/** @file
* Management Module Functions
*
* Author: Paul Moore <paul@paul-moore.com>
*
*/
/*
* (c) Copyright Hewlett-Packard Development Company, L.P., 2006, 2008
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of version 2 of the GNU General Public License as
* published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/
#include <stdlib.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/types.h>
#include <libnetlabel.h>
#include "netlabel_internal.h"
/* Generic Netlink family ID */
static uint16_t nlbl_mgmt_fid = 0;
/*
* Helper functions
*/
/**
* Create a new NetLabel management message
* @param command the NetLabel management command
* @param flags the message flags
*
* This function creates a new NetLabel management message using @command and
* @flags. Returns a pointer to the new message on success, or NULL on
* failure.
*
*/
static nlbl_msg *nlbl_mgmt_msg_new(uint16_t command, int flags)
{
nlbl_msg *msg;
struct nlmsghdr *nl_hdr;
struct genlmsghdr *genl_hdr;
/* create a new message */
msg = nlbl_msg_new();
if (msg == NULL)
goto msg_new_failure;
/* setup the netlink header */
nl_hdr = nlbl_msg_nlhdr(msg);
if (nl_hdr == NULL)
goto msg_new_failure;
nl_hdr->nlmsg_type = nlbl_mgmt_fid;
nl_hdr->nlmsg_flags = flags;
/* setup the generic netlink header */
genl_hdr = nlbl_msg_genlhdr(msg);
if (genl_hdr == NULL)
goto msg_new_failure;
genl_hdr->cmd = command;
return msg;
msg_new_failure:
nlbl_msg_free(msg);
return NULL;
}
/**
* Read a NetLabel management message
* @param hndl the NetLabel handle
* @param msg the message
*
* Try to read a NetLabel management message and return the message in @msg.
* Returns the number of bytes read on success, zero on EOF, and negative
* values on failure.
*
*/
static int nlbl_mgmt_recv(struct nlbl_handle *hndl, nlbl_msg **msg)
{
int rc;
struct nlmsghdr *nl_hdr;
/* try to get a message from the handle */
rc = nlbl_comm_recv(hndl, msg);
if (rc <= 0)
goto recv_failure;
/* process the response */
nl_hdr = nlbl_msg_nlhdr(*msg);
if (nl_hdr == NULL || (nl_hdr->nlmsg_type != nlbl_mgmt_fid &&
nl_hdr->nlmsg_type != NLMSG_DONE &&
nl_hdr->nlmsg_type != NLMSG_ERROR)) {
rc = -EBADMSG;
goto recv_failure;
}
return rc;
recv_failure:
nlbl_msg_free(*msg);
return rc;
}
/**
* Parse an ACK message
* @param msg the message
*
* Parse the ACK message in @msg and return the error code specified in the
* ACK.
*
*/
static int nlbl_mgmt_parse_ack(nlbl_msg *msg)
{
struct nlmsgerr *nl_err;
nl_err = nlbl_msg_err(msg);
if (nl_err == NULL)
return -ENOMSG;
return nl_err->error;
}
/**
* Parse a LIST message with address selectors
* @param nla_head the NLBL_MGMT_A_SELECTORLIST attribute
* @param domain the domain mapping entry
*
* Parse the NLBL_MGMT_A_SELECTORLIST attribute and populate @domain with
* the information. Returns zero on success, negative values on failure.
