = NLBL_CIPSOV4_C_ADD,
708 .flags = GENL_ADMIN_PERM,
709 .policy = netlbl_cipsov4_genl_policy,
710 .doit = netlbl_cipsov4_add,
714 static struct genl_ops netlbl_cipsov4_genl_c_remove = {
715 .cmd = NLBL_CIPSOV4_C_REMOVE,
716 .flags = GENL_ADMIN_PERM,
717 .policy = netlbl_cipsov4_genl_policy,
718 .doit = netlbl_cipsov4_remove,
722 static struct genl_ops netlbl_cipsov4_genl_c_list = {
723 .cmd = NLBL_CIPSOV4_C_LIST,
725 .policy = netlbl_cipsov4_genl_policy,
726 .doit = netlbl_cipsov4_list,
730 static struct genl_ops netlbl_cipsov4_genl_c_listall = {
731 .cmd = NLBL_CIPSOV4_C_LISTALL,
733 .policy = netlbl_cipsov4_genl_policy,
735 .dumpit = netlbl_cipsov4_listall,
739 * NetLabel Generic NETLINK Protocol Functions
743 * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
746 * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
747 * mechanism. Returns zero on success, negative values on failure.
750 int netlbl_cipsov4_genl_init(void)
754 ret_val = genl_register_family(&netlbl_cipsov4_gnl_family);
758 ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
759 &netlbl_cipsov4_genl_c_add);
762 ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
763 &netlbl_cipsov4_genl_c_remove);
766 ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
767 &netlbl_cipsov4_genl_c_list);
770 ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
771 &netlbl_cipsov4_genl_c_listall);