Loading...
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 * NetLabel CALIPSO Support
4 *
5 * This file defines the CALIPSO functions for the NetLabel system. The
6 * NetLabel system manages static and dynamic label mappings for network
7 * protocols such as CIPSO and RIPSO.
8 *
9 * Authors: Paul Moore <paul@paul-moore.com>
10 * Huw Davies <huw@codeweavers.com>
11 */
12
13/* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
15 */
16
17#ifndef _NETLABEL_CALIPSO
18#define _NETLABEL_CALIPSO
19
20#include <net/netlabel.h>
21#include <net/calipso.h>
22
23/* The following NetLabel payloads are supported by the CALIPSO subsystem.
24 *
25 * o ADD:
26 * Sent by an application to add a new DOI mapping table.
27 *
28 * Required attributes:
29 *
30 * NLBL_CALIPSO_A_DOI
31 * NLBL_CALIPSO_A_MTYPE
32 *
33 * If using CALIPSO_MAP_PASS no additional attributes are required.
34 *
35 * o REMOVE:
36 * Sent by an application to remove a specific DOI mapping table from the
37 * CALIPSO system.
38 *
39 * Required attributes:
40 *
41 * NLBL_CALIPSO_A_DOI
42 *
43 * o LIST:
44 * Sent by an application to list the details of a DOI definition. On
45 * success the kernel should send a response using the following format.
46 *
47 * Required attributes:
48 *
49 * NLBL_CALIPSO_A_DOI
50 *
51 * The valid response message format depends on the type of the DOI mapping,
52 * the defined formats are shown below.
53 *
54 * Required attributes:
55 *
56 * NLBL_CALIPSO_A_MTYPE
57 *
58 * If using CALIPSO_MAP_PASS no additional attributes are required.
59 *
60 * o LISTALL:
61 * This message is sent by an application to list the valid DOIs on the
62 * system. When sent by an application there is no payload and the
63 * NLM_F_DUMP flag should be set. The kernel should respond with a series of
64 * the following messages.
65 *
66 * Required attributes:
67 *
68 * NLBL_CALIPSO_A_DOI
69 * NLBL_CALIPSO_A_MTYPE
70 *
71 */
72
73/* NetLabel CALIPSO commands */
74enum {
75 NLBL_CALIPSO_C_UNSPEC,
76 NLBL_CALIPSO_C_ADD,
77 NLBL_CALIPSO_C_REMOVE,
78 NLBL_CALIPSO_C_LIST,
79 NLBL_CALIPSO_C_LISTALL,
80 __NLBL_CALIPSO_C_MAX,
81};
82
83/* NetLabel CALIPSO attributes */
84enum {
85 NLBL_CALIPSO_A_UNSPEC,
86 NLBL_CALIPSO_A_DOI,
87 /* (NLA_U32)
88 * the DOI value */
89 NLBL_CALIPSO_A_MTYPE,
90 /* (NLA_U32)
91 * the mapping table type (defined in the calipso.h header as
92 * CALIPSO_MAP_*) */
93 __NLBL_CALIPSO_A_MAX,
94};
95
96#define NLBL_CALIPSO_A_MAX (__NLBL_CALIPSO_A_MAX - 1)
97
98/* NetLabel protocol functions */
99#if IS_ENABLED(CONFIG_IPV6)
100int netlbl_calipso_genl_init(void);
101#else
102static inline int netlbl_calipso_genl_init(void)
103{
104 return 0;
105}
106#endif
107
108int calipso_doi_add(struct calipso_doi *doi_def,
109 struct netlbl_audit *audit_info);
110void calipso_doi_free(struct calipso_doi *doi_def);
111int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info);
112struct calipso_doi *calipso_doi_getdef(u32 doi);
113void calipso_doi_putdef(struct calipso_doi *doi_def);
114int calipso_doi_walk(u32 *skip_cnt,
115 int (*callback)(struct calipso_doi *doi_def, void *arg),
116 void *cb_arg);
117int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
118int calipso_sock_setattr(struct sock *sk,
119 const struct calipso_doi *doi_def,
120 const struct netlbl_lsm_secattr *secattr);
121void calipso_sock_delattr(struct sock *sk);
122int calipso_req_setattr(struct request_sock *req,
123 const struct calipso_doi *doi_def,
124 const struct netlbl_lsm_secattr *secattr);
125void calipso_req_delattr(struct request_sock *req);
126unsigned char *calipso_optptr(const struct sk_buff *skb);
127int calipso_getattr(const unsigned char *calipso,
128 struct netlbl_lsm_secattr *secattr);
129int calipso_skbuff_setattr(struct sk_buff *skb,
130 const struct calipso_doi *doi_def,
131 const struct netlbl_lsm_secattr *secattr);
132int calipso_skbuff_delattr(struct sk_buff *skb);
133void calipso_cache_invalidate(void);
134int calipso_cache_add(const unsigned char *calipso_ptr,
135 const struct netlbl_lsm_secattr *secattr);
136
137#endif
1/*
2 * NetLabel CALIPSO Support
3 *
4 * This file defines the CALIPSO functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
7 *
8 * Authors: Paul Moore <paul@paul-moore.com>
9 * Huw Davies <huw@codeweavers.com>
10 *
11 */
12
13/* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 2 of the License, or
19 * (at your option) any later version.