*
*/
static int nlbl_mgmt_list_addr(const struct nlattr *nla_head,
struct nlbl_dommap *domain)
{
struct nlbl_dommap_addr *addr_iter;
struct nlattr *nla_a;
struct nlattr *nla_b;
int nla_a_rem;
domain->proto_type = NETLBL_NLTYPE_ADDRSELECT;
/* parse the attributes */
nla_for_each_attr(nla_a,
nla_data(nla_head), nla_len(nla_head),
nla_a_rem)
if (nla_a->nla_type == NLBL_MGMT_A_ADDRSELECTOR) {
addr_iter = malloc(sizeof(*addr_iter));
if (addr_iter == NULL)
return -ENOMEM;
memset(addr_iter, 0, sizeof(*addr_iter));
if (domain->proto.addrsel != NULL) {
struct nlbl_dommap_addr *iter;
iter = domain->proto.addrsel;
while (iter->next != NULL)
iter = iter->next;
iter->next = addr_iter;
} else
domain->proto.addrsel = addr_iter;
nla_b = nla_find(nla_data(nla_a), nla_len(nla_a),
NLBL_MGMT_A_IPV4ADDR);
if (nla_b != NULL) {
if (nla_len(nla_b) != sizeof(struct in_addr))
return -EINVAL;
memcpy(&addr_iter->addr.addr.v4,
nla_data(nla_b), nla_len(nla_b));
nla_b = nla_find(nla_data(nla_a),
nla_len(nla_a),
NLBL_MGMT_A_IPV4MASK);
if (nla_b == NULL ||
nla_len(nla_b) != sizeof(struct in_addr))
return -EINVAL;
memcpy(&addr_iter->addr.mask.v4,
nla_data(nla_b), nla_len(nla_b));
addr_iter->addr.type = AF_INET;
nla_b = nla_find(nla_data(nla_a),
nla_len(nla_a),
NLBL_MGMT_A_PROTOCOL);
if (nla_b == NULL)
return -EINVAL;
addr_iter->proto_type = nla_get_u32(nla_b);
switch (addr_iter->proto_type) {
case NETLBL_NLTYPE_CIPSOV4:
nla_b = nla_find(nla_data(nla_a),
nla_len(nla_a),
NLBL_MGMT_A_CV4DOI);
if (nla_b == NULL)
return -EINVAL;
addr_iter->proto.cip_doi =
nla_get_u32(nla_b);
break;
}
} else if ((nla_b = nla_find(nla_data(nla_a),
nla_len(nla_a),
NLBL_MGMT_A_IPV6ADDR))) {
if (nla_len(nla_b) != sizeof(struct in6_addr))
return -EINVAL;
memcpy(&addr_iter->addr.addr.v6,
nla_data(nla_b), nla_len(nla_b));
nla_b = nla_find(nla_data(nla_a),
nla_len(nla_a),
NLBL_MGMT_A_IPV6MASK);
if (nla_b == NULL ||
nla_len(nla_b) != sizeof(struct in6_addr))
return -EINVAL;
memcpy(&addr_iter->addr.mask.v6,
nla_data(nla_b), nla_len(nla_b));
addr_iter->addr.type = AF_INET6;
nla_b = nla_find(nla_data(nla_a),
nla_len(nla_a),
NLBL_MGMT_A_PROTOCOL);
if (nla_b == NULL)
return -EINVAL;
addr_iter->proto_type = nla_get_u32(nla_b);
switch (addr_iter->proto_type) {
case NETLBL_NLTYPE_CALIPSO:
nla_b = nla_find(nla_data(nla_a),
nla_len(nla_a),
NLBL_MGMT_A_CLPDOI);
if (nla_b == NULL)
return -EINVAL;
addr_iter->proto.clp_doi =
nla_get_u32(nla_b);
break;
}
} else
return -EINVAL;
}
return 0;
}
/*
* Init functions
*/
/**
* Perform any setup needed
*
* Do any setup needed for the management component, including determining the
* NetLabel Mangement Generic Netlink family ID. Returns zero on success,
* negative values on error.
*
*/
int nlbl_mgmt_init(void)
{
int rc = -ENOMEM;
struct nlbl_handle *hndl;
/* get a netlabel handle */
hndl = nlbl_comm_open();
if (hndl == NULL)
goto init_return;
/* resolve the family */
rc = genl_ctrl_resolve(hndl->nl_sock, NETLBL_NLTYPE_MGMT_NAME);
if (rc < 0)
goto init_return;
nlbl_mgmt_fid = rc;
rc = 0;
init_return:
nlbl_comm_close(hndl);
return rc;
}
/*
* NetLabel operations
*/
/**
* Determine the supported list of NetLabel protocols
* @param hndl the NetLabel handle
* @param protocols protocol array
*
* Query the NetLabel subsystem and return the supported protocols in
* @protocols. If @hndl is NULL then the function will handle opening and
* closing it's own NetLabel handle. Returns the number of protocols on
* success, zero if no protocols are supported, and negative values on failure.
