[net-next-2.6.git] / net / netlabel / netlabel_unlabeled.h

/*
 * NetLabel Unlabeled Support
 *
 * This file defines functions for dealing with unlabeled packets for the
 * NetLabel system.  The NetLabel system manages static and dynamic label
 * mappings for network protocols such as CIPSO and RIPSO.
 *
 * Author: Paul Moore <paul.moore@hp.com>
 *
 */

/*
 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 *
 * This program is free software;  you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 * the GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program;  if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
 *
 */

#ifndef _NETLABEL_UNLABELED_H
#define _NETLABEL_UNLABELED_H

#include <net/netlabel.h>

/*
 * The following NetLabel payloads are supported by the Unlabeled subsystem.
 *
 * o STATICADD
 *   This message is sent from an application to add a new static label for
 *   incoming unlabeled connections.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_IFACE
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICREMOVE
 *   This message is sent from an application to remove an existing static
 *   label for incoming unlabeled connections.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_IFACE
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICLIST
 *   This message can be sent either from an application or by the kernel in
 *   response to an application generated STATICLIST message.  When sent by an
 *   application there is no payload and the NLM_F_DUMP flag should be set.
 *   The kernel should response with a series of the following messages.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_IFACE
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICADDDEF
 *   This message is sent from an application to set the default static
 *   label for incoming unlabeled connections.
 *
 *   Required attribute:
 *
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICREMOVEDEF
 *   This message is sent from an application to remove the existing default
 *   static label for incoming unlabeled connections.
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o STATICLISTDEF
 *   This message can be sent either from an application or by the kernel in
 *   response to an application generated STATICLISTDEF message.  When sent by
 *   an application there is no payload and the NLM_F_DUMP flag should be set.
 *   The kernel should response with the following message.
 *
 *   Required attribute:
 *
 *     NLBL_UNLABEL_A_SECCTX
 *
 *   If IPv4 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV4ADDR
 *     NLBL_UNLABEL_A_IPV4MASK
 *
 *   If IPv6 is specified the following attributes are required:
 *
 *     NLBL_UNLABEL_A_IPV6ADDR
 *     NLBL_UNLABEL_A_IPV6MASK
 *
 * o ACCEPT
 *   This message is sent from an application to specify if the kernel should
 *   allow unlabled packets to pass if they do not match any of the static
 *   mappings defined in the unlabeled module.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_ACPTFLG
 *
 * o LIST
 *   This message can be sent either from an application or by the kernel in
 *   response to an application generated LIST message.  When sent by an
 *   application there is no payload.  The kernel should respond to a LIST
 *   message with a LIST message on success.
 *
 *   Required attributes:
 *
 *     NLBL_UNLABEL_A_ACPTFLG
 *
 */

/* NetLabel Unlabeled commands */
enum {
	NLBL_UNLABEL_C_UNSPEC,
	NLBL_UNLABEL_C_ACCEPT,
	NLBL_UNLABEL_C_LIST,
	NLBL_UNLABEL_C_STATICADD,
	NLBL_UNLABEL_C_STATICREMOVE,
	NLBL_UNLABEL_C_STATICLIST,
	NLBL_UNLABEL_C_STATICADDDEF,
	NLBL_UNLABEL_C_STATICREMOVEDEF,
	NLBL_UNLABEL_C_STATICLISTDEF,
	__NLBL_UNLABEL_C_MAX,
};
#define NLBL_UNLABEL_C_MAX (__NLBL_UNLABEL_C_MAX - 1)