20 *
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
24 * the GNU General Public License for more details.
25 *
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
28 *
29 */
30
31#ifndef _NETLABEL_CALIPSO
32#define _NETLABEL_CALIPSO
33
34#include <net/netlabel.h>
35#include <net/calipso.h>
36
37/* The following NetLabel payloads are supported by the CALIPSO subsystem.
38 *
39 * o ADD:
40 * Sent by an application to add a new DOI mapping table.
41 *
42 * Required attributes:
43 *
44 * NLBL_CALIPSO_A_DOI
45 * NLBL_CALIPSO_A_MTYPE
46 *
47 * If using CALIPSO_MAP_PASS no additional attributes are required.
48 *
49 * o REMOVE:
50 * Sent by an application to remove a specific DOI mapping table from the
51 * CALIPSO system.
52 *
53 * Required attributes:
54 *
55 * NLBL_CALIPSO_A_DOI
56 *
57 * o LIST:
58 * Sent by an application to list the details of a DOI definition. On
59 * success the kernel should send a response using the following format.
60 *
61 * Required attributes:
62 *
63 * NLBL_CALIPSO_A_DOI
64 *
65 * The valid response message format depends on the type of the DOI mapping,
66 * the defined formats are shown below.
67 *
68 * Required attributes:
69 *
70 * NLBL_CALIPSO_A_MTYPE
71 *
72 * If using CALIPSO_MAP_PASS no additional attributes are required.
73 *
74 * o LISTALL:
75 * This message is sent by an application to list the valid DOIs on the
76 * system. When sent by an application there is no payload and the
77 * NLM_F_DUMP flag should be set. The kernel should respond with a series of
78 * the following messages.
79 *
80 * Required attributes:
81 *
82 * NLBL_CALIPSO_A_DOI
83 * NLBL_CALIPSO_A_MTYPE
84 *
85 */
86
87/* NetLabel CALIPSO commands */
88enum {
89 NLBL_CALIPSO_C_UNSPEC,
90 NLBL_CALIPSO_C_ADD,
91 NLBL_CALIPSO_C_REMOVE,
92 NLBL_CALIPSO_C_LIST,
93 NLBL_CALIPSO_C_LISTALL,
94 __NLBL_CALIPSO_C_MAX,
95};
96
97/* NetLabel CALIPSO attributes */
98enum {
99 NLBL_CALIPSO_A_UNSPEC,
100 NLBL_CALIPSO_A_DOI,
101 /* (NLA_U32)
102 * the DOI value */
103 NLBL_CALIPSO_A_MTYPE,
104 /* (NLA_U32)
105 * the mapping table type (defined in the calipso.h header as
106 * CALIPSO_MAP_*) */
107 __NLBL_CALIPSO_A_MAX,
108};
109
110#define NLBL_CALIPSO_A_MAX (__NLBL_CALIPSO_A_MAX - 1)
111
112/* NetLabel protocol functions */
113#if IS_ENABLED(CONFIG_IPV6)
114int netlbl_calipso_genl_init(void);
115#else
116static inline int netlbl_calipso_genl_init(void)
117{
118 return 0;
119}
120#endif
121
122int calipso_doi_add(struct calipso_doi *doi_def,
123 struct netlbl_audit *audit_info);
124void calipso_doi_free(struct calipso_doi *doi_def);
125int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info);
126struct calipso_doi *calipso_doi_getdef(u32 doi);
127void calipso_doi_putdef(struct calipso_doi *doi_def);
128int calipso_doi_walk(u32 *skip_cnt,
129 int (*callback)(struct calipso_doi *doi_def, void *arg),
130 void *cb_arg);
131int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
132int calipso_sock_setattr(struct sock *sk,
133 const struct calipso_doi *doi_def,
134 const struct netlbl_lsm_secattr *secattr);
135void calipso_sock_delattr(struct sock *sk);
136int calipso_req_setattr(struct request_sock *req,
137 const struct calipso_doi *doi_def,
138 const struct netlbl_lsm_secattr *secattr);
139void calipso_req_delattr(struct request_sock *req);
140unsigned char *calipso_optptr(const struct sk_buff *skb);
141int calipso_getattr(const unsigned char *calipso,
142 struct netlbl_lsm_secattr *secattr);
143int calipso_skbuff_setattr(struct sk_buff *skb,
144 const struct calipso_doi *doi_def,
145 const struct netlbl_lsm_secattr *secattr);
146int calipso_skbuff_delattr(struct sk_buff *skb);
147void calipso_cache_invalidate(void);
148int calipso_cache_add(const unsigned char *calipso_ptr,
149 const struct netlbl_lsm_secattr *secattr);
150
151#endif