Loading...
1/*
2 * NetLabel CIPSO/IPv4 Support
3 *
4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
7 *
8 * Author: Paul Moore <paul@paul-moore.com>
9 *
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 *
28 */
29
30#ifndef _NETLABEL_CIPSO_V4
31#define _NETLABEL_CIPSO_V4
32
33#include <net/netlabel.h>
34
35/*
36 * The following NetLabel payloads are supported by the CIPSO subsystem.
37 *
38 * o ADD:
39 * Sent by an application to add a new DOI mapping table.
40 *
41 * Required attributes:
42 *
43 * NLBL_CIPSOV4_A_DOI
44 * NLBL_CIPSOV4_A_MTYPE
45 * NLBL_CIPSOV4_A_TAGLST
46 *
47 * If using CIPSO_V4_MAP_TRANS the following attributes are required:
48 *
49 * NLBL_CIPSOV4_A_MLSLVLLST
50 * NLBL_CIPSOV4_A_MLSCATLST
51 *
52 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
53 * are required.
54 *
55 * o REMOVE:
56 * Sent by an application to remove a specific DOI mapping table from the
57 * CIPSO V4 system.
58 *
59 * Required attributes:
60 *
61 * NLBL_CIPSOV4_A_DOI
62 *
63 * o LIST:
64 * Sent by an application to list the details of a DOI definition. On
65 * success the kernel should send a response using the following format.
66 *
67 * Required attributes:
68 *
69 * NLBL_CIPSOV4_A_DOI
70 *
71 * The valid response message format depends on the type of the DOI mapping,
72 * the defined formats are shown below.
73 *
74 * Required attributes:
75 *
76 * NLBL_CIPSOV4_A_MTYPE
77 * NLBL_CIPSOV4_A_TAGLST
78 *
79 * If using CIPSO_V4_MAP_TRANS the following attributes are required:
80 *
81 * NLBL_CIPSOV4_A_MLSLVLLST
82 * NLBL_CIPSOV4_A_MLSCATLST
83 *
84 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
85 * are required.
86 *
87 * o LISTALL:
88 * This message is sent by an application to list the valid DOIs on the
89 * system. When sent by an application there is no payload and the
90 * NLM_F_DUMP flag should be set. The kernel should respond with a series of
91 * the following messages.
92 *
93 * Required attributes:
94 *
95 * NLBL_CIPSOV4_A_DOI
96 * NLBL_CIPSOV4_A_MTYPE
97 *
98 */
99
100/* NetLabel CIPSOv4 commands */
101enum {
102 NLBL_CIPSOV4_C_UNSPEC,
103 NLBL_CIPSOV4_C_ADD,
104 NLBL_CIPSOV4_C_REMOVE,
105 NLBL_CIPSOV4_C_LIST,
106 NLBL_CIPSOV4_C_LISTALL,
107 __NLBL_CIPSOV4_C_MAX,
108};
109
110/* NetLabel CIPSOv4 attributes */
111enum {
112 NLBL_CIPSOV4_A_UNSPEC,
113 NLBL_CIPSOV4_A_DOI,
114 /* (NLA_U32)
115 * the DOI value */
116 NLBL_CIPSOV4_A_MTYPE,
117 /* (NLA_U32)
118 * the mapping table type (defined in the cipso_ipv4.h header as
119 * CIPSO_V4_MAP_*) */
120 NLBL_CIPSOV4_A_TAG,
121 /* (NLA_U8)
122 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
123 * attribute */
124 NLBL_CIPSOV4_A_TAGLST,
125 /* (NLA_NESTED)
126 * the CIPSO tag list for the DOI, there must be at least one
127 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
128 * priorirty when sending packets */
129 NLBL_CIPSOV4_A_MLSLVLLOC,
130 /* (NLA_U32)
131 * the local MLS sensitivity level */
132 NLBL_CIPSOV4_A_MLSLVLREM,
133 /* (NLA_U32)
134 * the remote MLS sensitivity level */
135 NLBL_CIPSOV4_A_MLSLVL,
136 /* (NLA_NESTED)
137 * a MLS sensitivity level mapping, must contain only one attribute of
138 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
139 * NLBL_CIPSOV4_A_MLSLVLREM */
140 NLBL_CIPSOV4_A_MLSLVLLST,
141 /* (NLA_NESTED)
142 * the CIPSO level mappings, there must be at least one
143 * NLBL_CIPSOV4_A_MLSLVL attribute */
144 NLBL_CIPSOV4_A_MLSCATLOC,
145 /* (NLA_U32)
146 * the local MLS category */
147 NLBL_CIPSOV4_A_MLSCATREM,
148 /* (NLA_U32)
149 * the remote MLS category */
150 NLBL_CIPSOV4_A_MLSCAT,
151 /* (NLA_NESTED)
152 * a MLS category mapping, must contain only one attribute of each of
153 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
154 * NLBL_CIPSOV4_A_MLSCATREM */
155 NLBL_CIPSOV4_A_MLSCATLST,
156 /* (NLA_NESTED)
157 * the CIPSO category mappings, there must be at least one
158 * NLBL_CIPSOV4_A_MLSCAT attribute */
159 __NLBL_CIPSOV4_A_MAX,
160};
161#define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
162
163/* NetLabel protocol functions */
164int netlbl_cipsov4_genl_init(void);
165
166/* Free the memory associated with a CIPSOv4 DOI definition */
167void netlbl_cipsov4_doi_free(struct rcu_head *entry);
168
169#endif
1/*
2 * NetLabel CIPSO/IPv4 Support
3 *
4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
7 *
8 * Author: Paul Moore <paul@paul-moore.com>
9 *
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, see <http://www.gnu.org/licenses/>.