/* NetLabel Unlabeled attributes */
enum {
	NLBL_UNLABEL_A_UNSPEC,
	NLBL_UNLABEL_A_ACPTFLG,
	/* (NLA_U8)
	 * if true then unlabeled packets are allowed to pass, else unlabeled
	 * packets are rejected */
	NLBL_UNLABEL_A_IPV6ADDR,
	/* (NLA_BINARY, struct in6_addr)
	 * an IPv6 address */
	NLBL_UNLABEL_A_IPV6MASK,
	/* (NLA_BINARY, struct in6_addr)
	 * an IPv6 address mask */
	NLBL_UNLABEL_A_IPV4ADDR,
	/* (NLA_BINARY, struct in_addr)
	 * an IPv4 address */
	NLBL_UNLABEL_A_IPV4MASK,
	/* (NLA_BINARY, struct in_addr)
	 * and IPv4 address mask */
	NLBL_UNLABEL_A_IFACE,
	/* (NLA_NULL_STRING)
	 * network interface */
	NLBL_UNLABEL_A_SECCTX,
	/* (NLA_BINARY)
	 * a LSM specific security context */
	__NLBL_UNLABEL_A_MAX,
};
#define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1)

/* NetLabel protocol functions */
int netlbl_unlabel_genl_init(void);

/* Unlabeled connection hash table size */
/* XXX - currently this number is an uneducated guess */
#define NETLBL_UNLHSH_BITSIZE       7

/* General Unlabeled init function */
int netlbl_unlabel_init(u32 size);

/* Static/Fallback label management functions */
int netlbl_unlhsh_add(struct net *net,
		      const char *dev_name,
		      const void *addr,
		      const void *mask,
		      u32 addr_len,
		      u32 secid,
		      struct netlbl_audit *audit_info);
int netlbl_unlhsh_remove(struct net *net,
			 const char *dev_name,
			 const void *addr,
			 const void *mask,
			 u32 addr_len,
			 struct netlbl_audit *audit_info);

/* Process Unlabeled incoming network packets */
int netlbl_unlabel_getattr(const struct sk_buff *skb,
			   u16 family,
			   struct netlbl_lsm_secattr *secattr);

/* Set the default configuration to allow Unlabeled packets */
int netlbl_unlabel_defconf(void);

