selinux: Fix missing calls to netlbl_skbuff_err()
[linux-2.6.git] / net / netlabel / netlabel_cipso_v4.c
1 /*
2  * NetLabel CIPSO/IPv4 Support
3  *
4  * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
5  * NetLabel system manages static and dynamic label mappings for network
6  * protocols such as CIPSO and RIPSO.
7  *
8  * Author: Paul Moore <paul.moore@hp.com>
9  *
10  */
11
12 /*
13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14  *
15  * This program is free software;  you can redistribute it and/or modify
16  * it under the terms of the GNU General Public License as published by
17  * the Free Software Foundation; either version 2 of the License, or
18  * (at your option) any later version.
19  *
20  * This program is distributed in the hope that it will be useful,
21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
23  * the GNU General Public License for more details.
24  *
25  * You should have received a copy of the GNU General Public License
26  * along with this program;  if not, write to the Free Software
27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28  *
29  */
30
31 #include <linux/types.h>
32 #include <linux/socket.h>
33 #include <linux/string.h>
34 #include <linux/skbuff.h>
35 #include <linux/audit.h>
36 #include <net/sock.h>
37 #include <net/netlink.h>
38 #include <net/genetlink.h>
39 #include <net/netlabel.h>
40 #include <net/cipso_ipv4.h>
41 #include <asm/atomic.h>
42
43 #include "netlabel_user.h"
44 #include "netlabel_cipso_v4.h"
45 #include "netlabel_mgmt.h"
46
47 /* Argument struct for cipso_v4_doi_walk() */
48 struct netlbl_cipsov4_doiwalk_arg {
49         struct netlink_callback *nl_cb;
50         struct sk_buff *skb;
51         u32 seq;
52 };
53
54 /* NetLabel Generic NETLINK CIPSOv4 family */
55 static struct genl_family netlbl_cipsov4_gnl_family = {
56         .id = GENL_ID_GENERATE,
57         .hdrsize = 0,
58         .name = NETLBL_NLTYPE_CIPSOV4_NAME,
59         .version = NETLBL_PROTO_VERSION,
60         .maxattr = NLBL_CIPSOV4_A_MAX,
61 };
62
63 /* NetLabel Netlink attribute policy */
64 static const struct nla_policy netlbl_cipsov4_genl_policy[NLBL_CIPSOV4_A_MAX + 1] = {
65         [NLBL_CIPSOV4_A_DOI] = { .type = NLA_U32 },
66         [NLBL_CIPSOV4_A_MTYPE] = { .type = NLA_U32 },
67         [NLBL_CIPSOV4_A_TAG] = { .type = NLA_U8 },
68         [NLBL_CIPSOV4_A_TAGLST] = { .type = NLA_NESTED },
69         [NLBL_CIPSOV4_A_MLSLVLLOC] = { .type = NLA_U32 },
70         [NLBL_CIPSOV4_A_MLSLVLREM] = { .type = NLA_U32 },
71         [NLBL_CIPSOV4_A_MLSLVL] = { .type = NLA_NESTED },
72         [NLBL_CIPSOV4_A_MLSLVLLST] = { .type = NLA_NESTED },
73         [NLBL_CIPSOV4_A_MLSCATLOC] = { .type = NLA_U32 },
74         [NLBL_CIPSOV4_A_MLSCATREM] = { .type = NLA_U32 },
75         [NLBL_CIPSOV4_A_MLSCAT] = { .type = NLA_NESTED },
76         [NLBL_CIPSOV4_A_MLSCATLST] = { .type = NLA_NESTED },
77 };
78
79 /*
80  * Helper Functions
81  */
82
83 /**
84  * netlbl_cipsov4_doi_free - Frees a CIPSO V4 DOI definition
85  * @entry: the entry's RCU field
86  *
87  * Description:
88  * This function is designed to be used as a callback to the call_rcu()
89  * function so that the memory allocated to the DOI definition can be released
90  * safely.
