LXR linux/net/netlabel/netlabel

   1/*
   2 * NetLabel CALIPSO Support
   3 *
   4 * This file defines the CALIPSO functions for the NetLabel system.  The
   5 * NetLabel system manages static and dynamic label mappings for network
   6 * protocols such as CIPSO and RIPSO.
   7 *
   8 * Authors: Paul Moore <paul@paul-moore.com>
   9 *          Huw Davies <huw@codeweavers.com>
  10 *
  11 */
  12
  13/* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14 * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
  15 *
  16 * This program is free software;  you can redistribute it and/or modify
  17 * it under the terms of the GNU General Public License as published by
  18 * the Free Software Foundation; either version 2 of the License, or
  19 * (at your option) any later version.
  20 *
  21 * This program is distributed in the hope that it will be useful,
  22 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  24 * the GNU General Public License for more details.
  25 *
  26 * You should have received a copy of the GNU General Public License
  27 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
  28 *
  29 */
  30
  31#ifndef _NETLABEL_CALIPSO
  32#define _NETLABEL_CALIPSO
  33
  34#include <net/netlabel.h>
  35#include <net/calipso.h>
  36
  37/* The following NetLabel payloads are supported by the CALIPSO subsystem.
  38 *
  39 * o ADD:
  40 *   Sent by an application to add a new DOI mapping table.
  41 *
  42 *   Required attributes:
  43 *
  44 *     NLBL_CALIPSO_A_DOI
  45 *     NLBL_CALIPSO_A_MTYPE
  46 *
  47 *   If using CALIPSO_MAP_PASS no additional attributes are required.
  48 *
  49 * o REMOVE:
  50 *   Sent by an application to remove a specific DOI mapping table from the
  51 *   CALIPSO system.
  52 *
  53 *   Required attributes:
  54 *
  55 *     NLBL_CALIPSO_A_DOI
  56 *
  57 * o LIST:
  58 *   Sent by an application to list the details of a DOI definition.  On
  59 *   success the kernel should send a response using the following format.
  60 *
  61 *   Required attributes:
  62 *
  63 *     NLBL_CALIPSO_A_DOI
  64 *
  65 *   The valid response message format depends on the type of the DOI mapping,
  66 *   the defined formats are shown below.
  67 *
  68 *   Required attributes:
  69 *
  70 *     NLBL_CALIPSO_A_MTYPE
  71 *
  72 *   If using CALIPSO_MAP_PASS no additional attributes are required.
  73 *
  74 * o LISTALL:
  75 *   This message is sent by an application to list the valid DOIs on the
  76 *   system.  When sent by an application there is no payload and the
  77 *   NLM_F_DUMP flag should be set.  The kernel should respond with a series of
  78 *   the following messages.
  79 *
  80 *   Required attributes:
  81 *
  82 *    NLBL_CALIPSO_A_DOI
  83 *    NLBL_CALIPSO_A_MTYPE
  84 *
  85 */
  86
  87/* NetLabel CALIPSO commands */
  88enum {
  89        NLBL_CALIPSO_C_UNSPEC,
  90        NLBL_CALIPSO_C_ADD,
  91        NLBL_CALIPSO_C_REMOVE,
  92        NLBL_CALIPSO_C_LIST,
  93        NLBL_CALIPSO_C_LISTALL,
  94        __NLBL_CALIPSO_C_MAX,
  95};
  96
  97/* NetLabel CALIPSO attributes */
  98enum {
  99        NLBL_CALIPSO_A_UNSPEC,
 100        NLBL_CALIPSO_A_DOI,
 101        /* (NLA_U32)
 102         * the DOI value */
 103        NLBL_CALIPSO_A_MTYPE,
 104        /* (NLA_U32)
 105         * the mapping table type (defined in the calipso.h header as
 106         * CALIPSO_MAP_*) */
 107        __NLBL_CALIPSO_A_MAX,
 108};
 109
 110#define NLBL_CALIPSO_A_MAX (__NLBL_CALIPSO_A_MAX - 1)
 111
 112/* NetLabel protocol functions */
 113#if IS_ENABLED(CONFIG_IPV6)
 114int netlbl_calipso_genl_init(void);
 115#else
 116static inline int netlbl_calipso_genl_init(void)
 117{
 118        return 0;
 119}
 120#endif
 121
 122int calipso_doi_add(struct calipso_doi *doi_def,
 123                    struct netlbl_audit *audit_info);
 124void calipso_doi_free(struct calipso_doi *doi_def);
 125int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info);
 126struct calipso_doi *calipso_doi_getdef(u32 doi);
 127void calipso_doi_putdef(struct calipso_doi *doi_def);
 128int calipso_doi_walk(u32 *skip_cnt,
 129                     int (*callback)(struct calipso_doi *doi_def, void *arg),
 130                     void *cb_arg);
 131int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
 132int calipso_sock_setattr(struct sock *sk,
 133                         const struct calipso_doi *doi_def,
 134                         const struct netlbl_lsm_secattr *secattr);
 135void calipso_sock_delattr(struct sock *sk);
 136int calipso_req_setattr(struct request_sock *req,
 137                        const struct calipso_doi *doi_def,
 138                        const struct netlbl_lsm_secattr *secattr);
 139void calipso_req_delattr(struct request_sock *req);
 140unsigned char *calipso_optptr(const struct sk_buff *skb);
 141int calipso_getattr(const unsigned char *calipso,
 142                    struct netlbl_lsm_secattr *secattr);
 143int calipso_skbuff_setattr(struct sk_buff *skb,
 144                           const struct calipso_doi *doi_def,
 145                           const struct netlbl_lsm_secattr *secattr);
 146int calipso_skbuff_delattr(struct sk_buff *skb);
 147void calipso_cache_invalidate(void);
 148int calipso_cache_add(const unsigned char *calipso_ptr,
 149                      const struct netlbl_lsm_secattr *secattr);
 150
 151#endif
 152