#endif
Commit	Line	Data
d15c345f PM	1	/*
	2	* NetLabel Unlabeled Support
	3	*
	4	* This file defines functions for dealing with unlabeled packets for the
	5	* NetLabel system. The NetLabel system manages static and dynamic label
	6	* mappings for network protocols such as CIPSO and RIPSO.
	7	*
	8	* Author: Paul Moore <paul.moore@hp.com>
	9	*
	10	*/
	11
	12	/*
	13	* (c) Copyright Hewlett-Packard Development Company, L.P., 2006
	14	*
	15	* This program is free software; you can redistribute it and/or modify
	16	* it under the terms of the GNU General Public License as published by
	17	* the Free Software Foundation; either version 2 of the License, or
	18	* (at your option) any later version.
	19	*
	20	* This program is distributed in the hope that it will be useful,
	21	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	22	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
	23	* the GNU General Public License for more details.
	24	*
	25	* You should have received a copy of the GNU General Public License
	26	* along with this program; if not, write to the Free Software
	27	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	28	*
	29	*/
	30
	31	#ifndef _NETLABEL_UNLABELED_H
	32	#define _NETLABEL_UNLABELED_H
	33
	34	#include <net/netlabel.h>
	35
	36	/*
	37	* The following NetLabel payloads are supported by the Unlabeled subsystem.
	38	*
8cc44579 PM	39	* o STATICADD
	40	* This message is sent from an application to add a new static label for
	41	* incoming unlabeled connections.
	42	*
	43	* Required attributes:
	44	*
	45	* NLBL_UNLABEL_A_IFACE
	46	* NLBL_UNLABEL_A_SECCTX
	47	*
	48	* If IPv4 is specified the following attributes are required:
	49	*
	50	* NLBL_UNLABEL_A_IPV4ADDR
	51	* NLBL_UNLABEL_A_IPV4MASK
	52	*
	53	* If IPv6 is specified the following attributes are required:
	54	*
	55	* NLBL_UNLABEL_A_IPV6ADDR
	56	* NLBL_UNLABEL_A_IPV6MASK
	57	*
	58	* o STATICREMOVE
	59	* This message is sent from an application to remove an existing static
	60	* label for incoming unlabeled connections.
	61	*
	62	* Required attributes:
	63	*
	64	* NLBL_UNLABEL_A_IFACE
	65	*
	66	* If IPv4 is specified the following attributes are required:
	67	*
	68	* NLBL_UNLABEL_A_IPV4ADDR
	69	* NLBL_UNLABEL_A_IPV4MASK
	70	*
	71	* If IPv6 is specified the following attributes are required:
	72	*
	73	* NLBL_UNLABEL_A_IPV6ADDR
	74	* NLBL_UNLABEL_A_IPV6MASK
	75	*
	76	* o STATICLIST
	77	* This message can be sent either from an application or by the kernel in
	78	* response to an application generated STATICLIST message. When sent by an
	79	* application there is no payload and the NLM_F_DUMP flag should be set.
	80	* The kernel should response with a series of the following messages.
	81	*
	82	* Required attributes:
	83	*
	84	* NLBL_UNLABEL_A_IFACE
	85	* NLBL_UNLABEL_A_SECCTX
	86	*
	87	* If IPv4 is specified the following attributes are required:
	88	*
	89	* NLBL_UNLABEL_A_IPV4ADDR
	90	* NLBL_UNLABEL_A_IPV4MASK
	91	*
	92	* If IPv6 is specified the following attributes are required:
	93	*
	94	* NLBL_UNLABEL_A_IPV6ADDR
	95	* NLBL_UNLABEL_A_IPV6MASK
	96	*
	97	* o STATICADDDEF
	98	* This message is sent from an application to set the default static
	99	* label for incoming unlabeled connections.
	100	*
	101	* Required attribute:
	102	*
103	* NLBL_UNLABEL_A_SECCTX
104	*
105	* If IPv4 is specified the following attributes are required:
106	*
107	* NLBL_UNLABEL_A_IPV4ADDR
108	* NLBL_UNLABEL_A_IPV4MASK
109	*
110	* If IPv6 is specified the following attributes are required:
111	*
112	* NLBL_UNLABEL_A_IPV6ADDR
113	* NLBL_UNLABEL_A_IPV6MASK
114	*
115	* o STATICREMOVEDEF
116	* This message is sent from an application to remove the existing default
117	* static label for incoming unlabeled connections.
118	*
119	* If IPv4 is specified the following attributes are required:
120	*
121	* NLBL_UNLABEL_A_IPV4ADDR
122	* NLBL_UNLABEL_A_IPV4MASK
123	*
124	* If IPv6 is specified the following attributes are required:
125	*
126	* NLBL_UNLABEL_A_IPV6ADDR
127	* NLBL_UNLABEL_A_IPV6MASK