*
*/
int nlbl_mgmt_protocols(struct nlbl_handle *hndl, nlbl_proto **protocols)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
unsigned char *data = NULL;
nlbl_msg *msg = NULL;
struct nlmsghdr *nl_hdr;
struct genlmsghdr *genl_hdr;
struct nlattr *nla_head;
struct nlattr *nla;
int data_len;
int data_attrlen;
nlbl_proto *protos = NULL, *protos_new;
uint32_t protos_count = 0;
/* sanity checks */
if (protocols == NULL)
return -EINVAL;
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto protocols_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_PROTOCOLS, NLM_F_DUMP);
if (msg == NULL) {
rc = -ENOMEM;
goto protocols_return;
}
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto protocols_return;
}
/* read all of the messages (multi-message response) */
do {
if (data != NULL) {
free(data);
data = NULL;
}
/* get the next set of messages */
rc = nlbl_comm_recv_raw(p_hndl, &data);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto protocols_return;
}
data_len = rc;
nl_hdr = (struct nlmsghdr *)data;
/* check to see if this is a netlink control message we don't
* care about */
if (nl_hdr->nlmsg_type == NLMSG_NOOP ||
nl_hdr->nlmsg_type == NLMSG_ERROR ||
nl_hdr->nlmsg_type == NLMSG_OVERRUN) {
rc = -EBADMSG;
goto protocols_return;
}
/* loop through the messages */
while (nlmsg_ok(nl_hdr, data_len) &&
nl_hdr->nlmsg_type != NLMSG_DONE) {
/* get the header pointers */
genl_hdr = (struct genlmsghdr *)nlmsg_data(nl_hdr);
if (genl_hdr == NULL ||
genl_hdr->cmd != NLBL_MGMT_C_PROTOCOLS) {
rc = -EBADMSG;
goto protocols_return;
}
nla_head = (struct nlattr *)(&genl_hdr[1]);
data_attrlen = genlmsg_attrlen(genl_hdr, 0);
/* resize the array */
protos_new = realloc(protos,
sizeof(nlbl_proto) *
(protos_count + 1));
if (protos_new == NULL)
goto protocols_return;
protos = protos_new;
/* get the attribute information */
nla = nla_find(nla_head,
data_attrlen, NLBL_MGMT_A_PROTOCOL);
if (nla == NULL)
goto protocols_return;
protos[protos_count] = nla_get_u32(nla);
protos_count++;
/* next message */
nl_hdr = nlmsg_next(nl_hdr, &data_len);
}
} while (NL_MULTI_CONTINUE(nl_hdr));
*protocols = protos;
rc = protos_count;
protocols_return:
if (rc < 0 && protos)
free(protos);
if (hndl == NULL)
nlbl_comm_close(p_hndl);
if (data != NULL)
free(data);
nlbl_msg_free(msg);
return rc;
}
/**
* Determine the kernel's NetLabel protocol version
* @param hndl the NetLabel handle
* @param version the protocol version
*
* Request the NetLabel protocol version from the kernel and return the result
* to the caller. If @hndl is NULL then the function will handle opening and
* closing it's own NetLabel handle. Returns zero on success, negative values
* on failure.
*
*/
int nlbl_mgmt_version(struct nlbl_handle *hndl, uint32_t *version)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
nlbl_msg *msg = NULL;
nlbl_msg *ans_msg = NULL;
struct genlmsghdr *genl_hdr;
struct nlattr *nla;
/* sanity checks */
if (version == NULL)
return -EINVAL;
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto version_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_VERSION, 0);
if (msg == NULL)
goto version_return;
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc == 0) {
if (rc == 0)
rc = -ENODATA;
goto version_return;
}
/* read the response */
rc = nlbl_mgmt_recv(p_hndl, &ans_msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto version_return;
}
/* check the response */
rc = nlbl_mgmt_parse_ack(ans_msg);
if (rc < 0 && rc != -ENOMSG)
goto version_return;
genl_hdr = nlbl_msg_genlhdr(ans_msg);
if (genl_hdr == NULL || genl_hdr->cmd != NLBL_MGMT_C_VERSION) {
rc = -EBADMSG;
goto version_return;
}
/* process the response */
nla = nlbl_attr_find(ans_msg, NLBL_MGMT_A_VERSION);
if (nla == NULL) {
rc = -EBADMSG;
goto version_return;
}
*version = nla_get_u32(nla);
rc = 0;
version_return:
if (hndl == NULL)
nlbl_comm_close(p_hndl);
nlbl_msg_free(msg);
nlbl_msg_free(ans_msg);
return rc;
}
/**
* Add a domain mapping to the NetLabel system
* @param hndl the NetLabel handle
* @param domain the NetLabel domain map
* @param addr the network IP address
*
* Add the domain mapping in @domain to the NetLabel system. If @hndl is NULL
* then the function will handle opening and closing it's own NetLabel handle.
