net/netlabel/netlabel_cipso_v4.c

   1 /*
   2  * NetLabel CIPSO/IPv4 Support
   3  *
   4  * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
   5  * NetLabel system manages static and dynamic label mappings for network
   6  * protocols such as CIPSO and RIPSO.
   7  *
   8  * Author: Paul Moore <paul.moore@hp.com>
   9  *
  10  */
  11
  12 /*
  13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14  *
  15  * This program is free software;  you can redistribute it and/or modify
  16  * it under the terms of the GNU General Public License as published by
  17  * the Free Software Foundation; either version 2 of the License, or
  18  * (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  23  * the GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program;  if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28  *
  29  */
  30
  31 #include <linux/types.h>
  32 #include <linux/socket.h>
  33 #include <linux/string.h>
  34 #include <linux/skbuff.h>
  35 #include <linux/audit.h>
  36 #include <net/sock.h>
  37 #include <net/netlink.h>
  38 #include <net/genetlink.h>
  39 #include <net/netlabel.h>
  40 #include <net/cipso_ipv4.h>
  41
  42 #include "netlabel_user.h"
  43 #include "netlabel_cipso_v4.h"
  44
  45 /* Argument struct for cipso_v4_doi_walk() */
  46 struct netlbl_cipsov4_doiwalk_arg {
  47         struct netlink_callback *nl_cb;
  48         struct sk_buff *skb;
  49         u32 seq;
  50 };
  51
  52 /* NetLabel Generic NETLINK CIPSOv4 family */
  53 static struct genl_family netlbl_cipsov4_gnl_family = {
  54         .id = GENL_ID_GENERATE,
  55         .hdrsize = 0,
  56         .name = NETLBL_NLTYPE_CIPSOV4_NAME,
  57         .version = NETLBL_PROTO_VERSION,
  58         .maxattr = NLBL_CIPSOV4_A_MAX,
  59 };
  60
  61 /* NetLabel Netlink attribute policy */
  62 static struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
  63         [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
  64         [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
  65         [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
  66         [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
  67         [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
  68         [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
  69         [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
  70         [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
  71         [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
  72         [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
  73         [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
  74         [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
  75 };
  76
  77 /*
  78  * Helper Functions
  79  */
  80
  81 /**
  82  * netlbl_cipsov4_doi_free - Frees a CIPSO V4 DOI definition
  83  * @entry: the entry's RCU field
  84  *
  85  * Description:
  86  * This function is designed to be used as a callback to the call_rcu()
  87  * function so that the memory allocated to the DOI definition can be released
  88  * safely.
  89  *
  90  */
  91 static void netlbl_cipsov4_doi_free(struct rcu_head *entry)
  92 {
  93         struct cipso_v4_doi *ptr;
  94
  95         ptr = container_of(entry, struct cipso_v4_doi, rcu);
  96         switch (ptr->type) {
  97         case CIPSO_V4_MAP_STD:
  98                 kfree(ptr->map.std->lvl.cipso);
  99                 kfree(ptr->map.std->lvl.local);
 100                 kfree(ptr->map.std->cat.cipso);
 101                 kfree(ptr->map.std->cat.local);
 102                 break;
 103         }
 104         kfree(ptr);
 105 }
 106
 107 /**
 108  * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
 109  * @info: the Generic NETLINK info block
 110  * @doi_def: the CIPSO V4 DOI definition
 111  *
 112  * Description:
 113  * Parse the common sections of a ADD message and fill in the related values
 114  * in @doi_def.  Returns zero on success, negative values on failure.