128	*
129	* o STATICLISTDEF
130	* This message can be sent either from an application or by the kernel in
131	* response to an application generated STATICLISTDEF message. When sent by
132	* an application there is no payload and the NLM_F_DUMP flag should be set.
133	* The kernel should response with the following message.
134	*
135	* Required attribute:
136	*
137	* NLBL_UNLABEL_A_SECCTX
138	*
139	* If IPv4 is specified the following attributes are required:
140	*
141	* NLBL_UNLABEL_A_IPV4ADDR
142	* NLBL_UNLABEL_A_IPV4MASK
143	*
144	* If IPv6 is specified the following attributes are required:
145	*
146	* NLBL_UNLABEL_A_IPV6ADDR
147	* NLBL_UNLABEL_A_IPV6MASK
148	*
d15c345f PM	149	* o ACCEPT
	150	* This message is sent from an application to specify if the kernel should
	151	* allow unlabled packets to pass if they do not match any of the static
	152	* mappings defined in the unlabeled module.
	153	*
fd385855	154	* Required attributes:
d15c345f	155	*
fd385855	156	* NLBL_UNLABEL_A_ACPTFLG
d15c345f PM	157	*
	158	* o LIST
	159	* This message can be sent either from an application or by the kernel in
	160	* response to an application generated LIST message. When sent by an
	161	* application there is no payload. The kernel should respond to a LIST
fd385855	162	* message with a LIST message on success.
d15c345f	163	*
fd385855	164	* Required attributes:
d15c345f	165	*
fd385855	166	* NLBL_UNLABEL_A_ACPTFLG
d15c345f PM	167	*
	168	*/
	169
	170	/* NetLabel Unlabeled commands */
	171	enum {
	172	NLBL_UNLABEL_C_UNSPEC,
d15c345f PM	173	NLBL_UNLABEL_C_ACCEPT,
d15c345f PM	174	NLBL_UNLABEL_C_LIST,
8cc44579 PM	175	NLBL_UNLABEL_C_STATICADD,
	176	NLBL_UNLABEL_C_STATICREMOVE,
	177	NLBL_UNLABEL_C_STATICLIST,
	178	NLBL_UNLABEL_C_STATICADDDEF,
	179	NLBL_UNLABEL_C_STATICREMOVEDEF,
	180	NLBL_UNLABEL_C_STATICLISTDEF,
d15c345f PM	181	__NLBL_UNLABEL_C_MAX,
	182	};
	183	#define NLBL_UNLABEL_C_MAX (__NLBL_UNLABEL_C_MAX - 1)
	184
fd385855 PM	185	/* NetLabel Unlabeled attributes */
	186	enum {
	187	NLBL_UNLABEL_A_UNSPEC,
	188	NLBL_UNLABEL_A_ACPTFLG,
	189	/* (NLA_U8)
	190	* if true then unlabeled packets are allowed to pass, else unlabeled
	191	* packets are rejected */
8cc44579 PM	192	NLBL_UNLABEL_A_IPV6ADDR,
	193	/* (NLA_BINARY, struct in6_addr)
	194	* an IPv6 address */
	195	NLBL_UNLABEL_A_IPV6MASK,
	196	/* (NLA_BINARY, struct in6_addr)
	197	* an IPv6 address mask */
	198	NLBL_UNLABEL_A_IPV4ADDR,
	199	/* (NLA_BINARY, struct in_addr)
	200	* an IPv4 address */
	201	NLBL_UNLABEL_A_IPV4MASK,
	202	/* (NLA_BINARY, struct in_addr)
	203	* and IPv4 address mask */
	204	NLBL_UNLABEL_A_IFACE,
	205	/* (NLA_NULL_STRING)
	206	* network interface */
	207	NLBL_UNLABEL_A_SECCTX,
	208	/* (NLA_BINARY)
	209	* a LSM specific security context */
fd385855 PM	210	__NLBL_UNLABEL_A_MAX,
	211	};
	212	#define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1)
	213
d15c345f PM	214	/* NetLabel protocol functions */
	215	int netlbl_unlabel_genl_init(void);
	216
8cc44579 PM	217	/* Unlabeled connection hash table size */
	218	/* XXX - currently this number is an uneducated guess */
	219	#define NETLBL_UNLHSH_BITSIZE 7
	220
	221	/* General Unlabeled init function */
	222	int netlbl_unlabel_init(u32 size);
	223
6c2e8ac0 PM	224	/* Static/Fallback label management functions */
	225	int netlbl_unlhsh_add(struct net *net,
	226	const char *dev_name,
	227	const void *addr,
	228	const void *mask,
	229	u32 addr_len,
	230	u32 secid,
	231	struct netlbl_audit *audit_info);
	232	int netlbl_unlhsh_remove(struct net *net,
	233	const char *dev_name,
	234	const void *addr,
	235	const void *mask,
	236	u32 addr_len,
	237	struct netlbl_audit *audit_info);
	238
d15c345f	239	/* Process Unlabeled incoming network packets */
8cc44579 PM	240	int netlbl_unlabel_getattr(const struct sk_buff *skb,
	241	u16 family,
	242	struct netlbl_lsm_secattr *secattr);
d15c345f PM	243
	244	/* Set the default configuration to allow Unlabeled packets */
	245	int netlbl_unlabel_defconf(void);
	246
	247	#endif