* Returns zero on success, negative values on failure.
*
*/
int nlbl_mgmt_add(struct nlbl_handle *hndl,
struct nlbl_dommap *domain,
struct nlbl_netaddr *addr)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
nlbl_msg *msg = NULL;
nlbl_msg *ans_msg = NULL;
/* sanity checks */
if (domain == NULL || domain->domain == NULL)
return -EINVAL;
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto add_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_ADD, 0);
if (msg == NULL)
goto add_return;
/* add the required attributes to the message */
rc = nla_put_string(msg, NLBL_MGMT_A_DOMAIN, domain->domain);
if (rc != 0)
goto add_return;
rc = nla_put_u32(msg, NLBL_MGMT_A_PROTOCOL, domain->proto_type);
if (rc != 0)
goto add_return;
rc = nla_put_u16(msg, NLBL_MGMT_A_FAMILY, domain->family);
if (rc != 0)
goto add_return;
switch (domain->proto_type) {
case NETLBL_NLTYPE_CIPSOV4:
rc = nla_put_u32(msg,
NLBL_MGMT_A_CV4DOI,
domain->proto.cip_doi);
if (rc != 0)
goto add_return;
break;
case NETLBL_NLTYPE_CALIPSO:
rc = nla_put_u32(msg,
NLBL_MGMT_A_CLPDOI,
domain->proto.clp_doi);
if (rc != 0)
goto add_return;
break;
}
/* optional attributes */
switch (addr->type) {
case AF_INET:
rc = nla_put(msg,
NLBL_MGMT_A_IPV4ADDR,
sizeof(struct in_addr),
&addr->addr.v4);
if (rc != 0)
goto add_return;
rc = nla_put(msg,
NLBL_MGMT_A_IPV4MASK,
sizeof(struct in_addr),
&addr->mask.v4);
if (rc != 0)
goto add_return;
break;
case AF_INET6:
rc = nla_put(msg,
NLBL_MGMT_A_IPV6ADDR,
sizeof(struct in6_addr),
&addr->addr.v6);
if (rc != 0)
goto add_return;
rc = nla_put(msg,
NLBL_MGMT_A_IPV6MASK,
sizeof(struct in6_addr),
&addr->mask.v6);
if (rc != 0)
goto add_return;
break;
case 0:
rc = 0;
break;
default:
rc = -EINVAL;
goto add_return;
}
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto add_return;
}
/* read the response */
rc = nlbl_mgmt_recv(p_hndl, &ans_msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto add_return;
}
/* process the response */
rc = nlbl_mgmt_parse_ack(ans_msg);
add_return:
if (hndl == NULL)
nlbl_comm_close(p_hndl);
nlbl_msg_free(msg);
nlbl_msg_free(ans_msg);
return rc;
}
/**
* Add the default domain mapping to the NetLabel system
* @param hndl the NetLabel handle
* @param domain the NetLabel domain map
* @param addr the network IP address
*
* Add the domain mapping in @domain to the NetLabel system as the default
* mapping. If @hndl is NULL then the function will handle opening and
* closing it's own NetLabel handle. Returns zero on success, negative values
* on failure.
