[net-next-2.6.git] / net / netlabel / netlabel_kapi.c

/*
 * NetLabel Kernel API
 *
 * This file defines the kernel API for the NetLabel system.  The NetLabel
 * system manages static and dynamic label mappings for network protocols such
 * as CIPSO and RIPSO.
 *
 * Author: Paul Moore <paul.moore@hp.com>
 *
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 *
 * This program is free software;  you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program;  if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */

#include <linux/init.h>
#include <linux/types.h>
#include <net/ip.h>
#include <net/netlabel.h>
#include <net/cipso_ipv4.h>
#include <asm/bug.h>

#include "netlabel_domainhash.h"
#include "netlabel_unlabeled.h"
#include "netlabel_user.h"

/*
 * Security Attribute Functions
 */

/**
 * netlbl_secattr_catmap_walk - Walk a LSM secattr catmap looking for a bit
 * @catmap: the category bitmap
 * @offset: the offset to start searching at, in bits
 *
 * Description:
 * This function walks a LSM secattr category bitmap starting at @offset and
 * returns the spot of the first set bit or -ENOENT if no bits are set.
 *
 */
int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
			       u32 offset)
{
	struct netlbl_lsm_secattr_catmap *iter = catmap;
	u32 node_idx;
	u32 node_bit;
	NETLBL_CATMAP_MAPTYPE bitmap;

	if (offset > iter->startbit) {
		while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
			iter = iter->next;
			if (iter == NULL)
				return -ENOENT;
		}
		node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
		node_bit = offset - iter->startbit -
			   (NETLBL_CATMAP_MAPSIZE * node_idx);
	} else {
		node_idx = 0;
		node_bit = 0;
	}
	bitmap = iter->bitmap[node_idx] >> node_bit;

	for (;;) {
		if (bitmap != 0) {
			while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
				bitmap >>= 1;
				node_bit++;
			}
			return iter->startbit +
				(NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit;
		}
		if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
			if (iter->next != NULL) {
				iter = iter->next;
				node_idx = 0;
			} else
				return -ENOENT;
		}
		bitmap = iter->bitmap[node_idx];
		node_bit = 0;
	}

	return -ENOENT;
}

/**
 * netlbl_secattr_catmap_walk_rng - Find the end of a string of set bits
 * @catmap: the category bitmap
 * @offset: the offset to start searching at, in bits
 *
 * Description:
 * This function walks a LSM secattr category bitmap starting at @offset and
 * returns the spot of the first cleared bit or -ENOENT if the offset is past
 * the end of the bitmap.
 *
 */
int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
				   u32 offset)
{
	struct netlbl_lsm_secattr_catmap *iter = catmap;
	u32 node_idx;
	u32 node_bit;
	NETLBL_CATMAP_MAPTYPE bitmask;
	NETLBL_CATMAP_MAPTYPE bitmap;

	if (offset > iter->startbit) {
		while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
			iter = iter->next;
			if (iter == NULL)
				return -ENOENT;
		}
		node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
		node_bit = offset - iter->startbit -
			   (NETLBL_CATMAP_MAPSIZE * node_idx);
	} else {
		node_idx = 0;
		node_bit = 0;
	}
	bitmask = NETLBL_CATMAP_BIT << node_bit;

	for (;;) {
		bitmap = iter->bitmap[node_idx];
		while (bitmask != 0 && (bitmap & bitmask) != 0) {
			bitmask <<= 1;
			node_bit++;
		}

		if (bitmask != 0)
			return iter->startbit +
				(NETLBL_CATMAP_MAPSIZE * node_idx) +
				node_bit - 1;
		else if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
			if (iter->next == NULL)
				return iter->startbit +	NETLBL_CATMAP_SIZE - 1;
			iter = iter->next;
			node_idx = 0;
		}
		bitmask = NETLBL_CATMAP_BIT;
		node_bit = 0;
	}

	return -ENOENT;
}

/**
 * netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap
 * @catmap: the category bitmap
 * @bit: the bit to set
 * @flags: memory allocation flags
 *
 * Description:
 * Set the bit specified by @bit in @catmap.  Returns zero on success,
 * negative values on failure.
 *
 */
int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
				 u32 bit,
				 gfp_t flags)
{
	struct netlbl_lsm_secattr_catmap *iter = catmap;
	u32 node_bit;
	u32 node_idx;

	while (iter->next != NULL &&
	       bit >= (iter->startbit + NETLBL_CATMAP_SIZE))
		iter = iter->next;
	if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
		iter->next = netlbl_secattr_catmap_alloc(flags);
		if (iter->next == NULL)
			return -ENOMEM;
		iter = iter->next;
		iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1);
	}