 115  *
 116  */
 117 static int netlbl_cipsov4_add_common(struct genl_info *info,
 118                                      struct cipso_v4_doi *doi_def)
 119 {
 120         struct nlattr *nla;
 121         int nla_rem;
 122         u32 iter = 0;
 123
 124         doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 125
 126         if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST],
 127                                 NLBL_CIPSOV4_A_MAX,
 128                                 netlbl_cipsov4_genl_policy) != 0)
 129                 return -EINVAL;
 130
 131         nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
 132                 if (nla->nla_type == NLBL_CIPSOV4_A_TAG) {
 133                         if (iter > CIPSO_V4_TAG_MAXCNT)
 134                                 return -EINVAL;
 135                         doi_def->tags[iter++] = nla_get_u8(nla);
 136                 }
 137         if (iter < CIPSO_V4_TAG_MAXCNT)
 138                 doi_def->tags[iter] = CIPSO_V4_TAG_INVALID;
 139
 140         return 0;
 141 }
 142
 143 /*
 144  * NetLabel Command Handlers
 145  */
 146
 147 /**
 148  * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
 149  * @info: the Generic NETLINK info block
 150  *
 151  * Description:
 152  * Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message
 153  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
 154  * error.
 155  *
 156  */
 157 static int netlbl_cipsov4_add_std(struct genl_info *info)
 158 {
 159         int ret_val = -EINVAL;
 160         struct cipso_v4_doi *doi_def = NULL;
 161         struct nlattr *nla_a;
 162         struct nlattr *nla_b;
 163         int nla_a_rem;
 164         int nla_b_rem;
 165         u32 iter;
 166
 167         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
 168             !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
 169                 return -EINVAL;
 170
 171         if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
 172                                 NLBL_CIPSOV4_A_MAX,
 173                                 netlbl_cipsov4_genl_policy) != 0)
 174                 return -EINVAL;
 175
 176         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
 177         if (doi_def == NULL)
 178                 return -ENOMEM;
 179         doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
 180         if (doi_def->map.std == NULL) {
 181                 ret_val = -ENOMEM;
 182                 goto add_std_failure;
 183         }
 184         doi_def->type = CIPSO_V4_MAP_STD;
 185
 186         ret_val = netlbl_cipsov4_add_common(info, doi_def);
 187         if (ret_val != 0)
 188                 goto add_std_failure;
 189         ret_val = -EINVAL;
 190
 191         nla_for_each_nested(nla_a,
 192                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
 193                             nla_a_rem)
 194                 if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSLVL) {
 195                         if (nla_validate_nested(nla_a,
 196                                             NLBL_CIPSOV4_A_MAX,
 197                                             netlbl_cipsov4_genl_policy) != 0)
 198                                         goto add_std_failure;
 199                         nla_for_each_nested(nla_b, nla_a, nla_b_rem)
 200                                 switch (nla_b->nla_type) {
 201                                 case NLBL_CIPSOV4_A_MLSLVLLOC:
 202                                         if (nla_get_u32(nla_b) >
 203                                             CIPSO_V4_MAX_LOC_LVLS)
 204                                                 goto add_std_failure;
 205                                         if (nla_get_u32(nla_b) >=
 206                                             doi_def->map.std->lvl.local_size)
 207                                              doi_def->map.std->lvl.local_size =
 208                                                      nla_get_u32(nla_b) + 1;
 209                                         break;
 210                                 case NLBL_CIPSOV4_A_MLSLVLREM:
 211                                         if (nla_get_u32(nla_b) >
 212                                             CIPSO_V4_MAX_REM_LVLS)
 213                                                 goto add_std_failure;
 214                                         if (nla_get_u32(nla_b) >=
 215                                             doi_def->map.std->lvl.cipso_size)
 216                                              doi_def->map.std->lvl.cipso_size =
 217                                                      nla_get_u32(nla_b) + 1;
 218                                         break;
 219                                 }
 220                 }
 221         doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
 222                                               sizeof(u32),
 223                                               GFP_KERNEL);
 224         if (doi_def->map.std->lvl.local == NULL) {
 225                 ret_val = -ENOMEM;
 226                 goto add_std_failure;
 227         }
 228         doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
 229                                               sizeof(u32),
 230                                               GFP_KERNEL);
 231         if (doi_def->map.std->lvl.cipso == NULL) {
 232                 ret_val = -ENOMEM;
 233                 goto add_std_failure;
 234         }
 235         for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
 236                 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
 237         for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
 238                 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
 239         nla_for_each_nested(nla_a,
 240                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
 241                             nla_a_rem)
 242                 if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSLVL) {
 243                         struct nlattr *lvl_loc;
 244                         struct nlattr *lvl_rem;
 245
 246                         lvl_loc = nla_find_nested(nla_a,
 247                                                   NLBL_CIPSOV4_A_MLSLVLLOC);