*
*/
int nlbl_mgmt_adddef(struct nlbl_handle *hndl,
struct nlbl_dommap *domain,
struct nlbl_netaddr *addr)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
nlbl_msg *msg = NULL;
nlbl_msg *ans_msg = NULL;
/* sanity checks */
if (domain == NULL)
return -EINVAL;
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto adddef_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_ADDDEF, 0);
if (msg == NULL)
goto adddef_return;
/* add the required attributes to the message */
rc = nla_put_u32(msg, NLBL_MGMT_A_PROTOCOL, domain->proto_type);
if (rc != 0)
goto adddef_return;
rc = nla_put_u16(msg, NLBL_MGMT_A_FAMILY, domain->family);
if (rc != 0)
goto adddef_return;
switch (domain->proto_type) {
case NETLBL_NLTYPE_CIPSOV4:
rc = nla_put_u32(msg,
NLBL_MGMT_A_CV4DOI,
domain->proto.cip_doi);
if (rc != 0)
goto adddef_return;
break;
case NETLBL_NLTYPE_CALIPSO:
rc = nla_put_u32(msg,
NLBL_MGMT_A_CLPDOI,
domain->proto.clp_doi);
if (rc != 0)
goto adddef_return;
break;
}
/* optional attributes */
switch (addr->type) {
case AF_INET:
rc = nla_put(msg,
NLBL_MGMT_A_IPV4ADDR,
sizeof(struct in_addr),
&addr->addr.v4);
if (rc != 0)
goto adddef_return;
rc = nla_put(msg,
NLBL_MGMT_A_IPV4MASK,
sizeof(struct in_addr),
&addr->mask.v4);
if (rc != 0)
goto adddef_return;
break;
case AF_INET6:
rc = nla_put(msg,
NLBL_MGMT_A_IPV6ADDR,
sizeof(struct in6_addr),
&addr->addr.v6);
if (rc != 0)
goto adddef_return;
rc = nla_put(msg,
NLBL_MGMT_A_IPV6MASK,
sizeof(struct in6_addr),
&addr->mask.v6);
if (rc != 0)
goto adddef_return;
break;
case 0:
rc = 0;
break;
default:
rc = -EINVAL;
goto adddef_return;
}
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto adddef_return;
}
/* read the response */
rc = nlbl_mgmt_recv(p_hndl, &ans_msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto adddef_return;
}
/* process the response */
rc = nlbl_mgmt_parse_ack(ans_msg);
adddef_return:
if (hndl == NULL)
nlbl_comm_close(p_hndl);
nlbl_msg_free(msg);
nlbl_msg_free(ans_msg);
return rc;
}
/**
* Remove a domain mapping from the NetLabel system
* @param hndl the NetLabel handle
* @param domain the domain
*
* Remove the domain mapping specified by @domain from the NetLabel system.
* If @hndl is NULL then the function will handle opening and closing it's own
* NetLabel handle. Returns zero on success, negative values on failure.
*
*/
int nlbl_mgmt_del(struct nlbl_handle *hndl, char *domain)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
nlbl_msg *msg = NULL;
nlbl_msg *ans_msg = NULL;
/* sanity checks */
if (domain == NULL)
return -EINVAL;
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto del_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_REMOVE, 0);
if (msg == NULL)
goto del_return;
/* add the required attributes to the message */
rc = nla_put_string(msg, NLBL_MGMT_A_DOMAIN, domain);
if (rc != 0)
goto del_return;
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto del_return;
}
/* read the response */
rc = nlbl_mgmt_recv(p_hndl, &ans_msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto del_return;
}
/* process the response */
rc = nlbl_mgmt_parse_ack(ans_msg);
del_return:
if (hndl == NULL)
nlbl_comm_close(p_hndl);
nlbl_msg_free(msg);
nlbl_msg_free(ans_msg);
return rc;
}
/**
* Remove the default domain mapping from NetLabel
* @param hndl the NetLabel handle
*
* Remove the default domain mapping from the NetLabel system. If @hndl is
* NULL then the function will handle opening and closing it's own NetLabel
* handle. Returns zero on success, negative values on failure.
*
*/
int nlbl_mgmt_deldef(struct nlbl_handle *hndl)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
nlbl_msg *msg = NULL;
nlbl_msg *ans_msg = NULL;
/* sanity checks */
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto deldef_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_REMOVEDEF, 0);
if (msg == NULL)
goto deldef_return;
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto deldef_return;
}
/* read the response */
rc = nlbl_mgmt_recv(p_hndl, &ans_msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto deldef_return;
}
/* process the response */
rc = nlbl_mgmt_parse_ack(ans_msg);
deldef_return:
if (hndl == NULL)
nlbl_comm_close(p_hndl);
nlbl_msg_free(msg);
nlbl_msg_free(ans_msg);
return rc;
}
/**
* List the default NetLabel domain mapping
* @param hndl the NetLabel handle
* @param domain the default domain map
*
* Query the NetLabel subsystem and return the default domain mapping in
* @domain. If @hndl is NULL then the function will handle opening and
* closing it's own NetLabel handle. Returns zero on success, negative values
* on failure.
