net/netlabel/netlabel_unlabeled.h

   1 /*
   2  * NetLabel Unlabeled Support
   3  *
   4  * This file defines functions for dealing with unlabeled packets for the
   5  * NetLabel system.  The NetLabel system manages static and dynamic label
   6  * mappings for network protocols such as CIPSO and RIPSO.
   7  *
   8  * Author: Paul Moore <paul.moore@hp.com>
   9  *
  10  */
  11
  12 /*
  13  * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
  14  *
  15  * This program is free software;  you can redistribute it and/or modify
  16  * it under the terms of the GNU General Public License as published by
  17  * the Free Software Foundation; either version 2 of the License, or
  18  * (at your option) any later version.
  19  *
  20  * This program is distributed in the hope that it will be useful,
  21  * but WITHOUT ANY WARRANTY;  without even the implied warranty of
  22  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  23  * the GNU General Public License for more details.
  24  *
  25  * You should have received a copy of the GNU General Public License
  26  * along with this program;  if not, write to the Free Software
  27  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  28  *
  29  */
  30
  31 #ifndef _NETLABEL_UNLABELED_H
  32 #define _NETLABEL_UNLABELED_H
  33
  34 #include <net/netlabel.h>
  35
  36 /*
  37  * The following NetLabel payloads are supported by the Unlabeled subsystem.
  38  *
  39  * o STATICADD
  40  *   This message is sent from an application to add a new static label for
  41  *   incoming unlabeled connections.
  42  *
  43  *   Required attributes:
  44  *
  45  *     NLBL_UNLABEL_A_IFACE
  46  *     NLBL_UNLABEL_A_SECCTX
  47  *
  48  *   If IPv4 is specified the following attributes are required:
  49  *
  50  *     NLBL_UNLABEL_A_IPV4ADDR
  51  *     NLBL_UNLABEL_A_IPV4MASK
  52  *
  53  *   If IPv6 is specified the following attributes are required:
  54  *
  55  *     NLBL_UNLABEL_A_IPV6ADDR
  56  *     NLBL_UNLABEL_A_IPV6MASK
  57  *
  58  * o STATICREMOVE
  59  *   This message is sent from an application to remove an existing static
  60  *   label for incoming unlabeled connections.
  61  *
  62  *   Required attributes:
  63  *
  64  *     NLBL_UNLABEL_A_IFACE
  65  *
  66  *   If IPv4 is specified the following attributes are required:
  67  *
  68  *     NLBL_UNLABEL_A_IPV4ADDR
  69  *     NLBL_UNLABEL_A_IPV4MASK
  70  *
  71  *   If IPv6 is specified the following attributes are required:
  72  *
  73  *     NLBL_UNLABEL_A_IPV6ADDR
  74  *     NLBL_UNLABEL_A_IPV6MASK
  75  *
  76  * o STATICLIST
  77  *   This message can be sent either from an application or by the kernel in
  78  *   response to an application generated STATICLIST message.  When sent by an
  79  *   application there is no payload and the NLM_F_DUMP flag should be set.
  80  *   The kernel should response with a series of the following messages.
  81  *
  82  *   Required attributes:
  83  *
  84  *     NLBL_UNLABEL_A_IFACE
  85  *     NLBL_UNLABEL_A_SECCTX
  86  *
  87  *   If IPv4 is specified the following attributes are required:
  88  *
  89  *     NLBL_UNLABEL_A_IPV4ADDR
  90  *     NLBL_UNLABEL_A_IPV4MASK
  91  *
  92  *   If IPv6 is specified the following attributes are required:
  93  *
  94  *     NLBL_UNLABEL_A_IPV6ADDR
  95  *     NLBL_UNLABEL_A_IPV6MASK
  96  *
  97  * o STATICADDDEF
  98  *   This message is sent from an application to set the default static
  99  *   label for incoming unlabeled connections.
 100  *
 101  *   Required attribute:
 102  *
 103  *     NLBL_UNLABEL_A_SECCTX
 104  *
 105  *   If IPv4 is specified the following attributes are required:
 106  *
 107  *     NLBL_UNLABEL_A_IPV4ADDR
 108  *     NLBL_UNLABEL_A_IPV4MASK
 109  *
 110  *   If IPv6 is specified the following attributes are required:
 111  *
 112  *     NLBL_UNLABEL_A_IPV6ADDR
 113  *     NLBL_UNLABEL_A_IPV6MASK
 114  *
 115  * o STATICREMOVEDEF
 116  *   This message is sent from an application to remove the existing default
 117  *   static label for incoming unlabeled connections.
 118  *
 119  *   If IPv4 is specified the following attributes are required:
 120  *
 121  *     NLBL_UNLABEL_A_IPV4ADDR
 122  *     NLBL_UNLABEL_A_IPV4MASK
 123  *
 124  *   If IPv6 is specified the following attributes are required:
 125  *
 126  *     NLBL_UNLABEL_A_IPV6ADDR
 127  *     NLBL_UNLABEL_A_IPV6MASK
 128  *
 129  * o STATICLISTDEF
 130  *   This message can be sent either from an application or by the kernel in
 131  *   response to an application generated STATICLISTDEF message.  When sent by
 132  *   an application there is no payload and the NLM_F_DUMP flag should be set.
