~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/netlabel/netlabel_unlabeled.h

Version: ~ [ linux-5.4-rc3 ] ~ [ linux-5.3.6 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.79 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.149 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.196 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.196 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.75 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * NetLabel Unlabeled Support
  3  *
  4  * This file defines functions for dealing with unlabeled packets for the
  5  * NetLabel system.  The NetLabel system manages static and dynamic label
  6  * mappings for network protocols such as CIPSO and RIPSO.
  7  *
  8  * Author: Paul Moore <paul@paul-moore.com>
  9  *
 10  */
 11 
 12 /*
 13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
 14  *
 15  * This program is free software;  you can redistribute it and/or modify
 16  * it under the terms of the GNU General Public License as published by
 17  * the Free Software Foundation; either version 2 of the License, or
 18  * (at your option) any later version.
 19  *
 20  * This program is distributed in the hope that it will be useful,
 21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
 22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
 23  * the GNU General Public License for more details.
 24  *
 25  * You should have received a copy of the GNU General Public License
 26  * along with this program;  if not, see <http://www.gnu.org/licenses/>.
 27  *
 28  */
 29 
 30 #ifndef _NETLABEL_UNLABELED_H
 31 #define _NETLABEL_UNLABELED_H
 32 
 33 #include <net/netlabel.h>
 34 
 35 /*
 36  * The following NetLabel payloads are supported by the Unlabeled subsystem.
 37  *
 38  * o STATICADD
 39  *   This message is sent from an application to add a new static label for
 40  *   incoming unlabeled connections.
 41  *
 42  *   Required attributes:
 43  *
 44  *     NLBL_UNLABEL_A_IFACE
 45  *     NLBL_UNLABEL_A_SECCTX
 46  *
 47  *   If IPv4 is specified the following attributes are required:
 48  *
 49  *     NLBL_UNLABEL_A_IPV4ADDR
 50  *     NLBL_UNLABEL_A_IPV4MASK
 51  *
 52  *   If IPv6 is specified the following attributes are required:
 53  *
 54  *     NLBL_UNLABEL_A_IPV6ADDR
 55  *     NLBL_UNLABEL_A_IPV6MASK
 56  *
 57  * o STATICREMOVE
 58  *   This message is sent from an application to remove an existing static
 59  *   label for incoming unlabeled connections.
 60  *
 61  *   Required attributes:
 62  *
 63  *     NLBL_UNLABEL_A_IFACE
 64  *
 65  *   If IPv4 is specified the following attributes are required:
 66  *
 67  *     NLBL_UNLABEL_A_IPV4ADDR
 68  *     NLBL_UNLABEL_A_IPV4MASK
 69  *
 70  *   If IPv6 is specified the following attributes are required:
 71  *
 72  *     NLBL_UNLABEL_A_IPV6ADDR
 73  *     NLBL_UNLABEL_A_IPV6MASK
 74  *
 75  * o STATICLIST
 76  *   This message can be sent either from an application or by the kernel in
 77  *   response to an application generated STATICLIST message.  When sent by an
 78  *   application there is no payload and the NLM_F_DUMP flag should be set.
 79  *   The kernel should response with a series of the following messages.
 80  *
 81  *   Required attributes:
 82  *
 83  *     NLBL_UNLABEL_A_IFACE
 84  *     NLBL_UNLABEL_A_SECCTX
 85  *
 86  *   If IPv4 is specified the following attributes are required:
 87  *
 88  *     NLBL_UNLABEL_A_IPV4ADDR
 89  *     NLBL_UNLABEL_A_IPV4MASK
 90  *
 91  *   If IPv6 is specified the following attributes are required:
 92  *
 93  *     NLBL_UNLABEL_A_IPV6ADDR
 94  *     NLBL_UNLABEL_A_IPV6MASK
 95  *
 96  * o STATICADDDEF
 97  *   This message is sent from an application to set the default static
 98  *   label for incoming unlabeled connections.
 99  *
100  *   Required attribute:
101  *
102  *     NLBL_UNLABEL_A_SECCTX
103  *
104  *   If IPv4 is specified the following attributes are required:
105  *
106  *     NLBL_UNLABEL_A_IPV4ADDR
107  *     NLBL_UNLABEL_A_IPV4MASK
108  *
109  *   If IPv6 is specified the following attributes are required:
110  *
111  *     NLBL_UNLABEL_A_IPV6ADDR
112  *     NLBL_UNLABEL_A_IPV6MASK
113  *
114  * o STATICREMOVEDEF
115  *   This message is sent from an application to remove the existing default
116  *   static label for incoming unlabeled connections.
