Commit | Line | Data |
---|---|---|
96cb8e33 PM |
1 | /* |
2 | * NetLabel Unlabeled Support | |
3 | * | |
4 | * This file defines functions for dealing with unlabeled packets for the | |
5 | * NetLabel system. The NetLabel system manages static and dynamic label | |
6 | * mappings for network protocols such as CIPSO and RIPSO. | |
7 | * | |
8 | * Author: Paul Moore <paul.moore@hp.com> | |
9 | * | |
10 | */ | |
11 | ||
12 | /* | |
13 | * (c) Copyright Hewlett-Packard Development Company, L.P., 2006 | |
14 | * | |
15 | * This program is free software; you can redistribute it and/or modify | |
16 | * it under the terms of the GNU General Public License as published by | |
17 | * the Free Software Foundation; either version 2 of the License, or | |
18 | * (at your option) any later version. | |
19 | * | |
20 | * This program is distributed in the hope that it will be useful, | |
21 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
22 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See | |
23 | * the GNU General Public License for more details. | |
24 | * | |
25 | * You should have received a copy of the GNU General Public License | |
26 | * along with this program; if not, write to the Free Software | |
27 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
28 | * | |
29 | */ | |
30 | ||
31 | #include <linux/types.h> | |
32 | #include <linux/rcupdate.h> | |
33 | #include <linux/list.h> | |
34 | #include <linux/spinlock.h> | |
35 | #include <linux/socket.h> | |
36 | #include <linux/string.h> | |
37 | #include <linux/skbuff.h> | |
38 | #include <net/sock.h> | |
39 | #include <net/netlink.h> | |
40 | #include <net/genetlink.h> | |
41 | ||
42 | #include <net/netlabel.h> | |
43 | #include <asm/bug.h> | |
44 | ||
45 | #include "netlabel_user.h" | |
46 | #include "netlabel_domainhash.h" | |
47 | #include "netlabel_unlabeled.h" | |
48 | ||
49 | /* Accept unlabeled packets flag */ | |
50 | static atomic_t netlabel_unlabel_accept_flg = ATOMIC_INIT(0); | |
51 | ||
52 | /* NetLabel Generic NETLINK CIPSOv4 family */ | |
53 | static struct genl_family netlbl_unlabel_gnl_family = { | |
54 | .id = GENL_ID_GENERATE, | |
55 | .hdrsize = 0, | |
56 | .name = NETLBL_NLTYPE_UNLABELED_NAME, | |
57 | .version = NETLBL_PROTO_VERSION, | |
fd385855 | 58 | .maxattr = NLBL_UNLABEL_A_MAX, |
96cb8e33 PM |
59 | }; |
60 | ||
fd385855 PM |
61 | /* NetLabel Netlink attribute policy */ |
62 | static struct nla_policy netlbl_unlabel_genl_policy[NLBL_UNLABEL_A_MAX + 1] = { | |
63 | [NLBL_UNLABEL_A_ACPTFLG] = { .type = NLA_U8 }, | |
64 | }; | |
96cb8e33 PM |
65 | |
66 | /* | |
67 | * NetLabel Command Handlers | |
68 | */ | |
69 | ||
70 | /** | |
71 | * netlbl_unlabel_accept - Handle an ACCEPT message | |
72 | * @skb: the NETLINK buffer | |
73 | * @info: the Generic NETLINK info block | |
74 | * | |
75 | * Description: | |
76 | * Process a user generated ACCEPT message and set the accept flag accordingly. | |
77 | * Returns zero on success, negative values on failure. | |
78 | * | |
79 | */ | |
80 | static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info) | |
81 | { | |
fd385855 PM |
82 | int ret_val = -EINVAL; |
83 | u8 value; | |
96cb8e33 | 84 | |
fd385855 PM |
85 | if (info->attrs[NLBL_UNLABEL_A_ACPTFLG]) { |
86 | value = nla_get_u8(info->attrs[NLBL_UNLABEL_A_ACPTFLG]); | |
96cb8e33 PM |
87 | if (value == 1 || value == 0) { |
88 | atomic_set(&netlabel_unlabel_accept_flg, value); | |
fd385855 | 89 | ret_val = 0; |
96cb8e33 PM |
90 | } |
91 | } | |
92 | ||
fd385855 | 93 | return ret_val; |
96cb8e33 PM |
94 | } |
95 | ||
96 | /** | |
97 | * netlbl_unlabel_list - Handle a LIST message | |
98 | * @skb: the NETLINK buffer | |
99 | * @info: the Generic NETLINK info block | |
100 | * | |
101 | * Description: | |
102 | * Process a user generated LIST message and respond with the current status. | |
103 | * Returns zero on success, negative values on failure. | |
104 | * | |
105 | */ | |
106 | static int netlbl_unlabel_list(struct sk_buff *skb, struct genl_info *info) | |
107 | { | |
fd385855 | 108 | int ret_val = -EINVAL; |
96cb8e33 | 109 | struct sk_buff *ans_skb; |
fd385855 | 110 | void *data; |
96cb8e33 | 111 | |
fd385855 | 112 | ans_skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); |