	/* gcc always rounds to zero when doing integer division */
	node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
	node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx);
	iter->bitmap[node_idx] |= NETLBL_CATMAP_BIT << node_bit;

	return 0;
}

/**
 * netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap
 * @catmap: the category bitmap
 * @start: the starting bit
 * @end: the last bit in the string
 * @flags: memory allocation flags
 *
 * Description:
 * Set a range of bits, starting at @start and ending with @end.  Returns zero
 * on success, negative values on failure.
 *
 */
int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
				 u32 start,
				 u32 end,
				 gfp_t flags)
{
	int ret_val = 0;
	struct netlbl_lsm_secattr_catmap *iter = catmap;
	u32 iter_max_spot;
	u32 spot;

	/* XXX - This could probably be made a bit faster by combining writes
	 * to the catmap instead of setting a single bit each time, but for
	 * right now skipping to the start of the range in the catmap should
	 * be a nice improvement over calling the individual setbit function
	 * repeatedly from a loop. */

	while (iter->next != NULL &&
	       start >= (iter->startbit + NETLBL_CATMAP_SIZE))
		iter = iter->next;
	iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;

	for (spot = start; spot <= end && ret_val == 0; spot++) {
		if (spot >= iter_max_spot && iter->next != NULL) {
			iter = iter->next;
			iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
		}
		ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC);
	}

	return ret_val;
}

/*
 * LSM Functions
 */

/**
 * netlbl_socket_setattr - Label a socket using the correct protocol
 * @sk: the socket to label
 * @secattr: the security attributes
 *
 * Description:
 * Attach the correct label to the given socket using the security attributes
 * specified in @secattr.  This function requires exclusive access to @sk,
 * which means it either needs to be in the process of being created or locked.
 * Returns zero on success, negative values on failure.
 *
 */
int netlbl_sock_setattr(struct sock *sk,
			const struct netlbl_lsm_secattr *secattr)
{
	int ret_val = -ENOENT;
	struct netlbl_dom_map *dom_entry;

	rcu_read_lock();
	dom_entry = netlbl_domhsh_getentry(secattr->domain);
	if (dom_entry == NULL)
		goto socket_setattr_return;
	switch (dom_entry->type) {
	case NETLBL_NLTYPE_CIPSOV4:
		ret_val = cipso_v4_sock_setattr(sk,
						dom_entry->type_def.cipsov4,
						secattr);
		break;
	case NETLBL_NLTYPE_UNLABELED:
		ret_val = 0;
		break;
	default:
		ret_val = -ENOENT;
	}

socket_setattr_return:
	rcu_read_unlock();
	return ret_val;
}

/**
 * netlbl_sock_getattr - Determine the security attributes of a sock
 * @sk: the sock
 * @secattr: the security attributes
 *
 * Description:
 * Examines the given sock to see any NetLabel style labeling has been
 * applied to the sock, if so it parses the socket label and returns the
 * security attributes in @secattr.  Returns zero on success, negative values
 * on failure.
 *
 */
int netlbl_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr)
{
	int ret_val;

	ret_val = cipso_v4_sock_getattr(sk, secattr);
	if (ret_val == 0)
		return 0;

	return netlbl_unlabel_getattr(secattr);
}

/**
 * netlbl_skbuff_getattr - Determine the security attributes of a packet
 * @skb: the packet
 * @secattr: the security attributes
 *
 * Description:
 * Examines the given packet to see if a recognized form of packet labeling
 * is present, if so it parses the packet label and returns the security
 * attributes in @secattr.  Returns zero on success, negative values on
 * failure.
 *
 */
int netlbl_skbuff_getattr(const struct sk_buff *skb,
			  struct netlbl_lsm_secattr *secattr)
{
	if (CIPSO_V4_OPTEXIST(skb) &&
	    cipso_v4_skbuff_getattr(skb, secattr) == 0)
		return 0;

	return netlbl_unlabel_getattr(secattr);
}

/**
 * netlbl_skbuff_err - Handle a LSM error on a sk_buff
 * @skb: the packet
 * @error: the error code
 *
 * Description:
 * Deal with a LSM problem when handling the packet in @skb, typically this is
 * a permission denied problem (-EACCES).  The correct action is determined
 * according to the packet's labeling protocol.
 *
 */
void netlbl_skbuff_err(struct sk_buff *skb, int error)
{
	if (CIPSO_V4_OPTEXIST(skb))
		cipso_v4_error(skb, error, 0);
}

