net/netlabel/netlabel_cipso_v4.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * NetLabel CIPSO/IPv4 Support
   4  *
   5  * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
   6  * NetLabel system manages static and dynamic label mappings for network
   7  * protocols such as CIPSO and RIPSO.
   8  *
   9  * Author: Paul Moore <paul@paul-moore.com>
  10  */
  11
  12 /*
  13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14  */
  15
  16 #include <linux/types.h>
  17 #include <linux/socket.h>
  18 #include <linux/string.h>
  19 #include <linux/skbuff.h>
  20 #include <linux/audit.h>
  21 #include <linux/slab.h>
  22 #include <net/sock.h>
  23 #include <net/netlink.h>
  24 #include <net/genetlink.h>
  25 #include <net/netlabel.h>
  26 #include <net/cipso_ipv4.h>
  27 #include <linux/atomic.h>
  28
  29 #include "netlabel_user.h"
  30 #include "netlabel_cipso_v4.h"
  31 #include "netlabel_mgmt.h"
  32 #include "netlabel_domainhash.h"
  33
  34 /* Argument struct for cipso_v4_doi_walk() */
  35 struct netlbl_cipsov4_doiwalk_arg {
  36         struct netlink_callback *nl_cb;
  37         struct sk_buff *skb;
  38         u32 seq;
  39 };
  40
  41 /* Argument struct for netlbl_domhsh_walk() */
  42 struct netlbl_domhsh_walk_arg {
  43         struct netlbl_audit *audit_info;
  44         u32 doi;
  45 };
  46
  47 /* NetLabel Generic NETLINK CIPSOv4 family */
  48 static struct genl_family netlbl_cipsov4_gnl_family;
  49 /* NetLabel Netlink attribute policy */
  50 static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
  51         [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
  52         [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
  53         [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
  54         [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
  55         [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
  56         [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
  57         [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
  58         [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
  59         [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
  60         [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
  61         [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
  62         [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
  63 };
  64
  65 /*
  66  * Helper Functions
  67  */
  68
  69 /**
  70  * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
  71  * @info: the Generic NETLINK info block
  72  * @doi_def: the CIPSO V4 DOI definition
  73  *
  74  * Description:
  75  * Parse the common sections of a ADD message and fill in the related values
  76  * in @doi_def.  Returns zero on success, negative values on failure.
  77  *
  78  */
  79 static int netlbl_cipsov4_add_common(struct genl_info *info,
  80                                      struct cipso_v4_doi *doi_def)
  81 {
  82         struct nlattr *nla;
  83         int nla_rem;
  84         u32 iter = 0;
  85
  86         doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
  87
  88         if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_TAGLST],
  89                                            NLBL_CIPSOV4_A_MAX,
  90                                            netlbl_cipsov4_genl_policy,
  91                                            NULL) != 0)
  92                 return -EINVAL;
  93
  94         nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
  95                 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) {
  96                         if (iter >= CIPSO_V4_TAG_MAXCNT)
  97                                 return -EINVAL;
  98                         doi_def->tags[iter++] = nla_get_u8(nla);
  99                 }
 100         while (iter < CIPSO_V4_TAG_MAXCNT)
 101                 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
 102
 103         return 0;
 104 }
 105
 106 /*
 107  * NetLabel Command Handlers
 108  */
 109
 110 /**
 111  * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
 112  * @info: the Generic NETLINK info block
 113  * @audit_info: NetLabel audit information
 114  *
 115  * Description:
 116  * Create a new CIPSO_V4_MAP_TRANS DOI definition based on the given ADD
 117  * message and add it to the CIPSO V4 engine.  Return zero on success and
 118  * non-zero on error.
