#include <linux/skbuff.h>
#include <linux/spinlock.h>
#include <linux/string.h>
+#include <linux/audit.h>
#include <net/netlabel.h>
#include <net/cipso_ipv4.h>
#include <asm/bug.h>
#include "netlabel_mgmt.h"
#include "netlabel_domainhash.h"
+#include "netlabel_user.h"
struct netlbl_domhsh_tbl {
struct list_head *tbl;
/* Domain hash table */
/* XXX - updates should be so rare that having one spinlock for the entire
* hash table should be okay */
-DEFINE_SPINLOCK(netlbl_domhsh_lock);
+static DEFINE_SPINLOCK(netlbl_domhsh_lock);
static struct netlbl_domhsh_tbl *netlbl_domhsh = NULL;
/* Default domain mapping */
-DEFINE_SPINLOCK(netlbl_domhsh_def_lock);
+static DEFINE_SPINLOCK(netlbl_domhsh_def_lock);
static struct netlbl_dom_map *netlbl_domhsh_def = NULL;
/*
/**
* netlbl_domhsh_add - Adds a entry to the domain hash table
* @entry: the entry to add
+ * @audit_info: NetLabel audit information
*
* Description:
* Adds a new entry to the domain hash table and handles any updates to the
* negative on failure.
*
*/
-int netlbl_domhsh_add(struct netlbl_dom_map *entry)
+int netlbl_domhsh_add(struct netlbl_dom_map *entry,
+ struct netlbl_audit *audit_info)
{
int ret_val;
u32 bkt;
+ struct audit_buffer *audit_buf;
+ char *audit_domain;
switch (entry->type) {
case NETLBL_NLTYPE_UNLABELED:
spin_unlock(&netlbl_domhsh_def_lock);
} else
ret_val = -EINVAL;
+
+ if (entry->domain != NULL)
+ audit_domain = entry->domain;
+ else
+ audit_domain = "(default)";
+ audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_ADD, audit_info);
+ audit_log_format(audit_buf, " nlbl_domain=%s", audit_domain);
+ switch (entry->type) {
+ case NETLBL_NLTYPE_UNLABELED:
+ audit_log_format(audit_buf, " nlbl_protocol=unlbl");
+ break;
+ case NETLBL_NLTYPE_CIPSOV4:
+ audit_log_format(audit_buf,
+ " nlbl_protocol=cipsov4 cipso_doi=%u",
+ entry->type_def.cipsov4->doi);
+ break;
+ }
+ audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0);
+ audit_log_end(audit_buf);
+
rcu_read_unlock();
if (ret_val != 0) {
/**
* netlbl_domhsh_add_default - Adds the default entry to the domain hash table
* @entry: the entry to add
+ * @audit_info: NetLabel audit information
*
* Description:
* Adds a new default entry to the domain hash table and handles any updates
* negative on failure.
*
*/
-int netlbl_domhsh_add_default(struct netlbl_dom_map *entry)
+int netlbl_domhsh_add_default(struct netlbl_dom_map *entry,
+ struct netlbl_audit *audit_info)
{
- return netlbl_domhsh_add(entry);
+ return netlbl_domhsh_add(entry, audit_info);
}
/**
* netlbl_domhsh_remove - Removes an entry from the domain hash table
* @domain: the domain to remove
+ * @audit_info: NetLabel audit information
*
* Description:
* Removes an entry from the domain hash table and handles any updates to the
* negative on failure.
*
*/
-int netlbl_domhsh_remove(const char *domain)
+int netlbl_domhsh_remove(const char *domain, struct netlbl_audit *audit_info)
{
int ret_val = -ENOENT;
struct netlbl_dom_map *entry;
+ struct audit_buffer *audit_buf;
+ char *audit_domain;
rcu_read_lock();
if (domain != NULL)
ret_val = -ENOENT;
spin_unlock(&netlbl_domhsh_def_lock);
}
+
+ if (entry->domain != NULL)
+ audit_domain = entry->domain;
+ else
+ audit_domain = "(default)";
+ audit_buf = netlbl_audit_start_common(AUDIT_MAC_MAP_DEL, audit_info);
+ audit_log_format(audit_buf,
+ " nlbl_domain=%s res=%u",
+ audit_domain,
+ ret_val == 0 ? 1 : 0);
+ audit_log_end(audit_buf);
+
if (ret_val == 0)
call_rcu(&entry->rcu, netlbl_domhsh_free_entry);
/**
* netlbl_domhsh_remove_default - Removes the default entry from the table
+ * @audit_info: NetLabel audit information
*
* Description:
* Removes/resets the default entry for the domain hash table and handles any
* success, non-zero on failure.
