2 * NetLabel Management Support
4 * This file defines the management functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
8 * Author: Paul Moore <paul.moore@hp.com>
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 #include <linux/types.h>
32 #include <linux/socket.h>
33 #include <linux/string.h>
34 #include <linux/skbuff.h>
36 #include <net/netlink.h>
37 #include <net/genetlink.h>
38 #include <net/netlabel.h>
39 #include <net/cipso_ipv4.h>
41 #include "netlabel_domainhash.h"
42 #include "netlabel_user.h"
43 #include "netlabel_mgmt.h"
45 /* NetLabel Generic NETLINK CIPSOv4 family */
46 static struct genl_family netlbl_mgmt_gnl_family = {
47 .id = GENL_ID_GENERATE,
49 .name = NETLBL_NLTYPE_MGMT_NAME,
50 .version = NETLBL_PROTO_VERSION,
56 * NetLabel Command Handlers
60 * netlbl_mgmt_add - Handle an ADD message
61 * @skb: the NETLINK buffer
62 * @info: the Generic NETLINK info block
65 * Process a user generated ADD message and add the domains from the message
66 * to the hash table. See netlabel.h for a description of the message format.
67 * Returns zero on success, negative values on failure.
70 static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info)
72 int ret_val = -EINVAL;
73 struct nlattr *msg_ptr = netlbl_netlink_payload_data(skb);
74 int msg_len = netlbl_netlink_payload_len(skb);
76 struct netlbl_dom_map *entry = NULL;
81 ret_val = netlbl_netlink_cap_check(skb, CAP_NET_ADMIN);
85 if (msg_len < NETLBL_LEN_U32)
87 count = netlbl_getinc_u32(&msg_ptr, &msg_len);
89 for (iter = 0; iter < count && msg_len > 0; iter++, entry = NULL) {
94 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
99 tmp_size = nla_len(msg_ptr);
100 if (tmp_size <= 0 || tmp_size > msg_len) {
104 entry->domain = kmalloc(tmp_size, GFP_KERNEL);
105 if (entry->domain == NULL) {
109 nla_strlcpy(entry->domain, msg_ptr, tmp_size);
110 entry->domain[tmp_size - 1] = '\0';
111 msg_ptr = nla_next(msg_ptr, &msg_len);
113 if (msg_len < NETLBL_LEN_U32) {
117 tmp_val = netlbl_getinc_u32(&msg_ptr, &msg_len);
118 entry->type = tmp_val;
120 case NETLBL_NLTYPE_UNLABELED:
121 ret_val = netlbl_domhsh_add(entry);
123 case NETLBL_NLTYPE_CIPSOV4:
124 if (msg_len < NETLBL_LEN_U32) {
128 tmp_val = netlbl_getinc_u32(&msg_ptr, &msg_len);
129 /* We should be holding a rcu_read_lock() here
130 * while we hold the result but since the entry
131 * will always be deleted when the CIPSO DOI
132 * is deleted we aren't going to keep the lock. */
134 entry->type_def.cipsov4 = cipso_v4_doi_getdef(tmp_val);
135 if (entry->type_def.cipsov4 == NULL) {
140 ret_val = netlbl_domhsh_add(entry);
150 netlbl_netlink_send_ack(info,
151 netlbl_mgmt_gnl_family.id,
158 kfree(entry->domain);
160 netlbl_netlink_send_ack(info,
161 netlbl_mgmt_gnl_family.id,
168 * netlbl_mgmt_remove - Handle a REMOVE message
169 * @skb: the NETLINK buffer
170 * @info: the Generic NETLINK info block
173 * Process a user generated REMOVE message and remove the specified domain
174 * mappings. Returns zero on success, negative values on failure.
177 static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info)
179 int ret_val = -EINVAL;
180 struct nlattr *msg_ptr = netlbl_netlink_payload_data(skb);
181 int msg_len = netlbl_netlink_payload_len(skb);
185 unsigned char *domain;
187 ret_val = netlbl_netlink_cap_check(skb, CAP_NET_ADMIN);
191 if (msg_len < NETLBL_LEN_U32)
193 count = netlbl_getinc_u32(&msg_ptr, &msg_len);
195 for (iter = 0; iter < count && msg_len > 0; iter++) {
200 tmp_size = nla_len(msg_ptr);
201 domain = nla_data(msg_ptr);
202 if (tmp_size <= 0 || tmp_size > msg_len ||
203 domain[tmp_size - 1] != '\0') {
207 ret_val = netlbl_domhsh_remove(domain);
210 msg_ptr = nla_next(msg_ptr, &msg_len);
216 netlbl_netlink_send_ack(info,
217 netlbl_mgmt_gnl_family.id,
224 * netlbl_mgmt_list - Handle a LIST message
225 * @skb: the NETLINK buffer
226 * @info: the Generic NETLINK info block
229 * Process a user generated LIST message and dumps the domain hash table in a
230 * form suitable for use in a kernel generated LIST message. Returns zero on
231 * success, negative values on failure.