 119  *
 120  */
 121 static int netlbl_cipsov4_add_std(struct genl_info *info,
 122                                   struct netlbl_audit *audit_info)
 123 {
 124         int ret_val = -EINVAL;
 125         struct cipso_v4_doi *doi_def = NULL;
 126         struct nlattr *nla_a;
 127         struct nlattr *nla_b;
 128         int nla_a_rem;
 129         int nla_b_rem;
 130         u32 iter;
 131
 132         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
 133             !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
 134                 return -EINVAL;
 135
 136         if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
 137                                            NLBL_CIPSOV4_A_MAX,
 138                                            netlbl_cipsov4_genl_policy,
 139                                            NULL) != 0)
 140                 return -EINVAL;
 141
 142         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
 143         if (doi_def == NULL)
 144                 return -ENOMEM;
 145         doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
 146         if (doi_def->map.std == NULL) {
 147                 kfree(doi_def);
 148                 return -ENOMEM;
 149         }
 150         doi_def->type = CIPSO_V4_MAP_TRANS;
 151
 152         ret_val = netlbl_cipsov4_add_common(info, doi_def);
 153         if (ret_val != 0)
 154                 goto add_std_failure;
 155         ret_val = -EINVAL;
 156
 157         nla_for_each_nested(nla_a,
 158                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
 159                             nla_a_rem)
 160                 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
 161                         if (nla_validate_nested_deprecated(nla_a,
 162                                                            NLBL_CIPSOV4_A_MAX,
 163                                                            netlbl_cipsov4_genl_policy,
 164                                                            NULL) != 0)
 165                                 goto add_std_failure;
 166                         nla_for_each_nested(nla_b, nla_a, nla_b_rem)
 167                                 switch (nla_type(nla_b)) {
 168                                 case NLBL_CIPSOV4_A_MLSLVLLOC:
 169                                         if (nla_get_u32(nla_b) >
 170                                             CIPSO_V4_MAX_LOC_LVLS)
 171                                                 goto add_std_failure;
 172                                         if (nla_get_u32(nla_b) >=
 173                                             doi_def->map.std->lvl.local_size)
 174                                              doi_def->map.std->lvl.local_size =
 175                                                      nla_get_u32(nla_b) + 1;
 176                                         break;
 177                                 case NLBL_CIPSOV4_A_MLSLVLREM:
 178                                         if (nla_get_u32(nla_b) >
 179                                             CIPSO_V4_MAX_REM_LVLS)
 180                                                 goto add_std_failure;
 181                                         if (nla_get_u32(nla_b) >=
 182                                             doi_def->map.std->lvl.cipso_size)
 183                                              doi_def->map.std->lvl.cipso_size =
 184                                                      nla_get_u32(nla_b) + 1;
 185                                         break;
 186                                 }
 187                 }
 188         doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
 189                                               sizeof(u32),
 190                                               GFP_KERNEL | __GFP_NOWARN);
 191         if (doi_def->map.std->lvl.local == NULL) {
 192                 ret_val = -ENOMEM;
 193                 goto add_std_failure;
 194         }
 195         doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
 196                                               sizeof(u32),
 197                                               GFP_KERNEL | __GFP_NOWARN);
 198         if (doi_def->map.std->lvl.cipso == NULL) {
 199                 ret_val = -ENOMEM;
 200                 goto add_std_failure;
 201         }
 202         for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
 203                 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
 204         for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
 205                 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
 206         nla_for_each_nested(nla_a,
 207                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
 208                             nla_a_rem)
 209                 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
 210                         struct nlattr *lvl_loc;
 211                         struct nlattr *lvl_rem;
 212
 213                         lvl_loc = nla_find_nested(nla_a,
 214                                                   NLBL_CIPSOV4_A_MLSLVLLOC);
 215                         lvl_rem = nla_find_nested(nla_a,
 216                                                   NLBL_CIPSOV4_A_MLSLVLREM);
 217                         if (lvl_loc == NULL || lvl_rem == NULL)
 218                                 goto add_std_failure;
 219                         doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
 220                                 nla_get_u32(lvl_rem);
 221                         doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
 222                                 nla_get_u32(lvl_loc);
 223                 }
 224
 225         if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
 226                 if (nla_validate_nested_deprecated(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
