2 * NetLabel Management Support
4 * This file defines the management functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
8 * Author: Paul Moore <paul.moore@hp.com>
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
31 #include <linux/types.h>
32 #include <linux/socket.h>
33 #include <linux/string.h>
34 #include <linux/skbuff.h>
36 #include <net/netlink.h>
37 #include <net/genetlink.h>
38 #include <net/netlabel.h>
39 #include <net/cipso_ipv4.h>
41 #include "netlabel_domainhash.h"
42 #include "netlabel_user.h"
43 #include "netlabel_mgmt.h"
45 /* NetLabel Generic NETLINK CIPSOv4 family */
46 static struct genl_family netlbl_mgmt_gnl_family
= {
47 .id
= GENL_ID_GENERATE
,
49 .name
= NETLBL_NLTYPE_MGMT_NAME
,
50 .version
= NETLBL_PROTO_VERSION
,
56 * NetLabel Command Handlers
60 * netlbl_mgmt_add - Handle an ADD message
61 * @skb: the NETLINK buffer
62 * @info: the Generic NETLINK info block
65 * Process a user generated ADD message and add the domains from the message
66 * to the hash table. See netlabel.h for a description of the message format.
67 * Returns zero on success, negative values on failure.
70 static int netlbl_mgmt_add(struct sk_buff
*skb
, struct genl_info
*info
)
72 int ret_val
= -EINVAL
;
73 struct nlattr
*msg_ptr
= netlbl_netlink_payload_data(skb
);
74 int msg_len
= netlbl_netlink_payload_len(skb
);
76 struct netlbl_dom_map
*entry
= NULL
;
81 ret_val
= netlbl_netlink_cap_check(skb
, CAP_NET_ADMIN
);
85 if (msg_len
< NETLBL_LEN_U32
)
87 count
= netlbl_getinc_u32(&msg_ptr
, &msg_len
);
89 for (iter
= 0; iter
< count
&& msg_len
> 0; iter
++, entry
= NULL
) {
94 entry
= kzalloc(sizeof(*entry
), GFP_KERNEL
);
99 tmp_size
= nla_len(msg_ptr
);
100 if (tmp_size
<= 0 || tmp_size
> msg_len
) {
104 entry
->domain
= kmalloc(tmp_size
, GFP_KERNEL
);
105 if (entry
->domain
== NULL
) {
109 nla_strlcpy(entry
->domain
, msg_ptr
, tmp_size
);
110 entry
->domain
[tmp_size
- 1] = '\0';
111 msg_ptr
= nla_next(msg_ptr
, &msg_len
);
113 if (msg_len
< NETLBL_LEN_U32
) {
117 tmp_val
= netlbl_getinc_u32(&msg_ptr
, &msg_len
);
118 entry
->type
= tmp_val
;
120 case NETLBL_NLTYPE_UNLABELED
:
121 ret_val
= netlbl_domhsh_add(entry
);
123 case NETLBL_NLTYPE_CIPSOV4
:
124 if (msg_len
< NETLBL_LEN_U32
) {
128 tmp_val
= netlbl_getinc_u32(&msg_ptr
, &msg_len
);
129 /* We should be holding a rcu_read_lock() here
130 * while we hold the result but since the entry
131 * will always be deleted when the CIPSO DOI
132 * is deleted we aren't going to keep the lock. */
134 entry
->type_def
.cipsov4
= cipso_v4_doi_getdef(tmp_val
);
135 if (entry
->type_def
.cipsov4
== NULL
) {
140 ret_val
= netlbl_domhsh_add(entry
);
150 netlbl_netlink_send_ack(info
,
151 netlbl_mgmt_gnl_family
.id
,
158 kfree(entry
->domain
);
160 netlbl_netlink_send_ack(info
,
161 netlbl_mgmt_gnl_family
.id
,
168 * netlbl_mgmt_remove - Handle a REMOVE message
169 * @skb: the NETLINK buffer
170 * @info: the Generic NETLINK info block
173 * Process a user generated REMOVE message and remove the specified domain
174 * mappings. Returns zero on success, negative values on failure.
177 static int netlbl_mgmt_remove(struct sk_buff
*skb
, struct genl_info
*info
)
179 int ret_val
= -EINVAL
;
180 struct nlattr
*msg_ptr
= netlbl_netlink_payload_data(skb
);
181 int msg_len
= netlbl_netlink_payload_len(skb
);
185 unsigned char *domain
;
187 ret_val
= netlbl_netlink_cap_check(skb
, CAP_NET_ADMIN
);
191 if (msg_len
< NETLBL_LEN_U32
)
193 count
= netlbl_getinc_u32(&msg_ptr
, &msg_len
);
195 for (iter
= 0; iter
< count
&& msg_len
> 0; iter
++) {
200 tmp_size
= nla_len(msg_ptr
);
201 domain
= nla_data(msg_ptr
);
202 if (tmp_size
<= 0 || tmp_size
> msg_len
||
203 domain
[tmp_size
- 1] != '\0') {
207 ret_val
= netlbl_domhsh_remove(domain
);
210 msg_ptr
= nla_next(msg_ptr
, &msg_len
);
216 netlbl_netlink_send_ack(info
,
217 netlbl_mgmt_gnl_family
.id
,
224 * netlbl_mgmt_list - Handle a LIST message
225 * @skb: the NETLINK buffer
226 * @info: the Generic NETLINK info block
229 * Process a user generated LIST message and dumps the domain hash table in a
230 * form suitable for use in a kernel generated LIST message. Returns zero on
231 * success, negative values on failure.
234 static int netlbl_mgmt_list(struct sk_buff
*skb
, struct genl_info
*info
)
236 int ret_val
= -ENOMEM
;
237 struct sk_buff
*ans_skb
;
239 ans_skb
= netlbl_domhsh_dump(NLMSG_SPACE(GENL_HDRLEN
));
242 netlbl_netlink_hdr_push(ans_skb
,
245 netlbl_mgmt_gnl_family
.id
,
248 ret_val
= netlbl_netlink_snd(ans_skb
, info
->snd_pid
);
255 netlbl_netlink_send_ack(info
,
256 netlbl_mgmt_gnl_family
.id
,
263 * netlbl_mgmt_adddef - Handle an ADDDEF message
264 * @skb: the NETLINK buffer
265 * @info: the Generic NETLINK info block
268 * Process a user generated ADDDEF message and respond accordingly. Returns
269 * zero on success, negative values on failure.
272 static int netlbl_mgmt_adddef(struct sk_buff
*skb
, struct genl_info
*info
)
274 int ret_val
= -EINVAL
;
275 struct nlattr
*msg_ptr
= netlbl_netlink_payload_data(skb
);
276 int msg_len
= netlbl_netlink_payload_len(skb
);
277 struct netlbl_dom_map
*entry
= NULL
;
280 ret_val
= netlbl_netlink_cap_check(skb
, CAP_NET_ADMIN
);
284 if (msg_len
< NETLBL_LEN_U32
)
286 tmp_val
= netlbl_getinc_u32(&msg_ptr
, &msg_len
);
288 entry
= kzalloc(sizeof(*entry
), GFP_KERNEL
);
294 entry
->type
= tmp_val
;
295 switch (entry
->type
) {
296 case NETLBL_NLTYPE_UNLABELED
:
297 ret_val
= netlbl_domhsh_add_default(entry
);
299 case NETLBL_NLTYPE_CIPSOV4
:
300 if (msg_len
< NETLBL_LEN_U32
) {
304 tmp_val
= netlbl_getinc_u32(&msg_ptr
, &msg_len
);
305 /* We should be holding a rcu_read_lock here while we
306 * hold the result but since the entry will always be
307 * deleted when the CIPSO DOI is deleted we are going
308 * to skip the lock. */
310 entry
->type_def
.cipsov4
= cipso_v4_doi_getdef(tmp_val
);
311 if (entry
->type_def
.cipsov4
== NULL
) {
316 ret_val
= netlbl_domhsh_add_default(entry
);
325 netlbl_netlink_send_ack(info
,
326 netlbl_mgmt_gnl_family
.id
,
333 netlbl_netlink_send_ack(info
,
334 netlbl_mgmt_gnl_family
.id
,
341 * netlbl_mgmt_removedef - Handle a REMOVEDEF message
342 * @skb: the NETLINK buffer
343 * @info: the Generic NETLINK info block
346 * Process a user generated REMOVEDEF message and remove the default domain
347 * mapping. Returns zero on success, negative values on failure.
350 static int netlbl_mgmt_removedef(struct sk_buff
*skb
, struct genl_info
*info
)
354 ret_val
= netlbl_netlink_cap_check(skb
, CAP_NET_ADMIN
);
356 goto removedef_return
;
358 ret_val
= netlbl_domhsh_remove_default();
361 netlbl_netlink_send_ack(info
,
362 netlbl_mgmt_gnl_family
.id
,
369 * netlbl_mgmt_listdef - Handle a LISTDEF message
370 * @skb: the NETLINK buffer
371 * @info: the Generic NETLINK info block
374 * Process a user generated LISTDEF message and dumps the default domain
375 * mapping in a form suitable for use in a kernel generated LISTDEF message.
376 * Returns zero on success, negative values on failure.
379 static int netlbl_mgmt_listdef(struct sk_buff
*skb
, struct genl_info
*info
)
381 int ret_val
= -ENOMEM
;
382 struct sk_buff
*ans_skb
;
384 ans_skb
= netlbl_domhsh_dump_default(NLMSG_SPACE(GENL_HDRLEN
));
386 goto listdef_failure
;
387 netlbl_netlink_hdr_push(ans_skb
,
390 netlbl_mgmt_gnl_family
.id
,
391 NLBL_MGMT_C_LISTDEF
);
393 ret_val
= netlbl_netlink_snd(ans_skb
, info
->snd_pid
);
395 goto listdef_failure
;
400 netlbl_netlink_send_ack(info
,
401 netlbl_mgmt_gnl_family
.id
,
408 * netlbl_mgmt_modules - Handle a MODULES message
409 * @skb: the NETLINK buffer
410 * @info: the Generic NETLINK info block
413 * Process a user generated MODULES message and respond accordingly.
416 static int netlbl_mgmt_modules(struct sk_buff
*skb
, struct genl_info
*info
)
418 int ret_val
= -ENOMEM
;
421 struct sk_buff
*ans_skb
= NULL
;
423 /* unlabeled + cipsov4 */
426 data_size
= GENL_HDRLEN
+ NETLBL_LEN_U32
+ mod_count
* NETLBL_LEN_U32
;
427 ans_skb
= netlbl_netlink_alloc_skb(0, data_size
, GFP_KERNEL
);
429 goto modules_failure
;
431 if (netlbl_netlink_hdr_put(ans_skb
,
434 netlbl_mgmt_gnl_family
.id
,
435 NLBL_MGMT_C_MODULES
) == NULL
)
436 goto modules_failure
;
438 ret_val
= nla_put_u32(ans_skb
, NLA_U32
, mod_count
);
440 goto modules_failure
;
441 ret_val
= nla_put_u32(ans_skb
, NLA_U32
, NETLBL_NLTYPE_UNLABELED
);
443 goto modules_failure
;
444 ret_val
= nla_put_u32(ans_skb
, NLA_U32
, NETLBL_NLTYPE_CIPSOV4
);
446 goto modules_failure
;
448 ret_val
= netlbl_netlink_snd(ans_skb
, info
->snd_pid
);
450 goto modules_failure
;
456 netlbl_netlink_send_ack(info
,
457 netlbl_mgmt_gnl_family
.id
,
464 * netlbl_mgmt_version - Handle a VERSION message
465 * @skb: the NETLINK buffer
466 * @info: the Generic NETLINK info block
469 * Process a user generated VERSION message and respond accordingly. Returns
470 * zero on success, negative values on failure.
473 static int netlbl_mgmt_version(struct sk_buff
*skb
, struct genl_info
*info
)
475 int ret_val
= -ENOMEM
;
476 struct sk_buff
*ans_skb
= NULL
;
478 ans_skb
= netlbl_netlink_alloc_skb(0,
479 GENL_HDRLEN
+ NETLBL_LEN_U32
,
482 goto version_failure
;
483 if (netlbl_netlink_hdr_put(ans_skb
,
486 netlbl_mgmt_gnl_family
.id
,
487 NLBL_MGMT_C_VERSION
) == NULL
)
488 goto version_failure
;
490 ret_val
= nla_put_u32(ans_skb
, NLA_U32
, NETLBL_PROTO_VERSION
);
492 goto version_failure
;
494 ret_val
= netlbl_netlink_snd(ans_skb
, info
->snd_pid
);
496 goto version_failure
;
502 netlbl_netlink_send_ack(info
,
503 netlbl_mgmt_gnl_family
.id
,
511 * NetLabel Generic NETLINK Command Definitions
514 static struct genl_ops netlbl_mgmt_genl_c_add
= {
515 .cmd
= NLBL_MGMT_C_ADD
,
517 .doit
= netlbl_mgmt_add
,
521 static struct genl_ops netlbl_mgmt_genl_c_remove
= {
522 .cmd
= NLBL_MGMT_C_REMOVE
,
524 .doit
= netlbl_mgmt_remove
,
528 static struct genl_ops netlbl_mgmt_genl_c_list
= {
529 .cmd
= NLBL_MGMT_C_LIST
,
531 .doit
= netlbl_mgmt_list
,
535 static struct genl_ops netlbl_mgmt_genl_c_adddef
= {
536 .cmd
= NLBL_MGMT_C_ADDDEF
,
538 .doit
= netlbl_mgmt_adddef
,
542 static struct genl_ops netlbl_mgmt_genl_c_removedef
= {
543 .cmd
= NLBL_MGMT_C_REMOVEDEF
,
545 .doit
= netlbl_mgmt_removedef
,
549 static struct genl_ops netlbl_mgmt_genl_c_listdef
= {
550 .cmd
= NLBL_MGMT_C_LISTDEF
,
552 .doit
= netlbl_mgmt_listdef
,
556 static struct genl_ops netlbl_mgmt_genl_c_modules
= {
557 .cmd
= NLBL_MGMT_C_MODULES
,
559 .doit
= netlbl_mgmt_modules
,
563 static struct genl_ops netlbl_mgmt_genl_c_version
= {
564 .cmd
= NLBL_MGMT_C_VERSION
,
566 .doit
= netlbl_mgmt_version
,
571 * NetLabel Generic NETLINK Protocol Functions
575 * netlbl_mgmt_genl_init - Register the NetLabel management component
578 * Register the NetLabel management component with the Generic NETLINK
579 * mechanism. Returns zero on success, negative values on failure.
582 int netlbl_mgmt_genl_init(void)
586 ret_val
= genl_register_family(&netlbl_mgmt_gnl_family
);
590 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
591 &netlbl_mgmt_genl_c_add
);
594 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
595 &netlbl_mgmt_genl_c_remove
);
598 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
599 &netlbl_mgmt_genl_c_list
);
602 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
603 &netlbl_mgmt_genl_c_adddef
);
606 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
607 &netlbl_mgmt_genl_c_removedef
);
610 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
611 &netlbl_mgmt_genl_c_listdef
);
614 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
615 &netlbl_mgmt_genl_c_modules
);
618 ret_val
= genl_register_ops(&netlbl_mgmt_gnl_family
,
619 &netlbl_mgmt_genl_c_version
);