91  *
92  */
93 void netlbl_cipsov4_doi_free(struct rcu_head *entry)
94 {
95         struct cipso_v4_doi *ptr;
96
97         ptr = container_of(entry, struct cipso_v4_doi, rcu);
98         switch (ptr->type) {
99         case CIPSO_V4_MAP_STD:
100                 kfree(ptr->map.std->lvl.cipso);
101                 kfree(ptr->map.std->lvl.local);
102                 kfree(ptr->map.std->cat.cipso);
103                 kfree(ptr->map.std->cat.local);
104                 break;
105         }
106         kfree(ptr);
107 }
108
109 /**
110  * netlbl_cipsov4_add_common - Parse the common sections of a ADD message
111  * @info: the Generic NETLINK info block
112  * @doi_def: the CIPSO V4 DOI definition
113  *
114  * Description:
115  * Parse the common sections of a ADD message and fill in the related values
116  * in @doi_def.  Returns zero on success, negative values on failure.
117  *
118  */
119 static int netlbl_cipsov4_add_common(struct genl_info *info,
120                                      struct cipso_v4_doi *doi_def)
121 {
122         struct nlattr *nla;
123         int nla_rem;
124         u32 iter = 0;
125
126         doi_def->doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
127
128         if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_TAGLST],
129                                 NLBL_CIPSOV4_A_MAX,
130                                 netlbl_cipsov4_genl_policy) != 0)
131                 return -EINVAL;
132
133         nla_for_each_nested(nla, info->attrs[NLBL_CIPSOV4_A_TAGLST], nla_rem)
134                 if (nla_type(nla) == NLBL_CIPSOV4_A_TAG) {
135                         if (iter >= CIPSO_V4_TAG_MAXCNT)
136                                 return -EINVAL;
137                         doi_def->tags[iter++] = nla_get_u8(nla);
138                 }
139         while (iter < CIPSO_V4_TAG_MAXCNT)
140                 doi_def->tags[iter++] = CIPSO_V4_TAG_INVALID;
141
142         return 0;
143 }
144
145 /*
146  * NetLabel Command Handlers
147  */
148
149 /**
150  * netlbl_cipsov4_add_std - Adds a CIPSO V4 DOI definition
151  * @info: the Generic NETLINK info block
152  *
153  * Description:
154  * Create a new CIPSO_V4_MAP_STD DOI definition based on the given ADD message
155  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
156  * error.
157  *
158  */
159 static int netlbl_cipsov4_add_std(struct genl_info *info)
160 {
161         int ret_val = -EINVAL;
162         struct cipso_v4_doi *doi_def = NULL;
163         struct nlattr *nla_a;
164         struct nlattr *nla_b;
165         int nla_a_rem;
166         int nla_b_rem;
167         u32 iter;
168
169         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
170             !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
171                 return -EINVAL;
172
173         if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
174                                 NLBL_CIPSOV4_A_MAX,
175                                 netlbl_cipsov4_genl_policy) != 0)
176                 return -EINVAL;
177
178         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
179         if (doi_def == NULL)
180                 return -ENOMEM;
181         doi_def->map.std = kzalloc(sizeof(*doi_def->map.std), GFP_KERNEL);
182         if (doi_def->map.std == NULL) {
183                 ret_val = -ENOMEM;
184                 goto add_std_failure;
185         }
186         doi_def->type = CIPSO_V4_MAP_STD;
187
188         ret_val = netlbl_cipsov4_add_common(info, doi_def);
189         if (ret_val != 0)
190                 goto add_std_failure;
191         ret_val = -EINVAL;
192
193         nla_for_each_nested(nla_a,
194                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
195                             nla_a_rem)
196                 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
197                         if (nla_validate_nested(nla_a,
198                                             NLBL_CIPSOV4_A_MAX,
199                                             netlbl_cipsov4_genl_policy) != 0)
200                                         goto add_std_failure;
201                         nla_for_each_nested(nla_b, nla_a, nla_b_rem)
202                                 switch (nla_type(nla_b)) {
203                                 case NLBL_CIPSOV4_A_MLSLVLLOC:
204                                         if (nla_get_u32(nla_b) >
205                                             CIPSO_V4_MAX_LOC_LVLS)
206                                                 goto add_std_failure;
207                                         if (nla_get_u32(nla_b) >=
208                                             doi_def->map.std->lvl.local_size)
209                                              doi_def->map.std->lvl.local_size =
210                                                      nla_get_u32(nla_b) + 1;