/**
 * netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches
 *
 * Description:
 * For all of the NetLabel protocols that support some form of label mapping
 * cache, invalidate the cache.  Returns zero on success, negative values on
 * error.
 *
 */
void netlbl_cache_invalidate(void)
{
	cipso_v4_cache_invalidate();
}

/**
 * netlbl_cache_add - Add an entry to a NetLabel protocol cache
 * @skb: the packet
 * @secattr: the packet's security attributes
 *
 * Description:
 * Add the LSM security attributes for the given packet to the underlying
 * NetLabel protocol's label mapping cache.  Returns zero on success, negative
 * values on error.
 *
 */
int netlbl_cache_add(const struct sk_buff *skb,
		     const struct netlbl_lsm_secattr *secattr)
{
	if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
		return -ENOMSG;

	if (CIPSO_V4_OPTEXIST(skb))
		return cipso_v4_cache_add(skb, secattr);

	return -ENOMSG;
}

/*
 * Setup Functions
 */

/**
 * netlbl_init - Initialize NetLabel
 *
 * Description:
 * Perform the required NetLabel initialization before first use.
 *
 */
static int __init netlbl_init(void)
{
	int ret_val;

	printk(KERN_INFO "NetLabel: Initializing\n");
	printk(KERN_INFO "NetLabel:  domain hash size = %u\n",
	       (1 << NETLBL_DOMHSH_BITSIZE));
	printk(KERN_INFO "NetLabel:  protocols ="
	       " UNLABELED"
	       " CIPSOv4"
	       "\n");

	ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
	if (ret_val != 0)
		goto init_failure;

	ret_val = netlbl_netlink_init();
	if (ret_val != 0)
		goto init_failure;

	ret_val = netlbl_unlabel_defconf();
	if (ret_val != 0)
		goto init_failure;
	printk(KERN_INFO "NetLabel:  unlabeled traffic allowed by default\n");

	return 0;