 227                                                    NLBL_CIPSOV4_A_MAX,
 228                                                    netlbl_cipsov4_genl_policy,
 229                                                    NULL) != 0)
 230                         goto add_std_failure;
 231
 232                 nla_for_each_nested(nla_a,
 233                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
 234                                     nla_a_rem)
 235                         if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
 236                                 if (nla_validate_nested_deprecated(nla_a,
 237                                                                    NLBL_CIPSOV4_A_MAX,
 238                                                                    netlbl_cipsov4_genl_policy,
 239                                                                    NULL) != 0)
 240                                         goto add_std_failure;
 241                                 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
 242                                         switch (nla_type(nla_b)) {
 243                                         case NLBL_CIPSOV4_A_MLSCATLOC:
 244                                                 if (nla_get_u32(nla_b) >
 245                                                     CIPSO_V4_MAX_LOC_CATS)
 246                                                         goto add_std_failure;
 247                                                 if (nla_get_u32(nla_b) >=
 248                                               doi_def->map.std->cat.local_size)
 249                                              doi_def->map.std->cat.local_size =
 250                                                      nla_get_u32(nla_b) + 1;
 251                                                 break;
 252                                         case NLBL_CIPSOV4_A_MLSCATREM:
 253                                                 if (nla_get_u32(nla_b) >
 254                                                     CIPSO_V4_MAX_REM_CATS)
 255                                                         goto add_std_failure;
 256                                                 if (nla_get_u32(nla_b) >=
 257                                               doi_def->map.std->cat.cipso_size)
 258                                              doi_def->map.std->cat.cipso_size =
 259                                                      nla_get_u32(nla_b) + 1;
 260                                                 break;
 261                                         }
 262                         }
 263                 doi_def->map.std->cat.local = kcalloc(
 264                                               doi_def->map.std->cat.local_size,
 265                                               sizeof(u32),
 266                                               GFP_KERNEL | __GFP_NOWARN);
 267                 if (doi_def->map.std->cat.local == NULL) {
 268                         ret_val = -ENOMEM;
 269                         goto add_std_failure;
 270                 }
 271                 doi_def->map.std->cat.cipso = kcalloc(
 272                                               doi_def->map.std->cat.cipso_size,
 273                                               sizeof(u32),
 274                                               GFP_KERNEL | __GFP_NOWARN);
 275                 if (doi_def->map.std->cat.cipso == NULL) {
 276                         ret_val = -ENOMEM;
 277                         goto add_std_failure;
 278                 }
 279                 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
 280                         doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
 281                 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
 282                         doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
 283                 nla_for_each_nested(nla_a,
 284                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
 285                                     nla_a_rem)
 286                         if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
 287                                 struct nlattr *cat_loc;
 288                                 struct nlattr *cat_rem;
 289
 290                                 cat_loc = nla_find_nested(nla_a,
 291                                                      NLBL_CIPSOV4_A_MLSCATLOC);
 292                                 cat_rem = nla_find_nested(nla_a,
 293                                                      NLBL_CIPSOV4_A_MLSCATREM);
 294                                 if (cat_loc == NULL || cat_rem == NULL)
 295                                         goto add_std_failure;
 296                                 doi_def->map.std->cat.local[
 297                                                         nla_get_u32(cat_loc)] =
 298                                         nla_get_u32(cat_rem);
 299                                 doi_def->map.std->cat.cipso[
 300                                                         nla_get_u32(cat_rem)] =
 301                                         nla_get_u32(cat_loc);
 302                         }
 303         }
 304
 305         ret_val = cipso_v4_doi_add(doi_def, audit_info);
 306         if (ret_val != 0)
 307                 goto add_std_failure;
 308         return 0;
 309
 310 add_std_failure:
 311         cipso_v4_doi_free(doi_def);
 312         return ret_val;
 313 }
 314
 315 /**
 316  * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
 317  * @info: the Generic NETLINK info block
 318  * @audit_info: NetLabel audit information
 319  *
 320  * Description:
 321  * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
 322  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
 323  * error.