211                                         break;
212                                 case NLBL_CIPSOV4_A_MLSLVLREM:
213                                         if (nla_get_u32(nla_b) >
214                                             CIPSO_V4_MAX_REM_LVLS)
215                                                 goto add_std_failure;
216                                         if (nla_get_u32(nla_b) >=
217                                             doi_def->map.std->lvl.cipso_size)
218                                              doi_def->map.std->lvl.cipso_size =
219                                                      nla_get_u32(nla_b) + 1;
220                                         break;
221                                 }
222                 }
223         doi_def->map.std->lvl.local = kcalloc(doi_def->map.std->lvl.local_size,
224                                               sizeof(u32),
225                                               GFP_KERNEL);
226         if (doi_def->map.std->lvl.local == NULL) {
227                 ret_val = -ENOMEM;
228                 goto add_std_failure;
229         }
230         doi_def->map.std->lvl.cipso = kcalloc(doi_def->map.std->lvl.cipso_size,
231                                               sizeof(u32),
232                                               GFP_KERNEL);
233         if (doi_def->map.std->lvl.cipso == NULL) {
234                 ret_val = -ENOMEM;
235                 goto add_std_failure;
236         }
237         for (iter = 0; iter < doi_def->map.std->lvl.local_size; iter++)
238                 doi_def->map.std->lvl.local[iter] = CIPSO_V4_INV_LVL;
239         for (iter = 0; iter < doi_def->map.std->lvl.cipso_size; iter++)
240                 doi_def->map.std->lvl.cipso[iter] = CIPSO_V4_INV_LVL;
241         nla_for_each_nested(nla_a,
242                             info->attrs[NLBL_CIPSOV4_A_MLSLVLLST],
243                             nla_a_rem)
244                 if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSLVL) {
245                         struct nlattr *lvl_loc;
246                         struct nlattr *lvl_rem;
247
248                         lvl_loc = nla_find_nested(nla_a,
249                                                   NLBL_CIPSOV4_A_MLSLVLLOC);
250                         lvl_rem = nla_find_nested(nla_a,
251                                                   NLBL_CIPSOV4_A_MLSLVLREM);
252                         if (lvl_loc == NULL || lvl_rem == NULL)
253                                 goto add_std_failure;
254                         doi_def->map.std->lvl.local[nla_get_u32(lvl_loc)] =
255                                 nla_get_u32(lvl_rem);
256                         doi_def->map.std->lvl.cipso[nla_get_u32(lvl_rem)] =
257                                 nla_get_u32(lvl_loc);
258                 }
259
260         if (info->attrs[NLBL_CIPSOV4_A_MLSCATLST]) {
261                 if (nla_validate_nested(info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
262                                         NLBL_CIPSOV4_A_MAX,
263                                         netlbl_cipsov4_genl_policy) != 0)
264                         goto add_std_failure;
265
266                 nla_for_each_nested(nla_a,
267                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
268                                     nla_a_rem)
269                         if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
270                                 if (nla_validate_nested(nla_a,
271                                               NLBL_CIPSOV4_A_MAX,
272                                               netlbl_cipsov4_genl_policy) != 0)
273                                         goto add_std_failure;
274                                 nla_for_each_nested(nla_b, nla_a, nla_b_rem)
275                                         switch (nla_type(nla_b)) {
276                                         case NLBL_CIPSOV4_A_MLSCATLOC:
277                                                 if (nla_get_u32(nla_b) >
278                                                     CIPSO_V4_MAX_LOC_CATS)
279                                                         goto add_std_failure;
280                                                 if (nla_get_u32(nla_b) >=
281                                               doi_def->map.std->cat.local_size)
282                                              doi_def->map.std->cat.local_size =
283                                                      nla_get_u32(nla_b) + 1;
284                                                 break;
285                                         case NLBL_CIPSOV4_A_MLSCATREM:
286                                                 if (nla_get_u32(nla_b) >
287                                                     CIPSO_V4_MAX_REM_CATS)