init_failure:
	panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
}

subsys_initcall(netlbl_init);
Commit	Line	Data
d15c345f PM	1	/*
	2	* NetLabel Kernel API
	3	*
	4	* This file defines the kernel API for the NetLabel system. The NetLabel
	5	* system manages static and dynamic label mappings for network protocols such
	6	* as CIPSO and RIPSO.
	7	*
	8	* Author: Paul Moore <paul.moore@hp.com>
	9	*
	10	*/
	11
	12	/*
	13	* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
	14	*
	15	* This program is free software; you can redistribute it and/or modify
	16	* it under the terms of the GNU General Public License as published by
	17	* the Free Software Foundation; either version 2 of the License, or
	18	* (at your option) any later version.
	19	*
	20	* This program is distributed in the hope that it will be useful,
	21	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	22	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
	23	* the GNU General Public License for more details.
	24	*
	25	* You should have received a copy of the GNU General Public License
	26	* along with this program; if not, write to the Free Software
	27	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	28	*
	29	*/
	30
	31	#include <linux/init.h>
	32	#include <linux/types.h>
	33	#include <net/ip.h>
	34	#include <net/netlabel.h>
	35	#include <net/cipso_ipv4.h>
	36	#include <asm/bug.h>
	37
	38	#include "netlabel_domainhash.h"
	39	#include "netlabel_unlabeled.h"
	40	#include "netlabel_user.h"
	41
02752760 PM	42	/*
	43	* Security Attribute Functions
	44	*/
	45
	46	/**
	47	* netlbl_secattr_catmap_walk - Walk a LSM secattr catmap looking for a bit
	48	* @catmap: the category bitmap
	49	* @offset: the offset to start searching at, in bits
	50	*
	51	* Description:
	52	* This function walks a LSM secattr category bitmap starting at @offset and
	53	* returns the spot of the first set bit or -ENOENT if no bits are set.
	54	*
	55	*/
	56	int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
	57	u32 offset)
	58	{
	59	struct netlbl_lsm_secattr_catmap *iter = catmap;
	60	u32 node_idx;
	61	u32 node_bit;
	62	NETLBL_CATMAP_MAPTYPE bitmap;
	63
	64	if (offset > iter->startbit) {
	65	while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
	66	iter = iter->next;
	67	if (iter == NULL)
	68	return -ENOENT;
	69	}
	70	node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
	71	node_bit = offset - iter->startbit -
	72	(NETLBL_CATMAP_MAPSIZE * node_idx);
	73	} else {
	74	node_idx = 0;
	75	node_bit = 0;
	76	}
	77	bitmap = iter->bitmap[node_idx] >> node_bit;
	78
	79	for (;;) {
	80	if (bitmap != 0) {
	81	while ((bitmap & NETLBL_CATMAP_BIT) == 0) {
	82	bitmap >>= 1;
	83	node_bit++;
	84	}
	85	return iter->startbit +
	86	(NETLBL_CATMAP_MAPSIZE * node_idx) + node_bit;
	87	}
	88	if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
	89	if (iter->next != NULL) {
	90	iter = iter->next;
	91	node_idx = 0;
	92	} else
	93	return -ENOENT;
	94	}
	95	bitmap = iter->bitmap[node_idx];
	96	node_bit = 0;
	97	}
	98
	99	return -ENOENT;
	100	}
	101
	102	/**
	103	* netlbl_secattr_catmap_walk_rng - Find the end of a string of set bits
	104	* @catmap: the category bitmap
	105	* @offset: the offset to start searching at, in bits
106	*
107	* Description:
108	* This function walks a LSM secattr category bitmap starting at @offset and
109	* returns the spot of the first cleared bit or -ENOENT if the offset is past
110	* the end of the bitmap.
111	*
112	*/
113	int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
114	u32 offset)
115	{
116	struct netlbl_lsm_secattr_catmap *iter = catmap;
117	u32 node_idx;
118	u32 node_bit;
119	NETLBL_CATMAP_MAPTYPE bitmask;
120	NETLBL_CATMAP_MAPTYPE bitmap;
121
122	if (offset > iter->startbit) {
123	while (offset >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
124	iter = iter->next;
125	if (iter == NULL)
126	return -ENOENT;
127	}
128	node_idx = (offset - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
129	node_bit = offset - iter->startbit -
130	(NETLBL_CATMAP_MAPSIZE * node_idx);
131	} else {
132	node_idx = 0;
133	node_bit = 0;
134	}
135	bitmask = NETLBL_CATMAP_BIT << node_bit;
136
137	for (;;) {
138	bitmap = iter->bitmap[node_idx];
139	while (bitmask != 0 && (bitmap & bitmask) != 0) {