27 *
28 */
29
30#ifndef _NETLABEL_CIPSO_V4
31#define _NETLABEL_CIPSO_V4
32
33#include <net/netlabel.h>
34
35/*
36 * The following NetLabel payloads are supported by the CIPSO subsystem.
37 *
38 * o ADD:
39 * Sent by an application to add a new DOI mapping table.
40 *
41 * Required attributes:
42 *
43 * NLBL_CIPSOV4_A_DOI
44 * NLBL_CIPSOV4_A_MTYPE
45 * NLBL_CIPSOV4_A_TAGLST
46 *
47 * If using CIPSO_V4_MAP_TRANS the following attributes are required:
48 *
49 * NLBL_CIPSOV4_A_MLSLVLLST
50 * NLBL_CIPSOV4_A_MLSCATLST
51 *
52 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
53 * are required.
54 *
55 * o REMOVE:
56 * Sent by an application to remove a specific DOI mapping table from the
57 * CIPSO V4 system.
58 *
59 * Required attributes:
60 *
61 * NLBL_CIPSOV4_A_DOI
62 *
63 * o LIST:
64 * Sent by an application to list the details of a DOI definition. On
65 * success the kernel should send a response using the following format.
66 *
67 * Required attributes:
68 *
69 * NLBL_CIPSOV4_A_DOI
70 *
71 * The valid response message format depends on the type of the DOI mapping,
72 * the defined formats are shown below.
73 *
74 * Required attributes:
75 *
76 * NLBL_CIPSOV4_A_MTYPE
77 * NLBL_CIPSOV4_A_TAGLST
78 *
79 * If using CIPSO_V4_MAP_TRANS the following attributes are required:
80 *
81 * NLBL_CIPSOV4_A_MLSLVLLST
82 * NLBL_CIPSOV4_A_MLSCATLST
83 *
84 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
85 * are required.
86 *
87 * o LISTALL:
88 * This message is sent by an application to list the valid DOIs on the
89 * system. When sent by an application there is no payload and the
90 * NLM_F_DUMP flag should be set. The kernel should respond with a series of
91 * the following messages.
92 *
93 * Required attributes:
94 *
95 * NLBL_CIPSOV4_A_DOI
96 * NLBL_CIPSOV4_A_MTYPE
97 *
98 */
99
100/* NetLabel CIPSOv4 commands */
101enum {
102 NLBL_CIPSOV4_C_UNSPEC,
103 NLBL_CIPSOV4_C_ADD,
104 NLBL_CIPSOV4_C_REMOVE,
105 NLBL_CIPSOV4_C_LIST,
106 NLBL_CIPSOV4_C_LISTALL,
107 __NLBL_CIPSOV4_C_MAX,
108};
109
110/* NetLabel CIPSOv4 attributes */
111enum {
112 NLBL_CIPSOV4_A_UNSPEC,
113 NLBL_CIPSOV4_A_DOI,
114 /* (NLA_U32)
115 * the DOI value */
116 NLBL_CIPSOV4_A_MTYPE,
117 /* (NLA_U32)
118 * the mapping table type (defined in the cipso_ipv4.h header as
119 * CIPSO_V4_MAP_*) */
120 NLBL_CIPSOV4_A_TAG,
121 /* (NLA_U8)
122 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
123 * attribute */
124 NLBL_CIPSOV4_A_TAGLST,
125 /* (NLA_NESTED)
126 * the CIPSO tag list for the DOI, there must be at least one
127 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
128 * priorirty when sending packets */
129 NLBL_CIPSOV4_A_MLSLVLLOC,
130 /* (NLA_U32)
131 * the local MLS sensitivity level */
132 NLBL_CIPSOV4_A_MLSLVLREM,
133 /* (NLA_U32)
134 * the remote MLS sensitivity level */
135 NLBL_CIPSOV4_A_MLSLVL,
136 /* (NLA_NESTED)
137 * a MLS sensitivity level mapping, must contain only one attribute of
138 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
139 * NLBL_CIPSOV4_A_MLSLVLREM */
140 NLBL_CIPSOV4_A_MLSLVLLST,
141 /* (NLA_NESTED)
142 * the CIPSO level mappings, there must be at least one
143 * NLBL_CIPSOV4_A_MLSLVL attribute */
144 NLBL_CIPSOV4_A_MLSCATLOC,
145 /* (NLA_U32)
146 * the local MLS category */
147 NLBL_CIPSOV4_A_MLSCATREM,
148 /* (NLA_U32)
149 * the remote MLS category */
150 NLBL_CIPSOV4_A_MLSCAT,
151 /* (NLA_NESTED)
152 * a MLS category mapping, must contain only one attribute of each of
153 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
154 * NLBL_CIPSOV4_A_MLSCATREM */
155 NLBL_CIPSOV4_A_MLSCATLST,
156 /* (NLA_NESTED)
157 * the CIPSO category mappings, there must be at least one
158 * NLBL_CIPSOV4_A_MLSCAT attribute */
159 __NLBL_CIPSOV4_A_MAX,
160};
161#define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
162
163/* NetLabel protocol functions */
164int netlbl_cipsov4_genl_init(void);
165
166/* Free the memory associated with a CIPSOv4 DOI definition */
167void netlbl_cipsov4_doi_free(struct rcu_head *entry);
168
169#endif