 133  *   The kernel should response with the following message.
 134  *
 135  *   Required attribute:
 136  *
 137  *     NLBL_UNLABEL_A_SECCTX
 138  *
 139  *   If IPv4 is specified the following attributes are required:
 140  *
 141  *     NLBL_UNLABEL_A_IPV4ADDR
 142  *     NLBL_UNLABEL_A_IPV4MASK
 143  *
 144  *   If IPv6 is specified the following attributes are required:
 145  *
 146  *     NLBL_UNLABEL_A_IPV6ADDR
 147  *     NLBL_UNLABEL_A_IPV6MASK
 148  *
 149  * o ACCEPT
 150  *   This message is sent from an application to specify if the kernel should
 151  *   allow unlabled packets to pass if they do not match any of the static
 152  *   mappings defined in the unlabeled module.
 153  *
 154  *   Required attributes:
 155  *
 156  *     NLBL_UNLABEL_A_ACPTFLG
 157  *
 158  * o LIST
 159  *   This message can be sent either from an application or by the kernel in
 160  *   response to an application generated LIST message.  When sent by an
 161  *   application there is no payload.  The kernel should respond to a LIST
 162  *   message with a LIST message on success.
 163  *
 164  *   Required attributes:
 165  *
 166  *     NLBL_UNLABEL_A_ACPTFLG
 167  *
 168  */
 169
 170 /* NetLabel Unlabeled commands */
 171 enum {
 172         NLBL_UNLABEL_C_UNSPEC,
 173         NLBL_UNLABEL_C_ACCEPT,
 174         NLBL_UNLABEL_C_LIST,
 175         NLBL_UNLABEL_C_STATICADD,
 176         NLBL_UNLABEL_C_STATICREMOVE,
 177         NLBL_UNLABEL_C_STATICLIST,
 178         NLBL_UNLABEL_C_STATICADDDEF,
 179         NLBL_UNLABEL_C_STATICREMOVEDEF,
 180         NLBL_UNLABEL_C_STATICLISTDEF,
 181         __NLBL_UNLABEL_C_MAX,
 182 };
 183 #define NLBL_UNLABEL_C_MAX (__NLBL_UNLABEL_C_MAX - 1)
 184
 185 /* NetLabel Unlabeled attributes */
 186 enum {
 187         NLBL_UNLABEL_A_UNSPEC,
 188         NLBL_UNLABEL_A_ACPTFLG,
 189         /* (NLA_U8)
 190          * if true then unlabeled packets are allowed to pass, else unlabeled
 191          * packets are rejected */
 192         NLBL_UNLABEL_A_IPV6ADDR,
 193         /* (NLA_BINARY, struct in6_addr)
 194          * an IPv6 address */
 195         NLBL_UNLABEL_A_IPV6MASK,
 196         /* (NLA_BINARY, struct in6_addr)
 197          * an IPv6 address mask */
 198         NLBL_UNLABEL_A_IPV4ADDR,
 199         /* (NLA_BINARY, struct in_addr)
 200          * an IPv4 address */
 201         NLBL_UNLABEL_A_IPV4MASK,
 202         /* (NLA_BINARY, struct in_addr)
 203          * and IPv4 address mask */
 204         NLBL_UNLABEL_A_IFACE,
 205         /* (NLA_NULL_STRING)
 206          * network interface */
 207         NLBL_UNLABEL_A_SECCTX,
 208         /* (NLA_BINARY)
 209          * a LSM specific security context */
 210         __NLBL_UNLABEL_A_MAX,
 211 };
 212 #define NLBL_UNLABEL_A_MAX (__NLBL_UNLABEL_A_MAX - 1)
 213
 214 /* NetLabel protocol functions */
 215 int netlbl_unlabel_genl_init(void);
 216
 217 /* Unlabeled connection hash table size */
 218 /* XXX - currently this number is an uneducated guess */
 219 #define NETLBL_UNLHSH_BITSIZE       7
 220
 221 /* General Unlabeled init function */
 222 int netlbl_unlabel_init(u32 size);
 223
 224 /* Static/Fallback label management functions */
 225 int netlbl_unlhsh_add(struct net *net,
 226                       const char *dev_name,
 227                       const void *addr,
 228                       const void *mask,
 229                       u32 addr_len,
 230                       u32 secid,
 231                       struct netlbl_audit *audit_info);
 232 int netlbl_unlhsh_remove(struct net *net,
 233                          const char *dev_name,
 234                          const void *addr,
 235                          const void *mask,
 236                          u32 addr_len,
 237                          struct netlbl_audit *audit_info);
 238
 239 /* Process Unlabeled incoming network packets */
 240 int netlbl_unlabel_getattr(const struct sk_buff *skb,
 241                            u16 family,
 242                            struct netlbl_lsm_secattr *secattr);
 243
 244 /* Set the default configuration to allow Unlabeled packets */
 245 int netlbl_unlabel_defconf(void);
 246
 247 #endif