netlabel_unlabeled.h 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /*
  3. * NetLabel Unlabeled Support
  4. *
  5. * This file defines functions for dealing with unlabeled packets for the
  6. * NetLabel system. The NetLabel system manages static and dynamic label
  7. * mappings for network protocols such as CIPSO and RIPSO.
  8. *
  9. * Author: Paul Moore <paul@paul-moore.com>
  10. */
  11. /*
  12. * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  13. */
  14. #ifndef _NETLABEL_UNLABELED_H
  15. #define _NETLABEL_UNLABELED_H
  16. #include <net/netlabel.h>
  17. /*
  18. * The following NetLabel payloads are supported by the Unlabeled subsystem.
  19. *
  20. * o STATICADD
  21. * This message is sent from an application to add a new static label for
  22. * incoming unlabeled connections.
  23. *
  24. * Required attributes:
  25. *
  26. * NLBL_UNLABEL_A_IFACE
  27. * NLBL_UNLABEL_A_SECCTX
  28. *
  29. * If IPv4 is specified the following attributes are required:
  30. *
  31. * NLBL_UNLABEL_A_IPV4ADDR
  32. * NLBL_UNLABEL_A_IPV4MASK
  33. *
  34. * If IPv6 is specified the following attributes are required:
  35. *
  36. * NLBL_UNLABEL_A_IPV6ADDR
  37. * NLBL_UNLABEL_A_IPV6MASK
  38. *
  39. * o STATICREMOVE
  40. * This message is sent from an application to remove an existing static
  41. * label for incoming unlabeled connections.
  42. *
  43. * Required attributes:
  44. *
  45. * NLBL_UNLABEL_A_IFACE
  46. *
  47. * If IPv4 is specified the following attributes are required:
  48. *
  49. * NLBL_UNLABEL_A_IPV4ADDR
  50. * NLBL_UNLABEL_A_IPV4MASK
  51. *
  52. * If IPv6 is specified the following attributes are required:
  53. *
  54. * NLBL_UNLABEL_A_IPV6ADDR
  55. * NLBL_UNLABEL_A_IPV6MASK
  56. *
  57. * o STATICLIST
  58. * This message can be sent either from an application or by the kernel in
  59. * response to an application generated STATICLIST message. When sent by an
  60. * application there is no payload and the NLM_F_DUMP flag should be set.
  61. * The kernel should response with a series of the following messages.
  62. *
  63. * Required attributes:
  64. *
  65. * NLBL_UNLABEL_A_IFACE
  66. * NLBL_UNLABEL_A_SECCTX
  67. *
  68. * If IPv4 is specified the following attributes are required:
  69. *
  70. * NLBL_UNLABEL_A_IPV4ADDR
  71. * NLBL_UNLABEL_A_IPV4MASK
  72. *
  73. * If IPv6 is specified the following attributes are required:
  74. *
  75. * NLBL_UNLABEL_A_IPV6ADDR
  76. * NLBL_UNLABEL_A_IPV6MASK
  77. *
  78. * o STATICADDDEF
  79. * This message is sent from an application to set the default static
  80. * label for incoming unlabeled connections.
  81. *
  82. * Required attribute:
  83. *
  84. * NLBL_UNLABEL_A_SECCTX
  85. *
  86. * If IPv4 is specified the following attributes are required:
  87. *
  88. * NLBL_UNLABEL_A_IPV4ADDR
  89. * NLBL_UNLABEL_A_IPV4MASK
  90. *
  91. * If IPv6 is specified the following attributes are required:
  92. *
  93. * NLBL_UNLABEL_A_IPV6ADDR
  94. * NLBL_UNLABEL_A_IPV6MASK
  95. *
  96. * o STATICREMOVEDEF
  97. * This message is sent from an application to remove the existing default
  98. * static label for incoming unlabeled connections.
  99. *
  100. * If IPv4 is specified the following attributes are required:
  101. *
  102. * NLBL_UNLABEL_A_IPV4ADDR
  103. * NLBL_UNLABEL_A_IPV4MASK
  104. *
  105. * If IPv6 is specified the following attributes are required:
  106. *
  107. * NLBL_UNLABEL_A_IPV6ADDR
  108. * NLBL_UNLABEL_A_IPV6MASK
  109. *
  110. * o STATICLISTDEF
  111. * This message can be sent either from an application or by the kernel in
  112. * response to an application generated STATICLISTDEF message. When sent by
  113. * an application there is no payload and the NLM_F_DUMP flag should be set.
  114. * The kernel should response with the following message.
