blob: c8a4079261f04a88147695554865bab3765ce3bd [file] [log] [blame]
Paul Moored15c3452006-08-03 16:48:37 -07001/*
2 * NetLabel CIPSO/IPv4 Support
3 *
4 * This file defines the CIPSO/IPv4 functions for the NetLabel system. The
5 * NetLabel system manages static and dynamic label mappings for network
6 * protocols such as CIPSO and RIPSO.
7 *
8 * Author: Paul Moore <paul.moore@hp.com>
9 *
10 */
11
12/*
13 * (c) Copyright Hewlett-Packard Development Company, L.P., 2006
14 *
15 * This program is free software; you can redistribute it and/or modify
16 * it under the terms of the GNU General Public License as published by
17 * the Free Software Foundation; either version 2 of the License, or
18 * (at your option) any later version.
19 *
20 * This program is distributed in the hope that it will be useful,
21 * but WITHOUT ANY WARRANTY; without even the implied warranty of
22 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
23 * the GNU General Public License for more details.
24 *
25 * You should have received a copy of the GNU General Public License
26 * along with this program; if not, write to the Free Software
27 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28 *
29 */
30
31#ifndef _NETLABEL_CIPSO_V4
32#define _NETLABEL_CIPSO_V4
33
34#include <net/netlabel.h>
35
36/*
Paul Moorefd385852006-09-25 15:56:37 -070037 * The following NetLabel payloads are supported by the CIPSO subsystem.
Paul Moored15c3452006-08-03 16:48:37 -070038 *
39 * o ADD:
Paul Moorefd385852006-09-25 15:56:37 -070040 * Sent by an application to add a new DOI mapping table.
Paul Moored15c3452006-08-03 16:48:37 -070041 *
Paul Moorefd385852006-09-25 15:56:37 -070042 * Required attributes:
Paul Moored15c3452006-08-03 16:48:37 -070043 *
Paul Moorefd385852006-09-25 15:56:37 -070044 * NLBL_CIPSOV4_A_DOI
45 * NLBL_CIPSOV4_A_MTYPE
46 * NLBL_CIPSOV4_A_TAGLST
Paul Moored15c3452006-08-03 16:48:37 -070047 *
Paul Moore15c45f72008-10-10 10:16:34 -040048 * If using CIPSO_V4_MAP_TRANS the following attributes are required:
Paul Moored15c3452006-08-03 16:48:37 -070049 *
Paul Moorefd385852006-09-25 15:56:37 -070050 * NLBL_CIPSOV4_A_MLSLVLLST
51 * NLBL_CIPSOV4_A_MLSCATLST
Paul Moored15c3452006-08-03 16:48:37 -070052 *
Paul Moored91d4072008-10-10 10:16:34 -040053 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
54 * are required.
Paul Moored15c3452006-08-03 16:48:37 -070055 *
56 * o REMOVE:
57 * Sent by an application to remove a specific DOI mapping table from the
Paul Moorefd385852006-09-25 15:56:37 -070058 * CIPSO V4 system.
Paul Moored15c3452006-08-03 16:48:37 -070059 *
Paul Moorefd385852006-09-25 15:56:37 -070060 * Required attributes:
Paul Moored15c3452006-08-03 16:48:37 -070061 *
Paul Moorefd385852006-09-25 15:56:37 -070062 * NLBL_CIPSOV4_A_DOI
Paul Moored15c3452006-08-03 16:48:37 -070063 *
64 * o LIST:
Paul Moorefd385852006-09-25 15:56:37 -070065 * Sent by an application to list the details of a DOI definition. On
66 * success the kernel should send a response using the following format.
Paul Moored15c3452006-08-03 16:48:37 -070067 *
Paul Moorefd385852006-09-25 15:56:37 -070068 * Required attributes:
Paul Moored15c3452006-08-03 16:48:37 -070069 *
Paul Moorefd385852006-09-25 15:56:37 -070070 * NLBL_CIPSOV4_A_DOI
Paul Moored15c3452006-08-03 16:48:37 -070071 *
72 * The valid response message format depends on the type of the DOI mapping,
Paul Moorefd385852006-09-25 15:56:37 -070073 * the defined formats are shown below.
Paul Moored15c3452006-08-03 16:48:37 -070074 *
Paul Moorefd385852006-09-25 15:56:37 -070075 * Required attributes:
Paul Moored15c3452006-08-03 16:48:37 -070076 *
Paul Moorefd385852006-09-25 15:56:37 -070077 * NLBL_CIPSOV4_A_MTYPE
78 * NLBL_CIPSOV4_A_TAGLST
Paul Moored15c3452006-08-03 16:48:37 -070079 *
Paul Moore15c45f72008-10-10 10:16:34 -040080 * If using CIPSO_V4_MAP_TRANS the following attributes are required:
Paul Moored15c3452006-08-03 16:48:37 -070081 *
Paul Moorefd385852006-09-25 15:56:37 -070082 * NLBL_CIPSOV4_A_MLSLVLLST
83 * NLBL_CIPSOV4_A_MLSCATLST
Paul Moored15c3452006-08-03 16:48:37 -070084 *
Paul Moored91d4072008-10-10 10:16:34 -040085 * If using CIPSO_V4_MAP_PASS or CIPSO_V4_MAP_LOCAL no additional attributes
86 * are required.
