1/*
  2 * NetLabel CALIPSO Support
  3 *
  4 * This file defines the CALIPSO functions for the NetLabel system.  The
  5 * NetLabel system manages static and dynamic label mappings for network
  6 * protocols such as CIPSO and RIPSO.
  7 *
  8 * Authors: Paul Moore <paul@paul-moore.com>
  9 *          Huw Davies <huw@codeweavers.com>
 10 *
 11 */
 12
 13/* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 14 * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
 15 *
 16 * This program is free software;  you can redistribute it and/or modify
 17 * it under the terms of the GNU General Public License as published by
 18 * the Free Software Foundation; either version 2 of the License, or
 19 * (at your option) any later version.
 20 *
 21 * This program is distributed in the hope that it will be useful,
 22 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 24 * the GNU General Public License for more details.
 25 *
 26 * You should have received a copy of the GNU General Public License
 27 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
 28 *
 29 */
 30
 31#ifndef _NETLABEL_CALIPSO
 32#define _NETLABEL_CALIPSO
 33
 34#include <net/netlabel.h>
 35#include <net/calipso.h>
 36
 37/* The following NetLabel payloads are supported by the CALIPSO subsystem.
 38 *
 39 * o ADD:
 40 *   Sent by an application to add a new DOI mapping table.
 41 *
 42 *   Required attributes:
 43 *
 44 *     NLBL_CALIPSO_A_DOI
 45 *     NLBL_CALIPSO_A_MTYPE
 46 *
 47 *   If using CALIPSO_MAP_PASS no additional attributes are required.
 48 *
 49 * o REMOVE:
 50 *   Sent by an application to remove a specific DOI mapping table from the
 51 *   CALIPSO system.
 52 *
 53 *   Required attributes:
 54 *
 55 *     NLBL_CALIPSO_A_DOI
 56 *
 57 * o LIST:
 58 *   Sent by an application to list the details of a DOI definition.  On
 59 *   success the kernel should send a response using the following format.
 60 *
 61 *   Required attributes:
 62 *
 63 *     NLBL_CALIPSO_A_DOI
 64 *
 65 *   The valid response message format depends on the type of the DOI mapping,
 66 *   the defined formats are shown below.
 67 *
 68 *   Required attributes:
 69 *
 70 *     NLBL_CALIPSO_A_MTYPE
 71 *
 72 *   If using CALIPSO_MAP_PASS no additional attributes are required.
 73 *
 74 * o LISTALL:
 75 *   This message is sent by an application to list the valid DOIs on the
 76 *   system.  When sent by an application there is no payload and the
 77 *   NLM_F_DUMP flag should be set.  The kernel should respond with a series of
 78 *   the following messages.
 79 *
 80 *   Required attributes:
 81 *
 82 *    NLBL_CALIPSO_A_DOI
 83 *    NLBL_CALIPSO_A_MTYPE
 84 *
 85 */
 86
 87/* NetLabel CALIPSO commands */
 88enum {
 89	NLBL_CALIPSO_C_UNSPEC,
 90	NLBL_CALIPSO_C_ADD,
 91	NLBL_CALIPSO_C_REMOVE,
 92	NLBL_CALIPSO_C_LIST,
 93	NLBL_CALIPSO_C_LISTALL,
 94	__NLBL_CALIPSO_C_MAX,
 95};
 96
 97/* NetLabel CALIPSO attributes */
 98enum {
 99	NLBL_CALIPSO_A_UNSPEC,
100	NLBL_CALIPSO_A_DOI,
101	/* (NLA_U32)
102	 * the DOI value */
103	NLBL_CALIPSO_A_MTYPE,
104	/* (NLA_U32)
105	 * the mapping table type (defined in the calipso.h header as
106	 * CALIPSO_MAP_*) */
107	__NLBL_CALIPSO_A_MAX,
108};
109
110#define NLBL_CALIPSO_A_MAX (__NLBL_CALIPSO_A_MAX - 1)
111
112/* NetLabel protocol functions */
113#if IS_ENABLED(CONFIG_IPV6)
114int netlbl_calipso_genl_init(void);
115#else
116static inline int netlbl_calipso_genl_init(void)
117{
118	return 0;
119}
120#endif
121
122int calipso_doi_add(struct calipso_doi *doi_def,
123		    struct netlbl_audit *audit_info);
124void calipso_doi_free(struct calipso_doi *doi_def);
125int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info);
126struct calipso_doi *calipso_doi_getdef(u32 doi);
127void calipso_doi_putdef(struct calipso_doi *doi_def);
128int calipso_doi_walk(u32 *skip_cnt,
129		     int (*callback)(struct calipso_doi *doi_def, void *arg),
130		     void *cb_arg);
131int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
132int calipso_sock_setattr(struct sock *sk,
133			 const struct calipso_doi *doi_def,
134			 const struct netlbl_lsm_secattr *secattr);
135void calipso_sock_delattr(struct sock *sk);
136int calipso_req_setattr(struct request_sock *req,
137			const struct calipso_doi *doi_def,
138			const struct netlbl_lsm_secattr *secattr);
139void calipso_req_delattr(struct request_sock *req);
140unsigned char *calipso_optptr(const struct sk_buff *skb);
141int calipso_getattr(const unsigned char *calipso,
142		    struct netlbl_lsm_secattr *secattr);
143int calipso_skbuff_setattr(struct sk_buff *skb,
144			   const struct calipso_doi *doi_def,
145			   const struct netlbl_lsm_secattr *secattr);
146int calipso_skbuff_delattr(struct sk_buff *skb);
147void calipso_cache_invalidate(void);
148int calipso_cache_add(const unsigned char *calipso_ptr,
149		      const struct netlbl_lsm_secattr *secattr);
150
151#endif