140	bitmask <<= 1;
141	node_bit++;
142	}
143
144	if (bitmask != 0)
145	return iter->startbit +
146	(NETLBL_CATMAP_MAPSIZE * node_idx) +
147	node_bit - 1;
148	else if (++node_idx >= NETLBL_CATMAP_MAPCNT) {
149	if (iter->next == NULL)
150	return iter->startbit + NETLBL_CATMAP_SIZE - 1;
151	iter = iter->next;
152	node_idx = 0;
153	}
154	bitmask = NETLBL_CATMAP_BIT;
155	node_bit = 0;
156	}
157
158	return -ENOENT;
159	}
160
161	/**
162	* netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap
163	* @catmap: the category bitmap
164	* @bit: the bit to set
165	* @flags: memory allocation flags
166	*
167	* Description:
168	* Set the bit specified by @bit in @catmap. Returns zero on success,
169	* negative values on failure.
170	*
171	*/
172	int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
173	u32 bit,
174	gfp_t flags)
175	{
176	struct netlbl_lsm_secattr_catmap *iter = catmap;
177	u32 node_bit;
178	u32 node_idx;
179
180	while (iter->next != NULL &&
181	bit >= (iter->startbit + NETLBL_CATMAP_SIZE))
182	iter = iter->next;
183	if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
184	iter->next = netlbl_secattr_catmap_alloc(flags);
185	if (iter->next == NULL)
186	return -ENOMEM;
187	iter = iter->next;
188	iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1);
189	}
190
191	/* gcc always rounds to zero when doing integer division */
192	node_idx = (bit - iter->startbit) / NETLBL_CATMAP_MAPSIZE;
193	node_bit = bit - iter->startbit - (NETLBL_CATMAP_MAPSIZE * node_idx);
194	iter->bitmap[node_idx] \|= NETLBL_CATMAP_BIT << node_bit;
195
196	return 0;
197	}
198
199	/**
200	* netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap
201	* @catmap: the category bitmap
202	* @start: the starting bit
203	* @end: the last bit in the string
204	* @flags: memory allocation flags
205	*
206	* Description:
207	* Set a range of bits, starting at @start and ending with @end. Returns zero
208	* on success, negative values on failure.
209	*
210	*/
211	int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
212	u32 start,
213	u32 end,
214	gfp_t flags)
215	{
216	int ret_val = 0;
217	struct netlbl_lsm_secattr_catmap *iter = catmap;
218	u32 iter_max_spot;
219	u32 spot;
220
221	/* XXX - This could probably be made a bit faster by combining writes
222	* to the catmap instead of setting a single bit each time, but for
223	* right now skipping to the start of the range in the catmap should
224	* be a nice improvement over calling the individual setbit function
225	* repeatedly from a loop. */
226
227	while (iter->next != NULL &&
228	start >= (iter->startbit + NETLBL_CATMAP_SIZE))
229	iter = iter->next;
230	iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
231
232	for (spot = start; spot <= end && ret_val == 0; spot++) {
233	if (spot >= iter_max_spot && iter->next != NULL) {
234	iter = iter->next;
235	iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
236	}
237	ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC);
238	}
239
240	return ret_val;
241	}
242
d15c345f PM	243	/*
	244	* LSM Functions
	245	*/
	246
	247	/**
	248	* netlbl_socket_setattr - Label a socket using the correct protocol
ba6ff9f2	249	* @sk: the socket to label
d15c345f PM	250	* @secattr: the security attributes
	251	*
	252	* Description:
	253	* Attach the correct label to the given socket using the security attributes
ba6ff9f2 PM	254	* specified in @secattr. This function requires exclusive access to @sk,
	255	* which means it either needs to be in the process of being created or locked.
	256	* Returns zero on success, negative values on failure.
d15c345f PM	257	*
d15c345f PM	258	*/
ba6ff9f2 PM	259	int netlbl_sock_setattr(struct sock *sk,
ba6ff9f2 PM	260	const struct netlbl_lsm_secattr *secattr)
d15c345f PM	261	{
	262	int ret_val = -ENOENT;
	263	struct netlbl_dom_map *dom_entry;
	264
	265	rcu_read_lock();
	266	dom_entry = netlbl_domhsh_getentry(secattr->domain);
	267	if (dom_entry == NULL)
	268	goto socket_setattr_return;
	269	switch (dom_entry->type) {
	270	case NETLBL_NLTYPE_CIPSOV4:
ba6ff9f2 PM	271	ret_val = cipso_v4_sock_setattr(sk,
	272	dom_entry->type_def.cipsov4,
	273	secattr);
d15c345f PM	274	break;
	275	case NETLBL_NLTYPE_UNLABELED:
	276	ret_val = 0;
	277	break;
	278	default:
	279	ret_val = -ENOENT;