Paul Moored15c3452006-08-03 16:48:37 -070087 *
88 * o LISTALL:
89 * This message is sent by an application to list the valid DOIs on the
Paul Moorefd385852006-09-25 15:56:37 -070090 * system. When sent by an application there is no payload and the
91 * NLM_F_DUMP flag should be set. The kernel should respond with a series of
92 * the following messages.
Paul Moored15c3452006-08-03 16:48:37 -070093 *
Paul Moorefd385852006-09-25 15:56:37 -070094 * Required attributes:
Paul Moored15c3452006-08-03 16:48:37 -070095 *
Paul Moorefd385852006-09-25 15:56:37 -070096 * NLBL_CIPSOV4_A_DOI
97 * NLBL_CIPSOV4_A_MTYPE
Paul Moored15c3452006-08-03 16:48:37 -070098 *
99 */
100
101/* NetLabel CIPSOv4 commands */
102enum {
103 NLBL_CIPSOV4_C_UNSPEC,
Paul Moored15c3452006-08-03 16:48:37 -0700104 NLBL_CIPSOV4_C_ADD,
105 NLBL_CIPSOV4_C_REMOVE,
106 NLBL_CIPSOV4_C_LIST,
107 NLBL_CIPSOV4_C_LISTALL,
108 __NLBL_CIPSOV4_C_MAX,
109};
110#define NLBL_CIPSOV4_C_MAX (__NLBL_CIPSOV4_C_MAX - 1)
111
Paul Moorefd385852006-09-25 15:56:37 -0700112/* NetLabel CIPSOv4 attributes */
113enum {
114 NLBL_CIPSOV4_A_UNSPEC,
115 NLBL_CIPSOV4_A_DOI,
116 /* (NLA_U32)
117 * the DOI value */
118 NLBL_CIPSOV4_A_MTYPE,
119 /* (NLA_U32)
120 * the mapping table type (defined in the cipso_ipv4.h header as
121 * CIPSO_V4_MAP_*) */
122 NLBL_CIPSOV4_A_TAG,
123 /* (NLA_U8)
124 * a CIPSO tag type, meant to be used within a NLBL_CIPSOV4_A_TAGLST
125 * attribute */
126 NLBL_CIPSOV4_A_TAGLST,
127 /* (NLA_NESTED)
128 * the CIPSO tag list for the DOI, there must be at least one
129 * NLBL_CIPSOV4_A_TAG attribute, tags listed first are given higher
130 * priorirty when sending packets */
131 NLBL_CIPSOV4_A_MLSLVLLOC,
132 /* (NLA_U32)
133 * the local MLS sensitivity level */
134 NLBL_CIPSOV4_A_MLSLVLREM,
135 /* (NLA_U32)
136 * the remote MLS sensitivity level */
137 NLBL_CIPSOV4_A_MLSLVL,
138 /* (NLA_NESTED)
139 * a MLS sensitivity level mapping, must contain only one attribute of
140 * each of the following types: NLBL_CIPSOV4_A_MLSLVLLOC and
141 * NLBL_CIPSOV4_A_MLSLVLREM */
142 NLBL_CIPSOV4_A_MLSLVLLST,
143 /* (NLA_NESTED)
144 * the CIPSO level mappings, there must be at least one
145 * NLBL_CIPSOV4_A_MLSLVL attribute */
146 NLBL_CIPSOV4_A_MLSCATLOC,
147 /* (NLA_U32)
148 * the local MLS category */
149 NLBL_CIPSOV4_A_MLSCATREM,
150 /* (NLA_U32)
151 * the remote MLS category */
152 NLBL_CIPSOV4_A_MLSCAT,
153 /* (NLA_NESTED)
154 * a MLS category mapping, must contain only one attribute of each of
155 * the following types: NLBL_CIPSOV4_A_MLSCATLOC and
156 * NLBL_CIPSOV4_A_MLSCATREM */
157 NLBL_CIPSOV4_A_MLSCATLST,
158 /* (NLA_NESTED)
159 * the CIPSO category mappings, there must be at least one
160 * NLBL_CIPSOV4_A_MLSCAT attribute */
161 __NLBL_CIPSOV4_A_MAX,
162};
163#define NLBL_CIPSOV4_A_MAX (__NLBL_CIPSOV4_A_MAX - 1)
164
Paul Moored15c3452006-08-03 16:48:37 -0700165/* NetLabel protocol functions */
166int netlbl_cipsov4_genl_init(void);
167
Paul Mooreeda61d32008-02-04 22:29:47 -0800168/* Free the memory associated with a CIPSOv4 DOI definition */
169void netlbl_cipsov4_doi_free(struct rcu_head *entry);
170
Paul Moored15c3452006-08-03 16:48:37 -0700171#endif