117  *
118  *   If IPv4 is specified the following attributes are required:
119  *
120  *     NLBL_UNLABEL_A_IPV4ADDR
121  *     NLBL_UNLABEL_A_IPV4MASK
122  *
123  *   If IPv6 is specified the following attributes are required:
124  *
125  *     NLBL_UNLABEL_A_IPV6ADDR
126  *     NLBL_UNLABEL_A_IPV6MASK
127  *
128  * o STATICLISTDEF
129  *   This message can be sent either from an application or by the kernel in
130  *   response to an application generated STATICLISTDEF message.  When sent by
131  *   an application there is no payload and the NLM_F_DUMP flag should be set.
132  *   The kernel should response with the following message.
133  *
134  *   Required attribute:
135  *
136  *     NLBL_UNLABEL_A_SECCTX
137  *
138  *   If IPv4 is specified the following attributes are required:
139  *
140  *     NLBL_UNLABEL_A_IPV4ADDR
141  *     NLBL_UNLABEL_A_IPV4MASK
142  *
143  *   If IPv6 is specified the following attributes are required:
144  *
145  *     NLBL_UNLABEL_A_IPV6ADDR
146  *     NLBL_UNLABEL_A_IPV6MASK
147  *
148  * o ACCEPT
149  *   This message is sent from an application to specify if the kernel should
150  *   allow unlabled packets to pass if they do not match any of the static
151  *   mappings defined in the unlabeled module.
152  *
153  *   Required attributes:
154  *
155  *     NLBL_UNLABEL_A_ACPTFLG
156  *
157  * o LIST
158  *   This message can be sent either from an application or by the kernel in
159  *   response to an application generated LIST message.  When sent by an
160  *   application there is no payload.  The kernel should respond to a LIST
161  *   message with a LIST message on success.
162  *
163  *   Required attributes:
164  *
165  *     NLBL_UNLABEL_A_ACPTFLG
166  *
167  */
168 
169 /* NetLabel Unlabeled commands */
170 enum {
171         NLBL_UNLABEL_C_UNSPEC,
172         NLBL_UNLABEL_C_ACCEPT,
173         NLBL_UNLABEL_C_LIST,
174         NLBL_UNLABEL_C_STATICADD,
175         NLBL_UNLABEL_C_STATICREMOVE,
176         NLBL_UNLABEL_C_STATICLIST,
177         NLBL_UNLABEL_C_STATICADDDEF,
178         NLBL_UNLABEL_C_STATICREMOVEDEF,
179         NLBL_UNLABEL_C_STATICLISTDEF,
180         __NLBL_UNLABEL_C_MAX,
181 };
182 
183 /* NetLabel Unlabeled attributes */
184 enum {
185         NLBL_UNLABEL_A_UNSPEC,
186         NLBL_UNLABEL_A_ACPTFLG,
187         /* (NLA_U8)
188          * if true then unlabeled packets are allowed to pass, else unlabeled
189          * packets are rejected */
190         NLBL_UNLABEL_A_IPV6ADDR,
191         /* (NLA_BINARY, struct in6_addr)
192          * an IPv6 address */
193         NLBL_UNLABEL_A_IPV6MASK,
194         /* (NLA_BINARY, struct in6_addr)
195          * an IPv6 address mask */
196         NLBL_UNLABEL_A_IPV4ADDR,
197         /* (NLA_BINARY, struct in_addr)
198          * an IPv4 address */
199         NLBL_UNLABEL_A_IPV4MASK,
200         /* (NLA_BINARY, struct in_addr)
201          * and IPv4 address mask */
202         NLBL_UNLABEL_A_IFACE,
203         /* (NLA_NULL_STRING)
204          * network interface */
205         NLBL_UNLABEL_A_SECCTX,
206         /* (NLA_BINARY)
207          * a LSM specific security context */
208         __NLBL_UNLABEL_A_MAX,
209 };
210 #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1)
211 
212 /* NetLabel protocol functions */
213 int netlbl_unlabel_genl_init(void);
214 
215 /* Unlabeled connection hash table size */
216 /* XXX - currently this number is an uneducated guess */
217 #define NETLBL_UNLHSH_BITSIZE       7
218 
219 /* General Unlabeled init function */
220 int netlbl_unlabel_init(u32 size);
221 
222 /* Static/Fallback label management functions */
223 int netlbl_unlhsh_add(struct net *net,
224                       const char *dev_name,
225                       const void *addr,
226                       const void *mask,
227                       u32 addr_len,
228                       u32 secid,
229                       struct netlbl_audit *audit_info);
230 int netlbl_unlhsh_remove(struct net *net,
231                          const char *dev_name,
232                          const void *addr,
233                          const void *mask,
234                          u32 addr_len,
235                          struct netlbl_audit *audit_info);
236 
237 /* Process Unlabeled incoming network packets */
238 int netlbl_unlabel_getattr(const struct sk_buff *skb,
239                            u16 family,
240                            struct netlbl_lsm_secattr *secattr);
241 
242 /* Set the default configuration to allow Unlabeled packets */
243 int netlbl_unlabel_defconf(void);
244 
245 #endif
246 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp