net/netlabel/netlabel_cipso_v4.c

   1 /*
   2  * NetLabel CIPSO/IPv4 Support
   3  *
   4  * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
   5  * NetLabel system manages static and dynamic label mappings for network
   6  * protocols such as CIPSO and RIPSO.
   7  *
   8  * Author: Paul Moore <paul.moore@hp.com>
   9  *
  10  */
  11
  12 /*
  13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14  *
  15  * This program is free software;  you can redistribute it and/or modify
  16  * it under the terms of the GNU General Public License as published by
  17  * the Free Software Foundation; either version 2 of the License, or
  18  * (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  23  * the GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program;  if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28  *
  29  */
  30
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/string.h>
  34 #include <linux/skbuff.h>
  35 #include <net/sock.h>
  36 #include <net/netlink.h>
  37 #include <net/genetlink.h>
  38 #include <net/netlabel.h>
  39 #include <net/cipso_ipv4.h>
  40
  41 #include "netlabel_user.h"
  42 #include "netlabel_cipso_v4.h"
  43
  44 /* NetLabel Generic NETLINK CIPSOv4 family */
  45 static struct genl_family netlbl_cipsov4_gnl_family = {
  46         .id = GENL_ID_GENERATE,
  47         .hdrsize = 0,
  48         .name = NETLBL_NLTYPE_CIPSOV4_NAME,
  49         .version = NETLBL_PROTO_VERSION,
  50         .maxattr = 0,
  51 };
  52
  53
  54 /*
  55  * Helper Functions
  56  */
  57
  58 /**
  59  * netlbl_cipsov4_doi_free - Frees a CIPSO V4 DOI definition
  60  * @entry: the entry's RCU field
  61  *
  62  * Description:
  63  * This function is designed to be used as a callback to the call_rcu()
  64  * function so that the memory allocated to the DOI definition can be released
  65  * safely.
  66  *
  67  */
  68 static void netlbl_cipsov4_doi_free(struct rcu_head *entry)
  69 {
  70         struct cipso_v4_doi *ptr;
  71
  72         ptr = container_of(entry, struct cipso_v4_doi, rcu);
  73         switch (ptr->type) {
  74         case CIPSO_V4_MAP_STD:
  75                 kfree(ptr->map.std->lvl.cipso);
  76                 kfree(ptr->map.std->lvl.local);
  77                 kfree(ptr->map.std->cat.cipso);
  78                 kfree(ptr->map.std->cat.local);
  79                 break;
  80         }
  81         kfree(ptr);
  82 }
  83
  84
  85 /*
  86  * NetLabel Command Handlers
  87  */
  88
  89 /**
  90  * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
  91  * @doi: the DOI value
  92  * @msg: the ADD message data
  93  * @msg_size: the size of the ADD message buffer
  94  *
  95  * Description:
  96  * Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message
  97  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
  98  * error.
  99  *
 100  */
 101 static int netlbl_cipsov4_add_std(u32 doi, struct nlattr *msg, size_t msg_size)
 102 {
 103         int ret_val = -EINVAL;
 104         int msg_len = msg_size;
 105         u32 num_tags;
 106         u32 num_lvls;
 107         u32 num_cats;
 108         struct cipso_v4_doi *doi_def = NULL;
 109         u32 iter;
 110         u32 tmp_val_a;
 111         u32 tmp_val_b;
 112
 113         if (msg_len < NETLBL_LEN_U32)
 114                 goto add_std_failure;
 115         num_tags = netlbl_getinc_u32(&msg, &msg_len);
 116         if (num_tags == 0 || num_tags > CIPSO_V4_TAG_MAXCNT)
 117                 goto add_std_failure;
 118
 119         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
 120         if (doi_def == NULL) {
 121                 ret_val = -ENOMEM;
 122                 goto add_std_failure;
 123         }
 124         doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
 125         if (doi_def->map.std == NULL) {
 126                 ret_val = -ENOMEM;
 127                 goto add_std_failure;
 128         }
 129         doi_def->type = CIPSO_V4_MAP_STD;
 130
 131         for (iter = 0; iter < num_tags; iter++) {
 132                 if (msg_len < NETLBL_LEN_U8)
 133                         goto add_std_failure;
 134                 doi_def->tags[iter] = netlbl_getinc_u8(&msg, &msg_len);
 135                 switch (doi_def->tags[iter]) {
 136                 case CIPSO_V4_TAG_RBITMAP:
 137                         break;
 138                 default:
 139                         goto add_std_failure;
 140                 }
 141         }
 142         if (iter < CIPSO_V4_TAG_MAXCNT)
 143                 doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
 144
 145         if (msg_len < 6 * NETLBL_LEN_U32)
 146                 goto add_std_failure;
 147
 148         num_lvls = netlbl_getinc_u32(&msg, &msg_len);
 149         if (num_lvls == 0)
 150                 goto add_std_failure;
 151         doi_def->map.std->lvl.local_size = netlbl_getinc_u32(&msg, &msg_len);
 152         if (doi_def->map.std->lvl.local_size > CIPSO_V4_MAX_LOC_LVLS)
 153                 goto add_std_failure;
 154         doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
 155                                               sizeof(u32),
 156                                               GFP_KERNEL);
 157         if (doi_def->map.std->lvl.local == NULL) {
 158                 ret_val = -ENOMEM;
 159                 goto add_std_failure;
 160         }
 161         doi_def->map.std->lvl.cipso_size = netlbl_getinc_u8(&msg, &msg_len);
 162         if (doi_def->map.std->lvl.cipso_size > CIPSO_V4_MAX_REM_LVLS)
 163                 goto add_std_failure;
 164         doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
 165                                               sizeof(u32),
 166                                               GFP_KERNEL);
 167         if (doi_def->map.std->lvl.cipso == NULL) {
 168                 ret_val = -ENOMEM;
 169                 goto add_std_failure;
 170         }
 171
 172         num_cats = netlbl_getinc_u32(&msg, &msg_len);
 173         doi_def->map.std->cat.local_size = netlbl_getinc_u32(&msg, &msg_len);
 174         if (doi_def->map.std->cat.local_size > CIPSO_V4_MAX_LOC_CATS)
 175                 goto add_std_failure;
 176         doi_def->map.std->cat.local = kcalloc(doi_def->map.std->cat.local_size,
 177                                               sizeof(u32),
 178                                               GFP_KERNEL);
 179         if (doi_def->map.std->cat.local == NULL) {
 180                 ret_val = -ENOMEM;
 181                 goto add_std_failure;
 182         }
 183         doi_def->map.std->cat.cipso_size = netlbl_getinc_u16(&msg, &msg_len);
 184         if (doi_def->map.std->cat.cipso_size > CIPSO_V4_MAX_REM_CATS)
 185                 goto add_std_failure;
 186         doi_def->map.std->cat.cipso = kcalloc(doi_def->map.std->cat.cipso_size,
 187                                               sizeof(u32),
 188                                               GFP_KERNEL);
 189         if (doi_def->map.std->cat.cipso == NULL) {
 190                 ret_val = -ENOMEM;
 191                 goto add_std_failure;
 192         }
 193
 194         if (msg_len <
 195             num_lvls * (NETLBL_LEN_U32 + NETLBL_LEN_U8) +
 196             num_cats * (NETLBL_LEN_U32 + NETLBL_LEN_U16))
 197                 goto add_std_failure;
 198
 199         for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
 200                 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
 201         for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
 202                 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
 203         for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
 204                 doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
 205         for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
 206                 doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
 207
 208         for (iter = 0; iter < num_lvls; iter++) {
 209                 tmp_val_a = netlbl_getinc_u32(&msg, &msg_len);
 210                 tmp_val_b = netlbl_getinc_u8(&msg, &msg_len);
 211
 212                 if (tmp_val_a >= doi_def->map.std->lvl.local_size ||
 213                     tmp_val_b >= doi_def->map.std->lvl.cipso_size)
 214                         goto add_std_failure;
 215
 216                 doi_def->map.std->lvl.cipso[tmp_val_b] = tmp_val_a;
 217                 doi_def->map.std->lvl.local[tmp_val_a] = tmp_val_b;
 218         }
 219
 220         for (iter = 0; iter < num_cats; iter++) {
 221                 tmp_val_a = netlbl_getinc_u32(&msg, &msg_len);
 222                 tmp_val_b = netlbl_getinc_u16(&msg, &msg_len);
 223
 224                 if (tmp_val_a >= doi_def->map.std->cat.local_size ||
 225                     tmp_val_b >= doi_def->map.std->cat.cipso_size)
 226                         goto add_std_failure;
 227
 228                 doi_def->map.std->cat.cipso[tmp_val_b] = tmp_val_a;
 229                 doi_def->map.std->cat.local[tmp_val_a] = tmp_val_b;
 230         }
 231
 232         doi_def->doi = doi;
 233         ret_val = cipso_v4_doi_add(doi_def);
 234         if (ret_val != 0)
 235                 goto add_std_failure;
 236         return 0;
 237
 238 add_std_failure:
 239         if (doi_def)
 240                 netlbl_cipsov4_doi_free(&doi_def->rcu);
 241         return ret_val;
 242 }
 243
 244 /**
 245  * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
 246  * @doi: the DOI value
 247  * @msg: the ADD message data
 248  * @msg_size: the size of the ADD message buffer
 249  *
 250  * Description:
 251  * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
 252  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
 253  * error.
 254  *
 255  */
 256 static int netlbl_cipsov4_add_pass(u32 doi,
 257                                    struct nlattr *msg,
 258                                    size_t msg_size)
 259 {
 260         int ret_val = -EINVAL;
 261         int msg_len = msg_size;
 262         u32 num_tags;
 263         struct cipso_v4_doi *doi_def = NULL;
 264         u32 iter;
 265
 266         if (msg_len < NETLBL_LEN_U32)
 267                 goto add_pass_failure;
 268         num_tags = netlbl_getinc_u32(&msg, &msg_len);
 269         if (num_tags == 0 || num_tags > CIPSO_V4_TAG_MAXCNT)
 270                 goto add_pass_failure;
 271
 272         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
 273         if (doi_def == NULL) {
 274                 ret_val = -ENOMEM;
 275                 goto add_pass_failure;
 276         }
 277         doi_def->type = CIPSO_V4_MAP_PASS;
 278
 279         for (iter = 0; iter < num_tags; iter++) {
 280                 if (msg_len < NETLBL_LEN_U8)
 281                         goto add_pass_failure;
 282                 doi_def->tags[iter] = netlbl_getinc_u8(&msg, &msg_len);
 283                 switch (doi_def->tags[iter]) {
 284                 case CIPSO_V4_TAG_RBITMAP:
 285                         break;
 286                 default:
 287                         goto add_pass_failure;
 288                 }
 289         }
 290         if (iter < CIPSO_V4_TAG_MAXCNT)
 291                 doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
 292
 293         doi_def->doi = doi;
 294         ret_val = cipso_v4_doi_add(doi_def);
 295         if (ret_val != 0)
 296                 goto add_pass_failure;
 297         return 0;
 298
 299 add_pass_failure:
 300         if (doi_def)
 301                 netlbl_cipsov4_doi_free(&doi_def->rcu);
 302         return ret_val;
 303 }
 304
 305 /**
 306  * netlbl_cipsov4_add - Handle an ADD message
 307  * @skb: the NETLINK buffer
 308  * @info: the Generic NETLINK info block
 309  *
 310  * Description:
 311  * Create a new DOI definition based on the given ADD message and add it to the
 312  * CIPSO V4 engine.  Returns zero on success, negative values on failure.
 313  *
 314  */
 315 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 316
 317 {
 318         int ret_val = -EINVAL;
 319         u32 doi;
 320         u32 map_type;
 321         int msg_len = netlbl_netlink_payload_len(skb);
 322         struct nlattr *msg = netlbl_netlink_payload_data(skb);
 323
 324         ret_val = netlbl_netlink_cap_check(skb, CAP_NET_ADMIN);
 325         if (ret_val != 0)
 326                 goto add_return;
 327
 328         if (msg_len < 2 * NETLBL_LEN_U32)
 329                 goto add_return;
 330
 331         doi = netlbl_getinc_u32(&msg, &msg_len);
 332         map_type = netlbl_getinc_u32(&msg, &msg_len);
 333         switch (map_type) {
 334         case CIPSO_V4_MAP_STD:
 335                 ret_val = netlbl_cipsov4_add_std(doi, msg, msg_len);
 336                 break;
 337         case CIPSO_V4_MAP_PASS:
 338                 ret_val = netlbl_cipsov4_add_pass(doi, msg, msg_len);
 339                 break;
 340         }
 341
 342 add_return:
 343         netlbl_netlink_send_ack(info,
 344                                 netlbl_cipsov4_gnl_family.id,
 345                                 NLBL_CIPSOV4_C_ACK,
 346                                 -ret_val);
 347         return ret_val;
 348 }
 349
 350 /**
 351  * netlbl_cipsov4_list - Handle a LIST message
 352  * @skb: the NETLINK buffer
 353  * @info: the Generic NETLINK info block
 354  *
 355  * Description:
 356  * Process a user generated LIST message and respond accordingly.  Returns
 357  * zero on success and negative values on error.
 358  *
 359  */
 360 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
 361 {
 362         int ret_val = -EINVAL;
 363         u32 doi;
 364         struct nlattr *msg = netlbl_netlink_payload_data(skb);
 365         struct sk_buff *ans_skb;
 366
 367         if (netlbl_netlink_payload_len(skb) != NETLBL_LEN_U32)
 368                 goto list_failure;
 369
 370         doi = nla_get_u32(msg);
 371         ans_skb = cipso_v4_doi_dump(doi, NLMSG_SPACE(GENL_HDRLEN));
 372         if (ans_skb == NULL) {
 373                 ret_val = -ENOMEM;
 374                 goto list_failure;
 375         }
 376         netlbl_netlink_hdr_push(ans_skb,
 377                                 info->snd_pid,
 378                                 0,
 379                                 netlbl_cipsov4_gnl_family.id,
 380                                 NLBL_CIPSOV4_C_LIST);
 381
 382         ret_val = netlbl_netlink_snd(ans_skb, info->snd_pid);
 383         if (ret_val != 0)
 384                 goto list_failure;
 385
 386         return 0;
 387
 388 list_failure:
 389         netlbl_netlink_send_ack(info,
 390                                 netlbl_cipsov4_gnl_family.id,
 391                                 NLBL_CIPSOV4_C_ACK,
 392                                 -ret_val);
 393         return ret_val;
 394 }
 395
 396 /**
 397  * netlbl_cipsov4_listall - Handle a LISTALL message
 398  * @skb: the NETLINK buffer
 399  * @info: the Generic NETLINK info block
 400  *
 401  * Description:
 402  * Process a user generated LISTALL message and respond accordingly.  Returns
 403  * zero on success and negative values on error.
 404  *
 405  */
 406 static int netlbl_cipsov4_listall(struct sk_buff *skb, struct genl_info *info)
 407 {
 408         int ret_val = -EINVAL;
 409         struct sk_buff *ans_skb;
 410
 411         ans_skb = cipso_v4_doi_dump_all(NLMSG_SPACE(GENL_HDRLEN));
 412         if (ans_skb == NULL) {
 413                 ret_val = -ENOMEM;
 414                 goto listall_failure;
 415         }
 416         netlbl_netlink_hdr_push(ans_skb,
 417                                 info->snd_pid,
 418                                 0,
 419                                 netlbl_cipsov4_gnl_family.id,
 420                                 NLBL_CIPSOV4_C_LISTALL);
 421
 422         ret_val = netlbl_netlink_snd(ans_skb, info->snd_pid);
 423         if (ret_val != 0)
 424                 goto listall_failure;
 425
 426         return 0;
 427
 428 listall_failure:
 429         netlbl_netlink_send_ack(info,
 430                                 netlbl_cipsov4_gnl_family.id,
 431                                 NLBL_CIPSOV4_C_ACK,
 432                                 -ret_val);
 433         return ret_val;
 434 }
 435
 436 /**
 437  * netlbl_cipsov4_remove - Handle a REMOVE message
 438  * @skb: the NETLINK buffer
 439  * @info: the Generic NETLINK info block
 440  *
 441  * Description:
 442  * Process a user generated REMOVE message and respond accordingly.  Returns
 443  * zero on success, negative values on failure.