234 static int netlbl_mgmt_list(struct sk_buff *skb, struct genl_info *info)
236 int ret_val = -ENOMEM;
237 struct sk_buff *ans_skb;
239 ans_skb = netlbl_domhsh_dump(NLMSG_SPACE(GENL_HDRLEN));
242 netlbl_netlink_hdr_push(ans_skb,
245 netlbl_mgmt_gnl_family.id,
248 ret_val = netlbl_netlink_snd(ans_skb, info->snd_pid);
255 netlbl_netlink_send_ack(info,
256 netlbl_mgmt_gnl_family.id,
263 * netlbl_mgmt_adddef - Handle an ADDDEF message
264 * @skb: the NETLINK buffer
265 * @info: the Generic NETLINK info block
268 * Process a user generated ADDDEF message and respond accordingly. Returns
269 * zero on success, negative values on failure.
272 static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info)
274 int ret_val = -EINVAL;
275 struct nlattr *msg_ptr = netlbl_netlink_payload_data(skb);
276 int msg_len = netlbl_netlink_payload_len(skb);
277 struct netlbl_dom_map *entry = NULL;
280 ret_val = netlbl_netlink_cap_check(skb, CAP_NET_ADMIN);
284 if (msg_len < NETLBL_LEN_U32)
286 tmp_val = netlbl_getinc_u32(&msg_ptr, &msg_len);
288 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
294 entry->type = tmp_val;
295 switch (entry->type) {
296 case NETLBL_NLTYPE_UNLABELED:
297 ret_val = netlbl_domhsh_add_default(entry);
299 case NETLBL_NLTYPE_CIPSOV4:
300 if (msg_len < NETLBL_LEN_U32) {
304 tmp_val = netlbl_getinc_u32(&msg_ptr, &msg_len);
305 /* We should be holding a rcu_read_lock here while we
306 * hold the result but since the entry will always be
307 * deleted when the CIPSO DOI is deleted we are going
308 * to skip the lock. */
310 entry->type_def.cipsov4 = cipso_v4_doi_getdef(tmp_val);
311 if (entry->type_def.cipsov4 == NULL) {
316 ret_val = netlbl_domhsh_add_default(entry);
325 netlbl_netlink_send_ack(info,
326 netlbl_mgmt_gnl_family.id,
333 netlbl_netlink_send_ack(info,
334 netlbl_mgmt_gnl_family.id,
341 * netlbl_mgmt_removedef - Handle a REMOVEDEF message
342 * @skb: the NETLINK buffer
343 * @info: the Generic NETLINK info block
346 * Process a user generated REMOVEDEF message and remove the default domain
347 * mapping. Returns zero on success, negative values on failure.
350 static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info)
354 ret_val = netlbl_netlink_cap_check(skb, CAP_NET_ADMIN);
356 goto removedef_return;
358 ret_val = netlbl_domhsh_remove_default();
361 netlbl_netlink_send_ack(info,
362 netlbl_mgmt_gnl_family.id,
369 * netlbl_mgmt_listdef - Handle a LISTDEF message
370 * @skb: the NETLINK buffer
371 * @info: the Generic NETLINK info block
374 * Process a user generated LISTDEF message and dumps the default domain
375 * mapping in a form suitable for use in a kernel generated LISTDEF message.
376 * Returns zero on success, negative values on failure.
379 static int netlbl_mgmt_listdef(struct sk_buff *skb, struct genl_info *info)
381 int ret_val = -ENOMEM;
382 struct sk_buff *ans_skb;
384 ans_skb = netlbl_domhsh_dump_default(NLMSG_SPACE(GENL_HDRLEN));
386 goto listdef_failure;
387 netlbl_netlink_hdr_push(ans_skb,
390 netlbl_mgmt_gnl_family.id,
391 NLBL_MGMT_C_LISTDEF);
393 ret_val = netlbl_netlink_snd(ans_skb, info->snd_pid);
395 goto listdef_failure;
400 netlbl_netlink_send_ack(info,
401 netlbl_mgmt_gnl_family.id,
408 * netlbl_mgmt_modules - Handle a MODULES message
409 * @skb: the NETLINK buffer
410 * @info: the Generic NETLINK info block
413 * Process a user generated MODULES message and respond accordingly.
