1/* SPDX-License-Identifier: GPL-2.0-or-later */
  2/*
  3 * NetLabel CIPSO/IPv4 Support
  4 *
  5 * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
  6 * NetLabel system manages static and dynamic label mappings for network
  7 * protocols such as CIPSO and RIPSO.
  8 *
  9 * Author: Paul Moore <paul@paul-moore.com>
 
 10 */
 11
 12/*
 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 14 */
 15
 16#ifndef _NETLABEL_CIPSO_V4
 17#define _NETLABEL_CIPSO_V4
 18
 19#include <net/netlabel.h>
 20
 21/*
 22 * The following NetLabel payloads are supported by the CIPSO subsystem.
 23 *
 24 * o ADD:
 25 *   Sent by an application to add a new DOI mapping table.
 26 *
 27 *   Required attributes:
 28 *
 29 *     NLBL_CIPSOV4_A_DOI
 30 *     NLBL_CIPSOV4_A_MTYPE
 31 *     NLBL_CIPSOV4_A_TAGLST
 32 *
 33 *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
 34 *
 35 *     NLBL_CIPSOV4_A_MLSLVLLST
 36 *     NLBL_CIPSOV4_A_MLSCATLST
 37 *
 38 *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
 39 *   are required.
 40 *
 41 * o REMOVE:
 42 *   Sent by an application to remove a specific DOI mapping table from the
 43 *   CIPSO V4 system.
 44 *
 45 *   Required attributes:
 46 *
 47 *     NLBL_CIPSOV4_A_DOI
 48 *
 49 * o LIST:
 50 *   Sent by an application to list the details of a DOI definition.  On
 51 *   success the kernel should send a response using the following format.
 52 *
 53 *   Required attributes:
 54 *
 55 *     NLBL_CIPSOV4_A_DOI
 56 *
 57 *   The valid response message format depends on the type of the DOI mapping,
 58 *   the defined formats are shown below.
 59 *
 60 *   Required attributes:
 61 *
 62 *     NLBL_CIPSOV4_A_MTYPE
 63 *     NLBL_CIPSOV4_A_TAGLST
 64 *
 65 *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
 66 *
 67 *     NLBL_CIPSOV4_A_MLSLVLLST
 68 *     NLBL_CIPSOV4_A_MLSCATLST
 69 *
 70 *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
 71 *   are required.
 72 *
 73 * o LISTALL:
 74 *   This message is sent by an application to list the valid DOIs on the
 75 *   system.  When sent by an application there is no payload and the
 76 *   NLM_F_DUMP flag should be set.  The kernel should respond with a series of
 77 *   the following messages.
 78 *
 79 *   Required attributes:
 80 *
 81 *    NLBL_CIPSOV4_A_DOI
 82 *    NLBL_CIPSOV4_A_MTYPE
 83 *
 84 */
 85
 86/* NetLabel CIPSOv4 commands */
 87enum {
 88	NLBL_CIPSOV4_C_UNSPEC,
 89	NLBL_CIPSOV4_C_ADD,
 90	NLBL_CIPSOV4_C_REMOVE,
 91	NLBL_CIPSOV4_C_LIST,
 92	NLBL_CIPSOV4_C_LISTALL,
 93	__NLBL_CIPSOV4_C_MAX,
 94};
 95
 96/* NetLabel CIPSOv4 attributes */
 97enum {
 98	NLBL_CIPSOV4_A_UNSPEC,
 99	NLBL_CIPSOV4_A_DOI,
100	/* (NLA_U32)
101	 * the DOI value */
102	NLBL_CIPSOV4_A_MTYPE,
103	/* (NLA_U32)
104	 * the mapping table type (defined in the cipso_ipv4.h header as
105	 * CIPSO_V4_MAP_*) */
106	NLBL_CIPSOV4_A_TAG,
107	/* (NLA_U8)
108	 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
109	 * attribute */
110	NLBL_CIPSOV4_A_TAGLST,
111	/* (NLA_NESTED)
112	 * the CIPSO tag list for the DOI, there must be at least one
113	 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
114	 * priorirty when sending packets */
115	NLBL_CIPSOV4_A_MLSLVLLOC,
116	/* (NLA_U32)
117	 * the local MLS sensitivity level */
118	NLBL_CIPSOV4_A_MLSLVLREM,
119	/* (NLA_U32)
