LXR linux/net/netlabel/netlabel_cipso

   1/*
   2 * NetLabel CIPSO/IPv4 Support
   3 *
   4 * This file defines the CIPSO/IPv4 functions for the NetLabel system.  The
   5 * NetLabel system manages static and dynamic label mappings for network
   6 * protocols such as CIPSO and RIPSO.
   7 *
   8 * Author: Paul Moore <paul.moore@hp.com>
   9 *
  10 */
  11
  12/*
  13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14 *
  15 * This program is free software;  you can redistribute it and/or modify
  16 * it under the terms of the GNU General Public License as published by
  17 * the Free Software Foundation; either version 2 of the License, or
  18 * (at your option) any later version.
  19 *
  20 * This program is distributed in the hope that it will be useful,
  21 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  23 * the GNU General Public License for more details.
  24 *
  25 * You should have received a copy of the GNU General Public License
  26 * along with this program;  if not, write to the Free Software
  27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28 *
  29 */
  30
  31#ifndef _NETLABEL_CIPSO_V4
  32#define _NETLABEL_CIPSO_V4
  33
  34#include <net/netlabel.h>
  35
  36/*
  37 * The following NetLabel payloads are supported by the CIPSO subsystem.
  38 *
  39 * o ADD:
  40 *   Sent by an application to add a new DOI mapping table.
  41 *
  42 *   Required attributes:
  43 *
  44 *     NLBL_CIPSOV4_A_DOI
  45 *     NLBL_CIPSOV4_A_MTYPE
  46 *     NLBL_CIPSOV4_A_TAGLST
  47 *
  48 *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
  49 *
  50 *     NLBL_CIPSOV4_A_MLSLVLLST
  51 *     NLBL_CIPSOV4_A_MLSCATLST
  52 *
  53 *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
  54 *   are required.
  55 *
  56 * o REMOVE:
  57 *   Sent by an application to remove a specific DOI mapping table from the
  58 *   CIPSO V4 system.
  59 *
  60 *   Required attributes:
  61 *
  62 *     NLBL_CIPSOV4_A_DOI
  63 *
  64 * o LIST:
  65 *   Sent by an application to list the details of a DOI definition.  On
  66 *   success the kernel should send a response using the following format.
  67 *
  68 *   Required attributes:
  69 *
  70 *     NLBL_CIPSOV4_A_DOI
  71 *
  72 *   The valid response message format depends on the type of the DOI mapping,
  73 *   the defined formats are shown below.
  74 *
  75 *   Required attributes:
  76 *
  77 *     NLBL_CIPSOV4_A_MTYPE
  78 *     NLBL_CIPSOV4_A_TAGLST
  79 *
  80 *   If using CIPSO_V4_MAP_TRANS the following attributes are required:
  81 *
  82 *     NLBL_CIPSOV4_A_MLSLVLLST
  83 *     NLBL_CIPSOV4_A_MLSCATLST
  84 *
  85 *   If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
  86 *   are required.
  87 *
  88 * o LISTALL:
  89 *   This message is sent by an application to list the valid DOIs on the
  90 *   system.  When sent by an application there is no payload and the
  91 *   NLM_F_DUMP flag should be set.  The kernel should respond with a series of
  92 *   the following messages.
  93 *
  94 *   Required attributes:
  95 *
  96 *    NLBL_CIPSOV4_A_DOI
  97 *    NLBL_CIPSOV4_A_MTYPE
  98 *
  99 */
 100
 101/* NetLabel CIPSOv4 commands */
 102enum {
 103        NLBL_CIPSOV4_C_UNSPEC,
 104        NLBL_CIPSOV4_C_ADD,
 105        NLBL_CIPSOV4_C_REMOVE,
 106        NLBL_CIPSOV4_C_LIST,
 107        NLBL_CIPSOV4_C_LISTALL,
 108        __NLBL_CIPSOV4_C_MAX,
 109};
 110#define NLBL_CIPSOV4_C_MAX (__NLBL_CIPSOV4_C_MAX - 1)
 111
 112/* NetLabel CIPSOv4 attributes */
 113enum {
 114        NLBL_CIPSOV4_A_UNSPEC,
 115        NLBL_CIPSOV4_A_DOI,
 116        /* (NLA_U32)
 117         * the DOI value */
 118        NLBL_CIPSOV4_A_MTYPE,
 119        /* (NLA_U32)
 120         * the mapping table type (defined in the cipso_ipv4.h header as
 121         * CIPSO_V4_MAP_*) */
 122        NLBL_CIPSOV4_A_TAG,
 123        /* (NLA_U8)
 124         * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
 125         * attribute */
 126        NLBL_CIPSOV4_A_TAGLST,
 127        /* (NLA_NESTED)
 128         * the CIPSO tag list for the DOI, there must be at least one
 129         * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
 130         * priorirty when sending packets */
 131        NLBL_CIPSOV4_A_MLSLVLLOC,
 132        /* (NLA_U32)
 133         * the local MLS sensitivity level */
 134        NLBL_CIPSOV4_A_MLSLVLREM,
 135        /* (NLA_U32)
 136         * the remote MLS sensitivity level */
 137        NLBL_CIPSOV4_A_MLSLVL,
 138        /* (NLA_NESTED)
 139         * a MLS sensitivity level mapping, must contain only one attribute of
 140         * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
 141         * NLBL_CIPSOV4_A_MLSLVLREM */
 142        NLBL_CIPSOV4_A_MLSLVLLST,
 143        /* (NLA_NESTED)
 144         * the CIPSO level mappings, there must be at least one
 145         * NLBL_CIPSOV4_A_MLSLVL attribute */
 146        NLBL_CIPSOV4_A_MLSCATLOC,
 147        /* (NLA_U32)
 148         * the local MLS category */
 149        NLBL_CIPSOV4_A_MLSCATREM,
 150        /* (NLA_U32)
 151         * the remote MLS category */
 152        NLBL_CIPSOV4_A_MLSCAT,
 153        /* (NLA_NESTED)
 154         * a MLS category mapping, must contain only one attribute of each of
 155         * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
 156         * NLBL_CIPSOV4_A_MLSCATREM */
 157        NLBL_CIPSOV4_A_MLSCATLST,
 158        /* (NLA_NESTED)
 159         * the CIPSO category mappings, there must be at least one
 160         * NLBL_CIPSOV4_A_MLSCAT attribute */
 161        __NLBL_CIPSOV4_A_MAX,
 162};
 163#define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
 164
 165/* NetLabel protocol functions */
 166int netlbl_cipsov4_genl_init(void);
 167
 168/* Free the memory associated with a CIPSOv4 DOI definition */
 169void netlbl_cipsov4_doi_free(struct rcu_head *entry);
 170
 171#endif
 172