 248                         lvl_rem = nla_find_nested(nla_a,
 249                                                   NLBL_CIPSOV4_A_MLSLVLREM);
 250                         if (lvl_loc == NULL || lvl_rem == NULL)
 251                                 goto add_std_failure;
 252                         doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
 253                                 nla_get_u32(lvl_rem);
 254                         doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
 255                                 nla_get_u32(lvl_loc);
 256                 }
 257
 258         if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
 259                 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
 260                                         NLBL_CIPSOV4_A_MAX,
 261                                         netlbl_cipsov4_genl_policy) != 0)
 262                         goto add_std_failure;
 263
 264                 nla_for_each_nested(nla_a,
 265                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
 266                                     nla_a_rem)
 267                         if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSCAT) {
 268                                 if (nla_validate_nested(nla_a,
 269                                               NLBL_CIPSOV4_A_MAX,
 270                                               netlbl_cipsov4_genl_policy) != 0)
 271                                         goto add_std_failure;
 272                                 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
 273                                         switch (nla_b->nla_type) {
 274                                         case NLBL_CIPSOV4_A_MLSCATLOC:
 275                                                 if (nla_get_u32(nla_b) >
 276                                                     CIPSO_V4_MAX_LOC_CATS)
 277                                                         goto add_std_failure;
 278                                                 if (nla_get_u32(nla_b) >=
 279                                               doi_def->map.std->cat.local_size)
 280                                              doi_def->map.std->cat.local_size =
 281                                                      nla_get_u32(nla_b) + 1;
 282                                                 break;
 283                                         case NLBL_CIPSOV4_A_MLSCATREM:
 284                                                 if (nla_get_u32(nla_b) >
 285                                                     CIPSO_V4_MAX_REM_CATS)
 286                                                         goto add_std_failure;
 287                                                 if (nla_get_u32(nla_b) >=
 288                                               doi_def->map.std->cat.cipso_size)
 289                                              doi_def->map.std->cat.cipso_size =
 290                                                      nla_get_u32(nla_b) + 1;
 291                                                 break;
 292                                         }
 293                         }
 294                 doi_def->map.std->cat.local = kcalloc(
 295                                               doi_def->map.std->cat.local_size,
 296                                               sizeof(u32),
 297                                               GFP_KERNEL);
 298                 if (doi_def->map.std->cat.local == NULL) {
 299                         ret_val = -ENOMEM;
 300                         goto add_std_failure;
 301                 }
 302                 doi_def->map.std->cat.cipso = kcalloc(
 303                                               doi_def->map.std->cat.cipso_size,
 304                                               sizeof(u32),
 305                                               GFP_KERNEL);
 306                 if (doi_def->map.std->cat.cipso == NULL) {
 307                         ret_val = -ENOMEM;
 308                         goto add_std_failure;
 309                 }
 310                 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
 311                         doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
 312                 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
 313                         doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
 314                 nla_for_each_nested(nla_a,
 315                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
 316                                     nla_a_rem)
 317                         if (nla_a->nla_type == NLBL_CIPSOV4_A_MLSCAT) {
 318                                 struct nlattr *cat_loc;
 319                                 struct nlattr *cat_rem;
 320
 321                                 cat_loc = nla_find_nested(nla_a,
 322                                                      NLBL_CIPSOV4_A_MLSCATLOC);
 323                                 cat_rem = nla_find_nested(nla_a,
 324                                                      NLBL_CIPSOV4_A_MLSCATREM);
 325                                 if (cat_loc == NULL || cat_rem == NULL)
 326                                         goto add_std_failure;
 327                                 doi_def->map.std->cat.local[
 328                                                         nla_get_u32(cat_loc)] =
 329                                         nla_get_u32(cat_rem);
 330                                 doi_def->map.std->cat.cipso[
 331                                                         nla_get_u32(cat_rem)] =
 332                                         nla_get_u32(cat_loc);
 333                         }
 334         }
 335
 336         ret_val = cipso_v4_doi_add(doi_def);
 337         if (ret_val != 0)
 338                 goto add_std_failure;
 339         return 0;
 340
 341 add_std_failure:
 342         if (doi_def)
 343                 netlbl_cipsov4_doi_free(&doi_def->rcu);
 344         return ret_val;
 345 }
 346
 347 /**
 348  * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
 349  * @info: the Generic NETLINK info block
 350  *
 351  * Description:
 352  * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
 353  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
 354  * error.