120	 * the remote MLS sensitivity level */
121	NLBL_CIPSOV4_A_MLSLVL,
122	/* (NLA_NESTED)
123	 * a MLS sensitivity level mapping, must contain only one attribute of
124	 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
125	 * NLBL_CIPSOV4_A_MLSLVLREM */
126	NLBL_CIPSOV4_A_MLSLVLLST,
127	/* (NLA_NESTED)
128	 * the CIPSO level mappings, there must be at least one
129	 * NLBL_CIPSOV4_A_MLSLVL attribute */
130	NLBL_CIPSOV4_A_MLSCATLOC,
131	/* (NLA_U32)
132	 * the local MLS category */
133	NLBL_CIPSOV4_A_MLSCATREM,
134	/* (NLA_U32)
135	 * the remote MLS category */
136	NLBL_CIPSOV4_A_MLSCAT,
137	/* (NLA_NESTED)
138	 * a MLS category mapping, must contain only one attribute of each of
139	 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
140	 * NLBL_CIPSOV4_A_MLSCATREM */
141	NLBL_CIPSOV4_A_MLSCATLST,
142	/* (NLA_NESTED)
143	 * the CIPSO category mappings, there must be at least one
144	 * NLBL_CIPSOV4_A_MLSCAT attribute */
145	__NLBL_CIPSOV4_A_MAX,
146};
147#define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
148
149/* NetLabel protocol functions */
150int netlbl_cipsov4_genl_init(void);
 
 
 
151
152#endif

 
  1/*
  2 * NetLabel CIPSO/IPv4 Support
  3 *
  4 * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
  5 * NetLabel system manages static and dynamic label mappings for network
  6 * protocols such as CIPSO and RIPSO.
  7 *
  8 * Author: Paul Moore <paul@paul-moore.com>
  9 *
 10 */
 11
 12/*
 13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 14 *
 15 * This program is free software;  you can redistribute it and/or modify
 16 * it under the terms of the GNU General Public License as published by
 17 * the Free Software Foundation; either version 2 of the License, or
 18 * (at your option) any later version.
 19 *
 20 * This program is distributed in the hope that it will be useful,
 21 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 23 * the GNU General Public License for more details.
 24 *
 25 * You should have received a copy of the GNU General Public License
 26 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
 27 *
 28 */
 29
 30#ifndef _NETLABEL_CIPSO_V4
 31#define _NETLABEL_CIPSO_V4
 32
 33#include <net/netlabel.h>
 34
 35/*
 36 * The following NetLabel payloads are supported by the CIPSO subsystem.
 37 *
 38 * o ADD:
 39 *   Sent by an application to add a new DOI mapping table.
 40 *
 41 *   Required attributes:
 42 *
 43 *     NLBL_CIPSOV4_A_DOI
 44 *     NLBL_CIPSOV4_A_MTYPE
 45 *     NLBL_CIPSOV4_A_TAGLST
 46 *
 47 *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
 48 *
 49 *     NLBL_CIPSOV4_A_MLSLVLLST
 50 *     NLBL_CIPSOV4_A_MLSCATLST
 51 *
 52 *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
 53 *   are required.
 54 *
 55 * o REMOVE:
 56 *   Sent by an application to remove a specific DOI mapping table from the
 57 *   CIPSO V4 system.
 58 *
 59 *   Required attributes:
 60 *
 61 *     NLBL_CIPSOV4_A_DOI
 62 *
 63 * o LIST:
 64 *   Sent by an application to list the details of a DOI definition.  On
 65 *   success the kernel should send a response using the following format.
 66 *
 67 *   Required attributes:
 68 *
 69 *     NLBL_CIPSOV4_A_DOI
 70 *
 71 *   The valid response message format depends on the type of the DOI mapping,
 72 *   the defined formats are shown below.