*
*/
int nlbl_mgmt_listdef(struct nlbl_handle *hndl, uint16_t family,
struct nlbl_dommap *domain)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
nlbl_msg *msg = NULL;
nlbl_msg *ans_msg = NULL;
struct genlmsghdr *genl_hdr;
struct nlattr *nla;
/* sanity checks */
if (domain == NULL)
return -EINVAL;
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto listdef_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_LISTDEF, 0);
if (msg == NULL)
goto listdef_return;
rc = nla_put_u16(msg, NLBL_MGMT_A_FAMILY, family);
if (rc != 0)
goto listdef_return;
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto listdef_return;
}
/* read the response */
rc = nlbl_mgmt_recv(p_hndl, &ans_msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto listdef_return;
}
/* check the response */
rc = nlbl_mgmt_parse_ack(ans_msg);
if (rc < 0 && rc != -ENOMSG)
goto listdef_return;
genl_hdr = nlbl_msg_genlhdr(ans_msg);
if (genl_hdr == NULL || genl_hdr->cmd != NLBL_MGMT_C_LISTDEF) {
rc = -EBADMSG;
goto listdef_return;
}
/* process the response */
genl_hdr = nlbl_msg_genlhdr(ans_msg);
if (genl_hdr == NULL || genl_hdr->cmd != NLBL_MGMT_C_LISTDEF)
goto listdef_return;
nla = nlbl_attr_find(ans_msg, NLBL_MGMT_A_FAMILY);
if (nla != NULL)
domain->family = nla_get_u16(nla);
else
domain->family = AF_UNSPEC;
nla = nlbl_attr_find(ans_msg, NLBL_MGMT_A_PROTOCOL);
if (nla != NULL) {
domain->proto_type = nla_get_u32(nla);
switch (domain->proto_type) {
case NETLBL_NLTYPE_CIPSOV4:
nla = nlbl_attr_find(ans_msg, NLBL_MGMT_A_CV4DOI);
if (nla == NULL)
goto listdef_return;
domain->proto.cip_doi = nla_get_u32(nla);
break;
case NETLBL_NLTYPE_CALIPSO:
nla = nlbl_attr_find(ans_msg, NLBL_MGMT_A_CLPDOI);
if (nla == NULL)
goto listdef_return;
domain->proto.clp_doi = nla_get_u32(nla);
break;
}
} else if ((nla = nlbl_attr_find(ans_msg, NLBL_MGMT_A_SELECTORLIST))) {
if (nlbl_mgmt_list_addr(nla, domain) != 0)
goto listdef_return;
} else
goto listdef_return;
rc = 0;
listdef_return:
if (hndl == NULL)
nlbl_comm_close(p_hndl);
nlbl_msg_free(msg);
nlbl_msg_free(ans_msg);
return rc;
}
/**
* List all of the configured NetLabel domain mappings
* @param hndl the NetLabel handle
* @param domains domain mapping array
*
* Query the NetLabel subsystem and return the configured domain mappings in
* @domains. If @hndl is NULL then the function will handle opening and
* closing it's own NetLabel handle. Returns the number of domains on success,
* zero if no domains are specified, and negative values on failure.