416 static int netlbl_mgmt_modules(struct sk_buff *skb, struct genl_info *info)
418 int ret_val = -ENOMEM;
421 struct sk_buff *ans_skb = NULL;
423 /* unlabeled + cipsov4 */
426 data_size = GENL_HDRLEN + NETLBL_LEN_U32 + mod_count * NETLBL_LEN_U32;
427 ans_skb = netlbl_netlink_alloc_skb(0, data_size, GFP_KERNEL);
429 goto modules_failure;
431 if (netlbl_netlink_hdr_put(ans_skb,
434 netlbl_mgmt_gnl_family.id,
435 NLBL_MGMT_C_MODULES) == NULL)
436 goto modules_failure;
438 ret_val = nla_put_u32(ans_skb, NLA_U32, mod_count);
440 goto modules_failure;
441 ret_val = nla_put_u32(ans_skb, NLA_U32, NETLBL_NLTYPE_UNLABELED);
443 goto modules_failure;
444 ret_val = nla_put_u32(ans_skb, NLA_U32, NETLBL_NLTYPE_CIPSOV4);
446 goto modules_failure;
448 ret_val = netlbl_netlink_snd(ans_skb, info->snd_pid);
450 goto modules_failure;
456 netlbl_netlink_send_ack(info,
457 netlbl_mgmt_gnl_family.id,
464 * netlbl_mgmt_version - Handle a VERSION message
465 * @skb: the NETLINK buffer
466 * @info: the Generic NETLINK info block
469 * Process a user generated VERSION message and respond accordingly. Returns
470 * zero on success, negative values on failure.
473 static int netlbl_mgmt_version(struct sk_buff *skb, struct genl_info *info)
475 int ret_val = -ENOMEM;
476 struct sk_buff *ans_skb = NULL;
478 ans_skb = netlbl_netlink_alloc_skb(0,
479 GENL_HDRLEN + NETLBL_LEN_U32,
482 goto version_failure;
483 if (netlbl_netlink_hdr_put(ans_skb,
486 netlbl_mgmt_gnl_family.id,
487 NLBL_MGMT_C_VERSION) == NULL)
488 goto version_failure;
490 ret_val = nla_put_u32(ans_skb, NLA_U32, NETLBL_PROTO_VERSION);
492 goto version_failure;
494 ret_val = netlbl_netlink_snd(ans_skb, info->snd_pid);
496 goto version_failure;
502 netlbl_netlink_send_ack(info,
503 netlbl_mgmt_gnl_family.id,
511 * NetLabel Generic NETLINK Command Definitions
514 static struct genl_ops netlbl_mgmt_genl_c_add = {
515 .cmd = NLBL_MGMT_C_ADD,
517 .doit = netlbl_mgmt_add,
521 static struct genl_ops netlbl_mgmt_genl_c_remove = {
522 .cmd = NLBL_MGMT_C_REMOVE,
524 .doit = netlbl_mgmt_remove,
528 static struct genl_ops netlbl_mgmt_genl_c_list = {
529 .cmd = NLBL_MGMT_C_LIST,
531 .doit = netlbl_mgmt_list,
535 static struct genl_ops netlbl_mgmt_genl_c_adddef = {
536 .cmd = NLBL_MGMT_C_ADDDEF,
538 .doit = netlbl_mgmt_adddef,
542 static struct genl_ops netlbl_mgmt_genl_c_removedef = {
543 .cmd = NLBL_MGMT_C_REMOVEDEF,
545 .doit = netlbl_mgmt_removedef,
549 static struct genl_ops netlbl_mgmt_genl_c_listdef = {
550 .cmd = NLBL_MGMT_C_LISTDEF,
552 .doit = netlbl_mgmt_listdef,
556 static struct genl_ops netlbl_mgmt_genl_c_modules = {
557 .cmd = NLBL_MGMT_C_MODULES,
559 .doit = netlbl_mgmt_modules,
563 static struct genl_ops netlbl_mgmt_genl_c_version = {
564 .cmd = NLBL_MGMT_C_VERSION,
566 .doit = netlbl_mgmt_version,
571 * NetLabel Generic NETLINK Protocol Functions
575 * netlbl_mgmt_genl_init - Register the NetLabel management component
578 * Register the NetLabel management component with the Generic NETLINK
579 * mechanism. Returns zero on success, negative values on failure.
582 int netlbl_mgmt_genl_init(void)
586 ret_val = genl_register_family(&netlbl_mgmt_gnl_family);
590 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
591 &netlbl_mgmt_genl_c_add);
594 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
595 &netlbl_mgmt_genl_c_remove);
598 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
599 &netlbl_mgmt_genl_c_list);
602 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
603 &netlbl_mgmt_genl_c_adddef);
606 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
607 &netlbl_mgmt_genl_c_removedef);
610 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
611 &netlbl_mgmt_genl_c_listdef);
614 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
615 &netlbl_mgmt_genl_c_modules);
618 ret_val = genl_register_ops(&netlbl_mgmt_gnl_family,
619 &netlbl_mgmt_genl_c_version);