 324  *
 325  */
 326 static int netlbl_cipsov4_add_pass(struct genl_info *info,
 327                                    struct netlbl_audit *audit_info)
 328 {
 329         int ret_val;
 330         struct cipso_v4_doi *doi_def = NULL;
 331
 332         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
 333                 return -EINVAL;
 334
 335         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
 336         if (doi_def == NULL)
 337                 return -ENOMEM;
 338         doi_def->type = CIPSO_V4_MAP_PASS;
 339
 340         ret_val = netlbl_cipsov4_add_common(info, doi_def);
 341         if (ret_val != 0)
 342                 goto add_pass_failure;
 343
 344         ret_val = cipso_v4_doi_add(doi_def, audit_info);
 345         if (ret_val != 0)
 346                 goto add_pass_failure;
 347         return 0;
 348
 349 add_pass_failure:
 350         cipso_v4_doi_free(doi_def);
 351         return ret_val;
 352 }
 353
 354 /**
 355  * netlbl_cipsov4_add_local - Adds a CIPSO V4 DOI definition
 356  * @info: the Generic NETLINK info block
 357  * @audit_info: NetLabel audit information
 358  *
 359  * Description:
 360  * Create a new CIPSO_V4_MAP_LOCAL DOI definition based on the given ADD
 361  * message and add it to the CIPSO V4 engine.  Return zero on success and
 362  * non-zero on error.
 363  *
 364  */
 365 static int netlbl_cipsov4_add_local(struct genl_info *info,
 366                                     struct netlbl_audit *audit_info)
 367 {
 368         int ret_val;
 369         struct cipso_v4_doi *doi_def = NULL;
 370
 371         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
 372                 return -EINVAL;
 373
 374         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
 375         if (doi_def == NULL)
 376                 return -ENOMEM;
 377         doi_def->type = CIPSO_V4_MAP_LOCAL;
 378
 379         ret_val = netlbl_cipsov4_add_common(info, doi_def);
 380         if (ret_val != 0)
 381                 goto add_local_failure;
 382
 383         ret_val = cipso_v4_doi_add(doi_def, audit_info);
 384         if (ret_val != 0)
 385                 goto add_local_failure;
 386         return 0;
 387
 388 add_local_failure:
 389         cipso_v4_doi_free(doi_def);
 390         return ret_val;
 391 }
 392
 393 /**
 394  * netlbl_cipsov4_add - Handle an ADD message
 395  * @skb: the NETLINK buffer
 396  * @info: the Generic NETLINK info block
 397  *
 398  * Description:
 399  * Create a new DOI definition based on the given ADD message and add it to the
 400  * CIPSO V4 engine.  Returns zero on success, negative values on failure.
 401  *
 402  */
 403 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 404
 405 {
 406         int ret_val = -EINVAL;
 407         struct netlbl_audit audit_info;
 408
 409         if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
 410             !info->attrs[NLBL_CIPSOV4_A_MTYPE])
 411                 return -EINVAL;
 412
 413         netlbl_netlink_auditinfo(&audit_info);
 414         switch (nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE])) {
 415         case CIPSO_V4_MAP_TRANS:
 416                 ret_val = netlbl_cipsov4_add_std(info, &audit_info);
 417                 break;
 418         case CIPSO_V4_MAP_PASS:
 419                 ret_val = netlbl_cipsov4_add_pass(info, &audit_info);
 420                 break;
 421         case CIPSO_V4_MAP_LOCAL:
 422                 ret_val = netlbl_cipsov4_add_local(info, &audit_info);
 423                 break;
 424         }
 425         if (ret_val == 0)
 426                 atomic_inc(&netlabel_mgmt_protocount);
 427
 428         return ret_val;
 429 }
 430
 431 /**
 432  * netlbl_cipsov4_list - Handle a LIST message
 433  * @skb: the NETLINK buffer
 434  * @info: the Generic NETLINK info block
 435  *
 436  * Description:
 437  * Process a user generated LIST message and respond accordingly.  While the
 438  * response message generated by the kernel is straightforward, determining
 439  * before hand the size of the buffer to allocate is not (we have to generate
 440  * the message to know the size).  In order to keep this function sane what we
 441  * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
 442  * that size, if we fail then we restart with a larger buffer and try again.
 443  * We continue in this manner until we hit a limit of failed attempts then we
 444  * give up and just send an error message.  Returns zero on success and
 445  * negative values on error.