 355  *
 356  */
 357 static int netlbl_cipsov4_add_pass(struct genl_info *info)
 358 {
 359         int ret_val;
 360         struct cipso_v4_doi *doi_def = NULL;
 361
 362         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
 363                 return -EINVAL;
 364
 365         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
 366         if (doi_def == NULL)
 367                 return -ENOMEM;
 368         doi_def->type = CIPSO_V4_MAP_PASS;
 369
 370         ret_val = netlbl_cipsov4_add_common(info, doi_def);
 371         if (ret_val != 0)
 372                 goto add_pass_failure;
 373
 374         ret_val = cipso_v4_doi_add(doi_def);
 375         if (ret_val != 0)
 376                 goto add_pass_failure;
 377         return 0;
 378
 379 add_pass_failure:
 380         netlbl_cipsov4_doi_free(&doi_def->rcu);
 381         return ret_val;
 382 }
 383
 384 /**
 385  * netlbl_cipsov4_add - Handle an ADD message
 386  * @skb: the NETLINK buffer
 387  * @info: the Generic NETLINK info block
 388  *
 389  * Description:
 390  * Create a new DOI definition based on the given ADD message and add it to the
 391  * CIPSO V4 engine.  Returns zero on success, negative values on failure.
 392  *
 393  */
 394 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 395
 396 {
 397         int ret_val = -EINVAL;
 398         u32 type;
 399         u32 doi;
 400         const char *type_str = "(unknown)";
 401         struct audit_buffer *audit_buf;
 402         struct netlbl_audit audit_info;
 403
 404         if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
 405             !info->attrs[NLBL_CIPSOV4_A_MTYPE])
 406                 return -EINVAL;
 407
 408         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 409         netlbl_netlink_auditinfo(skb, &audit_info);
 410
 411         type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
 412         switch (type) {
 413         case CIPSO_V4_MAP_STD:
 414                 type_str = "std";
 415                 ret_val = netlbl_cipsov4_add_std(info);
 416                 break;
 417         case CIPSO_V4_MAP_PASS:
 418                 type_str = "pass";
 419                 ret_val = netlbl_cipsov4_add_pass(info);
 420                 break;
 421         }
 422
 423         audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
 424                                               &audit_info);
 425         if (audit_buf != NULL) {
 426                 audit_log_format(audit_buf,
 427                                  " cipso_doi=%u cipso_type=%s res=%u",
 428                                  doi,
 429                                  type_str,
 430                                  ret_val == 0 ? 1 : 0);
 431                 audit_log_end(audit_buf);
 432         }
 433
 434         return ret_val;
 435 }
 436
 437 /**
 438  * netlbl_cipsov4_list - Handle a LIST message
 439  * @skb: the NETLINK buffer
 440  * @info: the Generic NETLINK info block
 441  *
 442  * Description:
 443  * Process a user generated LIST message and respond accordingly.  While the
 444  * response message generated by the kernel is straightforward, determining
 445  * before hand the size of the buffer to allocate is not (we have to generate
 446  * the message to know the size).  In order to keep this function sane what we
 447  * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
 448  * that size, if we fail then we restart with a larger buffer and try again.