96cb8e33 PM |
113 | if (ans_skb == NULL) |
114 | goto list_failure; | |
fd385855 PM |
115 | data = netlbl_netlink_hdr_put(ans_skb, |
116 | info->snd_pid, | |
117 | info->snd_seq, | |
118 | netlbl_unlabel_gnl_family.id, | |
119 | 0, | |
120 | NLBL_UNLABEL_C_LIST); | |
121 | if (data == NULL) { | |
122 | ret_val = -ENOMEM; | |
96cb8e33 | 123 | goto list_failure; |
fd385855 | 124 | } |
96cb8e33 | 125 | |
fd385855 PM |
126 | ret_val = nla_put_u8(ans_skb, |
127 | NLBL_UNLABEL_A_ACPTFLG, | |
128 | atomic_read(&netlabel_unlabel_accept_flg)); | |
96cb8e33 PM |
129 | if (ret_val != 0) |
130 | goto list_failure; | |
131 | ||
fd385855 PM |
132 | genlmsg_end(ans_skb, data); |
133 | ||
134 | ret_val = genlmsg_unicast(ans_skb, info->snd_pid); | |
96cb8e33 PM |
135 | if (ret_val != 0) |
136 | goto list_failure; | |
96cb8e33 PM |
137 | return 0; |
138 | ||
139 | list_failure: | |
fd385855 | 140 | kfree(ans_skb); |
96cb8e33 PM |
141 | return ret_val; |
142 | } | |
143 | ||
144 | ||
145 | /* | |
146 | * NetLabel Generic NETLINK Command Definitions | |
147 | */ | |
148 | ||
149 | static struct genl_ops netlbl_unlabel_genl_c_accept = { | |
150 | .cmd = NLBL_UNLABEL_C_ACCEPT, | |
fd385855 PM |
151 | .flags = GENL_ADMIN_PERM, |
152 | .policy = netlbl_unlabel_genl_policy, | |
96cb8e33 PM |
153 | .doit = netlbl_unlabel_accept, |
154 | .dumpit = NULL, | |
155 | }; | |
156 | ||
157 | static struct genl_ops netlbl_unlabel_genl_c_list = { | |
158 | .cmd = NLBL_UNLABEL_C_LIST, | |
159 | .flags = 0, | |
fd385855 | 160 | .policy = netlbl_unlabel_genl_policy, |
96cb8e33 PM |
161 | .doit = netlbl_unlabel_list, |
162 | .dumpit = NULL, | |
163 | }; | |
164 | ||
165 | ||
166 | /* | |
167 | * NetLabel Generic NETLINK Protocol Functions | |
168 | */ | |
169 | ||
170 | /** | |
171 | * netlbl_unlabel_genl_init - Register the Unlabeled NetLabel component | |
172 | * | |
173 | * Description: | |
174 | * Register the unlabeled packet NetLabel component with the Generic NETLINK | |
175 | * mechanism. Returns zero on success, negative values on failure. | |
176 | * | |
177 | */ | |
178 | int netlbl_unlabel_genl_init(void) | |
179 | { | |
180 | int ret_val; | |
181 | ||
182 | ret_val = genl_register_family(&netlbl_unlabel_gnl_family); | |
183 | if (ret_val != 0) | |
184 | return ret_val; | |
185 | ||
186 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | |
187 | &netlbl_unlabel_genl_c_accept); | |
188 | if (ret_val != 0) | |
189 | return ret_val; | |
190 | ||
191 | ret_val = genl_register_ops(&netlbl_unlabel_gnl_family, | |
192 | &netlbl_unlabel_genl_c_list); | |
193 | if (ret_val != 0) | |
194 | return ret_val; | |
195 | ||
196 | return 0; | |
197 | } | |
198 | ||
199 | /* | |
200 | * NetLabel KAPI Hooks | |
201 | */ | |
202 | ||
203 | /** | |
204 | * netlbl_unlabel_getattr - Get the security attributes for an unlabled packet | |
205 | * @secattr: the security attributes | |
206 | * | |
207 | * Description: | |
208 | * Determine the security attributes, if any, for an unlabled packet and return | |
209 | * them in @secattr. Returns zero on success and negative values on failure. | |
210 | * | |
211 | */ | |
212 | int netlbl_unlabel_getattr(struct netlbl_lsm_secattr *secattr) | |
213 | { | |
fd385855 PM |
214 | if (atomic_read(&netlabel_unlabel_accept_flg) == 1) |
215 | return netlbl_secattr_init(secattr); | |
96cb8e33 PM |
216 | |
217 | return -ENOMSG; | |
218 | } | |
219 | ||
220 | /** | |
221 | * netlbl_unlabel_defconf - Set the default config to allow unlabeled packets | |
222 | * | |
223 | * Description: | |
224 | * Set the default NetLabel configuration to allow incoming unlabeled packets | |
225 | * and to send unlabeled network traffic by default. | |
226 | * | |
227 | */ | |
228 | int netlbl_unlabel_defconf(void) | |
229 | { | |
230 | int ret_val; | |
231 | struct netlbl_dom_map *entry; | |
232 | ||
233 | entry = kzalloc(sizeof(*entry), GFP_KERNEL); | |
234 | if (entry == NULL) | |
235 | return -ENOMEM; | |
236 | entry->type = NETLBL_NLTYPE_UNLABELED; | |
237 | ret_val = netlbl_domhsh_add_default(entry); | |
238 | if (ret_val != 0) | |
239 | return ret_val; | |
240 | ||
241 | atomic_set(&netlabel_unlabel_accept_flg, 1); | |
242 | ||
243 | return 0; | |
244 | } |