 446  *
 447  */
 448 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
 449 {
 450         int ret_val;
 451         struct sk_buff *ans_skb = NULL;
 452         u32 nlsze_mult = 1;
 453         void *data;
 454         u32 doi;
 455         struct nlattr *nla_a;
 456         struct nlattr *nla_b;
 457         struct cipso_v4_doi *doi_def;
 458         u32 iter;
 459
 460         if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
 461                 ret_val = -EINVAL;
 462                 goto list_failure;
 463         }
 464
 465 list_start:
 466         ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
 467         if (ans_skb == NULL) {
 468                 ret_val = -ENOMEM;
 469                 goto list_failure;
 470         }
 471         data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
 472                                  0, NLBL_CIPSOV4_C_LIST);
 473         if (data == NULL) {
 474                 ret_val = -ENOMEM;
 475                 goto list_failure;
 476         }
 477
 478         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 479
 480         rcu_read_lock();
 481         doi_def = cipso_v4_doi_getdef(doi);
 482         if (doi_def == NULL) {
 483                 ret_val = -EINVAL;
 484                 goto list_failure_lock;
 485         }
 486
 487         ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
 488         if (ret_val != 0)
 489                 goto list_failure_lock;
 490
 491         nla_a = nla_nest_start_noflag(ans_skb, NLBL_CIPSOV4_A_TAGLST);
 492         if (nla_a == NULL) {
 493                 ret_val = -ENOMEM;
 494                 goto list_failure_lock;
 495         }
 496         for (iter = 0;
 497              iter < CIPSO_V4_TAG_MAXCNT &&
 498                doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
 499              iter++) {
 500                 ret_val = nla_put_u8(ans_skb,
 501                                      NLBL_CIPSOV4_A_TAG,
 502                                      doi_def->tags[iter]);
 503                 if (ret_val != 0)
 504                         goto list_failure_lock;
 505         }
 506         nla_nest_end(ans_skb, nla_a);
 507
 508         switch (doi_def->type) {
 509         case CIPSO_V4_MAP_TRANS:
 510                 nla_a = nla_nest_start_noflag(ans_skb,
 511                                               NLBL_CIPSOV4_A_MLSLVLLST);
 512                 if (nla_a == NULL) {
 513                         ret_val = -ENOMEM;
 514                         goto list_failure_lock;
 515                 }
 516                 for (iter = 0;
 517                      iter < doi_def->map.std->lvl.local_size;
 518                      iter++) {
 519                         if (doi_def->map.std->lvl.local[iter] ==
 520                             CIPSO_V4_INV_LVL)
 521                                 continue;
 522
 523                         nla_b = nla_nest_start_noflag(ans_skb,
 524                                                       NLBL_CIPSOV4_A_MLSLVL);
 525                         if (nla_b == NULL) {
 526                                 ret_val = -ENOMEM;
 527                                 goto list_retry;
 528                         }
 529                         ret_val = nla_put_u32(ans_skb,
 530                                               NLBL_CIPSOV4_A_MLSLVLLOC,
 531                                               iter);
 532                         if (ret_val != 0)
 533                                 goto list_retry;
 534                         ret_val = nla_put_u32(ans_skb,
 535                                             NLBL_CIPSOV4_A_MLSLVLREM,
 536                                             doi_def->map.std->lvl.local[iter]);
 537                         if (ret_val != 0)
 538                                 goto list_retry;
 539                         nla_nest_end(ans_skb, nla_b);
 540                 }
 541                 nla_nest_end(ans_skb, nla_a);
 542
 543                 nla_a = nla_nest_start_noflag(ans_skb,
 544                                               NLBL_CIPSOV4_A_MLSCATLST);
 545                 if (nla_a == NULL) {
 546                         ret_val = -ENOMEM;
 547                         goto list_retry;
 548                 }
 549                 for (iter = 0;
 550                      iter < doi_def->map.std->cat.local_size;
 551                      iter++) {
 552                         if (doi_def->map.std->cat.local[iter] ==
 553                             CIPSO_V4_INV_CAT)
 554                                 continue;
 555
 556                         nla_b = nla_nest_start_noflag(ans_skb,