*
*/
int nlbl_mgmt_listall(struct nlbl_handle *hndl, struct nlbl_dommap **domains)
{
int rc = -ENOMEM;
struct nlbl_handle *p_hndl = hndl;
unsigned char *data = NULL;
nlbl_msg *msg = NULL;
struct nlmsghdr *nl_hdr;
struct genlmsghdr *genl_hdr;
struct nlattr *nla_head;
struct nlattr *nla;
int data_len;
int data_attrlen;
struct nlbl_dommap *dmns = NULL, *dmns_new;
uint32_t dmns_count = 0;
/* sanity checks */
if (domains == NULL)
return -EINVAL;
if (nlbl_mgmt_fid == 0)
return -ENOPROTOOPT;
/* open a handle if we need one */
if (p_hndl == NULL) {
p_hndl = nlbl_comm_open();
if (p_hndl == NULL)
goto listall_return;
}
/* create a new message */
msg = nlbl_mgmt_msg_new(NLBL_MGMT_C_LISTALL, NLM_F_DUMP);
if (msg == NULL) {
rc = -ENOMEM;
goto listall_return;
}
/* send the request */
rc = nlbl_comm_send(p_hndl, msg);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto listall_return;
}
/* read all of the messages (multi-message response) */
do {
if (data != NULL) {
free(data);
data = NULL;
}
/* get the next set of messages */
rc = nlbl_comm_recv_raw(p_hndl, &data);
if (rc <= 0) {
if (rc == 0)
rc = -ENODATA;
goto listall_return;
}
data_len = rc;
nl_hdr = (struct nlmsghdr *)data;
/* check to see if this is a netlink control message we don't
* care about */
if (nl_hdr->nlmsg_type == NLMSG_NOOP ||
nl_hdr->nlmsg_type == NLMSG_ERROR ||
nl_hdr->nlmsg_type == NLMSG_OVERRUN) {
rc = -EBADMSG;
goto listall_return;
}
/* loop through the messages */
while (nlmsg_ok(nl_hdr, data_len) &&
nl_hdr->nlmsg_type != NLMSG_DONE) {
/* get the header pointers */
genl_hdr = (struct genlmsghdr *)nlmsg_data(nl_hdr);
if (genl_hdr == NULL ||
genl_hdr->cmd != NLBL_MGMT_C_LISTALL) {
rc = -EBADMSG;
goto listall_return;
}
nla_head = (struct nlattr *)(&genl_hdr[1]);
data_attrlen = genlmsg_attrlen(genl_hdr, 0);
/* resize the array */
dmns_new = realloc(dmns,
sizeof(*dmns) * (dmns_count + 1));
if (dmns_new == NULL)
goto listall_return;
dmns = dmns_new;
memset(&dmns[dmns_count], 0, sizeof(*dmns));
/* get the attribute information */
nla = nla_find(nla_head,
data_attrlen, NLBL_MGMT_A_DOMAIN);
if (nla == NULL)
goto listall_return;
dmns[dmns_count].domain = malloc(nla_len(nla));
if (dmns[dmns_count].domain == NULL)
goto listall_return;
strncpy(dmns[dmns_count].domain, nla_data(nla),
nla_len(nla));
nla = nla_find(nla_head,
data_attrlen, NLBL_MGMT_A_FAMILY);
if (nla != NULL)
dmns[dmns_count].family = nla_get_u16(nla);
else
dmns[dmns_count].family = AF_UNSPEC;
nla = nla_find(nla_head,
data_attrlen, NLBL_MGMT_A_PROTOCOL);
if (nla != NULL) {
dmns[dmns_count].proto_type = nla_get_u32(nla);
switch (dmns[dmns_count].proto_type) {
case NETLBL_NLTYPE_CIPSOV4:
nla = nla_find(nla_head,
data_attrlen,
NLBL_MGMT_A_CV4DOI);
if (nla == NULL)
goto listall_return;
dmns[dmns_count].proto.cip_doi =
nla_get_u32(nla);
break;
case NETLBL_NLTYPE_CALIPSO:
nla = nla_find(nla_head,
data_attrlen,
NLBL_MGMT_A_CLPDOI);
if (nla == NULL)
goto listall_return;
dmns[dmns_count].proto.clp_doi =
nla_get_u32(nla);
break;
}
} else if ((nla = nla_find(nla_head, data_attrlen,
NLBL_MGMT_A_SELECTORLIST))) {
if (nlbl_mgmt_list_addr(nla,
&dmns[dmns_count]) != 0)
goto listall_return;
} else
goto listall_return;
dmns_count++;
/* next message */
nl_hdr = nlmsg_next(nl_hdr, &data_len);
}
} while (NL_MULTI_CONTINUE(nl_hdr));
*domains = dmns;
rc = dmns_count;
listall_return:
if (rc < 0 && dmns) {
do {
if (dmns[dmns_count].domain) {
free(dmns[dmns_count].domain);
if (dmns[dmns_count].proto_type ==
NETLBL_NLTYPE_ADDRSELECT) {
struct nlbl_dommap_addr *iter, *prev;
iter = dmns[dmns_count].proto.addrsel;
while (iter) {
prev = iter;
iter = iter->next;
free(prev);
}
}
}
} while (dmns_count-- > 0);
free(dmns);
}
if (hndl == NULL)
nlbl_comm_close(p_hndl);
if (data)
free(data);
nlbl_msg_free(msg);
return rc;
}