[deliverable/linux.git] / net / netlabel / netlabel_unlabeled.h

/*
 * NetLabel Unlabeled Support
 *
 * This file defines functions for dealing with unlabeled packets for the
 * NetLabel system.  The NetLabel system manages static and dynamic label
 * mappings for network protocols such as CIPSO and RIPSO.
 *
 * Author: Paul Moore <paul@paul-moore.com>
 *
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 *
 * This program is free software;  you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program;  if not, see <http://www.gnu.org/licenses/>.
 *
 */

#ifndef _NETLABEL_UNLABELED_H
#define _NETLABEL_UNLABELED_H

#include <net/netlabel.h>

/*
 * The following NetLabel payloads are supported by the Unlabeled subsystem.
 *
 * o STATICADD
 *   This message is sent from an application to add a new static label for
 *   incoming unlabeled connections.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_IFACE
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICREMOVE
 *   This message is sent from an application to remove an existing static
 *   label for incoming unlabeled connections.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_IFACE
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICLIST
 *   This message can be sent either from an application or by the kernel in
 *   response to an application generated STATICLIST message.  When sent by an
 *   application there is no payload and the NLM_F_DUMP flag should be set.
 *   The kernel should response with a series of the following messages.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_IFACE
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICADDDEF
 *   This message is sent from an application to set the default static
 *   label for incoming unlabeled connections.
 *
 *   Required attribute:
 *
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICREMOVEDEF
 *   This message is sent from an application to remove the existing default
 *   static label for incoming unlabeled connections.
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICLISTDEF
 *   This message can be sent either from an application or by the kernel in
 *   response to an application generated STATICLISTDEF message.  When sent by
 *   an application there is no payload and the NLM_F_DUMP flag should be set.
 *   The kernel should response with the following message.
 *
 *   Required attribute:
 *
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o ACCEPT
 *   This message is sent from an application to specify if the kernel should
 *   allow unlabled packets to pass if they do not match any of the static
 *   mappings defined in the unlabeled module.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_ACPTFLG
 *
 * o LIST
 *   This message can be sent either from an application or by the kernel in
 *   response to an application generated LIST message.  When sent by an
 *   application there is no payload.  The kernel should respond to a LIST
 *   message with a LIST message on success.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_ACPTFLG
 *
 */

/* NetLabel Unlabeled commands */
enum {
	NLBL_UNLABEL_C_UNSPEC,
	NLBL_UNLABEL_C_ACCEPT,
	NLBL_UNLABEL_C_LIST,
	NLBL_UNLABEL_C_STATICADD,
	NLBL_UNLABEL_C_STATICREMOVE,
	NLBL_UNLABEL_C_STATICLIST,
	NLBL_UNLABEL_C_STATICADDDEF,
	NLBL_UNLABEL_C_STATICREMOVEDEF,
	NLBL_UNLABEL_C_STATICLISTDEF,
	__NLBL_UNLABEL_C_MAX,
};

/* NetLabel Unlabeled attributes */
enum {
	NLBL_UNLABEL_A_UNSPEC,
	NLBL_UNLABEL_A_ACPTFLG,
	/* (NLA_U8)
	 * if true then unlabeled packets are allowed to pass, else unlabeled
	 * packets are rejected */
	NLBL_UNLABEL_A_IPV6ADDR,
	/* (NLA_BINARY, struct in6_addr)
	 * an IPv6 address */
	NLBL_UNLABEL_A_IPV6MASK,
	/* (NLA_BINARY, struct in6_addr)
	 * an IPv6 address mask */
	NLBL_UNLABEL_A_IPV4ADDR,
	/* (NLA_BINARY, struct in_addr)
	 * an IPv4 address */
	NLBL_UNLABEL_A_IPV4MASK,
	/* (NLA_BINARY, struct in_addr)
	 * and IPv4 address mask */
	NLBL_UNLABEL_A_IFACE,
	/* (NLA_NULL_STRING)
	 * network interface */
	NLBL_UNLABEL_A_SECCTX,
	/* (NLA_BINARY)
	 * a LSM specific security context */
	__NLBL_UNLABEL_A_MAX,
};
#define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1)

/* NetLabel protocol functions */
int netlbl_unlabel_genl_init(void);

/* Unlabeled connection hash table size */
/* XXX - currently this number is an uneducated guess */
#define NETLBL_UNLHSH_BITSIZE       7

/* General Unlabeled init function */
int netlbl_unlabel_init(u32 size);

/* Static/Fallback label management functions */
int netlbl_unlhsh_add(struct net *net,
		      const char *dev_name,
		      const void *addr,
		      const void *mask,
		      u32 addr_len,
		      u32 secid,
		      struct netlbl_audit *audit_info);
int netlbl_unlhsh_remove(struct net *net,
			 const char *dev_name,
			 const void *addr,
			 const void *mask,
			 u32 addr_len,
			 struct netlbl_audit *audit_info);

/* Process Unlabeled incoming network packets */
int netlbl_unlabel_getattr(const struct sk_buff *skb,
			   u16 family,
			   struct netlbl_lsm_secattr *secattr);