 557                                                       NLBL_CIPSOV4_A_MLSCAT);
 558                         if (nla_b == NULL) {
 559                                 ret_val = -ENOMEM;
 560                                 goto list_retry;
 561                         }
 562                         ret_val = nla_put_u32(ans_skb,
 563                                               NLBL_CIPSOV4_A_MLSCATLOC,
 564                                               iter);
 565                         if (ret_val != 0)
 566                                 goto list_retry;
 567                         ret_val = nla_put_u32(ans_skb,
 568                                             NLBL_CIPSOV4_A_MLSCATREM,
 569                                             doi_def->map.std->cat.local[iter]);
 570                         if (ret_val != 0)
 571                                 goto list_retry;
 572                         nla_nest_end(ans_skb, nla_b);
 573                 }
 574                 nla_nest_end(ans_skb, nla_a);
 575
 576                 break;
 577         }
 578         cipso_v4_doi_putdef(doi_def);
 579         rcu_read_unlock();
 580
 581         genlmsg_end(ans_skb, data);
 582         return genlmsg_reply(ans_skb, info);
 583
 584 list_retry:
 585         /* XXX - this limit is a guesstimate */
 586         if (nlsze_mult < 4) {
 587                 cipso_v4_doi_putdef(doi_def);
 588                 rcu_read_unlock();
 589                 kfree_skb(ans_skb);
 590                 nlsze_mult *= 2;
 591                 goto list_start;
 592         }
 593 list_failure_lock:
 594         cipso_v4_doi_putdef(doi_def);
 595         rcu_read_unlock();
 596 list_failure:
 597         kfree_skb(ans_skb);
 598         return ret_val;
 599 }
 600
 601 /**
 602  * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
 603  * @doi_def: the CIPSOv4 DOI definition
 604  * @arg: the netlbl_cipsov4_doiwalk_arg structure
 605  *
 606  * Description:
 607  * This function is designed to be used as a callback to the
 608  * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
 609  * message.  Returns the size of the message on success, negative values on
 610  * failure.
 611  *
 612  */
 613 static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
 614 {
 615         int ret_val = -ENOMEM;
 616         struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
 617         void *data;
 618
 619         data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid,
 620                            cb_arg->seq, &netlbl_cipsov4_gnl_family,
 621                            NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
 622         if (data == NULL)
 623                 goto listall_cb_failure;
 624
 625         ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
 626         if (ret_val != 0)
 627                 goto listall_cb_failure;
 628         ret_val = nla_put_u32(cb_arg->skb,
 629                               NLBL_CIPSOV4_A_MTYPE,
 630                               doi_def->type);
 631         if (ret_val != 0)
 632                 goto listall_cb_failure;
 633
 634         genlmsg_end(cb_arg->skb, data);
 635         return 0;
 636
 637 listall_cb_failure:
 638         genlmsg_cancel(cb_arg->skb, data);
 639         return ret_val;
 640 }
 641
 642 /**
 643  * netlbl_cipsov4_listall - Handle a LISTALL message
 644  * @skb: the NETLINK buffer
 645  * @cb: the NETLINK callback
 646  *
 647  * Description:
 648  * Process a user generated LISTALL message and respond accordingly.  Returns
 649  * zero on success and negative values on error.
 650  *
 651  */
 652 static int netlbl_cipsov4_listall(struct sk_buff *skb,
 653                                   struct netlink_callback *cb)
 654 {
 655         struct netlbl_cipsov4_doiwalk_arg cb_arg;
 656         u32 doi_skip = cb->args[0];
 657
 658         cb_arg.nl_cb = cb;
 659         cb_arg.skb = skb;
 660         cb_arg.seq = cb->nlh->nlmsg_seq;
 661
 662         cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
 663
 664         cb->args[0] = doi_skip;
 665         return skb->len;
 666 }
 667
 668 /**
 669  * netlbl_cipsov4_remove_cb - netlbl_cipsov4_remove() callback for REMOVE
 670  * @entry: LSM domain mapping entry
 671  * @arg: the netlbl_domhsh_walk_arg structure
 672  *
 673  * Description:
 674  * This function is intended for use by netlbl_cipsov4_remove() as the callback
 675  * for the netlbl_domhsh_walk() function; it removes LSM domain map entries
 676  * which are associated with the CIPSO DOI specified in @arg.  Returns zero on
 677  * success, negative values on failure.