 449  * We continue in this manner until we hit a limit of failed attempts then we
 450  * give up and just send an error message.  Returns zero on success and
 451  * negative values on error.
 452  *
 453  */
 454 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
 455 {
 456         int ret_val;
 457         struct sk_buff *ans_skb = NULL;
 458         u32 nlsze_mult = 1;
 459         void *data;
 460         u32 doi;
 461         struct nlattr *nla_a;
 462         struct nlattr *nla_b;
 463         struct cipso_v4_doi *doi_def;
 464         u32 iter;
 465
 466         if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
 467                 ret_val = -EINVAL;
 468                 goto list_failure;
 469         }
 470
 471 list_start:
 472         ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
 473         if (ans_skb == NULL) {
 474                 ret_val = -ENOMEM;
 475                 goto list_failure;
 476         }
 477         data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
 478                                  0, NLBL_CIPSOV4_C_LIST);
 479         if (data == NULL) {
 480                 ret_val = -ENOMEM;
 481                 goto list_failure;
 482         }
 483
 484         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 485
 486         rcu_read_lock();
 487         doi_def = cipso_v4_doi_getdef(doi);
 488         if (doi_def == NULL) {
 489                 ret_val = -EINVAL;
 490                 goto list_failure;
 491         }
 492
 493         ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
 494         if (ret_val != 0)
 495                 goto list_failure_lock;
 496
 497         nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST);
 498         if (nla_a == NULL) {
 499                 ret_val = -ENOMEM;
 500                 goto list_failure_lock;
 501         }
 502         for (iter = 0;
 503              iter < CIPSO_V4_TAG_MAXCNT &&
 504                doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
 505              iter++) {
 506                 ret_val = nla_put_u8(ans_skb,
 507                                      NLBL_CIPSOV4_A_TAG,
 508                                      doi_def->tags[iter]);
 509                 if (ret_val != 0)
 510                         goto list_failure_lock;
 511         }
 512         nla_nest_end(ans_skb, nla_a);
 513
 514         switch (doi_def->type) {
 515         case CIPSO_V4_MAP_STD:
 516                 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
 517                 if (nla_a == NULL) {
 518                         ret_val = -ENOMEM;
 519                         goto list_failure_lock;
 520                 }
 521                 for (iter = 0;
 522                      iter < doi_def->map.std->lvl.local_size;
 523                      iter++) {
 524                         if (doi_def->map.std->lvl.local[iter] ==
 525                             CIPSO_V4_INV_LVL)
 526                                 continue;
 527
 528                         nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL);
 529                         if (nla_b == NULL) {
 530                                 ret_val = -ENOMEM;
 531                                 goto list_retry;
 532                         }
 533                         ret_val = nla_put_u32(ans_skb,
 534                                               NLBL_CIPSOV4_A_MLSLVLLOC,
 535                                               iter);
 536                         if (ret_val != 0)
 537                                 goto list_retry;
 538                         ret_val = nla_put_u32(ans_skb,
 539                                             NLBL_CIPSOV4_A_MLSLVLREM,
 540                                             doi_def->map.std->lvl.local[iter]);
 541                         if (ret_val != 0)
 542                                 goto list_retry;
 543                         nla_nest_end(ans_skb, nla_b);
 544                 }
 545                 nla_nest_end(ans_skb, nla_a);
 546
 547                 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST);
 548                 if (nla_a == NULL) {
 549                         ret_val = -ENOMEM;
 550                         goto list_retry;
 551                 }
 552                 for (iter = 0;
 553                      iter < doi_def->map.std->cat.local_size;
 554                      iter++) {
 555                         if (doi_def->map.std->cat.local[iter] ==