*
*/
-int netlbl_domhsh_remove_default(void)
+int netlbl_domhsh_remove_default(struct netlbl_audit *audit_info)
{
- return netlbl_domhsh_remove(NULL);
+ return netlbl_domhsh_remove(NULL, audit_info);
}
/**
}
/**
- * netlbl_domhsh_dump - Dump the domain hash table into a sk_buff
+ * netlbl_domhsh_walk - Iterate through the domain mapping hash table
+ * @skip_bkt: the number of buckets to skip at the start
+ * @skip_chain: the number of entries to skip in the first iterated bucket
+ * @callback: callback for each entry
+ * @cb_arg: argument for the callback function
*
* Description:
- * Dump the domain hash table into a buffer suitable for returning to an
- * application in response to a NetLabel management DOMAIN message. This
- * function may fail if another process is growing the hash table at the same
- * time. The returned sk_buff has room at the front of the sk_buff for
- * @headroom bytes. See netlabel.h for the DOMAIN message format. Returns a
- * pointer to a sk_buff on success, NULL on error.
+ * Interate over the domain mapping hash table, skipping the first @skip_bkt
+ * buckets and @skip_chain entries. For each entry in the table call
+ * @callback, if @callback returns a negative value stop 'walking' through the
+ * table and return. Updates the values in @skip_bkt and @skip_chain on
+ * return. Returns zero on succcess, negative values on failure.
*
*/
-struct sk_buff *netlbl_domhsh_dump(size_t headroom)
+int netlbl_domhsh_walk(u32 *skip_bkt,
+ u32 *skip_chain,
+ int (*callback) (struct netlbl_dom_map *entry, void *arg),
+ void *cb_arg)
{
- struct sk_buff *skb = NULL;
- ssize_t buf_len;
- u32 bkt_iter;
- u32 dom_cnt = 0;
- struct netlbl_domhsh_tbl *hsh_tbl;
- struct netlbl_dom_map *list_iter;
- ssize_t tmp_len;
+ int ret_val = -ENOENT;
+ u32 iter_bkt;
+ struct netlbl_dom_map *iter_entry;
+ u32 chain_cnt = 0;
- buf_len = NETLBL_LEN_U32;
rcu_read_lock();
- hsh_tbl = rcu_dereference(netlbl_domhsh);
- for (bkt_iter = 0; bkt_iter < hsh_tbl->size; bkt_iter++)
- list_for_each_entry_rcu(list_iter,
- &hsh_tbl->tbl[bkt_iter], list) {
- buf_len += NETLBL_LEN_U32 +
- nla_total_size(strlen(list_iter->domain) + 1);
- switch (list_iter->type) {
- case NETLBL_NLTYPE_UNLABELED:
- break;
- case NETLBL_NLTYPE_CIPSOV4:
- buf_len += 2 * NETLBL_LEN_U32;
- break;
- }
- dom_cnt++;
- }
-
- skb = netlbl_netlink_alloc_skb(headroom, buf_len, GFP_ATOMIC);
- if (skb == NULL)
- goto dump_failure;
-
- if (nla_put_u32(skb, NLA_U32, dom_cnt) != 0)
- goto dump_failure;
- buf_len -= NETLBL_LEN_U32;
- hsh_tbl = rcu_dereference(netlbl_domhsh);
- for (bkt_iter = 0; bkt_iter < hsh_tbl->size; bkt_iter++)
- list_for_each_entry_rcu(list_iter,
- &hsh_tbl->tbl[bkt_iter], list) {
- tmp_len = nla_total_size(strlen(list_iter->domain) +
- 1);
- if (buf_len < NETLBL_LEN_U32 + tmp_len)
- goto dump_failure;
- if (nla_put_string(skb,
- NLA_STRING,
- list_iter->domain) != 0)
- goto dump_failure;
- if (nla_put_u32(skb, NLA_U32, list_iter->type) != 0)