 73 *
 74 *   Required attributes:
 75 *
 76 *     NLBL_CIPSOV4_A_MTYPE
 77 *     NLBL_CIPSOV4_A_TAGLST
 78 *
 79 *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
 80 *
 81 *     NLBL_CIPSOV4_A_MLSLVLLST
 82 *     NLBL_CIPSOV4_A_MLSCATLST
 83 *
 84 *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
 85 *   are required.
 86 *
 87 * o LISTALL:
 88 *   This message is sent by an application to list the valid DOIs on the
 89 *   system.  When sent by an application there is no payload and the
 90 *   NLM_F_DUMP flag should be set.  The kernel should respond with a series of
 91 *   the following messages.
 92 *
 93 *   Required attributes:
 94 *
 95 *    NLBL_CIPSOV4_A_DOI
 96 *    NLBL_CIPSOV4_A_MTYPE
 97 *
 98 */
 99
100/* NetLabel CIPSOv4 commands */
101enum {
102	NLBL_CIPSOV4_C_UNSPEC,
103	NLBL_CIPSOV4_C_ADD,
104	NLBL_CIPSOV4_C_REMOVE,
105	NLBL_CIPSOV4_C_LIST,
106	NLBL_CIPSOV4_C_LISTALL,
107	__NLBL_CIPSOV4_C_MAX,
108};
109
110/* NetLabel CIPSOv4 attributes */
111enum {
112	NLBL_CIPSOV4_A_UNSPEC,
113	NLBL_CIPSOV4_A_DOI,
114	/* (NLA_U32)
115	 * the DOI value */
116	NLBL_CIPSOV4_A_MTYPE,
117	/* (NLA_U32)
118	 * the mapping table type (defined in the cipso_ipv4.h header as
119	 * CIPSO_V4_MAP_*) */
120	NLBL_CIPSOV4_A_TAG,
121	/* (NLA_U8)
122	 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
123	 * attribute */
124	NLBL_CIPSOV4_A_TAGLST,
125	/* (NLA_NESTED)
126	 * the CIPSO tag list for the DOI, there must be at least one
127	 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
128	 * priorirty when sending packets */
129	NLBL_CIPSOV4_A_MLSLVLLOC,
130	/* (NLA_U32)
131	 * the local MLS sensitivity level */
132	NLBL_CIPSOV4_A_MLSLVLREM,
133	/* (NLA_U32)
134	 * the remote MLS sensitivity level */
135	NLBL_CIPSOV4_A_MLSLVL,
136	/* (NLA_NESTED)
137	 * a MLS sensitivity level mapping, must contain only one attribute of
138	 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
139	 * NLBL_CIPSOV4_A_MLSLVLREM */
140	NLBL_CIPSOV4_A_MLSLVLLST,
141	/* (NLA_NESTED)
142	 * the CIPSO level mappings, there must be at least one
143	 * NLBL_CIPSOV4_A_MLSLVL attribute */
144	NLBL_CIPSOV4_A_MLSCATLOC,
145	/* (NLA_U32)
146	 * the local MLS category */
147	NLBL_CIPSOV4_A_MLSCATREM,
148	/* (NLA_U32)
149	 * the remote MLS category */
150	NLBL_CIPSOV4_A_MLSCAT,
151	/* (NLA_NESTED)
152	 * a MLS category mapping, must contain only one attribute of each of
153	 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
154	 * NLBL_CIPSOV4_A_MLSCATREM */
155	NLBL_CIPSOV4_A_MLSCATLST,
156	/* (NLA_NESTED)
157	 * the CIPSO category mappings, there must be at least one
158	 * NLBL_CIPSOV4_A_MLSCAT attribute */
159	__NLBL_CIPSOV4_A_MAX,
160};
161#define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
162
163/* NetLabel protocol functions */
164int netlbl_cipsov4_genl_init(void);
165
166/* Free the memory associated with a CIPSOv4 DOI definition */
167void netlbl_cipsov4_doi_free(struct rcu_head *entry);
168
169#endif