 678  *
 679  */
 680 static int netlbl_cipsov4_remove_cb(struct netlbl_dom_map *entry, void *arg)
 681 {
 682         struct netlbl_domhsh_walk_arg *cb_arg = arg;
 683
 684         if (entry->def.type == NETLBL_NLTYPE_CIPSOV4 &&
 685             entry->def.cipso->doi == cb_arg->doi)
 686                 return netlbl_domhsh_remove_entry(entry, cb_arg->audit_info);
 687
 688         return 0;
 689 }
 690
 691 /**
 692  * netlbl_cipsov4_remove - Handle a REMOVE message
 693  * @skb: the NETLINK buffer
 694  * @info: the Generic NETLINK info block
 695  *
 696  * Description:
 697  * Process a user generated REMOVE message and respond accordingly.  Returns
 698  * zero on success, negative values on failure.
 699  *
 700  */
 701 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 702 {
 703         int ret_val = -EINVAL;
 704         struct netlbl_domhsh_walk_arg cb_arg;
 705         struct netlbl_audit audit_info;
 706         u32 skip_bkt = 0;
 707         u32 skip_chain = 0;
 708
 709         if (!info->attrs[NLBL_CIPSOV4_A_DOI])
 710                 return -EINVAL;
 711
 712         netlbl_netlink_auditinfo(&audit_info);
 713         cb_arg.doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
 714         cb_arg.audit_info = &audit_info;
 715         ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
 716                                      netlbl_cipsov4_remove_cb, &cb_arg);
 717         if (ret_val == 0 || ret_val == -ENOENT) {
 718                 ret_val = cipso_v4_doi_remove(cb_arg.doi, &audit_info);
 719                 if (ret_val == 0)
 720                         atomic_dec(&netlabel_mgmt_protocount);
 721         }
 722
 723         return ret_val;
 724 }
 725
 726 /*
 727  * NetLabel Generic NETLINK Command Definitions
 728  */
 729
 730 static const struct genl_small_ops netlbl_cipsov4_ops[] = {
 731         {
 732         .cmd = NLBL_CIPSOV4_C_ADD,
 733         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 734         .flags = GENL_ADMIN_PERM,
 735         .doit = netlbl_cipsov4_add,
 736         .dumpit = NULL,
 737         },
 738         {
 739         .cmd = NLBL_CIPSOV4_C_REMOVE,
 740         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 741         .flags = GENL_ADMIN_PERM,
 742         .doit = netlbl_cipsov4_remove,
 743         .dumpit = NULL,
 744         },
 745         {
 746         .cmd = NLBL_CIPSOV4_C_LIST,
 747         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 748         .flags = 0,
 749         .doit = netlbl_cipsov4_list,
 750         .dumpit = NULL,
 751         },
 752         {
 753         .cmd = NLBL_CIPSOV4_C_LISTALL,
 754         .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
 755         .flags = 0,
 756         .doit = NULL,
 757         .dumpit = netlbl_cipsov4_listall,
 758         },
 759 };
 760
 761 static struct genl_family netlbl_cipsov4_gnl_family __ro_after_init = {
 762         .hdrsize = 0,
 763         .name = NETLBL_NLTYPE_CIPSOV4_NAME,
 764         .version = NETLBL_PROTO_VERSION,
 765         .maxattr = NLBL_CIPSOV4_A_MAX,
 766         .policy = netlbl_cipsov4_genl_policy,
 767         .module = THIS_MODULE,
 768         .small_ops = netlbl_cipsov4_ops,
 769         .n_small_ops = ARRAY_SIZE(netlbl_cipsov4_ops),
 770         .resv_start_op = NLBL_CIPSOV4_C_LISTALL + 1,
 771 };
 772
 773 /*
 774  * NetLabel Generic NETLINK Protocol Functions
 775  */
 776
 777 /**
 778  * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
 779  *
 780  * Description:
 781  * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
 782  * mechanism.  Returns zero on success, negative values on failure.
 783  *
 784  */
 785 int __init netlbl_cipsov4_genl_init(void)
 786 {
 787         return genl_register_family(&netlbl_cipsov4_gnl_family);
 788 }