[NETFILTER]: nf_conntrack: EXPORT_SYMBOL cleanup

[linux-2.6] / net / netlabel / netlabel_cipso_v4.c

diff --git a/net/netlabel/netlabel_cipso_v4.c b/net/netlabel/netlabel_cipso_v4.c
index 4125a55f469f197051963a3f0c3e1f8057084c95..743b05734a497598feea4ca8dd609ad33ed276bf 100644 (file)
--- a/net/netlabel/netlabel_cipso_v4.c
+++ b/net/netlabel/netlabel_cipso_v4.c
@@ -32,6 +32,7 @@
 #include <linux/socket.h>
 #include <linux/string.h>
 #include <linux/skbuff.h>
+#include <linux/audit.h>
 #include <net/sock.h>
 #include <net/netlink.h>
 #include <net/genetlink.h>
@@ -162,8 +163,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info)
        int nla_a_rem;
        int nla_b_rem;
 
-       if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
-           !info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
+       if (!info->attrs[NLBL_CIPSOV4_A_TAGLST] ||
            !info->attrs[NLBL_CIPSOV4_A_MLSLVLLST])
                return -EINVAL;
 
@@ -344,8 +344,7 @@ static int netlbl_cipsov4_add_pass(struct genl_info *info)
        int ret_val;
        struct cipso_v4_doi *doi_def = NULL;
 
-       if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
-           !info->attrs[NLBL_CIPSOV4_A_TAGLST])
+       if (!info->attrs[NLBL_CIPSOV4_A_TAGLST])
                return -EINVAL;
 
        doi_def = kmalloc(sizeof(*doi_def), GFP_KERNEL);
@@ -381,21 +380,42 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info)
 
 {
        int ret_val = -EINVAL;
-       u32 map_type;
+       u32 type;
+       u32 doi;
+       const char *type_str = "(unknown)";
+       struct audit_buffer *audit_buf;
+       struct netlbl_audit audit_info;
 
-       if (!info->attrs[NLBL_CIPSOV4_A_MTYPE])
+       if (!info->attrs[NLBL_CIPSOV4_A_DOI] ||
+           !info->attrs[NLBL_CIPSOV4_A_MTYPE])
                return -EINVAL;
 
-       map_type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
-       switch (map_type) {
+       doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
+       netlbl_netlink_auditinfo(skb, &audit_info);
+
+       type = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_MTYPE]);
+       switch (type) {
        case CIPSO_V4_MAP_STD:
+               type_str = "std";
                ret_val = netlbl_cipsov4_add_std(info);
                break;
        case CIPSO_V4_MAP_PASS:
+               type_str = "pass";
                ret_val = netlbl_cipsov4_add_pass(info);
                break;
        }
 
+       audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_ADD,
+                                             &audit_info);
+       if (audit_buf != NULL) {
+               audit_log_format(audit_buf,
+                                " cipso_doi=%u cipso_type=%s res=%u",
+                                doi,
+                                type_str,
+                                ret_val == 0 ? 1 : 0);
+               audit_log_end(audit_buf);
+       }
+
        return ret_val;
 }
 
@@ -434,17 +454,13 @@ static int netlbl_cipsov4_list(struct sk_buff *skb, struct genl_info *info)
        }
 
 list_start:
-       ans_skb = nlmsg_new(NLMSG_GOODSIZE * nlsze_mult, GFP_KERNEL);
+       ans_skb = nlmsg_new(NLMSG_DEFAULT_SIZE * nlsze_mult, GFP_KERNEL);
        if (ans_skb == NULL) {
                ret_val = -ENOMEM;
                goto list_failure;
        }
-       data = netlbl_netlink_hdr_put(ans_skb,
-                                     info->snd_pid,
-                                     info->snd_seq,
-                                     netlbl_cipsov4_gnl_family.id,
-                                     0,
-                                     NLBL_CIPSOV4_C_LIST);
+       data = genlmsg_put_reply(ans_skb, info, &netlbl_cipsov4_gnl_family,
+                                0, NLBL_CIPSOV4_C_LIST);
        if (data == NULL) {
                ret_val = -ENOMEM;
                goto list_failure;
@@ -550,7 +566,7 @@ list_start:
 
        genlmsg_end(ans_skb, data);
 
-       ret_val = genlmsg_unicast(ans_skb, info->snd_pid);
+       ret_val = genlmsg_reply(ans_skb, info);
        if (ret_val != 0)
                goto list_failure;
 
@@ -589,12 +605,9 @@ static int netlbl_cipsov4_listall_cb(struct cipso_v4_doi *doi_def, void *arg)
        struct netlbl_cipsov4_doiwalk_arg *cb_arg = arg;
        void *data;
 
-       data = netlbl_netlink_hdr_put(cb_arg->skb,
-                                     NETLINK_CB(cb_arg->nl_cb->skb).pid,
-                                     cb_arg->seq,
-                                     netlbl_cipsov4_gnl_family.id,
-                                     NLM_F_MULTI,
-                                     NLBL_CIPSOV4_C_LISTALL);
+       data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).pid,
+                          cb_arg->seq, &netlbl_cipsov4_gnl_family,
+                          NLM_F_MULTI, NLBL_CIPSOV4_C_LISTALL);
        if (data == NULL)
                goto listall_cb_failure;
 
@@ -653,11 +666,28 @@ static int netlbl_cipsov4_listall(struct sk_buff *skb,
 static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)
 {
        int ret_val = -EINVAL;
-       u32 doi;
+       u32 doi = 0;
+       struct audit_buffer *audit_buf;
+       struct netlbl_audit audit_info;
 
-       if (info->attrs[NLBL_CIPSOV4_A_DOI]) {
-               doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
-               ret_val = cipso_v4_doi_remove(doi, netlbl_cipsov4_doi_free);
+       if (!info->attrs[NLBL_CIPSOV4_A_DOI])
+               return -EINVAL;
+
+       doi = nla_get_u32(info->attrs[NLBL_CIPSOV4_A_DOI]);
+       netlbl_netlink_auditinfo(skb, &audit_info);
+
+       ret_val = cipso_v4_doi_remove(doi,
+                                     &audit_info,
+                                     netlbl_cipsov4_doi_free);
+
+       audit_buf = netlbl_audit_start_common(AUDIT_MAC_CIPSOV4_DEL,
+                                             &audit_info);
+       if (audit_buf != NULL) {
+               audit_log_format(audit_buf,
+                                " cipso_doi=%u res=%u",
+                                doi,
+                                ret_val == 0 ? 1 : 0);
+               audit_log_end(audit_buf);
        }
 
        return ret_val;