/* Set the default configuration to allow Unlabeled packets */
int netlbl_unlabel_defconf(void);

#endif
Commit	Line	Data
d15c345f PM	1	/*
	2	* NetLabel Unlabeled Support
	3	*
	4	* This file defines functions for dealing with unlabeled packets for the
	5	* NetLabel system. The NetLabel system manages static and dynamic label
	6	* mappings for network protocols such as CIPSO and RIPSO.
	7	*
82c21bfa	8	* Author: Paul Moore <paul@paul-moore.com>
d15c345f PM	9	*
	10	*/
	11
	12	/*
	13	* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
	14	*
	15	* This program is free software; you can redistribute it and/or modify
	16	* it under the terms of the GNU General Public License as published by
	17	* the Free Software Foundation; either version 2 of the License, or
	18	* (at your option) any later version.
	19	*
	20	* This program is distributed in the hope that it will be useful,
	21	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	22	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
	23	* the GNU General Public License for more details.
	24	*
	25	* You should have received a copy of the GNU General Public License
d484ff15	26	* along with this program; if not, see <http://www.gnu.org/licenses/>.
d15c345f PM	27	*
	28	*/
	29
	30	#ifndef _NETLABEL_UNLABELED_H
	31	#define _NETLABEL_UNLABELED_H
	32
	33	#include <net/netlabel.h>
	34
	35	/*
	36	* The following NetLabel payloads are supported by the Unlabeled subsystem.
	37	*
8cc44579 PM	38	* o STATICADD
	39	* This message is sent from an application to add a new static label for
	40	* incoming unlabeled connections.
	41	*
	42	* Required attributes:
	43	*
	44	* NLBL_UNLABEL_A_IFACE
	45	* NLBL_UNLABEL_A_SECCTX
	46	*
	47	* If IPv4 is specified the following attributes are required:
	48	*
	49	* NLBL_UNLABEL_A_IPV4ADDR
	50	* NLBL_UNLABEL_A_IPV4MASK
	51	*
	52	* If IPv6 is specified the following attributes are required:
	53	*
	54	* NLBL_UNLABEL_A_IPV6ADDR
	55	* NLBL_UNLABEL_A_IPV6MASK
	56	*
	57	* o STATICREMOVE
	58	* This message is sent from an application to remove an existing static
	59	* label for incoming unlabeled connections.
	60	*
	61	* Required attributes:
	62	*
	63	* NLBL_UNLABEL_A_IFACE
	64	*
	65	* If IPv4 is specified the following attributes are required:
	66	*
	67	* NLBL_UNLABEL_A_IPV4ADDR
	68	* NLBL_UNLABEL_A_IPV4MASK
	69	*
	70	* If IPv6 is specified the following attributes are required:
	71	*
	72	* NLBL_UNLABEL_A_IPV6ADDR
	73	* NLBL_UNLABEL_A_IPV6MASK
	74	*
	75	* o STATICLIST
	76	* This message can be sent either from an application or by the kernel in
	77	* response to an application generated STATICLIST message. When sent by an
	78	* application there is no payload and the NLM_F_DUMP flag should be set.
	79	* The kernel should response with a series of the following messages.
	80	*
	81	* Required attributes:
	82	*
	83	* NLBL_UNLABEL_A_IFACE
	84	* NLBL_UNLABEL_A_SECCTX
	85	*
	86	* If IPv4 is specified the following attributes are required:
	87	*
	88	* NLBL_UNLABEL_A_IPV4ADDR
	89	* NLBL_UNLABEL_A_IPV4MASK
	90	*
	91	* If IPv6 is specified the following attributes are required:
	92	*
	93	* NLBL_UNLABEL_A_IPV6ADDR
	94	* NLBL_UNLABEL_A_IPV6MASK
	95	*
	96	* o STATICADDDEF
	97	* This message is sent from an application to set the default static
	98	* label for incoming unlabeled connections.
	99	*
	100	* Required attribute:
	101	*
102	* NLBL_UNLABEL_A_SECCTX
103	*
104	* If IPv4 is specified the following attributes are required:
105	*
106	* NLBL_UNLABEL_A_IPV4ADDR
107	* NLBL_UNLABEL_A_IPV4MASK
108	*
109	* If IPv6 is specified the following attributes are required:
110	*
111	* NLBL_UNLABEL_A_IPV6ADDR
112	* NLBL_UNLABEL_A_IPV6MASK
113	*
114	* o STATICREMOVEDEF
115	* This message is sent from an application to remove the existing default
116	* static label for incoming unlabeled connections.
117	*
118	* If IPv4 is specified the following attributes are required:
119	*
120	* NLBL_UNLABEL_A_IPV4ADDR
121	* NLBL_UNLABEL_A_IPV4MASK
122	*
123	* If IPv6 is specified the following attributes are required:
124	*
125	* NLBL_UNLABEL_A_IPV6ADDR
126	* NLBL_UNLABEL_A_IPV6MASK
127	*
128	* o STATICLISTDEF
129	* This message can be sent either from an application or by the kernel in
130	* response to an application generated STATICLISTDEF message. When sent by
131	* an application there is no payload and the NLM_F_DUMP flag should be set.
132	* The kernel should response with the following message.
133	*
134	* Required attribute:
135	*
136	* NLBL_UNLABEL_A_SECCTX
137	*
138	* If IPv4 is specified the following attributes are required:
139	*
140	* NLBL_UNLABEL_A_IPV4ADDR
141	* NLBL_UNLABEL_A_IPV4MASK
142	*
143	* If IPv6 is specified the following attributes are required:
144	*
145	* NLBL_UNLABEL_A_IPV6ADDR
146	* NLBL_UNLABEL_A_IPV6MASK
147	*
d15c345f PM	148	* o ACCEPT
	149	* This message is sent from an application to specify if the kernel should
	150	* allow unlabled packets to pass if they do not match any of the static
	151	* mappings defined in the unlabeled module.
	152	*
fd385855	153	* Required attributes:
d15c345f	154	*
fd385855	155	* NLBL_UNLABEL_A_ACPTFLG
d15c345f PM	156	*
	157	* o LIST
	158	* This message can be sent either from an application or by the kernel in
	159	* response to an application generated LIST message. When sent by an
	160	* application there is no payload. The kernel should respond to a LIST
fd385855	161	* message with a LIST message on success.
d15c345f	162	*
fd385855	163	* Required attributes:
d15c345f	164	*
fd385855	165	* NLBL_UNLABEL_A_ACPTFLG
d15c345f PM	166	*
	167	*/
	168
	169	/* NetLabel Unlabeled commands */
	170	enum {
	171	NLBL_UNLABEL_C_UNSPEC,
d15c345f PM	172	NLBL_UNLABEL_C_ACCEPT,
d15c345f PM	173	NLBL_UNLABEL_C_LIST,
8cc44579 PM	174	NLBL_UNLABEL_C_STATICADD,
	175	NLBL_UNLABEL_C_STATICREMOVE,
	176	NLBL_UNLABEL_C_STATICLIST,
	177	NLBL_UNLABEL_C_STATICADDDEF,
	178	NLBL_UNLABEL_C_STATICREMOVEDEF,
	179	NLBL_UNLABEL_C_STATICLISTDEF,
d15c345f PM	180	__NLBL_UNLABEL_C_MAX,
d15c345f PM	181	};
d15c345f	182
fd385855 PM	183	/* NetLabel Unlabeled attributes */
	184	enum {
	185	NLBL_UNLABEL_A_UNSPEC,
	186	NLBL_UNLABEL_A_ACPTFLG,
	187	/* (NLA_U8)
	188	* if true then unlabeled packets are allowed to pass, else unlabeled
	189	* packets are rejected */
8cc44579 PM	190	NLBL_UNLABEL_A_IPV6ADDR,
	191	/* (NLA_BINARY, struct in6_addr)
	192	* an IPv6 address */
	193	NLBL_UNLABEL_A_IPV6MASK,
	194	/* (NLA_BINARY, struct in6_addr)
	195	* an IPv6 address mask */
	196	NLBL_UNLABEL_A_IPV4ADDR,
	197	/* (NLA_BINARY, struct in_addr)
	198	* an IPv4 address */
	199	NLBL_UNLABEL_A_IPV4MASK,
	200	/* (NLA_BINARY, struct in_addr)
	201	* and IPv4 address mask */
	202	NLBL_UNLABEL_A_IFACE,
	203	/* (NLA_NULL_STRING)
	204	* network interface */
	205	NLBL_UNLABEL_A_SECCTX,
	206	/* (NLA_BINARY)
	207	* a LSM specific security context */
fd385855 PM	208	__NLBL_UNLABEL_A_MAX,
	209	};
	210	#define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1)
	211
d15c345f PM	212	/* NetLabel protocol functions */
	213	int netlbl_unlabel_genl_init(void);
	214
8cc44579 PM	215	/* Unlabeled connection hash table size */
	216	/* XXX - currently this number is an uneducated guess */
	217	#define NETLBL_UNLHSH_BITSIZE 7
	218
	219	/* General Unlabeled init function */
	220	int netlbl_unlabel_init(u32 size);
	221
6c2e8ac0 PM	222	/* Static/Fallback label management functions */
	223	int netlbl_unlhsh_add(struct net *net,
	224	const char *dev_name,
	225	const void *addr,
	226	const void *mask,
	227	u32 addr_len,
	228	u32 secid,
	229	struct netlbl_audit *audit_info);
	230	int netlbl_unlhsh_remove(struct net *net,
	231	const char *dev_name,
	232	const void *addr,
	233	const void *mask,
	234	u32 addr_len,
	235	struct netlbl_audit *audit_info);
	236
d15c345f	237	/* Process Unlabeled incoming network packets */
8cc44579 PM	238	int netlbl_unlabel_getattr(const struct sk_buff *skb,
	239	u16 family,
	240	struct netlbl_lsm_secattr *secattr);
d15c345f PM	241
	242	/* Set the default configuration to allow Unlabeled packets */
	243	int netlbl_unlabel_defconf(void);
	244
	245	#endif