 556                             CIPSO_V4_INV_CAT)
 557                                 continue;
 558
 559                         nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT);
 560                         if (nla_b == NULL) {
 561                                 ret_val = -ENOMEM;
 562                                 goto list_retry;
 563                         }
 564                         ret_val = nla_put_u32(ans_skb,
 565                                               NLBL_CIPSOV4_A_MLSCATLOC,
 566                                               iter);
 567                         if (ret_val != 0)
 568                                 goto list_retry;
 569                         ret_val = nla_put_u32(ans_skb,
 570                                             NLBL_CIPSOV4_A_MLSCATREM,
 571                                             doi_def->map.std->cat.local[iter]);
 572                         if (ret_val != 0)
 573                                 goto list_retry;
 574                         nla_nest_end(ans_skb, nla_b);
 575                 }
 576                 nla_nest_end(ans_skb, nla_a);
 577
 578                 break;
 579         }
 580         rcu_read_unlock();
 581
 582         genlmsg_end(ans_skb, data);
 583
 584         ret_val = genlmsg_reply(ans_skb, info);
 585         if (ret_val != 0)
 586                 goto list_failure;
 587
 588         return 0;
 589
 590 list_retry:
 591         /* XXX - this limit is a guesstimate */
 592         if (nlsze_mult < 4) {
 593                 rcu_read_unlock();
 594                 kfree_skb(ans_skb);
 595                 nlsze_mult++;
 596                 goto list_start;
 597         }
 598 list_failure_lock:
 599         rcu_read_unlock();
 600 list_failure:
 601         kfree_skb(ans_skb);
 602         return ret_val;
 603 }
 604
 605 /**
 606  * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
 607  * @doi_def: the CIPSOv4 DOI definition
 608  * @arg: the netlbl_cipsov4_doiwalk_arg structure
 609  *
 610  * Description:
 611  * This function is designed to be used as a callback to the
 612  * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
 613  * message.  Returns the size of the message on success, negative values on
 614  * failure.
 615  *
 616  */
 617 static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
 618 {
 619         int ret_val = -ENOMEM;
 620         struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
 621         void *data;
 622
 623         data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
 624                            cb_arg->seq, &netlbl_cipsov4_gnl_family,
 625                            NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
 626         if (data == NULL)
 627                 goto listall_cb_failure;
 628
 629         ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
 630         if (ret_val != 0)
 631                 goto listall_cb_failure;
 632         ret_val = nla_put_u32(cb_arg->skb,
 633                               NLBL_CIPSOV4_A_MTYPE,
 634                               doi_def->type);
 635         if (ret_val != 0)
 636                 goto listall_cb_failure;
 637
 638         return genlmsg_end(cb_arg->skb, data);
 639
 640 listall_cb_failure:
 641         genlmsg_cancel(cb_arg->skb, data);
 642         return ret_val;
 643 }
 644
 645 /**
 646  * netlbl_cipsov4_listall - Handle a LISTALL message
 647  * @skb: the NETLINK buffer
 648  * @cb: the NETLINK callback
 649  *
 650  * Description:
 651  * Process a user generated LISTALL message and respond accordingly.  Returns
 652  * zero on success and negative values on error.
 653  *
 654  */
 655 static int netlbl_cipsov4_listall(struct sk_buff *skb,
 656                                   struct netlink_callback *cb)
 657 {
 658         struct netlbl_cipsov4_doiwalk_arg cb_arg;
 659         int doi_skip = cb->args[0];
 660
 661         cb_arg.nl_cb = cb;
 662         cb_arg.skb = skb;
 663         cb_arg.seq = cb->nlh->nlmsg_seq;
 664
 665         cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
 666
 667         cb->args[0] = doi_skip;
 668         return skb->len;
 669 }
 670
 671 /**
 672  * netlbl_cipsov4_remove - Handle a REMOVE message
 673  * @skb: the NETLINK buffer
 674  * @info: the Generic NETLINK info block
 675  *
 676  * Description:
 677  * Process a user generated REMOVE message and respond accordingly.  Returns
 678  * zero on success, negative values on failure.
