netlabel_cipso_v4.h 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /*
  3. * NetLabel CIPSO/IPv4 Support
  4. *
  5. * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
  6. * NetLabel system manages static and dynamic label mappings for network
  7. * protocols such as CIPSO and RIPSO.
  8. *
  9. * Author: Paul Moore <paul@paul-moore.com>
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  13. */
  14. #ifndef _NETLABEL_CIPSO_V4
  15. #define _NETLABEL_CIPSO_V4
  16. #include <net/netlabel.h>
  17. /*
  18. * The following NetLabel payloads are supported by the CIPSO subsystem.
  19. *
  20. * o ADD:
  21. * Sent by an application to add a new DOI mapping table.
  22. *
  23. * Required attributes:
  24. *
  25. * NLBL_CIPSOV4_A_DOI
  26. * NLBL_CIPSOV4_A_MTYPE
  27. * NLBL_CIPSOV4_A_TAGLST
  28. *
  29. * If using CIPSO_V4_MAP_TRANS the following attributes are required:
  30. *
  31. * NLBL_CIPSOV4_A_MLSLVLLST
  32. * NLBL_CIPSOV4_A_MLSCATLST
  33. *
  34. * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
  35. * are required.
  36. *
  37. * o REMOVE:
  38. * Sent by an application to remove a specific DOI mapping table from the
  39. * CIPSO V4 system.
  40. *
  41. * Required attributes:
  42. *
  43. * NLBL_CIPSOV4_A_DOI
  44. *
  45. * o LIST:
  46. * Sent by an application to list the details of a DOI definition. On
  47. * success the kernel should send a response using the following format.
  48. *
  49. * Required attributes:
  50. *
  51. * NLBL_CIPSOV4_A_DOI
  52. *
  53. * The valid response message format depends on the type of the DOI mapping,
  54. * the defined formats are shown below.
  55. *
  56. * Required attributes:
  57. *
  58. * NLBL_CIPSOV4_A_MTYPE
  59. * NLBL_CIPSOV4_A_TAGLST
  60. *
  61. * If using CIPSO_V4_MAP_TRANS the following attributes are required:
  62. *
  63. * NLBL_CIPSOV4_A_MLSLVLLST
  64. * NLBL_CIPSOV4_A_MLSCATLST
  65. *
  66. * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
  67. * are required.
  68. *
  69. * o LISTALL:
  70. * This message is sent by an application to list the valid DOIs on the
  71. * system. When sent by an application there is no payload and the
  72. * NLM_F_DUMP flag should be set. The kernel should respond with a series of
  73. * the following messages.
  74. *
  75. * Required attributes:
  76. *
  77. * NLBL_CIPSOV4_A_DOI
  78. * NLBL_CIPSOV4_A_MTYPE
  79. *
  80. */
  81. /* NetLabel CIPSOv4 commands */
  82. enum {
  83. NLBL_CIPSOV4_C_UNSPEC,
  84. NLBL_CIPSOV4_C_ADD,
  85. NLBL_CIPSOV4_C_REMOVE,
  86. NLBL_CIPSOV4_C_LIST,
  87. NLBL_CIPSOV4_C_LISTALL,
  88. __NLBL_CIPSOV4_C_MAX,
  89. };
  90. /* NetLabel CIPSOv4 attributes */
  91. enum {
  92. NLBL_CIPSOV4_A_UNSPEC,
  93. NLBL_CIPSOV4_A_DOI,
  94. /* (NLA_U32)
  95. * the DOI value */
  96. NLBL_CIPSOV4_A_MTYPE,
  97. /* (NLA_U32)
  98. * the mapping table type (defined in the cipso_ipv4.h header as
  99. * CIPSO_V4_MAP_*) */
  100. NLBL_CIPSOV4_A_TAG,
  101. /* (NLA_U8)
  102. * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
  103. * attribute */
  104. NLBL_CIPSOV4_A_TAGLST,
  105. /* (NLA_NESTED)
  106. * the CIPSO tag list for the DOI, there must be at least one
  107. * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
  108. * priorirty when sending packets */
  109. NLBL_CIPSOV4_A_MLSLVLLOC,
  110. /* (NLA_U32)
  111. * the local MLS sensitivity level */
  112. NLBL_CIPSOV4_A_MLSLVLREM,
  113. /* (NLA_U32)
  114. * the remote MLS sensitivity level */
  115. NLBL_CIPSOV4_A_MLSLVL,
  116. /* (NLA_NESTED)
  117. * a MLS sensitivity level mapping, must contain only one attribute of
  118. * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
  119. * NLBL_CIPSOV4_A_MLSLVLREM */
  120. NLBL_CIPSOV4_A_MLSLVLLST,
  121. /* (NLA_NESTED)
  122. * the CIPSO level mappings, there must be at least one
  123. * NLBL_CIPSOV4_A_MLSLVL attribute */
  124. NLBL_CIPSOV4_A_MLSCATLOC,
  125. /* (NLA_U32)
  126. * the local MLS category */
  127. NLBL_CIPSOV4_A_MLSCATREM,
  128. /* (NLA_U32)
  129. * the remote MLS category */
  130. NLBL_CIPSOV4_A_MLSCAT,
  131. /* (NLA_NESTED)
  132. * a MLS category mapping, must contain only one attribute of each of
  133. * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
  134. * NLBL_CIPSOV4_A_MLSCATREM */
  135. NLBL_CIPSOV4_A_MLSCATLST,
  136. /* (NLA_NESTED)
  137. * the CIPSO category mappings, there must be at least one
  138. * NLBL_CIPSOV4_A_MLSCAT attribute */
  139. __NLBL_CIPSOV4_A_MAX,
  140. };
  141. #define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
  142. /* NetLabel protocol functions */
  143. int netlbl_cipsov4_genl_init(void);
  144. /* Free the memory associated with a CIPSOv4 DOI definition */
  145. void netlbl_cipsov4_doi_free(struct rcu_head *entry);
  146. #endif