288                                                         goto add_std_failure;
289                                                 if (nla_get_u32(nla_b) >=
290                                               doi_def->map.std->cat.cipso_size)
291                                              doi_def->map.std->cat.cipso_size =
292                                                      nla_get_u32(nla_b) + 1;
293                                                 break;
294                                         }
295                         }
296                 doi_def->map.std->cat.local = kcalloc(
297                                               doi_def->map.std->cat.local_size,
298                                               sizeof(u32),
299                                               GFP_KERNEL);
300                 if (doi_def->map.std->cat.local == NULL) {
301                         ret_val = -ENOMEM;
302                         goto add_std_failure;
303                 }
304                 doi_def->map.std->cat.cipso = kcalloc(
305                                               doi_def->map.std->cat.cipso_size,
306                                               sizeof(u32),
307                                               GFP_KERNEL);
308                 if (doi_def->map.std->cat.cipso == NULL) {
309                         ret_val = -ENOMEM;
310                         goto add_std_failure;
311                 }
312                 for (iter = 0; iter < doi_def->map.std->cat.local_size; iter++)
313                         doi_def->map.std->cat.local[iter] = CIPSO_V4_INV_CAT;
314                 for (iter = 0; iter < doi_def->map.std->cat.cipso_size; iter++)
315                         doi_def->map.std->cat.cipso[iter] = CIPSO_V4_INV_CAT;
316                 nla_for_each_nested(nla_a,
317                                     info->attrs[NLBL_CIPSOV4_A_MLSCATLST],
318                                     nla_a_rem)
319                         if (nla_type(nla_a) == NLBL_CIPSOV4_A_MLSCAT) {
320                                 struct nlattr *cat_loc;
321                                 struct nlattr *cat_rem;
322
323                                 cat_loc = nla_find_nested(nla_a,
324                                                      NLBL_CIPSOV4_A_MLSCATLOC);
325                                 cat_rem = nla_find_nested(nla_a,
326                                                      NLBL_CIPSOV4_A_MLSCATREM);
327                                 if (cat_loc == NULL || cat_rem == NULL)
328                                         goto add_std_failure;
329                                 doi_def->map.std->cat.local[
330                                                         nla_get_u32(cat_loc)] =
331                                         nla_get_u32(cat_rem);
332                                 doi_def->map.std->cat.cipso[
333                                                         nla_get_u32(cat_rem)] =
334                                         nla_get_u32(cat_loc);
335                         }
336         }
337
338         ret_val = cipso_v4_doi_add(doi_def);
339         if (ret_val != 0)
340                 goto add_std_failure;
341         return 0;
342
343 add_std_failure:
344         if (doi_def)
345                 netlbl_cipsov4_doi_free(&doi_def->rcu);
346         return ret_val;
347 }
348
349 /**
350  * netlbl_cipsov4_add_pass - Adds a CIPSO V4 DOI definition
351  * @info: the Generic NETLINK info block
352  *
353  * Description:
354  * Create a new CIPSO_V4_MAP_PASS DOI definition based on the given ADD message
355  * and add it to the CIPSO V4 engine.  Return zero on success and non-zero on
356  * error.
357  *
358  */
359 static int netlbl_cipsov4_add_pass(struct genl_info *info)
360 {
361         int ret_val;
362         struct cipso_v4_doi *doi_def = NULL;
363
364         if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
365                 return -EINVAL;
366
367         doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
368         if (doi_def == NULL)
369                 return -ENOMEM;
370         doi_def->type = CIPSO_V4_MAP_PASS;
371
372         ret_val = netlbl_cipsov4_add_common(info, doi_def);
373         if (ret_val != 0)
374                 goto add_pass_failure;
375
376         ret_val = cipso_v4_doi_add(doi_def);
377         if (ret_val != 0)
378                 goto add_pass_failure;
379         return 0;
380
381 add_pass_failure:
382         netlbl_cipsov4_doi_free(&doi_def->rcu);
383         return ret_val;
384 }
385
386 /**
387  * netlbl_cipsov4_add - Handle an ADD message
388  * @skb: the NETLINK buffer
389  * @info: the Generic NETLINK info block
390  *
391  * Description:
392  * Create a new DOI definition based on the given ADD message and add it to the
393  * CIPSO V4 engine.  Returns zero on success, negative values on failure.