  115. *
  116. * Required attribute:
  117. *
  118. * NLBL_UNLABEL_A_SECCTX
  119. *
  120. * If IPv4 is specified the following attributes are required:
  121. *
  122. * NLBL_UNLABEL_A_IPV4ADDR
  123. * NLBL_UNLABEL_A_IPV4MASK
  124. *
  125. * If IPv6 is specified the following attributes are required:
  126. *
  127. * NLBL_UNLABEL_A_IPV6ADDR
  128. * NLBL_UNLABEL_A_IPV6MASK
  129. *
  130. * o ACCEPT
  131. * This message is sent from an application to specify if the kernel should
  132. * allow unlabled packets to pass if they do not match any of the static
  133. * mappings defined in the unlabeled module.
  134. *
  135. * Required attributes:
  136. *
  137. * NLBL_UNLABEL_A_ACPTFLG
  138. *
  139. * o LIST
  140. * This message can be sent either from an application or by the kernel in
  141. * response to an application generated LIST message. When sent by an
  142. * application there is no payload. The kernel should respond to a LIST
  143. * message with a LIST message on success.
  144. *
  145. * Required attributes:
  146. *
  147. * NLBL_UNLABEL_A_ACPTFLG
  148. *
  149. */
  150. /* NetLabel Unlabeled commands */
  151. enum {
  152. NLBL_UNLABEL_C_UNSPEC,
  153. NLBL_UNLABEL_C_ACCEPT,
  154. NLBL_UNLABEL_C_LIST,
  155. NLBL_UNLABEL_C_STATICADD,
  156. NLBL_UNLABEL_C_STATICREMOVE,
  157. NLBL_UNLABEL_C_STATICLIST,
  158. NLBL_UNLABEL_C_STATICADDDEF,
  159. NLBL_UNLABEL_C_STATICREMOVEDEF,
  160. NLBL_UNLABEL_C_STATICLISTDEF,
  161. __NLBL_UNLABEL_C_MAX,
  162. };
  163. /* NetLabel Unlabeled attributes */
  164. enum {
  165. NLBL_UNLABEL_A_UNSPEC,
  166. NLBL_UNLABEL_A_ACPTFLG,
  167. /* (NLA_U8)
  168. * if true then unlabeled packets are allowed to pass, else unlabeled
  169. * packets are rejected */
  170. NLBL_UNLABEL_A_IPV6ADDR,
  171. /* (NLA_BINARY, struct in6_addr)
  172. * an IPv6 address */
  173. NLBL_UNLABEL_A_IPV6MASK,
  174. /* (NLA_BINARY, struct in6_addr)
  175. * an IPv6 address mask */
  176. NLBL_UNLABEL_A_IPV4ADDR,
  177. /* (NLA_BINARY, struct in_addr)
  178. * an IPv4 address */
  179. NLBL_UNLABEL_A_IPV4MASK,
  180. /* (NLA_BINARY, struct in_addr)
  181. * and IPv4 address mask */
  182. NLBL_UNLABEL_A_IFACE,
  183. /* (NLA_NULL_STRING)
  184. * network interface */
  185. NLBL_UNLABEL_A_SECCTX,
  186. /* (NLA_BINARY)
  187. * a LSM specific security context */
  188. __NLBL_UNLABEL_A_MAX,
  189. };
  190. #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1)
  191. /* NetLabel protocol functions */
  192. int netlbl_unlabel_genl_init(void);
  193. /* Unlabeled connection hash table size */
  194. /* XXX - currently this number is an uneducated guess */
  195. #define NETLBL_UNLHSH_BITSIZE 7
  196. /* General Unlabeled init function */
  197. int netlbl_unlabel_init(u32 size);
  198. /* Static/Fallback label management functions */
  199. int netlbl_unlhsh_add(struct net *net,
  200. const char *dev_name,
  201. const void *addr,
  202. const void *mask,
  203. u32 addr_len,
  204. u32 secid,
  205. struct netlbl_audit *audit_info);
  206. int netlbl_unlhsh_remove(struct net *net,
  207. const char *dev_name,
  208. const void *addr,
  209. const void *mask,
  210. u32 addr_len,
  211. struct netlbl_audit *audit_info);
  212. /* Process Unlabeled incoming network packets */
  213. int netlbl_unlabel_getattr(const struct sk_buff *skb,
  214. u16 family,
  215. struct netlbl_lsm_secattr *secattr);
  216. /* Set the default configuration to allow Unlabeled packets */
  217. int netlbl_unlabel_defconf(void);
  218. #endif