- goto dump_failure;
- buf_len -= NETLBL_LEN_U32 + tmp_len;
- switch (list_iter->type) {
- case NETLBL_NLTYPE_UNLABELED:
- break;
- case NETLBL_NLTYPE_CIPSOV4:
- if (buf_len < 2 * NETLBL_LEN_U32)
- goto dump_failure;
- if (nla_put_u32(skb,
- NLA_U32,
- list_iter->type_def.cipsov4->type) != 0)
- goto dump_failure;
- if (nla_put_u32(skb,
- NLA_U32,
- list_iter->type_def.cipsov4->doi) != 0)
- goto dump_failure;
- buf_len -= 2 * NETLBL_LEN_U32;
- break;
+ for (iter_bkt = *skip_bkt;
+ iter_bkt < rcu_dereference(netlbl_domhsh)->size;
+ iter_bkt++, chain_cnt = 0) {
+ list_for_each_entry_rcu(iter_entry,
+ &netlbl_domhsh->tbl[iter_bkt],
+ list)
+ if (iter_entry->valid) {
+ if (chain_cnt++ < *skip_chain)
+ continue;
+ ret_val = callback(iter_entry, cb_arg);
+ if (ret_val < 0) {
+ chain_cnt--;
+ goto walk_return;
+ }
}
- }
- rcu_read_unlock();
-
- return skb;
-
-dump_failure:
- rcu_read_unlock();
- kfree_skb(skb);
- return NULL;
-}
-
-/**
- * netlbl_domhsh_dump_default - Dump the default domain mapping into a sk_buff
- *
- * Description:
- * Dump the default domain mapping into a buffer suitable for returning to an
- * application in response to a NetLabel management DEFDOMAIN message. This
- * function may fail if another process is changing the default domain mapping
- * at the same time. The returned sk_buff has room at the front of the
- * skb_buff for @headroom bytes. See netlabel.h for the DEFDOMAIN message
- * format. Returns a pointer to a sk_buff on success, NULL on error.
- *
- */
-struct sk_buff *netlbl_domhsh_dump_default(size_t headroom)
-{
- struct sk_buff *skb;
- ssize_t buf_len;
- struct netlbl_dom_map *entry;
-
- buf_len = NETLBL_LEN_U32;
- rcu_read_lock();
- entry = rcu_dereference(netlbl_domhsh_def);
- if (entry != NULL)
- switch (entry->type) {
- case NETLBL_NLTYPE_UNLABELED:
- break;
- case NETLBL_NLTYPE_CIPSOV4:
- buf_len += 2 * NETLBL_LEN_U32;
- break;
- }
-
- skb = netlbl_netlink_alloc_skb(headroom, buf_len, GFP_ATOMIC);
- if (skb == NULL)
- goto dump_default_failure;
-
- if (entry != rcu_dereference(netlbl_domhsh_def))
- goto dump_default_failure;
- if (entry != NULL) {
- if (nla_put_u32(skb, NLA_U32, entry->type) != 0)
- goto dump_default_failure;
- buf_len -= NETLBL_LEN_U32;
- switch (entry->type) {
- case NETLBL_NLTYPE_UNLABELED:
- break;
- case NETLBL_NLTYPE_CIPSOV4:
- if (buf_len < 2 * NETLBL_LEN_U32)
- goto dump_default_failure;
- if (nla_put_u32(skb,
- NLA_U32,
- entry->type_def.cipsov4->type) != 0)
- goto dump_default_failure;
- if (nla_put_u32(skb,
- NLA_U32,
- entry->type_def.cipsov4->doi) != 0)
- goto dump_default_failure;
- buf_len -= 2 * NETLBL_LEN_U32;
- break;
- }
- } else
- nla_put_u32(skb, NLA_U32, NETLBL_NLTYPE_NONE);
- rcu_read_unlock();
-
- return skb;
+ }
-dump_default_failure:
+walk_return:
rcu_read_unlock();
- kfree_skb(skb);
- return NULL;
+ *skip_bkt = iter_bkt;
+ *skip_chain = chain_cnt;
+ return ret_val;
}
git://ftp.safe.ca / safe / jmp / linux-2.6 / blobdiff