netlabel_calipso.h 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /*
  3. * NetLabel CALIPSO Support
  4. *
  5. * This file defines the CALIPSO functions for the NetLabel system. The
  6. * NetLabel system manages static and dynamic label mappings for network
  7. * protocols such as CIPSO and RIPSO.
  8. *
  9. * Authors: Paul Moore <paul@paul-moore.com>
  10. * Huw Davies <huw@codeweavers.com>
  11. */
  12. /* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  13. * (c) Copyright Huw Davies <huw@codeweavers.com>, 2015
  14. */
  15. #ifndef _NETLABEL_CALIPSO
  16. #define _NETLABEL_CALIPSO
  17. #include <net/netlabel.h>
  18. #include <net/calipso.h>
  19. /* The following NetLabel payloads are supported by the CALIPSO subsystem.
  20. *
  21. * o ADD:
  22. * Sent by an application to add a new DOI mapping table.
  23. *
  24. * Required attributes:
  25. *
  26. * NLBL_CALIPSO_A_DOI
  27. * NLBL_CALIPSO_A_MTYPE
  28. *
  29. * If using CALIPSO_MAP_PASS no additional attributes are required.
  30. *
  31. * o REMOVE:
  32. * Sent by an application to remove a specific DOI mapping table from the
  33. * CALIPSO system.
  34. *
  35. * Required attributes:
  36. *
  37. * NLBL_CALIPSO_A_DOI
  38. *
  39. * o LIST:
  40. * Sent by an application to list the details of a DOI definition. On
  41. * success the kernel should send a response using the following format.
  42. *
  43. * Required attributes:
  44. *
  45. * NLBL_CALIPSO_A_DOI
  46. *
  47. * The valid response message format depends on the type of the DOI mapping,
  48. * the defined formats are shown below.
  49. *
  50. * Required attributes:
  51. *
  52. * NLBL_CALIPSO_A_MTYPE
  53. *
  54. * If using CALIPSO_MAP_PASS no additional attributes are required.
  55. *
  56. * o LISTALL:
  57. * This message is sent by an application to list the valid DOIs on the
  58. * system. When sent by an application there is no payload and the
  59. * NLM_F_DUMP flag should be set. The kernel should respond with a series of
  60. * the following messages.
  61. *
  62. * Required attributes:
  63. *
  64. * NLBL_CALIPSO_A_DOI
  65. * NLBL_CALIPSO_A_MTYPE
  66. *
  67. */
  68. /* NetLabel CALIPSO commands */
  69. enum {
  70. NLBL_CALIPSO_C_UNSPEC,
  71. NLBL_CALIPSO_C_ADD,
  72. NLBL_CALIPSO_C_REMOVE,
  73. NLBL_CALIPSO_C_LIST,
  74. NLBL_CALIPSO_C_LISTALL,
  75. __NLBL_CALIPSO_C_MAX,
  76. };
  77. /* NetLabel CALIPSO attributes */
  78. enum {
  79. NLBL_CALIPSO_A_UNSPEC,
  80. NLBL_CALIPSO_A_DOI,
  81. /* (NLA_U32)
  82. * the DOI value */
  83. NLBL_CALIPSO_A_MTYPE,
  84. /* (NLA_U32)
  85. * the mapping table type (defined in the calipso.h header as
  86. * CALIPSO_MAP_*) */
  87. __NLBL_CALIPSO_A_MAX,
  88. };
  89. #define NLBL_CALIPSO_A_MAX (__NLBL_CALIPSO_A_MAX - 1)
  90. /* NetLabel protocol functions */
  91. #if IS_ENABLED(CONFIG_IPV6)
  92. int netlbl_calipso_genl_init(void);
  93. #else
  94. static inline int netlbl_calipso_genl_init(void)
  95. {
  96. return 0;
  97. }
  98. #endif
  99. int calipso_doi_add(struct calipso_doi *doi_def,
  100. struct netlbl_audit *audit_info);
  101. void calipso_doi_free(struct calipso_doi *doi_def);
  102. int calipso_doi_remove(u32 doi, struct netlbl_audit *audit_info);
  103. struct calipso_doi *calipso_doi_getdef(u32 doi);
  104. void calipso_doi_putdef(struct calipso_doi *doi_def);
  105. int calipso_doi_walk(u32 *skip_cnt,
  106. int (*callback)(struct calipso_doi *doi_def, void *arg),
  107. void *cb_arg);
  108. int calipso_sock_getattr(struct sock *sk, struct netlbl_lsm_secattr *secattr);
  109. int calipso_sock_setattr(struct sock *sk,
  110. const struct calipso_doi *doi_def,
  111. const struct netlbl_lsm_secattr *secattr);
  112. void calipso_sock_delattr(struct sock *sk);
  113. int calipso_req_setattr(struct request_sock *req,
  114. const struct calipso_doi *doi_def,
  115. const struct netlbl_lsm_secattr *secattr);
  116. void calipso_req_delattr(struct request_sock *req);
  117. unsigned char *calipso_optptr(const struct sk_buff *skb);
  118. int calipso_getattr(const unsigned char *calipso,
  119. struct netlbl_lsm_secattr *secattr);
  120. int calipso_skbuff_setattr(struct sk_buff *skb,
  121. const struct calipso_doi *doi_def,
  122. const struct netlbl_lsm_secattr *secattr);
  123. int calipso_skbuff_delattr(struct sk_buff *skb);
  124. void calipso_cache_invalidate(void);
  125. int calipso_cache_add(const unsigned char *calipso_ptr,
  126. const struct netlbl_lsm_secattr *secattr);
  127. #endif