394  *
395  */
396 static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
397
398 {
399         int ret_val = -EINVAL;
400         u32 type;
401         u32 doi;
402         const char *type_str = "(unknown)";
403         struct audit_buffer *audit_buf;
404         struct netlbl_audit audit_info;
405
406         if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
407             !info->attrs[NLBL_CIPSOV4_A_MTYPE])
408                 return -EINVAL;
409
410         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
411         netlbl_netlink_auditinfo(skb, &audit_info);
412
413         type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
414         switch (type) {
415         case CIPSO_V4_MAP_STD:
416                 type_str = "std";
417                 ret_val = netlbl_cipsov4_add_std(info);
418                 break;
419         case CIPSO_V4_MAP_PASS:
420                 type_str = "pass";
421                 ret_val = netlbl_cipsov4_add_pass(info);
422                 break;
423         }
424         if (ret_val == 0)
425                 atomic_inc(&netlabel_mgmt_protocount);
426
427         audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
428                                               &audit_info);
429         if (audit_buf != NULL) {
430                 audit_log_format(audit_buf,
431                                  " cipso_doi=%u cipso_type=%s res=%u",
432                                  doi,
433                                  type_str,
434                                  ret_val == 0 ? 1 : 0);
435                 audit_log_end(audit_buf);
436         }
437
438         return ret_val;
439 }
440
441 /**
442  * netlbl_cipsov4_list - Handle a LIST message
443  * @skb: the NETLINK buffer
444  * @info: the Generic NETLINK info block
445  *
446  * Description:
447  * Process a user generated LIST message and respond accordingly.  While the
448  * response message generated by the kernel is straightforward, determining
449  * before hand the size of the buffer to allocate is not (we have to generate
450  * the message to know the size).  In order to keep this function sane what we
451  * do is allocate a buffer of NLMSG_GOODSIZE and try to fit the response in
452  * that size, if we fail then we restart with a larger buffer and try again.
453  * We continue in this manner until we hit a limit of failed attempts then we
454  * give up and just send an error message.  Returns zero on success and
455  * negative values on error.
456  *
457  */
458 static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
459 {
460         int ret_val;
461         struct sk_buff *ans_skb = NULL;
462         u32 nlsze_mult = 1;
463         void *data;
464         u32 doi;
465         struct nlattr *nla_a;
466         struct nlattr *nla_b;
467         struct cipso_v4_doi *doi_def;
468         u32 iter;
469
470         if (!info->attrs[NLBL_CIPSOV4_A_DOI]) {
471                 ret_val = -EINVAL;
472                 goto list_failure;
473         }
474
475 list_start:
476         ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
477         if (ans_skb == NULL) {
478                 ret_val = -ENOMEM;
479                 goto list_failure;
480         }
481         data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
482                                  0, NLBL_CIPSOV4_C_LIST);
483         if (data == NULL) {
484                 ret_val = -ENOMEM;
485                 goto list_failure;
486         }
487
488         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
489
490         rcu_read_lock();
491         doi_def = cipso_v4_doi_getdef(doi);
492         if (doi_def == NULL) {
493                 ret_val = -EINVAL;
494                 goto list_failure_lock;
495         }
496
497         ret_val = nla_put_u32(ans_skb, NLBL_CIPSOV4_A_MTYPE, doi_def->type);
498         if (ret_val != 0)
499                 goto list_failure_lock;
500
501         nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_TAGLST);
502         if (nla_a == NULL) {
503                 ret_val = -ENOMEM;
504                 goto list_failure_lock;
505         }
506         for (iter = 0;
507              iter < CIPSO_V4_TAG_MAXCNT &&
508                doi_def->tags[iter] != CIPSO_V4_TAG_INVALID;
509              iter++) {
510                 ret_val = nla_put_u8(ans_skb,
511                                      NLBL_CIPSOV4_A_TAG,
512                                      doi_def->tags[iter]);
513                 if (ret_val != 0)
514                         goto list_failure_lock;
515         }
516         nla_nest_end(ans_skb, nla_a);
517
518         switch (doi_def->type) {
519         case CIPSO_V4_MAP_STD:
520                 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVLLST);
521                 if (nla_a == NULL) {
522                         ret_val = -ENOMEM;
523                         goto list_failure_lock;
524                 }
525                 for (iter = 0;
526                      iter < doi_def->map.std->lvl.local_size;
527                      iter++) {
528                         if (doi_def->map.std->lvl.local[iter] ==
