LXR linux/security/selinux/include/xfrm.h

   1/*
   2 * SELinux support for the XFRM LSM hooks
   3 *
   4 * Author : Trent Jaeger, <jaegert@us.ibm.com>
   5 * Updated : Venkat Yekkirala, <vyekkirala@TrustedCS.com>
   6 */
   7#ifndef _SELINUX_XFRM_H_
   8#define _SELINUX_XFRM_H_
   9
  10#include <net/flow.h>
  11
  12int selinux_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp,
  13                              struct xfrm_user_sec_ctx *uctx,
  14                              gfp_t gfp);
  15int selinux_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx,
  16                              struct xfrm_sec_ctx **new_ctxp);
  17void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
  18int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
  19int selinux_xfrm_state_alloc(struct xfrm_state *x,
  20                             struct xfrm_user_sec_ctx *uctx);
  21int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x,
  22                                     struct xfrm_sec_ctx *polsec, u32 secid);
  23void selinux_xfrm_state_free(struct xfrm_state *x);
  24int selinux_xfrm_state_delete(struct xfrm_state *x);
  25int selinux_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
  26int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x,
  27                                      struct xfrm_policy *xp,
  28                                      const struct flowi *fl);
  29
  30#ifdef CONFIG_SECURITY_NETWORK_XFRM
  31extern atomic_t selinux_xfrm_refcount;
  32
  33static inline int selinux_xfrm_enabled(void)
  34{
  35        return (atomic_read(&selinux_xfrm_refcount) > 0);
  36}
  37
  38int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
  39                              struct common_audit_data *ad);
  40int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
  41                                struct common_audit_data *ad, u8 proto);
  42int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall);
  43int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid);
  44
  45static inline void selinux_xfrm_notify_policyload(void)
  46{
  47        struct net *net;
  48
  49        rtnl_lock();
  50        for_each_net(net) {
  51                atomic_inc(&net->xfrm.flow_cache_genid);
  52                rt_genid_bump_all(net);
  53        }
  54        rtnl_unlock();
  55}
  56#else
  57static inline int selinux_xfrm_enabled(void)
  58{
  59        return 0;
  60}
  61
  62static inline int selinux_xfrm_sock_rcv_skb(u32 sk_sid, struct sk_buff *skb,
  63                                            struct common_audit_data *ad)
  64{
  65        return 0;
  66}
  67
  68static inline int selinux_xfrm_postroute_last(u32 sk_sid, struct sk_buff *skb,
  69                                              struct common_audit_data *ad,
  70                                              u8 proto)
  71{
  72        return 0;
  73}
  74
  75static inline int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid,
  76                                              int ckall)
  77{
  78        *sid = SECSID_NULL;
  79        return 0;
  80}
  81
  82static inline void selinux_xfrm_notify_policyload(void)
  83{
  84}
  85
  86static inline int selinux_xfrm_skb_sid(struct sk_buff *skb, u32 *sid)
  87{
  88        *sid = SECSID_NULL;
  89        return 0;
  90}
  91#endif
  92
  93#endif /* _SELINUX_XFRM_H_ */
  94