 679  *
 680  */
 681 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 682 {
 683         int ret_val = -EINVAL;
 684         u32 doi = 0;
 685         struct audit_buffer *audit_buf;
 686         struct netlbl_audit audit_info;
 687
 688         if (!info->attrs[NLBL_CIPSOV4_A_DOI])
 689                 return -EINVAL;
 690
 691         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 692         netlbl_netlink_auditinfo(skb, &audit_info);
 693
 694         ret_val = cipso_v4_doi_remove(doi,
 695                                       &audit_info,
 696                                       netlbl_cipsov4_doi_free);
 697
 698         audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
 699                                               &audit_info);
 700         if (audit_buf != NULL) {
 701                 audit_log_format(audit_buf,
 702                                  " cipso_doi=%u res=%u",
 703                                  doi,
 704                                  ret_val == 0 ? 1 : 0);
 705                 audit_log_end(audit_buf);
 706         }
 707
 708         return ret_val;
 709 }
 710
 711 /*
 712  * NetLabel Generic NETLINK Command Definitions
 713  */
 714
 715 static struct genl_ops netlbl_cipsov4_genl_c_add = {
 716         .cmd = NLBL_CIPSOV4_C_ADD,
 717         .flags = GENL_ADMIN_PERM,
 718         .policy = netlbl_cipsov4_genl_policy,
 719         .doit = netlbl_cipsov4_add,
 720         .dumpit = NULL,
 721 };
 722
 723 static struct genl_ops netlbl_cipsov4_genl_c_remove = {
 724         .cmd = NLBL_CIPSOV4_C_REMOVE,
 725         .flags = GENL_ADMIN_PERM,
 726         .policy = netlbl_cipsov4_genl_policy,
 727         .doit = netlbl_cipsov4_remove,
 728         .dumpit = NULL,
 729 };
 730
 731 static struct genl_ops netlbl_cipsov4_genl_c_list = {
 732         .cmd = NLBL_CIPSOV4_C_LIST,
 733         .flags = 0,
 734         .policy = netlbl_cipsov4_genl_policy,
 735         .doit = netlbl_cipsov4_list,
 736         .dumpit = NULL,
 737 };
 738
 739 static struct genl_ops netlbl_cipsov4_genl_c_listall = {
 740         .cmd = NLBL_CIPSOV4_C_LISTALL,
 741         .flags = 0,
 742         .policy = netlbl_cipsov4_genl_policy,
 743         .doit = NULL,
 744         .dumpit = netlbl_cipsov4_listall,
 745 };
 746
 747 /*
 748  * NetLabel Generic NETLINK Protocol Functions
 749  */
 750
 751 /**
 752  * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
 753  *
 754  * Description:
 755  * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
 756  * mechanism.  Returns zero on success, negative values on failure.
 757  *
 758  */
 759 int netlbl_cipsov4_genl_init(void)
 760 {
 761         int ret_val;
 762
 763         ret_val = genl_register_family(&netlbl_cipsov4_gnl_family);
 764         if (ret_val != 0)
 765                 return ret_val;
 766
 767         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 768                                     &netlbl_cipsov4_genl_c_add);
 769         if (ret_val != 0)
 770                 return ret_val;
 771         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 772                                     &netlbl_cipsov4_genl_c_remove);
 773         if (ret_val != 0)
 774                 return ret_val;
 775         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 776                                     &netlbl_cipsov4_genl_c_list);
 777         if (ret_val != 0)
 778                 return ret_val;
 779         ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
 780                                     &netlbl_cipsov4_genl_c_listall);
 781         if (ret_val != 0)
 782                 return ret_val;
 783
 784         return 0;
 785 }