529                             CIPSO_V4_INV_LVL)
530                                 continue;
531
532                         nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSLVL);
533                         if (nla_b == NULL) {
534                                 ret_val = -ENOMEM;
535                                 goto list_retry;
536                         }
537                         ret_val = nla_put_u32(ans_skb,
538                                               NLBL_CIPSOV4_A_MLSLVLLOC,
539                                               iter);
540                         if (ret_val != 0)
541                                 goto list_retry;
542                         ret_val = nla_put_u32(ans_skb,
543                                             NLBL_CIPSOV4_A_MLSLVLREM,
544                                             doi_def->map.std->lvl.local[iter]);
545                         if (ret_val != 0)
546                                 goto list_retry;
547                         nla_nest_end(ans_skb, nla_b);
548                 }
549                 nla_nest_end(ans_skb, nla_a);
550
551                 nla_a = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCATLST);
552                 if (nla_a == NULL) {
553                         ret_val = -ENOMEM;
554                         goto list_retry;
555                 }
556                 for (iter = 0;
557                      iter < doi_def->map.std->cat.local_size;
558                      iter++) {
559                         if (doi_def->map.std->cat.local[iter] ==
560                             CIPSO_V4_INV_CAT)
561                                 continue;
562
563                         nla_b = nla_nest_start(ans_skb, NLBL_CIPSOV4_A_MLSCAT);
564                         if (nla_b == NULL) {
565                                 ret_val = -ENOMEM;
566                                 goto list_retry;
567                         }
568                         ret_val = nla_put_u32(ans_skb,
569                                               NLBL_CIPSOV4_A_MLSCATLOC,
570                                               iter);
571                         if (ret_val != 0)
572                                 goto list_retry;
573                         ret_val = nla_put_u32(ans_skb,
574                                             NLBL_CIPSOV4_A_MLSCATREM,
575                                             doi_def->map.std->cat.local[iter]);
576                         if (ret_val != 0)
577                                 goto list_retry;
578                         nla_nest_end(ans_skb, nla_b);
579                 }
580                 nla_nest_end(ans_skb, nla_a);
581
582                 break;
583         }
584         rcu_read_unlock();
585
586         genlmsg_end(ans_skb, data);
587         return genlmsg_reply(ans_skb, info);
588
589 list_retry:
590         /* XXX - this limit is a guesstimate */
591         if (nlsze_mult < 4) {
592                 rcu_read_unlock();
593                 kfree_skb(ans_skb);
594                 nlsze_mult *= 2;
595                 goto list_start;
596         }
597 list_failure_lock:
598         rcu_read_unlock();
599 list_failure:
600         kfree_skb(ans_skb);
601         return ret_val;
602 }
603
604 /**
605  * netlbl_cipsov4_listall_cb - cipso_v4_doi_walk() callback for LISTALL
606  * @doi_def: the CIPSOv4 DOI definition
607  * @arg: the netlbl_cipsov4_doiwalk_arg structure
608  *
609  * Description:
610  * This function is designed to be used as a callback to the
611  * cipso_v4_doi_walk() function for use in generating a response for a LISTALL
612  * message.  Returns the size of the message on success, negative values on
613  * failure.
614  *
615  */
616 static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
617 {
618         int ret_val = -ENOMEM;
619         struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
620         void *data;
621
622         data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
623                            cb_arg->seq, &netlbl_cipsov4_gnl_family,
624                            NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
625         if (data == NULL)
626                 goto listall_cb_failure;
627
628         ret_val = nla_put_u32(cb_arg->skb, NLBL_CIPSOV4_A_DOI, doi_def->doi);
629         if (ret_val != 0)
630                 goto listall_cb_failure;
631         ret_val = nla_put_u32(cb_arg->skb,
632                               NLBL_CIPSOV4_A_MTYPE,
633                               doi_def->type);
634         if (ret_val != 0)
635                 goto listall_cb_failure;
636
637         return genlmsg_end(cb_arg->skb, data);
638
639 listall_cb_failure:
640         genlmsg_cancel(cb_arg->skb, data);
641         return ret_val;
642 }
643
644 /**
645  * netlbl_cipsov4_listall - Handle a LISTALL message
646  * @skb: the NETLINK buffer
647  * @cb: the NETLINK callback
648  *
649  * Description:
650  * Process a user generated LISTALL message and respond accordingly.  Returns
651  * zero on success and negative values on error.