	280	}
	281
	282	socket_setattr_return:
	283	rcu_read_unlock();
	284	return ret_val;
	285	}
	286
14a72f53 PM	287	/**
	288	* netlbl_sock_getattr - Determine the security attributes of a sock
	289	* @sk: the sock
	290	* @secattr: the security attributes
	291	*
	292	* Description:
	293	* Examines the given sock to see any NetLabel style labeling has been
	294	* applied to the sock, if so it parses the socket label and returns the
	295	* security attributes in @secattr. Returns zero on success, negative values
	296	* on failure.
	297	*
	298	*/
	299	int netlbl_sock_getattr(struct sock sk, struct netlbl_lsm_secattr secattr)
	300	{
	301	int ret_val;
	302
	303	ret_val = cipso_v4_sock_getattr(sk, secattr);
	304	if (ret_val == 0)
	305	return 0;
	306
	307	return netlbl_unlabel_getattr(secattr);
	308	}
	309
d15c345f PM	310	/**
	311	* netlbl_skbuff_getattr - Determine the security attributes of a packet
	312	* @skb: the packet
	313	* @secattr: the security attributes
	314	*
	315	* Description:
	316	* Examines the given packet to see if a recognized form of packet labeling
	317	* is present, if so it parses the packet label and returns the security
	318	* attributes in @secattr. Returns zero on success, negative values on
	319	* failure.
	320	*
	321	*/
	322	int netlbl_skbuff_getattr(const struct sk_buff *skb,
	323	struct netlbl_lsm_secattr *secattr)
	324	{
05e00cbf PM	325	if (CIPSO_V4_OPTEXIST(skb) &&
05e00cbf PM	326	cipso_v4_skbuff_getattr(skb, secattr) == 0)
d15c345f PM	327	return 0;
	328
	329	return netlbl_unlabel_getattr(secattr);
	330	}
	331
	332	/**
	333	* netlbl_skbuff_err - Handle a LSM error on a sk_buff
	334	* @skb: the packet
	335	* @error: the error code
	336	*
	337	* Description:
	338	* Deal with a LSM problem when handling the packet in @skb, typically this is
	339	* a permission denied problem (-EACCES). The correct action is determined
	340	* according to the packet's labeling protocol.
	341	*
	342	*/
	343	void netlbl_skbuff_err(struct sk_buff *skb, int error)
	344	{
	345	if (CIPSO_V4_OPTEXIST(skb))
	346	cipso_v4_error(skb, error, 0);
	347	}
	348
	349	/**
	350	* netlbl_cache_invalidate - Invalidate all of the NetLabel protocol caches
	351	*
	352	* Description:
	353	* For all of the NetLabel protocols that support some form of label mapping
	354	* cache, invalidate the cache. Returns zero on success, negative values on
	355	* error.
	356	*
	357	*/
	358	void netlbl_cache_invalidate(void)
	359	{
	360	cipso_v4_cache_invalidate();
	361	}
	362
	363	/**
	364	* netlbl_cache_add - Add an entry to a NetLabel protocol cache
	365	* @skb: the packet
	366	* @secattr: the packet's security attributes
	367	*
	368	* Description:
	369	* Add the LSM security attributes for the given packet to the underlying
	370	* NetLabel protocol's label mapping cache. Returns zero on success, negative
	371	* values on error.
	372	*
	373	*/
	374	int netlbl_cache_add(const struct sk_buff *skb,
	375	const struct netlbl_lsm_secattr *secattr)
	376	{
701a90ba	377	if ((secattr->flags & NETLBL_SECATTR_CACHE) == 0)
d15c345f PM	378	return -ENOMSG;
	379
	380	if (CIPSO_V4_OPTEXIST(skb))
	381	return cipso_v4_cache_add(skb, secattr);
	382
	383	return -ENOMSG;
	384	}
	385
	386	/*
	387	* Setup Functions
	388	*/
	389
	390	/**
	391	* netlbl_init - Initialize NetLabel
	392	*
	393	* Description:
	394	* Perform the required NetLabel initialization before first use.
	395	*
	396	*/
	397	static int __init netlbl_init(void)
	398	{
	399	int ret_val;
	400
	401	printk(KERN_INFO "NetLabel: Initializing\n");
	402	printk(KERN_INFO "NetLabel: domain hash size = %u\n",
	403	(1 << NETLBL_DOMHSH_BITSIZE));
	404	printk(KERN_INFO "NetLabel: protocols ="
	405	" UNLABELED"
	406	" CIPSOv4"
	407	"\n");
	408
	409	ret_val = netlbl_domhsh_init(NETLBL_DOMHSH_BITSIZE);
	410	if (ret_val != 0)
	411	goto init_failure;
	412
	413	ret_val = netlbl_netlink_init();
	414	if (ret_val != 0)
	415	goto init_failure;
	416
	417	ret_val = netlbl_unlabel_defconf();
	418	if (ret_val != 0)
	419	goto init_failure;
	420	printk(KERN_INFO "NetLabel: unlabeled traffic allowed by default\n");
	421
	422	return 0;
	423
	424	init_failure:
	425	panic("NetLabel: failed to initialize properly (%d)\n", ret_val);
	426	}
	427
	428	subsys_initcall(netlbl_init);