 444  *
 445  */
 446 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 447 {
 448         int ret_val;
 449         u32 doi;
 450         struct nlattr *msg = netlbl_netlink_payload_data(skb);
 451
 452         ret_val = netlbl_netlink_cap_check(skb, CAP_NET_ADMIN);
 453         if (ret_val != 0)
 454                 goto remove_return;
 455
 456         if (netlbl_netlink_payload_len(skb) != NETLBL_LEN_U32) {
 457                 ret_val = -EINVAL;
 458                 goto remove_return;
 459         }
 460
 461         doi = nla_get_u32(msg);
 462         ret_val = cipso_v4_doi_remove(doi, netlbl_cipsov4_doi_free);
 463
 464 remove_return:
 465         netlbl_netlink_send_ack(info,
 466                                 netlbl_cipsov4_gnl_family.id,
 467                                 NLBL_CIPSOV4_C_ACK,
 468                                 -ret_val);
 469         return ret_val;
 470 }
 471
 472 /*
 473  * NetLabel Generic NETLINK Command Definitions
 474  */
 475
 476 static struct genl_ops netlbl_cipsov4_genl_c_add = {
 477         .cmd = NLBL_CIPSOV4_C_ADD,
 478         .flags = 0,
 479         .doit = netlbl_cipsov4_add,
 480         .dumpit = NULL,
 481 };
 482
 483 static struct genl_ops netlbl_cipsov4_genl_c_remove = {
 484         .cmd = NLBL_CIPSOV4_C_REMOVE,
 485         .flags = 0,
 486         .doit = netlbl_cipsov4_remove,
 487         .dumpit = NULL,
 488 };
 489
 490 static struct genl_ops netlbl_cipsov4_genl_c_list = {
 491         .cmd = NLBL_CIPSOV4_C_LIST,
 492         .flags = 0,
 493         .doit = netlbl_cipsov4_list,
 494         .dumpit = NULL,
 495 };
 496
 497 static struct genl_ops netlbl_cipsov4_genl_c_listall = {
 498         .cmd = NLBL_CIPSOV4_C_LISTALL,
 499         .flags = 0,
 500         .doit = netlbl_cipsov4_listall,
 501         .dumpit = NULL,
 502 };
 503
 504 /*
 505  * NetLabel Generic NETLINK Protocol Functions
 506  */
 507
 508 /**
 509  * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
 510  *
 511  * Description:
 512  * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
 513  * mechanism.  Returns zero on success, negative values on failure.
 514  *
 515  */
 516 int netlbl_cipsov4_genl_init(void)
 517 {
 518         int ret_val;
 519
 520         ret_val = genl_register_family(&netlbl_cipsov4_gnl_family);
 521         if (ret_val != 0)
 522                 return ret_val;
 523
 524         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 525                                     &netlbl_cipsov4_genl_c_add);
 526         if (ret_val != 0)
 527                 return ret_val;
 528         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 529                                     &netlbl_cipsov4_genl_c_remove);
 530         if (ret_val != 0)
 531                 return ret_val;
 532         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 533                                     &netlbl_cipsov4_genl_c_list);
 534         if (ret_val != 0)
 535                 return ret_val;
 536         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 537                                     &netlbl_cipsov4_genl_c_listall);
 538         if (ret_val != 0)
 539                 return ret_val;
 540
 541         return 0;
 542 }