652  *
653  */
654 static int netlbl_cipsov4_listall(struct sk_buff *skb,
655                                   struct netlink_callback *cb)
656 {
657         struct netlbl_cipsov4_doiwalk_arg cb_arg;
658         u32 doi_skip = cb->args[0];
659
660         cb_arg.nl_cb = cb;
661         cb_arg.skb = skb;
662         cb_arg.seq = cb->nlh->nlmsg_seq;
663
664         cipso_v4_doi_walk(&doi_skip, netlbl_cipsov4_listall_cb, &cb_arg);
665
666         cb->args[0] = doi_skip;
667         return skb->len;
668 }
669
670 /**
671  * netlbl_cipsov4_remove - Handle a REMOVE message
672  * @skb: the NETLINK buffer
673  * @info: the Generic NETLINK info block
674  *
675  * Description:
676  * Process a user generated REMOVE message and respond accordingly.  Returns
677  * zero on success, negative values on failure.
678  *
679  */
680 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
681 {
682         int ret_val = -EINVAL;
683         u32 doi = 0;
684         struct audit_buffer *audit_buf;
685         struct netlbl_audit audit_info;
686
687         if (!info->attrs[NLBL_CIPSOV4_A_DOI])
688                 return -EINVAL;
689
690         doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
691         netlbl_netlink_auditinfo(skb, &audit_info);
692
693         ret_val = cipso_v4_doi_remove(doi,
694                                       &audit_info,
695                                       netlbl_cipsov4_doi_free);
696         if (ret_val == 0)
697                 atomic_dec(&netlabel_mgmt_protocount);
698
699         audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
700                                               &audit_info);
701         if (audit_buf != NULL) {
702                 audit_log_format(audit_buf,
703                                  " cipso_doi=%u res=%u",
704                                  doi,
705                                  ret_val == 0 ? 1 : 0);
706                 audit_log_end(audit_buf);
707         }
708
709         return ret_val;
710 }
711
712 /*
713  * NetLabel Generic NETLINK Command Definitions
714  */
715
716 static struct genl_ops netlbl_cipsov4_ops[] = {
717         {
718         .cmd = NLBL_CIPSOV4_C_ADD,
719         .flags = GENL_ADMIN_PERM,
720         .policy = netlbl_cipsov4_genl_policy,
721         .doit = netlbl_cipsov4_add,
722         .dumpit = NULL,
723         },
724         {
725         .cmd = NLBL_CIPSOV4_C_REMOVE,
726         .flags = GENL_ADMIN_PERM,
727         .policy = netlbl_cipsov4_genl_policy,
728         .doit = netlbl_cipsov4_remove,
729         .dumpit = NULL,
730         },
731         {
732         .cmd = NLBL_CIPSOV4_C_LIST,
733         .flags = 0,
734         .policy = netlbl_cipsov4_genl_policy,
735         .doit = netlbl_cipsov4_list,
736         .dumpit = NULL,
737         },
738         {
739         .cmd = NLBL_CIPSOV4_C_LISTALL,
740         .flags = 0,
741         .policy = netlbl_cipsov4_genl_policy,
742         .doit = NULL,
743         .dumpit = netlbl_cipsov4_listall,
744         },
745 };
746
747 /*
748  * NetLabel Generic NETLINK Protocol Functions
749  */
750
751 /**
752  * netlbl_cipsov4_genl_init - Register the CIPSOv4 NetLabel component
753  *
754  * Description:
755  * Register the CIPSOv4 packet NetLabel component with the Generic NETLINK
756  * mechanism.  Returns zero on success, negative values on failure.
757  *
758  */
759 int __init netlbl_cipsov4_genl_init(void)
760 {
761         int ret_val, i;
762
763         ret_val = genl_register_family(&netlbl_cipsov4_gnl_family);
764         if (ret_val != 0)
765                 return ret_val;
766
767         for (i = 0; i < ARRAY_SIZE(netlbl_cipsov4_ops); i++) {
768                 ret_val = genl_register_ops(&netlbl_cipsov4_gnl_family,
769                                 &netlbl_cipsov4_ops[i]);
770                 if (ret_val != 0)
771                         return ret_val;
772         }
773
774         return 0;
775 }